Key Points
- During the COVID-19 pandemic, the Victorian Government made a number of orders to protect public health, including mandatory vaccination for specified workers.
- Following the revocation of a number of those orders, temporary amendments were made to the Occupational Health and Safety Regulations 2017 (Vic) to specifically authorise employers to collect COVID-19 vaccination information in order to control risks to health and safety at their workplace.
- Those regulations were revoked as of 12 July 2023, which means that employers now have until 11 August 2023 to destroy that information, unless they have another legal basis to retain it.
Collecting vaccination information
The Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations 2022 (the Regulations), which came into operation on 12 July 2022, temporarily amended the Occupational Health and Safety Regulations 2017 (Vic) to
authorise employers to collect, record, hold and use COVID-19 vaccination information of specified persons:
- to determine reasonably practicable measures to control the risks to health and safety associated with COVID-19 at that workplace; and
- to implement any reasonably practicable control measure to control the risks to health and safety associated with COVID-19 at that workplace,
for the purposes of performing a duty imposed by Part 3 of the Occupational Health and Safety Act 2004 (Vic) (OHS Act) or the Regulations. Part 3 of the OHS Act includes duties such as providing a working environment for employees that is safe and without risks to health and ensuring that other people are not exposed to risks to their health and safety arising from the conduct of the employer.
The term “specified persons” includes employees, independent contractors and their employees, volunteers and students on placement who work be attending the workplace.
Destruction of vaccination information
The Regulations were only intended to operate for 12 months and were revoked as of 12 July 2023.
The Regulations provided for a 30-day grace period until 11 August 2023 for employers to destroy all COVID-19 vaccination information collected under the Regulations.
Importantly, the requirement to destroy this information does not apply where a law of Victoria or the Commonwealth or of any other State or Territory permits or requires the information to be retained on or after the specified destruction date. Accordingly, there will be some employers who have a legitimate need to retain at least some vaccination information, and this will depend on a range of factors such as the particular industry, the type of workplace and what was communicated to the employees when the information was collected.
Each business will need to identify the COVID-19 vaccination information it collected under these Regulations and assess whether it has another legal basis to retain that information. If not, the business will need to take immediate steps to destroy that information prior to the deadline. Given that some of that information was collected while employees were working remotely, there may be copies stored in a range of different media and devices (such as photos in SMS messages).
What do employers need to do?
Victorian businesses should take immediate steps to:
- identify where and how they are holding COVID-19 vaccination information;
- determine whether they have a continuing legal basis to retain this information;
and if not,
- arrange for its destruction.
How we can help?
For assistance with determining how this applies to your particular business, please contact our experts in Privacy, Health, Aged Care and Workplace Relations, Employment and Safety at Russell Kennedy Lawyers.
If you would like to stay up-to-date with Alerts and Insights from our expert Workplace Relations, Employment and Safety team, you can subscribe to our mailing list here.