Covid 19, Vaccinations and The Privacy Act 2020
The recent resurgence of COVID 19 in New Zealand and the introduction of the vaccination campaign earlier this year has raised many questions for employers and employees around the application of the Privacy Act 2020.
Back in July our HR Consultant Claire Pilton, wrote this blog answering COVID 19 vaccination FAQs: read this here The Covid 19 Vaccination and Your Employees.
Further to this, lawyers Bundle Findlay state that "employers have a duty to keep their employees’ personal information confidential, and can only share that information if an exception in the Privacy Act allows". They advise that employers stick to the Privacy Act principles.
We have shared 11 of the key principles below:
1. You can only collect personal information if it is for a lawful purpose and the information is necessary for that purpose. You should not require identifying information if it is not necessary for your purpose.
2. You should generally collect personal information directly from the person it is about. Because that won’t always be possible, you can collect it from other people in certain situations. For instance, if:
- the person concerned gives you permission
- collecting it in another way would not prejudice the person’s interests
- collecting the information from the person directly would undermine the purpose of collection
- collection is from a publicly available source
3. When you collect personal information, you must take reasonable steps to make sure that the person knows:
- why it’s being collected
- who will receive it
- whether giving it is compulsory or voluntary
- what will happen if they don’t give you the information
4. You may only collect and use personal information in ways that are lawful, fair and not
unreasonably intrusive.
5. You must make sure that there are reasonable security safeguards in place to prevent loss, misuse or disclosure of personal information.
6. People have a right to ask you for access to their personal information. In most cases you have to promptly give them their information. Sometimes you may have good reasons to refuse access. For example, if releasing the information could:
- endanger someone’s safety
- create a significant likelihood of serious harassment
- prevent the detection or investigation of a crime
- breach someone else’s privacy
7. A person has a right to ask an organisation or business to correct their personal information if they think it is wrong.
8. Before using or disclosing personal information, you must take reasonable steps to check it is accurate, complete, relevant, up to date and not misleading.
9. You must not keep personal information for longer than is necessary.
10. You can generally only use personal information for the purpose you collected it. You may use it in ways that are directly related to the original purpose, or you may use it another way if the person gives you permission, or in other limited circumstances.
11. You may only disclose personal information in limited circumstances. For example, if:
- disclosure is one of the purposes for which you got the information
- the person concerned authorised the disclosure
- the information will be used in an anonymous way
- disclosure is necessary to avoid endangering someone’s health or safety
- disclosure is necessary to avoid a prejudice to the maintenance of the law
This, along with Claire's blog, reinforces that Employers have to have a lawful purpose for collecting or using information relating to an individual’s COVID 19 vaccination status.
If employers are requesting to know an employee's vaccination status it is likely to only be lawful in regards to the Privacy Act when the role is assessed from a health and safety perspective to require a vaccinated person to perform it. The need for vaccination must have been identified during a comprehensive risk assessment process.
Mandatory Vaccinations
When considering whether a business can make it mandatory for employers to have vaccinations, they must be guided by:
- New Zealand Bill of Rights 1990
- Employment Relations Act 2000
- Human Rights Act 1993
- Health and Safety at Work Act 2015
Although we are yet to have any NZ case law to guide employers regarding non-border worker roles, it is accepted that employers can currently only require mandatory vaccinations when there is high risk to the employee, other staff or clients of contracting COVID 19. If the community outbreak is not contained or becomes more widespread, then it is likely we will see more employers having to review their risk tolerances. We are already seeing this in a number of other countries around the world.
When determining what a fair and reasonable employer could do when it comes to requiring mandatory vaccinations (or mandatory testing), the following are some circumstances that could be relevant:
• Whether there are cases of community transmission (especially if it is wide and sustained);
• The type of industry – whether it involves aged care facilities, essential medical workers, or any other industry or organisation that cares for people considered “high risk” or industry or organisation where the risk of transmission to others is “high risk”;
• Whether it is possible to assign employees to alternative duties of lesser risk, such as those duties which do not require face to face contact with other workers or members of the public;
• Whether it is possible for employees to work remotely;
• The impact on an employer’s business of not having all staff vaccinated (if an employee was infection, could the business still operate? Are there international market access issues if products are made by unvaccinated staff?);
• Whether PPE (personal protective equipment) can be safely used to minimise the risk of transmission;
• Whether there are other processes, controls and precautionary measures that can be utilised to reduce or minimise the risk of exposure;
• Whether the employee has any underlying health condition(s) for which a vaccine is contraindicated
• Whether there is a government issued Public Health Order in place for your industry or organisation.
What we do know is that vaccinations are considered a significant control mechanism that along with other controls (such as PPE, social distancing etc) can help reduce the spread and the likely impact of severe illness. Where possible information and support for employees to access the vaccinations should be encouraged.
If you have any queries please:
Contact your HR Connect Consultant directly
Email admin@hrconnect.co.nz and Bronwyn or Lee will respond to you as soon as possible
Call the office phone on 07 839 7005 or 0800 131 557
Take care,
HR Connect Ltd
Sources: Bundle Findlay Law, The Privacy Commission Website, Dunseath and Associates
