Employers, employees and vaccinations: rights, responsibilities and GDPR compliance

Charlie Mullins of Pimlico Plumbers caused a mini media storm last week when he floated a ‘no jab, no job’ policy for new starters. Employment lawyers everywhere immediately began discussing the legalities of such a policy, with many expressing concern that firms could become embroiled in litigation if they were to dismiss staff for refusing to have a vaccine. Mr Mullins later clarified that it is only potential new employees who refused to have the vaccination that would be subject to the “no vaccine, no job” policy, but that existing employees would not be forced to have it.

Whilst employers could offer to provide vaccinations to those who are not already immunised, employees retain the right to refuse. If employers want to make the Covid vaccine a contractual requirement, then any changes to the terms of existing contracts would need to be agreed by staff. If an employer was to enforce this change without the express consent of the employee, they would find themselves in breach of contract giving rise for employees to resign and claim constructive unfair dismissal.

Lawyers for Pimlico Plumbing were said to be working on writing the requirement into employee contracts for its 450-strong workforce, and anyone who attended a job interview at the firm would need to show proof of vaccination. The company has set aside £800,000 to pay for vaccinations, but Mullins said he was willing to pay up to £1m for each round of jabs that new strains of coronavirus might require.

If companies are considering arranging their own mandatory private clinics to vaccinate their employees, they could find themselves liable for any mishandling, storing or administering of the vaccine if their employees go on to experience any adverse side-effects.

Beyond employment law and health and safety issues, organisations must also be aware of the GDPR implications. Under both GDPR and the Data Protection Act, processing of personal data concerning health constitutes a special category so is prohibited, unless “necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment” and “providing for appropriate safeguards for the fundamental rights and the interests of the data subject”.

This is not likely to change after 1 January 2021 when the UK withdraws from the European Union.

It is vital that employers carry out a data privacy impact assessment before collecting and processing this type of data. Part of the consideration of whether there is a legitimate reason to collect the data is what the benefit of this information will be, and there needs to be a very clear reason why any specific vaccination data is needed.

In light of these various and highly complex legal and moral issues, the majority of employers may prefer to adopt the safer policy of actively encouraging staff to receive the COVID-19 vaccine, in much the same way that employers often promote and help facilitate their staff members to have the flu jab.