What to consider when implementing a vaccination policy in your organisation

UK employers are not alone in this conundrum of how to approach vaccinations, and testing, in their workforces. In an attempt to drive up vaccination rates in parts of the US President Joe Biden recently announced a vaccine mandate for all US employers with 100 or more employees, demanding that employers ensure that their staff are either double-vaccinated or comply with weekly testing requirements, failing which they face substantial fines per employee. The President has also made it mandatory for all government employees to be double-vaccinated, doing away with the testing alternative altogether. Italy also has recently passed a law requiring workers to show a “Green Pass”, proving their vaccinated status, or that they have recently had COVID-19 or a negative test result, in order to access company offices/premises. It is anticipated that more countries may follow suit in the coming months and this has left many employers around the world, including in the UK, asking the question of what more can be done now to ensure a safe working environment going forward and should they be considering a vaccine mandate or tougher measures for the workplace?

So what is the answer and will other countries’ bold approach of mandating vaccines in certain workforces have any impact or influence here in the UK? It would seem not. Prime Minister Boris Johnson recently announced in a US television interview that he would not be following the US approach by imposing mandatory vaccination on those people who have so far refused to get vaccinated, stating “In my country, we’re at great levels of liberty. We’ve had to do it by sweet reason and persuasion. And that’s working”. When asked by the interviewer what happens when “sweet reason and persuasion don’t work” he replied “Keep going. More sweet reason.” “Sweet reason” has in fact been abandoned in the care sector, and legislation has been passed requiring those who work in regulated care homes to be double vaccinated unless medically exempt (though this is currently subject to a legal challenge). There is also a consultation underway regarding proposals to require frontline NHS health and social care staff to be fully vaccinated, unless medically exempt. Outside of health and social care, though, there is no indication that the government will legislate. With government intervention seemingly ruled out the responsibility will continue to fall on individual employers to determine their own approaches and policies for their workforces, taking into account both employment and data protection law implications.

• Can employers ask employees if they have been vaccinated?
  
  Yes, in principle, but from a data protection perspective this data can only be processed by the employer if there is a legitimate interest justifying the processing, the processing is proportionate and it is necessary to comply with their legal obligations under employment law (namely, the obligation to take reasonable steps to ensure the health and safety of their employees). This may well be difficult for many employers to demonstrate. The Information Commissioner’s Office (ICO) explains that the sector you work in, the kind of work your staff do and the health and safety risks in your workplace should help you to decide if you have legitimate reasons to record whether your staff have had the COVID-19 vaccine. The ICO gives examples of workplaces where such checks may be justified as those where staff are more likely to encounter infected people, or where infected people and unvaccinated people could pose a risk to clinically vulnerable individuals. Employers with workplaces where these risks are not present are much less likely to be able to justify such an approach. In addition, Public Health England’s “Working Safely: guidance to employers” proposes numerous measures that employers should consider to reduce coronavirus transmission risks, but does not focus on or suggest the use of the NHS COVID Pass (which allows individuals to demonstrate their COVID status using vaccines and testing) or vaccine status checks as part of its recommendations in any but event settings.
  
  If this information is collected, employers should only collect and retain the minimum amount of information needed to fulfil their purpose in line with ICO guidance and the data minimisation principle. It’s important to remember from both a data protection and employment law perspective the use of vaccine status data must not result in any unfair or unjustified treatment of employees and if the collection or use of COVID status information is likely to have a negative consequence for someone, this must be justifiable.
  
  
• Can employers carry out workplace testing of employees/require employees to provide evidence of a negative test?
  
  As above, this is possible but only if this is proportionate and necessary for employers to comply with their legal obligations to ensure the health and safety of their workplace. Employers will need to carry out a risk assessment, taking into account the particular features of their workplace and workforce, to determine whether the processing test data is necessary to comply with their health and safety obligations and to demonstrate that they have carefully considered all relevant factors in coming to this conclusion. As with vaccine status, carrying out testing or processing test information will require the completion of a Data Protection Impact Assessment to demonstrate that the proposed testing/collection of test data is necessary to comply with the employer’s health and safety obligations under employment law. Before carrying out any tests, or requiring that test evidence be provided, employers must tell their staff what personal information is required, what it will be used for and who the company will share it with. The ICO also stresses the importance of the accuracy principle – employers should record the date of any test results, because the health status of individuals may change over time and the test result may no longer be valid after a short period. As with collection of vaccine status data, use of test information must not result in any unfair or unjustified treatment of employees, and any negative consequence of use of this information must be justifiable.
  
