Labour Law News South Africa

Covid-19: Data privacy concerns of vaccination statuses - part 2

In part 1 of this article, we looked at the two competing challenges of data privacy requirements and the National Vaccination Rollout and Strategy, which require serious consideration. Here we'll discuss the practical implications.
Source: Oleksandr Omelchenko –
Source: Oleksandr Omelchenko – 123RF.com

What are the practical implications?

Consider a scenario where Company A contracts with Company B, wherein Company A will provide cleaning services at the premises of Company B, by way of sending a team of their employees to provide such services.

Company B, however, requires Company A to provide only employees who have been vaccinated against Covid-19 and can present their vaccination cards as confirmation thereof. As justification for such a demand, Company B states that the DMA, LRA and OSHA places an obligation on Company B to ensure that it provides a safe workplace for employees of Company B and the public.

In order to evaluate the stance taken by Company B, one needs to consider the justification for such a demand from various perspectives:

  • Firstly, a practical question arises, namely: will adherence to the demand of Company B achieve the desired outcome?
    As at the date of this article, the World Health Organisation (WHO) has stated that, while a Covid-19 vaccine will prevent serious illness and death of an individual, the WHO still cannot confirm the extent to which a Covid-19 vaccine keeps an individual from being infected and passing the virus on to others. Therefore, insisting that all employees provided by Company A to Company B in the rendering of the services are vaccinated, does not, with the information available at present, seem to safeguard the workplace for the employees of Company B and/or the public. Therefore, from a practicality perspective, the demand of Company B does not achieve the desired outcome.

  • Secondly, the question as to the National Vaccination Rollout and Strategy requires consideration, i.e. does the demand of Company B assist the National Vaccination Rollout and Strategy?
    In this regard, it is certainly conceivable that the demand of Company B would, indeed, assist in the National Vaccination Rollout and Strategy. By requiring Company A to only provide employees who have been vaccinated to render services at the premises of Company B, Company B is effectively applying a form of social/communal pressure on Company A and/or its employees to make sure that they are vaccinated in order to render the services and maintain a viable business.

  • Thirdly, one has to consider whether Company B’s request is reasonable given the requirements relating to data privacy.

    PoPIA and its requirements does not necessarily prohibit the collection, processing and dissemination of personal information. What PoPIA does require, however, is that the parties involved in the processing, collecting and dissemination of the personal information of a data subject (i.e the employee in this example), must be held accountable for their actions. Therefore, Company B’s request is not necessarily unsustainable in terms of PoPIA, but care needs to be exercised by both Company A and Company B in order to ensure that they have the necessary grounds to collect, process and disseminate the personal information and that they have taken the appropriate and reasonable technical and organisational measures to safeguard the personal information.

In light of the above, one would have to concede that Company B’s demand does not achieve the desired objective of creating a safer workplace for the employees of Company B and/or the public. If the Covid-19 vaccine only prevents serious illness and death, but does not hinder the transferability of the virus, it is submitted that the general requirements as to social distancing, screening, sanitisation and wearing of masks would be far better employed to achieve Company B’s desired objective of a safer workplace.

However, from a National Vaccination Rollout and Strategy perspective and a social responsibility point of view, Company B’s request does seem to have merit. As such, Company A may want to consider implementing a mandatory vaccine policy, as envisaged in the Direction, but as discussed above, the Direction does not truly provide the legal muscle required to enforce it as being “mandatory”. Therefore, an alternative approach may be recommended in that Company A implements a policy which encourages employees to be vaccinated, not only for the benefit of their own health, but also as part of their civil duty to the greater community and in order to ensure that Company A can continue to render its services to the market and thereby maintain a viable business.

In terms of PoPIA, it is submitted that the neither the Direction, nor the DMA, in its present form provides a basis for processing of the vaccination status of an employee to be deemed as necessary for the establishment, exercise or defence of a right or obligation in law. In a similar fashion, presently there has not yet been an initiative taken to apply to the Information Regulator to declare the vaccination status of individuals to be processed on the basis of public interest. Therefore, Company A will either have to obtain the consent of the employees, as discussed above, or Company A could rely on the fact that a particular employee has deliberately made their vaccination status public, by publishing this on public platforms, such as Facebook and various other social media platforms or groups. Company A could also embark on a social responsibility campaign, encouraging their employees to disclose their vaccination status voluntarily, in order to further assist the National Vaccination Rollout and Strategy.

Conclusion

Given the serious nature of the consequences that the Covid-19 pandemic leaves in its wake and the international trend that certain civil liberties of individuals have been and will continue to be limited in order to effectively battle the Covid-19 pandemic, it is certainly conceivable that we may very well see legislation in South Africa take a more concrete stance on the vaccination status of individuals. This will most certainly impact the constitutional rights of such individuals and infringements on the fundamental rights of the individuals will have to be justified in terms of Section 36 of the Constitution of South Africa.

However, until a more concrete stance on the vaccination status of individuals is taken up in legislation, employers would be well advised to apply strict adherence to the provisions of PoPIA when collecting, processing and disseminating their employees’ vaccination status and to encourage their employees, as a matter of social policy, to battle the Covid-19 pandemic by being vaccinated.

Read part 1 of this article.

About Phillip Kruger

Phillip Kruger is the Director: Legal, RSM South Africa
Let's do Biz