When can an employer record staff vaccination information?

Mandatory vaccinations are, and will continue to be, an issue at the forefront of employers’ minds.?In Western Australia, front-line health workers, the resources sector and allied health professionals have all been alerted that they have, or will shortly have, mandatory vaccination requirements.?There are also other sectors which are being considered, including teachers and politicians.?The list will continue to grow as WA aims to hit its vaccination targets.

For sectors where vaccination is mandated, there is no real dispute about whether employers can require their employees to vaccinate.?In sectors where vaccinations are not mandated the matter is far less clear.?Notwithstanding this, there is a question that arises for both of these categories; to what extent can an employer request or demand an employee’s vaccination record and what are they allowed to do with it?

This question, at its core, is one of privacy, which is governed by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APP).?The APP outline the privacy obligations for “organisations”, which is defined to include sole traders, body corporates, partnerships, unincorporated associations and trusts (and some small businesses). ?If you are an employer in Australia, including WA, there is a good chance the APP apply to your business and that compliance with the APP is a legal requirement.?

Broadly, the APP govern the standards around collection, use and disclosure of personal information, the accountability of the organisation that collects this information and the rights of the individual to access this information.?In relation to vaccination information, the APP will likely only apply where the organisation is collecting or recording vaccination information (i.e. keeping it on record rather than simply sighting it).

Principle 3 of the APP provides that an organisation may only collect ‘sensitive information’ (which includes medical information) in circumstances where:

·????????the individual consents to the collection of the information; and

·????????the information is reasonably necessary for one or more of the organisation’s functions or activities.

The path of least resistance is to obtain (freely given) consent from your staff; as with many workplace matters, mutual agreement is very much your friend.?Where mutually agreement cannot be reached and consent is not given, employers must tread far more carefully.

Although limited, an employer may still collect sensitive information without consent; this includes where the collection is required or authorised by or under an Australian law.?Practically, this means that employers in an industry with government mandated vaccinations may not need consent to collect the vaccination records of their staff.

Although employer’s may be familiar with the general exemption for employee records under section 7B of the Privacy Act this too has limits.?The Fair Work Commission has observed that the ‘employee records’ exception only applies once the records have been obtained and does not absolve an employer of its obligations under the APP regarding the collection of records.?The prudent employer should, at a minimum, obtain consent and ensure the information is reasonably necessary for their functions.

While many employers will be looking to mandate vaccinations for their staff, it is imperative they comply with any obligations under the APP.?Employers should always be completely open to their staff that they intend to and are collecting vaccination information.?Save for where an employer falls under an APP exception, they should get genuine consent from the employee.?If an employer collects vaccination information, strict and ongoing compliance with the APP is of paramount importance.?Failure to comply with the APP at any point can result in an employer being liable for an offence or civil penalties.

Employers who need clarity on the these issues should contact Carla Vinciullo or Joshua Richards on (08) 6109 6644 (www.kvlaw.com.au) and review the National COVID-19 Privacy Principles guidance note https://www.oaic.gov.au/privacy/guidance-and-advice/national-covid-19-privacy-principles??

Author: Carla Vinciullo (Director) & Joshua Richards (Associate), Kennedy Vinciullo.

Note: The above article is written for general information and is not intended to constitute legal advice nor should it be relied upon as such.