Demystifying 'No jab, no job' schemes

As covid-19 restrictions ease in the UK, employers face the challenge of planning a gradual return to the office and putting measures in place to ensure their employees are safe.

In this context, many employers (controllers, under data protection law) will be wondering if they should monitor vaccination status or make a return to the office, or job offers, conditional on employees and candidates having received the vaccine.

In this blog, we have captured some of the key practical considerations, as well as the headline issues from an employment and data protection law point of view.

Practical issues

Whist the rollout of vaccinations seems to be progressing well, the reality is that many people of working age have not yet received their first vaccination. The picture on whether or not the various types of vaccination will prevent the spread of infection remains unclear and there is a risk that some vaccines could be ineffective against emerging strains of Covid-19. That being the case, it is hard to make the case that having only vaccinated people travelling to and attending the workplace will be totally safe, in the absence of other measures.

It is also difficult for employers to adopt a position which is at odds with public health guidance and messaging. At present, that essentially remains: work from home if you can, and deploy measures to protect those who have to attend the workplace, like hand sanitising stations, screens separating work stations and measures to support social distancing in common areas. Although the Government intends to publish a roadmap review on Covid-Status Certification (vaccination passports), there is seemingly no current intention to mandate vaccinations for attendance at work.

Employment law

In the context of the pandemic, much has been made of employer's legal duty to safeguard the health and safety of their employees. In light of the practical issues we have touched on, employers are highly unlikely to be required to mandate vaccinations in order to meet that obligation, though.

In fact, requiring employees and candidates to be vaccinated could present very real risks under employment law. For example:

• If employers cannot guarantee equal treatment between those who are vaccinated – and allowed to take up a role or attend the workplace - and those who are not, it could face claims for indirect discrimination.

For example, an employer that requires employees to be vaccinated and decides to incentivise the return to work through a bonus scheme would be treating those who have been unable to access the vaccine (younger employees) or who have been advised not to (for instance, pregnant employees acting on medical advice) in a less favourable way.

• Insisting on vaccination without considering any employee's objections or concerns, and barring attendance at the workplace for those who are not vaccinated could amount to a fundamental breach of the employment contract, allowing employees to resign and pursue claims for constructive unfair dismissal (provided they have the requisite 2 years' service). 

Data protection law

From a UK data protection standpoint, as set out in guidance from the ICO (available here), collection of employees' vaccination status data will be lawful provided there is a clear and compelling reason to do so. Employers will have to assess and document whether recording staff vaccination status data will help them achieve this goal. Employers in certain industries (for example, health and social care providers) will be more likely to  demonstrate that these activities are lawful as their employees are more likely to be in contact with patients infected with covid-19, or with vulnerable people who could become infected. However, employers in other industries/settings may struggle to justify such measures.

Employers will have to assess compliance of their proposed scheme with the principles of:

• Necessity: The ICO has advised (in the context of covid-19 testing, but it is transferable here) that employers should ask themselves whether the information is necessary and whether employers can achieve the same result without collecting personal information.
• Proportionality. Employers should consider blanket v. targeted schemes depending on their business and workforce.
• Fairness. Consider any potential negative consequences for individuals, for example, the impact on those who cannot have the vaccine (for medical reasons or simply because their age group has not been invited to have it yet) or do not wish to do so.

When planning to process vaccination status personal data, employers should put measures in place to comply with the key data protection principles that are set out in the UK GDPR. All requirements will apply but we would highlight the importance being transparent with employees, and keeping the data processed to the minimum. Employers must only process the data for the purposes for which it was obtained (or compatible purposes), the risk of scope creep in such fast paced environment is great. Furthermore, employers must ensure that they document the measures implemented in compliance with the accountability principle by, for instance, carrying out a data protection impact assessment and setting out a Vaccination status policy which identifies the scope and extent of the programme. 

The above is underpinned by the stricter restrictions set out by data protection law to the processing of 'special category personal data', as covid-19 vaccination records would be, because of the sensitive nature of the information.

What to do?

It is likely to be some time before employers in most sectors can safely and lawfully insist on employees and candidates being vaccinated. Plenty of employers are considering and adopting more nuanced approaches, for instance the adoption of policy rules which encourage employees to take up the vaccine at the earliest possible opportunity and which require vaccination as a pre-condition to a return to the workplace unless exceptions apply. Ultimately the lawfulness of such an approach will depend on the ever-evolving state of the vaccine rollout, the science behind the impact of the vaccine on the transmission of and the nature of the workplace itself.

As is often the case, employers would be well advised to consider carefully before over committing to a binary position here and collecting special category data of their employees.