Government mandates following from the Covid-19 pandemic and recent lockdowns have restricted the movements of certain individuals within NSW. As a result, many workplaces have experienced hardships with returning to business as usual due to Government orders impacting upon their ability to conduct work. Consequently, organisations have been forced to alter their normal trade practices, with many workplaces only able to conduct business as usual if employees are fully vaccinated for Covid-19. As NSW Government mandates and restrictions continue to impact upon how an organisation can conduct work, employers have increasingly needed to be aware of the Covid-19 vaccination status of their employees, and prospective employees during a recruitment process.

This article will explain whether it is lawful for an employer to ask their employees and prospective employees for their Covid-19 vaccination status, and whether such requests will remain lawful when Government restrictions are eased in the future.

Can an employee lawfully ask for an employee’s or prospective employee’s vaccination status?

Requesting information about a person’s Covid-19 vaccination status is protected in Australia under the Privacy Act 1988 (“the Act”). The Act contains the ‘Australian Privacy Principles’ (“APPs”) outlined within Schedule 1 which apply to all ‘APP Entities’. An APP Entity is defined under the Act to mean ‘an agency or organisation’. If your business falls under the category of an Agency or an organisation, you will be required to follow the principles outlined within the APPs in order to lawfully request a person’s Covid-19 vaccination status.

 What do the APPs outline?

Information about a person’s Covid-19 vaccination status is regarded as ‘sensitive information’ under the Act and is afforded a higher degree of protection. The APPs will only apply to an employer if they wish to ‘collect’ a person’s Covid-19 vaccination status. ‘Collect’ is defined under the Act to mean ‘if the entity collects the personal information for inclusion in a record or generally available publication’. If an employer intends to make a record and document the vaccination status of an individual to keep with a file, this will constitute ‘collecting’ as under the Act and the APPs will apply to you. If an employer does not intend to collect the Covid-19 vaccination status of an individual by writing down and making a record of such information, but simply asks for evidence of an individual’s vaccination status, they may do this without raising any obligations under an APP or the Act.

If an employer wishes to ‘collect’ the Covid-19 vaccination status from an individual, APP 3 outlines they must not do this unless:

• The individual consents to the collection of the information; and
• The information is reasonably necessary for one or more of the entity’s functions or activities.

Each of the requirements are outlined below.

How does an individual ‘consent’ under the law?

For an individual to consent to giving their Covid-19 vaccination status as required by law, this consent must be given freely and without pressure or intimidation. Under APP 1, an employer who requests consent to collect an individual’s Covid-19 vaccination status must be transparent about why the information is being collected and what is will be used for.

As a result, for an individual to freely consent to providing their Covid-19 vaccination status, an employer should provide adequate information surrounding the request of the vaccination status, such as for example:

• What the information will be collected for;
• Why it is required to be collected;
• If the information will be disclosed to any third parties; or
• Whether there are any consequences for refusing to consent to collection.

Furthermore, in line with APP 5, an employer must disclose to an individual that the APP privacy policy contains information about how the individual may access their personal information, seek correction of their personal information, make a complaint about a breach of the APPs terms and how the employer will deal with such a complaint. An employer is required to provide the above information before they collect the Covid-19 vaccination status or, if this is not practicable, provide the information as soon as practicable after the collection occurs.

When information will be reasonably necessary:

Whether a direction is ‘reasonable’ is heavily fact dependent and needs to be assessed on a case-by-case basis. Factors that will affect whether a direction is ‘reasonably necessary’, will include:

• Applicable workplace laws (including any discrimination laws that may be applicable);
• Contractual obligations; and
• Whether vaccination is an essential requirement of the proposed work to be performed by the employee or prospective employee.

Requiring an individual to disclose their vaccination status on a ‘just in case’ basis will be hard to prove disclosure is reasonably necessary.

 Can you continue to ask for Covid-19 Vaccination information after Government restrictions are lifted?

Again, whether an employer can request the Covid-19 vaccination status from an employee or prospective employee depends on the circumstances surrounding the request. For an employee who wishes to ‘collect’ the Covid-19 vaccination status from an individual, this can only be done with that persons consent and where the request is reasonably necessary for one or more the business’ functions or activities. Applicable workplace laws and contractual obligations will impact whether the collection of vaccination status is reasonably necessary for a organisations’ functions or activities.

As mentioned above, what is seen as ‘reasonable’ under the law is heavily fact dependent and requires an analysis on a case-by-case basis considering the relevant surrounding circumstances. What constitutes ‘reasonable’ may change over time if restrictions are eased and whether an individual’s vaccination status affects the scope of work conducted in your organisation.

Keystone Lawyers can assist with advising employers on whether it is lawful to request the Covid-19 vaccination status of an individual, considering the specific circumstances impacting your organisation.