The first publication we will look at is “Advice to NPHET regarding policies relating to healthcare personnel who do not avail of the Covid-19 vaccination” prepared by HIQA and published on the 8^th of April 2021.

The second publication we will look at is “Processing Covid-19 Vaccination Data in the content of Employment” prepared by the Data Protection Commission and published on the 22 of June 2021.

Advice to NPHET regarding policies relating to healthcare personnel who do not avail of the Covid-19 vaccination” prepared by HIQA and published on the 8^th of April 2021

HIQA are described as an independent statutory body who report into the Minister for Health. Since March of 2020 a special team within HIQA has provided what they refer to as “research evidence” to support the work of NPHET. In September 2020, it would appear that NPHET began writing to HIQA to ask them to provide advice on specific topics – the topic we are looking at in this video is: “What policies, mitigation actions or initiatives have been implemented internationally relating to and Covidhealthcare workers who do not avail of COVID-19 vaccination that could be considered by the Irish Health Service”

This particular guidance relates specifically to healthcare workers. It is important to note that frontline healthcare workers are generally treated differently to all other types of employees when it comes to the COVID-19 vaccine. As this guidance applies, in particular, to healthcare workers, those of you who are not healthcare workers may think this document is not applicable to you, however, this document should be of use in understanding the limitations placed on employers in settings other than front line healthcare, given that this document outlines the measures that may be taken in the extreme.

The takeaways from the HIQA report are as follows:

1. A laddered approach should be used to encourage front line healthcare workers to take the vaccine. This means an employer cannot go straight to “the vaccine is mandatory”. This laddered approach will start with nudges to influence choices, escalating to more restrictive steps through disincentives and the restriction of choice, for example through redeployment, with Mandatory vaccination sitting at the top of the ladder as the most intrusive step. The further up the ladder the state or employer climbs, the stronger the justification has to be. The decision to step up the ladder is said to be influenced by the level of risk to patients from unvaccinated healthcare personnel.
2. Collection of data on uptake, reasons for refusal, ethnicity and setting is considered critical, in order to ascertain where refusals may be higher than usual and any associated factors, so that appropriate supports could be put in place.
3. It is confirmed that there is a data reconciliation project ongoing in Ireland which will facilitate the estimation of uptake rates among healthcare workers.
4. It is said that there is a duty of care for healthcare workers in direct patient contact to be vaccinated, with nursing home residents being considered to be at greater risk from unvaccinated healthcare workers – meaning healthcare workers in nursing homes are likely to come under even greater pressure.
5. It is said that mandating COVID-19 vaccination at this time, may not be appropriate as this may act as a deterrent. As an aside, there is general agreement throughout the EU that mandating a vaccination in law does not actually increase uptake – this is one reason the COVID-19 vaccine is highly unlikely to be mandated in law in Ireland. We are far more likely to use coercive underhand measures that are more difficult to challenge legally.
6. The measure of mandating the vaccine for healthcare workers was also considered in the context of public perception and it was concluded that such a measure may be perceived as being overly harsh on a workforce that have had a particularly traumatic year. We know from everything that has happened over the past 18 months that keeping the public on side is very important to the Government and I suspect this is one of the reasons the HSE backtracked on the announcement that all student nurses would be required to take the vaccine or have their placement stopped in April of this year.
7. Professional Bodies such as the Medical Council of Ireland, Nursing and Midwifery Board of Ireland, Pharmaceutical Society of Ireland and also trade unions and third level institutions will be utilised to increase uptake of the vaccine – so do not expect any support from any of these bodies in the event you wish to decline the vaccine.
8. Finally, it was noted that, in particular, GP’s and pharmacists play a pivotal role in increasing uptake of the vaccine given the high number of direct contacts they have with the public each day – and if this cohort display any vaccine hesitancy this could have the very real prospect of influencing the wider public – in this regard the report states that “There needs to be clear advice against healthcare workers spreading misinformation.” Again, we know what is meant by misinformation in this context.

Processing Covid-19 Vaccination Data in the content of Employment prepared by the Data Protection Commission and published on the 22 of June 2021

This guidance note answers the question “what information can employers process in relation to their employees on their return to the workplace and in particular, can an employer lawfully collect and process information on whether an employee has received or intends to take the covid-19 vaccine.”

The conclusion by the Data Commissioner is that: in the absence of clear advice from public health authorities (presumably this means the Department of Health) that it is necessary for employers to establish the vaccination status of their employees, any such processing of an employee’s vaccination data represents unnecessary and excessive data collection for which there is no clear legal basis. That said, it should be noted that once again frontline healthcare workers are treated differently to all other categories of employee and there is a suggestion that requesting information on the vaccination status of frontline healthcare workers may be justified from a data protection perspective.

In order that employees are fully informed as to the protection they enjoy under the General Data Protection Regulations in connection with the processing of their personal data, a brief overview of this legislation is necessary.

General Data Protection Regulations

The General Data Protection Regulations which came into force on the 25th of May 2018 lay down rules relating to the protection of persons with regard to the processing of their personal data.

The Recitals to the regulations state that “The protection of natural persons in relation to the processing of personal data is a fundamental right”. Article 8 of the EU Charter of Fundamental Rights states that everyone has the right to the protection of their personal data AND such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned, or some other legitimate basis laid down by law.

Information regarding whether or not an employee has been vaccinated constitutes health data which is a type of special category data under the General Data Protection Regulations.

Article 6 of the GDPR

In order to lawfully process health data, an employer must first determine a legal basis for the processing of such data under Article 6 of the Regulations, such as on the basis of consent or to comply with a legal obligation. In this regard it is important to note that consent (under Article 6(1)(a)) is generally not regarded as a valid basis for processing an employee’s personal data because of the inequality in bargaining power between an employer and an employee.

In fact, in this guidance note, the Data Commissioner specially states the following “The processing of personal data in the context of employment takes place in a situation where there is an imbalance between the data subject (employee) and data controller (employer). Therefore, employees should not be asked to consent to the processing of vaccine data as this consent is not likely to be freely given.”

This means that even if an employer asks an employee what their vaccination status is and even if the employees answers the question, it is highly likely that this would be considered unlawful – in which case an employee could raise a complaint with the Data Protection Commission.

Article 9 of the GDPR

So, if an employer can determine a legal basis for the processing of health data under Article 6 (which appears unlikely in circumstances where the Department of Health has not provided any guidelines stipulating the necessity of doing so), then an employer should be aware that the processing of special categories of personal data (which includes health data) is generally prohibited unless an employer can avail itself of one of the exemptions in Article 9.

Data Protection Impact Assessment

Furthermore, large-scale processing of special category data requires a Data Protection Impact Assessment, which must be carried out before introducing a policy relating to processing the vaccination status of employees.

The advice by the Data Commissioner also confirms that the decision to get the covid-19 vaccine is voluntary and this further suggests that COVID-19 vaccination should not, in general, be considered a necessary workplace safety measure and consequently, the processing of vaccine data is unlikely to be necessary or proportionate in the employment context.

The Data Commissioner goes on to confirm that “In addition, the long-term efficacy of vaccination in terms of immunity is not yet clear i.e. where new COVID variants may arise, or vaccine top-ups may be required. For these reasons, there does not appear to be a sufficiently evidence based justification to consider that knowledge and processing of vaccination status can be considered necessary in employment at this time.”

Please find a template letter that may be issued to employers requesting an employees vaccination status at this link: Letter of Vaccination Status