As the vaccination roll-out continues apace, schools are considering (afresh) collecting vaccination status data on their staff. This decision is not straightforward; it involves navigating the various benefits, pitfalls and hurdles before this sensitive data can be collected lawfully.
As a starting point, we encourage schools to look at guidance published by the Information Commissioner’s Office (ICO), accessible here.
The ICO guidance states that an employer’s reason for recording vaccination data ‘must be clear and compelling’. It cannot be collected on a ‘just in case’ basis, or when you can achieve your aim without it. It is therefore crucial that, before schools start collecting their employees’ vaccination status, they have thought through what they are trying to achieve and whether this data will actually help to achieve it.
Not only is this data personal to each employee, it is their private health information and classed as ‘special category data’ (SCD). It is afforded extra protection under data protection law, and schools’ use of it must be fair, necessary, and relevant to what they seek to achieve with it.
For schools, their legitimate interests and the ‘employment condition’ are likely to be the appropriate lawful bases for processing this data as part of their risk assessment. This should be considered by each school based on their circumstances. Consent is unlikely to be appropriate in the employer-employee context as it may not be freely given even when it is not mandatory.
In our experience, schools collecting vaccination status data about staff do so to inform their risk assessments and the Covid-19 measures they put in place around the school (including for clinically vulnerable and clinically extremely vulnerable staff). Tracking levels of vaccination take-up may assist in establishing the risk of transmission and in turn, inform what protection measures need to be in place to address that risk.
Schools would need to show that, as part of the risk assessment, vaccination status data is needed for staff (and pupil) health and safety, and that other measures for managing infection (such as Covid-19 testing) is insufficient. As long as this is established and documented, it should protect schools from challenges that excessive SCD is being collected. SCD would include information on staff the school knows have not been vaccinated and why (if reasons are given).
If a school decides to collect vaccination data, it should only be used for purposes staff would reasonably expect. If there is any possible negative impact on staff, it must be justified and fair, and it should be made clear to staff in advance via, for instance, a vaccination policy or guidelines (more on this below). We recommend you seek legal advice if your school is proposing consequences for staff who fail to provide their vaccination status; it is a complex area of law.
As is the case with all forms of personal data processing, schools must be transparent about recording vaccination status data and it must be held securely and confidentially. A school’s privacy notice for staff is likely to need updating to factor in collection of this new data.
The decision to continue to collect this information should be kept under review in light of changing government guidance, and as the vaccination roll-out reaches more people. We expect it will be practical for most schools to review this data collection each time their risk assessments are updated.
Schools are not legally obliged to implement vaccination guidelines, or a vaccination policy, but doing so may assist in setting out a school’s position, encouraging staff to get vaccinated where possible and, alongside a school’s Covid-19 risk assessment, may further reassure staff as they carry out their duties.
We have worked with the Independent Schools’ Bursars Association (ISBA) to produce template vaccination guidelines which ISBA member schools can access on the ISBA website. We recommend that schools seek legal advice on their arrangements in any event and when tailoring this template.