It has been said that privacy is not about something to hide but something to protect and is what gives us the ability to share with the world who we are, on our own terms.
These days, privacy is a carefully guarded commodity, and there can be serious consequences for privacy breaches, whether deliberate or accidental.
The New Zealand Office of the Privacy Commissioner (“OPC”) exists to uphold privacy here in New Zealand and the statute that governs privacy is the Privacy Act 2020.
The purpose of the OPC is to develop and promote a culture in which personal information is respected and protected. So how does all this translate in terms of the privacy rules surrounding a person’s vaccination status?
As with most things, it is not black and white. In certain circumstances a person’s right to privacy may be outweighed by other recognised interests such as ensuring a person’s safety.
With what appears to be an upward trend in mandatory vaccination orders in response to the Delta variant, a lot of questions are being asked by both employers and employees. In terms of both parties’ rights there are a few important things to be aware of.
Employers can lawfully ask about an employee’s vaccination status if they have a legitimate reason for doing so and can demonstrate why they need it. For example, if there is a legitimate health and safety risk, or the work is subject to a mandatory vaccination order. Employers do not necessarily need to know why a person is not vaccinated however, and employees can lawfully refuse to provide this information. WorkSafe has guidelines on how to undertake a health and safety risk assessment.
Employees can also lawfully refuse to advise employers of their vaccination status. In such circumstances, an employer is allowed to assume the employee is unvaccinated. The employer must however put this tentative conclusion to the employee and allow them to comment before taking any action or relying upon that assumption. Regardless, an employee should carefully consider the potential consequences of refusing to confirm their vaccination status.
Employers beware, though. Be mindful of how you ask for an employee’s vaccination status. The circumstances in which the information is collected must be fair, and not unreasonably intrude on an individual’s personal affairs or privacy. It’s unlikely for instance, that it would be considered fair to ask for a person’s vaccination status in front of others or in a public place.
Additionally, employers must consider who else in their organisation needs to know about a person’s vaccination status. As an overarching guide, it is unlikely that many people will need to know.
The OPC encourages organisations to put themselves in the shoes of the person affected and consider these questions. Why do you need this information? How much information do you need? How do you ask for it in a reasonable, privacy enhancing way?
Ultimately, an individual’s vaccination status is sensitive information, and as with all personal information that is collected, appropriate care must be taken, otherwise you could end up being subjected to a complaint to the OPC.