Consider privacy before asking about vaccines

Can I collect, use and disclose an employee’s COVID-19 vaccination status, and if so, how do I avoid interfering with the employee’s privacy?

The issues raised by these questions have become increasingly common in Australian workplaces and are a sensitive topic.

The Privacy Act’s impact on an employer’s ability to collect, use and disclose personal information forms a significant part of these issues, says Amber Roncoroni, Senior Lawyer at Ai Group Workplace Lawyers.

“An employer may not be aware that the Privacy Act is likely to apply to the collection and certain uses and disclosures of employee personal information, such as the employee’s COVID-19 vaccination status or test results,” Ms Roncoroni said.

“This may be because the employer broadly applies the employee records exemption contained in the Privacy Act, without considering if this is, in fact, the correct approach.

“If the Australian Privacy Principles (APPs) apply, an employer will need to consider its obligations in relation to obtaining the correct consents from each employee to collect the information and use and disclose it in certain situations.”

Ms Roncoroni said most employees were comfortable providing their consent for COVID-19 vaccination status information and COVID-19 test results to be collected by their employer and for it to be used and disclosed so they could continue working safely and in accordance with government requirements.

Reluctant employees might simply be unsure of, and cautious about, what would happen to their information, which is why a privacy policy that explained how the information would be dealt with was important, she added.

“As individuals, we naturally feel protective of our personal information and our privacy,” Ms Roncoroni said.

“However, measures to manage the COVID-19 pandemic can place employees and employers in a difficult position, and the needs of the individual need to be balanced with reasonable and legitimate business needs.

“For instance, an employee may not be able to enter the site and may not have any work to do if the employee does not have a COVID-19 vaccination. In this case, an employer may need to collect, use and disclose the employee’s COVID-19 vaccination status, so the employee’s ability to access the site can be assessed. An employer would be placed in a difficult position if an employee does not consent to the collection and necessary uses or disclosures where the employee’s consent is required. An employer may need to consider their options in relation to the employee’s employment, whether this be alternative duties or termination of employment. Neither of these options is ideal.” 

Ms Roncoroni said employers needed to be able to justify why they wanted to know an employee’s COVID-19 vaccination status or COVID-19 test results.

“One of the justifications may be Work Health and Safety (WHS),” she said.

“However, this justification needs to be assessed carefully. For instance, if you have someone working from home indefinitely, it is unlikely that you would need to know their COVID-19 vaccination status as they would not be coming into contact with people at work who may be carrying the virus.

“But if you have employees working on a site where social distancing is not possible, then an employee’s COVID-19 vaccination status may need to be known in order to put appropriate risk management controls in place.

“Either way, it is recommended that an employer undertake an appropriate WHS assessment with the assistance of a WHS professional, so that the employer can justify its position from a privacy and also employment perspective.

Ai Group’s WHS National Manager Trinette Jaeschke said it was crucial that any health information collected was stored securely.

“You’ll need to consider the way of keeping this information in a secure fashion,” Ms Jaeschke said.

“Normally you will find a HR manager with a locked filing cabinet or some other secure method of retaining the medical records and personal details of staff.”

COVID-19 vaccines have already been mandated across aged care and construction in some states and, in some companies, in the private sector.

“It’s up to the employer to make sure they’ve asked whether or not someone has had that vaccination," Ms Jaeschke said.

"It’s important to ask permission and to explain what will happen to an employee’s personal information and what you will do with it. Demonstrating this information is held in a secure and confidential manner is important.”

Good record-keeping was essential, Ms Jaeschke added.

“There’s a variety of different types of documentation you must keep from a records management perspective in the safety arena,” she said.

“Just like an accountant needs to keep records for 30 years, in safety you need to keep your medical health records for 10 years or longer – depending on the type of medical records. Take, for instance, a hearing loss claim. An employee may want to claim for hearing loss and these health monitoring records can provide valuable history of the effectiveness of your risk management processes and help with determining liability for workers compensation claims."

“For COVID records, adopt the same process as you would for a workers compensation claim. You still need to make sure you’ve got the worker’s authority to release medical health records if this information is required in the future.”

To help employers ensure the Privacy Act and WHS regulations are adhered to when dealing with employee COVID information, Ai Group Workplace Lawyers can provide advice, policies and forms related to collecting, using and disclosing employee COVID-19 vaccination status and COVID-19 test results.

“The advice, policies and forms are helpful to employers as there are potential sanctions for not collecting, using and disclosing personal information in accordance with the Privacy Act, where required," Ms Roncoroni said.

“In summary, it is natural for individuals to be cautious about sharing personal information such as COVID-19 vaccination information and COVID-19 test results. However, there are benefits to both the employee and the employer in exchanging this information in accordance with the law so that work and business can be conducted safely and productively.”

For more information, please visit https://www.aigroup.com.au/services-and-advice/covid-19/workplace-relations/ir-assistance