Katy Docherty tells HRNews about gathering vaccination-related data and the ICO’s stance on this

HR-News-Tile-1200x675pxV2

We're sorry, this video is not available in your location.

  • Transcript

    Covid restrictions in England ended on Thursday last week so how is that impacting employers across the UK? The health and safety risks have not gone away, especially for vulnerable staff, so how should those risks be managed? 

    The government’s plan for ‘Living with Covid’ has a timetable for the removal of Covid measures in England. Last week, on 24 February, the legal requirement to self-isolate following a positive test was replaced with guidance to stay at home, contact tracing came to an end and so did the £500 self-isolation support payments for those on a low income. From 24 March, the special rules about statutory sick pay relating to Covid will end.  

    From 1 April, the government will no longer be offering free community Covid-19 testing, including both symptomatic PCR tests and asymptomatic rapid lateral flow tests. Free testing will instead be targeted to symptomatic cases in ‘a small number of at-risk groups’. The requirement that employers explicitly consider Covid-19 in their health and safety risk assessments will also end. 

    Given the staggered timetable, it means the changes will be gradual so employers have time to plan for them and consult their employees along the way. Broadly speaking, the legal issues fall into three main categories which are covered by three of Pinsent Masons lawyers in their Outlaw article ‘Tricky issues for employers as England ends Covid restrictions’. Those issues are: general employment law considerations, the employer’s health and safety duties and data protection obligations if vaccination-related data is gathered. 

    Anne Sammon says employers must continue to consider the needs of their clinically extremely vulnerable workers in their health and safety risk assessments, regardless of an explicit duty to consider Covid-19 implications. She says ‘employers should speak to staff to understand their concerns and consider reasonable adjustments, where necessary, such as home-working on a permanent basis. She says, ultimately, if that role needs to be done from the office and the employee refuses to attend, termination of employment may be the only option – but there are discrimination risks, so specific advice must be sought on the particular circumstances.’ 

    Health and safety specialist, Katherine Metcalfe who is based in Glasgow, says ‘although Covid-specific rules around testing, self-isolation and mask-wearing will differ throughout the UK, the health and safety risks posed to employees by Covid-19 are essentially the same everywhere. There are challenges around that though. She says: ‘employers may use England as a baseline and add any further mitigation measures required by law in the devolved nations but, in doing so, employers may inadvertently demonstrate that, from a health and safety perspective, it is reasonably practicable to do more to address the risks of Covid-19 than is now being done in England. The other option available until now is that some employers have designed measures to comply with whichever set of rules is the most stringent and applied these everywhere but, she says, the withdrawal of free testing and isolation requirements now makes that a challenging approach too.’

    Data protection expert Katy Docherty warns that employers collecting data on Covid-19 infections or vaccination status among their staff will need to think carefully in light of the government’s change in approach. She says: ‘employers will need to consider, on a case-by-case basis, the reasons why they might still want to gather data about employee health or vaccination status, and consider whether they have a ‘lawful basis and processing condition’ under data protection law to allow them to do so.’ She says: ‘notwithstanding the government’s change in stance, employers may nevertheless determine that to meet their own health and safety obligations, they still need to know whether staff have Covid-19, or if they are vaccinated, or they might have pressing commercial reasons, which mean they still need to seriously consider whether they can justify gathering such data.’

    If we pick up on that last point, a further issue to be aware of is what the ICO’s approach to this will be because, so far, we’ve not had any new guidance from the regulator since the government’s announcement. So what is the position? I spoke to Katy Docherty to find out:

    Katy Docherty: “One problem that employers have had throughout the pandemic is that they aren't always going to be very sure of how the ICO will react to the data that they are gathering in related to Coronavirus, or related to vaccination status. Now, ICO guidance itself on gathering in vaccination status is quite vague but what it does say is that there will be good lawful basis for companies to do that. Now we don’t know how the ICO will react to companies who gather this in but given that their own guidance does say there will be a good lawful basis we would anticipate that companies who demonstrate that they take data protection seriously and have a very good compelling justification for holding this data should be able to fend off any complaint. A very good way to do this, particularly in this context where you're gathering in potentially special category data on a large scale, is to carry out a privacy impact assessment. That will companies to show their working, document their thinking as to why they consider they can lawfully process, for example, vaccination status data, and it may be the in carrying out such an assessment, particularly against the altered public health backdrop, against the perhaps undermining of justifications they may have used previously, companies decide that actually they can't lawfully process vaccination data and the privacy impact assessment will allow them to look at what alternatives they might be able to adopt to still help them achieve their business goals. I would say that cutting a privacy impact assessment in this context is essential, but it will also mean if there ever is a complaint to the ICO, and a company has to justify the action that it took, it will be in a better position to mitigate any risks.”

    That article by Anne, Katherine and Katy is called ‘Tricky issues for employers as England ends Covid restrictions’ and is available from the Outlaw website. 

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.