Vaccinations, data protection and return to the workplace

Vaccinations, data protection and return to the workplace

The Covid-19 pandemic has brought a great deal of difficulty and uncertainty to employers and employees alike. Both have had to face dealing with layoffs and short-time working, restrictions in the workplace, remote working and more. While the rollout of the vaccination is a positive step in reducing the impact of Covid-19, it creates a new issue for employers concerning the vaccination status of their employees, as well as what can be done with such information.

Data Protection and the Data Protection Commissioner

The picture from the UK and the US has been stark, with instances of employees who have been dismissed or refused entry to the workplace on the basis that they are not vaccinated. However the situation in Ireland is a complex one. Ireland’s stance on employees’ vaccination status is governed by the Data Protection Commissioner (‘DPC’) as the fact of whether an individual is vaccinated or not is considered to be personal data. The DPC has stated that the collection of vaccination data represents “unnecessary and excessive data collection for which no legal basis exists”. Further, the Government’s ‘Work Safely Protocol: COVID-19 National Protocol for Employers and Workers’ notes that employees can make their own decisions on whether they wish to be vaccinated.

In relation to the storing of vaccination status under the General Data Protection Regulations (GDPR), vaccination status would constitute ‘special category data’ and therefore has strict requirements under GDPR.  Articles 6 and 9 GDPR would require the employer to have a legal basis for storing such data, along with receiving consent from the employee to do so.

At present there is no legal requirement for individuals to be vaccinated, save in special category roles. In addition to this, employers may struggle to show that ‘consent’ has been given by the employee, given the power imbalance in the two roles and the potential implication for an employee who is not vaccinated.  This is why the main issue regarding the storing of an employee’s vaccination data is not so much the storage itself but rather what will be done with this information.  Requesting the information implies that the information will be acted upon, be that by restricting employees from the workplace or terminating their employment.  For now, most bodies echo the DPC’s stance that collecting this data is “unnecessary and excessive … for which no legal basis exists”.

Constitutional considerations

The Irish Constitution provides a fundamental personal right to bodily integrity and while this right is not absolute, and there are often instances where the ‘common good’ prevails, there has been no indication by the Government to make vaccines mandatory.  This, coupled with the right to earn a livelihood leaves employers, who require their employees to be vaccinated in order return to work, open to various claims including discrimination and breach of constitutional rights.

Voluntary nature of vaccines

It is also important to note that receiving a vaccine is voluntary, as is noted in the Government’s Protocol document.  For employers to suggest that their employees need to be vaccinated to return to work would defeat their voluntary nature and is likely to be perceived as disproportionate to achieving a safe working environment.  Further, the vaccine rollout does not bring an end to the need for social distancing and other restrictive measures introduced by the Government during the pandemic.  As such, the DPC and the Government Protocol recommend that employers continue to apply these measures in the workplace before resorting to seeking the vaccination status of their employees.

Guidelines are likely to change to mirror the ever changing pandemic and while it may be unlikely that vaccinations will become mandatory, it is important for employers to be aware of DPC and Government guidelines and act in accordance with those.  Employers should also continue to implement the control measures already in place in the workplace including social distancing, information to employees and working from home where possible.

For further information on this topic, please contact Laura Graham at

Laura Graham
Author: Laura Graham