88% of Irish Firms Call for Guidance on the Collection of Employee Vaccination Data

Most (94%) Irish businesses have not put an employee vaccination strategy in place – while the majority of these say they do not intend to do so. However, 88% of Irish firms are calling on the Data Protection Commission (DPC) to issue guidance on the collection of employee vaccination data. These are the primary findings of the latest nationwide survey from the Association of Compliance Officers in Ireland (ACOI), which sought the views of over 300 organisations, and was completed by ACOI members with responsibility for compliance in financial organisations throughout the country.

Speaking of the findings, Michael Kavanagh, CEO of ACOI, commented,

“The results have highlighted a demand amongst respondents for guidance on how employers collect and process their employee’s vaccination information – or indeed if they do so at all.

There is a sense of urgency surrounding this amongst 46% of respondents who agree that this guidance needs to be issued ASAP, with a further 42% believing its needs to be forthcoming before the Summer. All of which is understandable because as it stands these employers simply do not know how to proceed. Just 12% believe that the DPC have until later in the year to take action on this issue.”

The ACOI say that this issue is likely to become more and more pressing as the country’s national vaccination rollout continues, and the age of those vaccinated continues to move downward, thus incorporating more of Ireland’s labour force, who will, in turn, begin to consider a return to their workplace as restrictions ease.

Mr Kavanagh continued,

“The survey reveals that most organisations (94%) have not put an employee vaccination strategy in place and that 75% have no current intentions of doing so. There is a danger here that employers may not give proper attention to this important issue unless proper and timely guidance is issued.

Perhaps there is a feeling among employers that this won’t be as important an issue while staff are working remotely, but complacency is not an option. GDPR on the topic of employee vaccinations has the potential to become a highly contentious area of compliance for firms, and the processing of health data, in particular, has important implications under GDRP legislation.

Our experience would show us that a constructive and proactive approach is crucial in the successful rollout of any compliance strategy. We are advising organisations that one immediate step they can take is to ensure their employee privacy policy is reviewed and updated once the DPC issues any guidance.”