  
• Can employers require employees to be vaccinated as a condition of continuing employment? What can be done if the employee refuses?
  
  Whilst this is theoretically possible, a blanket requirement is likely to be risky for most employers, taking into account the data protection considerations outlined above and employment law risks, summarised below.
  
  Employers may be able to make vaccination a condition of being permitted to work in certain environments, on health and safety grounds. Relevant sectors are likely to include healthcare, social care and other high-risk sectors, where an employer’s obligation to ensure employees do not pose a risk to patients or clients and vice versa may include an obligation to ensure such employees are vaccinated against common infections/transmissible illnesses/biological hazards. Where an employee refuses to comply with a vaccination requirement, the employer may then have grounds to move the employee onto alternative work and/or to take disciplinary action up to and including dismissal in connection with that refusal. Whether or not such action is lawful or not will depend on the specific circumstances.
  
  Employers will need to carry out a risk assessment on a case-by-case basis to determine whether a vaccination requirement can be justified and whether adverse (e.g. disciplinary) action can be taken for refusal, taking into account (i) the role in question (including the working environment, the risk posed by the employee to others and vice versa); and (ii) the health and needs of the employee, to determine whether it is reasonable to impose such a condition and take such action. There are many reasons why an individual might legitimately be unable, or refuse, to be vaccinated. Employers will need to consider objections carefully and individually in order to avoid claims of discrimination and/or victimisation under the Equality Act 2010 as well as any claims for unfair dismissal, and may need to be prepared to make exceptions where individuals have legitimate reasons for not being vaccinated. In particular, employees with medical conditions that mean they cannot be vaccinated may be disabled for the purposes of the Equality Act 2010; there will be a duty to make reasonable adjustments for such employees, and this may include waiving a vaccination requirement.
  
  
• Can employers require employees to be tested and/or to present a negative test or evidence of immunity in a specified form on a regular basis?
  
  Provided testing is proportionate and necessary to ensure compliance with an employer’s legal obligations (see answer to question on testing above) a regular resting or evidence requirement would in most cases be a reasonable alternative to excluding non-vaccinated employees, whilst also managing the level of risk for other employees. Providing evidence of immunity should only be considered if this is through the NHS COVID Pass, which recognises potential natural immunity. Antibody testing is not yet commonplace, nor is its accuracy/utility recognised in the UK.
  
  
• Can employers require employees to be vaccinated, as a condition of physical attendance at the workplace?
  
  As above, whilst this is theoretically possible, a blanket requirement is likely to be risky for most employers.
  
  In theory, employers may be able to exclude unvaccinated employees from the physical workplace in certain sectors, again on health and safety grounds. As above, this is most likely to be justifiable in the healthcare, social care and other high-risk sectors. If the employer considered that the risk to the employee in question, to colleague or to patients, clients, supplier or other third parties was sufficiently high and there was no other way to mitigate or minimise this risk, it may have grounds to exclude the employee from some or all areas of the physical workplace.
  
  As with a requirement of vaccination as a condition of continuing employment, employers will need to carry out a risk assessment on a case-by-case basis taking into account (i) the role in question (including the working environment, the risk posed by the employee to others and vice versa); and (ii) the health and needs of the employee, to determine whether a vaccination requirement can be justified and whether adverse action can lawfully be taken against an employee who refuses. There are several potential legal risks associated with requiring vaccinations as a condition of attendance at the workplace, including: (i) a blanket policy could lead to indirect discrimination claims under the Equality Act 2010, e.g. on the basis that the policy places those with protected characteristics at a particular disadvantage. Any such policy would need to be objectively justified and this is a stringent test; (ii) breach of contract; and (iii) unfair dismissal.

Unfortunately for employers, the UK position on vaccination is not black and white, and the specifics of the workplace, the nature of the work involved and the particular characteristics of the employees themselves are all likely to be relevant to the question of whether it is lawful to require vaccination as a condition of employment or attendance at a particular workplace. At the time of writing, the government has given no indication that further clarity will be provided, and so businesses in the UK will have to continue to grapple with the law as it stands. The stance they take is likely to depend (at least partly) on their appetite for legal risk.

It’s important that specific advice is sought by any employer looking to introduce a vaccination/testing requirement and/or looking to take action against an employee for refusing to comply with any testing or vaccination policy. For more details on the above topics, including the position for Mobile/Gig Economy/Agency Workers as well as Visitors to your premises please see our COVID-19 vaccine guidance document, which not only examines the position in the UK but also the approach internationally with advice for 17 other countries globally.