Covid-19: Data privacy concerns of vaccination statuses - part 1

Source: RF._.studio from Pexels

In a similar fashion, commerce, industry and businesses have become accustomed to functioning within a pandemic environment. In South Africa, the Disaster Management Act 57 of 2002 (the DMA), the Labour Relations Act 66 of 1995 (the LRA) and the Occupational Health and Safety Act 85 of 1993 (the OHSA) have been amended and applied with great agility in order to ensure that employers and employees are well aware of their rights and obligations relating to the employment relationship within the greater Covid-19 pandemic environment.

Enter, however, two new participants to this mix and the apple-cart does not seem as stable as it did in first half of 2021, particularly insofar as it relates to the employment relationship.

The newcomers represent competing challenges which require serious consideration, namely: (i) Data Privacy Requirements and (ii) The National Vaccination Roll Out and Strategy.

Data privacy requirements

The Protection of Personal Information Act 4 of 2013 (PoPIA) has come into full force and effect on 1 July 2021, after a 12-month grace period was allowed for businesses to implement the necessary processes and policies to be compliant with the provisions of PoPIA.

The main objective of PoPIA is to promote the protection of personal information processed by public and private bodies by, among others, introducing certain conditions for the lawful processing of personal information so as to establish minimum requirements for the processing of such information.

PoPIA also introduces the concept of so-called “Special Personal Information” (SPI) which is defined as the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject or the criminal behaviour of a data subject.

The national vaccination rollout and strategy

The South African government, as many other governments worldwide, has undertaken the massive task of sourcing, distributing and overseeing the roll-out of the vaccine against Covid-19. To this end, a national register for Covid-19 vaccinations was established and the vaccination system is based on a pre-vaccination registration and appointment system. All those vaccinated are recorded in a national register and provided with a vaccination card.
Internationally, a trend has formed in many developed countries requiring a vaccination card to be presented before individuals are allowed to travel, enter public spaces and before being allowed to enter the workplace.

In South Africa, however, we have not reached this point yet. The DMA, LRA and OSHA do, however, place an obligation on the employer to ensure that it provides a safe workplace for employees and the public.

Furthermore, the Department of Labour has issued the Consolidated Direction on Occupational Health and Safety Measures in Certain Workplaces (the Direction), dated 11 June 2021, which allows employers to adopt a mandatory vaccine policy.

Such a mandatory vaccine policy, however, must allow an employee to refuse to be vaccinated on constitutional grounds, such as the right to bodily integrity and the right to freedom of religion, belief and opinion, or medical grounds. If an employee refuses to be vaccinated, the employer must take steps to reasonably accommodate the employee in a position that does not require the employee to be vaccinated, in order to enable the employee to remain employed at the organisation, which might include allowing the employee to work offsite or at home, or to work in isolation from other employees.

Therefore, the South African law does not yet allow an employer to limit or refuse an employee their employment entitlements purely based on their vaccination status.

Competing challenges: Vaccination status v data privacy

It seems, therefore, that employers may be stuck between a rock and a hard place. On the one hand, the employer has an obligation to protect the personal information of its employees in terms of the provisions of PoPIA, whilst, on the other hand, international trends seem to indicate that, unless you disclose your vaccination status by way of presenting your vaccination card, certain social liberties will be withheld from you. Furthermore, employers are required in terms of the DMA, LRA and OSHA to provide a safe working environment for all of their staff.

All the while, however, employers are only empowered by the Direction with the ability to adopt a mandatory vaccine policy, which upon deeper reflection, is not truly “mandatory” in the sense of the dictionary definition of the word at all.

The question, therefore, arises as to how an employer is to deal with the personal information of their employees relating to their vaccination status.

Given the inclusion of personal information relating to an individual’s health as SPI in terms of PoPIA, employers will be required to be extremely circumspect with how they intend to deal with the collection, processing and dissemination of their employees’ vaccination status.

PoPIA is very clear in its provisions that SPI may only be processed in the event that:

• processing is carried out with the consent of a data subject (i.e the employee);
  
• processing is necessary for the establishment, exercise or defence of a right or obligation in law;
  
• processing is necessary to comply with an obligation of international public law;
  
• information has deliberately been made public by the data subject (i.e the employee); or
  
• processing is for historical, statistical or research purposes to the extent that –

  • it serves a public interest and the processing is necessary for the purpose concerned; or
    
  • it appears to be impossible or would involve a disproportionate effort to ask for consent, and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the data subject to a disproportionate extent.

  As such, in order for an employer to collect, process or disseminate personal information regarding its employees’ vaccination status, the employer would have to comply with the provisions of PoPIA in respect of the processing of SPI.

  As per the above, the South African law does not yet require employers to process the vaccination status of their employees as an obligation of law. As such, it would be of the utmost importance that employers obtain the consent of employees in order to collect, process and/or disseminate their employees’ vaccination status.

  In this regard PoPIA requires such consent to be a voluntary, specific and informed expression of will in terms of which permission is given by the employee to the employer for the collection, processing and dissemination of the personal information of the employee.

  In part 2 of this two-part series, we’ll look at practical implications.