Office of the Privacy Commissioner
PO Box 10094, The Terrace, Wel ington 6143
Level 11, 215 Lambton Quay
Wellington, New Zealand
P +64 4 474 7590 F +64 4 474 7595
E [email address]
0800 803 909 Enquiries
privacy.org.nz
30 May 2024
Erika Whittome
By email only to:
[FYI request #26617 email]
Tēnā koe
Official Information Act Request (Our Ref: OIA/0357)
We refer to your Official Information Act request of 3 May 2024.
Your request:
This websit
e https://www.privacy.org.nz/resources-2/privacy-and-covid-19/ of yours
says that:
"Employers that have a legitimate need to know an employee’s vaccination status"
Would you please share the minutes, emails and any correspondence and policy
documents for the decision to publish the above saying that an employer has a
legitimate reason to ask health status of a worker.
Please include any legal discussions and legal advice, and also refer to the specific
sections of the Health and Safety at Work Act 2015 as the basis for this
statement. . .especially any discussions around section 168 (4) of the Health and
Safety at Work Act 2015.
I would like all the memos, correspondence and meeting minutes including legal advice
that occurred prior to this advice being published on your website in 2021.
Please share any inter agency correspondence regarding the decision for this eg with
Worksafe, MBIE, the MoH, Crown Law etc.
In Sep 2021, this statement or similar was nowhere on the same "Covid" webpage
(https://web.archive.org/web/20200901054927/ht ps://privacy.org.nz/resources-
2/privacy-and-covid-19/)
So I assume this "covid" advice came about later in 2021 or early 2022 on the Privacy
Commision's webpage.
Your request has been considered under the Of icial Information Act 1982, and my response
is set out below.
OIA/0357/A972098
2
Our response
We note that you have asked for “the minutes, emails and any correspondence and policy
documents for the decision to publish the above
saying that an employer has a legitimate
reason to ask health status of a worker” (emphasis added).
However, to clarify, the statement on our website does not say that an employer
has a
legitimate reason to ask about the health or vaccination status of a worker. Rather, it confirms
that
if an employer has a legitimate need to know an employee’s vaccination status, it is lawful
for them to collect that information, and provides two examples of when that may be the case.
The full text on our website page that you refer to
(https:/ www.privacy.org.nz/resources-
2/privacy-and-covid-19/) is set out below:
Privacy and vaccination status in the workplace
Employers that have a legitimate need to know an employee’s vaccination status can
ask the employee for that information; for example, where the employee’s role is
subject to a vaccine mandate, or where the information is material to a health and
safety plan.
This website page has been updated a number of times as the COVID-19 response evolved,
as follows:
12 July 2021
15 December 2021
OIA/0357/A972098
3
17 December 2021
8 August 2022
A copy of the documentation held relating to the development and publication of the updated
material on 8 August 2022 is
enclosed.
OIA/0357/A972098
link to page 4 link to page 4
4
Consistent with earlier OPC guidance
For completeness, I also note that the statement that you have expressed interest in – that:
“
Employers that have a legitimate need to know an employee’s vaccination status can ask
the employee for that information” – is consistent with other guidance that our Of ice
developed to assist agencies and individuals in understanding and navigating their privacy
obligations and rights in the context of the evolving COVID-19 pandemic.
For example, and while predating the development, approval and government roll-out of the
COVID-19 vaccinations,
OPC's blog post of 30 March 20201 (which was based on an article
published in the March 2020 edition of NZ Doctor) addressed the issue of employee privacy
rights, and noted the following:
What does the Privacy Act say?
The Privacy Act permits employers to collect information about their employees’ health
status if it is needed for a lawful purpose such as health and safety.
Another example is our July 2021 blog post:
The COVID-19 vaccination and privacy rights2
that, among other things, explained that:
A person’s vaccination status is personal information and so falls under the protections
laid out in the Privacy Act 2020. However, as we have outlined previously, there are
limited situations where an employer can ask for the vaccination status of an employee
where they have a legitimate need to know. Justifiable reasons to ask for this can
include a legitimate health and safety concern, or where certain roles must be
performed by a vaccinated worker, such as staff at an MIQ facility.
That blog was updated in November 2021, however, this statement remained the same.
The two redactions in the enclosure relate to DDI numbers of two staff members redacted
under s9(2)(a) of the OIA.
We trust that this response is helpful. If you are not satisfied with this response, you have the
right to ask the Ombudsman to review my decision on your request.
Nāku iti noa, nā
Liz MacPherson
Deputy Privacy Commissioner
Encl.
1 https://www.privacy.org.nz/blog/employee-health-privacy-for-gps-in-a-covid-19-world/
2 https://www.privacy.org.nz/blog/the-covid-19-vaccination-and-privacy-rights/
OIA/0357/A972098
