Your Rights on Vaccine Status

Since COVID-19 restrictions lifted in the UK, many workers have gradually returned to the office. Despite early evidence—including statements from Pfizer and government press briefings—that the “vaccine” did not fully prevent transmission, some employers continue to request staff vaccination details. Below is a reminder of your rights regarding disclosure of medical information.

How Is Data Regarding COVID Vaccination Status Classified?

Your COVID vaccination status constitutes special category data under the UK General Data Protection Regulation (UK GDPR) because it reveals private health information. When processing special category data, the Information Commissioner’s Office (ICO) requires that use of this data be fair, relevant and necessary for a clearly defined purpose. Employers must therefore ask:

• Is collecting vaccination status essential to meet health and safety obligations?
• Does the industry sector or specific workplace setting justify this request?
• Are there less intrusive measures available?

Maintaining ongoing reviews of changing circumstances is vital to ensure that processing remains proportionate and compliant.

Lawfully Processing Employees’ COVID Vaccination Status

To request and use employees’ vaccination details, an employer must:

1. Identify a lawful basis under Article 6 of the UK GDPR (e.g., legitimate interests or contractual necessity).
2. Invoke a separate condition for processing special category data under Article 9 of the UK GDPR.
3. Where required, satisfy additional provisions of the Data Protection Act 2018.

Depending on the chosen bases and conditions, employers may also need to produce an appropriate policy document outlining the measures in place for handling this sensitive data.

Other Legal Factors

Beyond data protection, employers should consider:

• Workplace discrimination issues under Section 60 of the Equality Act 2010.
• Human rights, specifically the right to privacy (Article 8) and freedom of thought, belief and religion (Article 9) under the Human Rights Act 1998.
• Health and safety at work obligations and risk assessments.
• Contractual conflicts with existing employment terms.

Employers must also heed guidance from industry regulators, NHS public health advisories and the latest UK government directives to ensure a coherent approach.

Further Reading

• UK GDPR Special Category Data Explained
• Employee Rights and Health Data