POPIA and the disclosure of an employee’s vaccination status

The Protection of Personal Information Act 4 of 2013 (POPIA) provides for the protection of personal information processed by public and private bodies. Whilst POPIA defines personal information, it also creates another category termed ‘special personal information’.

28 Apr 2021 3 min read Employment Law Alert Article

At a glance

  • The Protection of Personal Information Act (POPIA) defines personal information and special personal information, with the latter category attracting higher protection due to its sensitive nature.
  • Personal information can only be processed under specific conditions, including consent, contractual necessity, legal obligations, legitimate interests, and public law duties.
  • Special personal information, such as religious beliefs, race, health, or biometric information, is prohibited from processing without consent, except in limited instances required by law or serving public interests. Vaccination status falls under special personal information.

POPIA defines ‘personal information’ as information relating to: Living natural persons and existing juristic persons. This includes information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person. Aspects such as criminal and employment history, physical address, telephone numbers and biometric information are also included under the definition.

Any form of ‘personal information’ may only be processed where:

  • a person has provided consent;
  • it is necessary for the conclusion of a contract;
  • it is imposed by a law;
  • it protects a legitimate interest of the person;
  • it is required for the performance of a public law duty by a public body; or
  • it is needed for pursuing the legitimate interest of the responsible party.

The word ‘process’ is widely defined in POPIA to include: Collection, collation, storage and retrieval of information.

Section 26 of POPIA prohibits the processing of ‘special personal information’. Given the sensitive nature of this information, this is a special category which attracts a higher degree of protection. This information relates to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information. Also included in this category is information relating to the alleged commission of any offence or any proceedings in respect of any offence allegedly committed and the outcome of such proceedings. In the absence of consent, processing ‘special personal information’ is prohibited.

However, in terms of section 27 of POPIA, there are a few instances where consent will not be required. This includes instances where the processing of such information is necessary by law and when such information is needed for historical, statistical or research purposes that serve the public interest. The exceptions to the prohibition of processing ‘special personal information’ are limited compared to the exceptions to the prohibition of processing ‘personal information’.

When South Africa gets to the point of vaccinations, the question of whether an employee or applicant for employment has been vaccinated will arise. There are many reasons why an employer may legitimately require such information. So, can an employer require that an employee disclose their vaccination status? Can employees object to the request?

There is likely not to be any law which will require that employees disclose their vaccination status. As an inoculation will be a voluntary act (assuming there to be no mandatory policy in a workplace), this means the issue will be regulated by the law of privacy and obviously POPIA. The same would apply in the instance of the imposition of a mandatory vaccination policy in the workplace. An employee’s vaccination status would constitute ‘special personal information’. 

This aside, as part of the pre-planning by an employer on the application of a vaccine policy, during the consultation phase, this is also an important topic to be raised in consultation with employees.  Under POPIA this information should not be retained for longer than is necessary for achieving the purpose for which the information was collected. Planning around this subject would require input and direction of the Information Officer and Human Resources.

The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2024 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com.