Businesses operating in Victoria should make sure they have arranged for the destruction of any COVID-19 vaccination information recorded or held under the Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations 2022 by 11 August 2023.
Collecting COVID-19 vaccination information
The Regulations, which came into operation on 12 July 2022, deal with the collection, recording, holding and use of COVID-19 vaccination information, following the removal of certain vaccination requirements in "pandemic orders".
In practice, the Regulations allowed persons managing a workplace to continue to collect, record, hold and use of COVID-19 vaccination information for the purpose of complying with their general health and safety duties under the Occupational Health and Safety Act 2004 (Vic) for a period of 12 months (ending on 12 July 2023).
After this 12-month period, any data collected, recorded, held or used must be destroyed within 30 days.
What vaccination information is captured by the Regulations?
The Regulations allowed data to be collected from any "specified person" who attended or will be attending the relevant workplace. A specified person was defined to include an employee, an independent contractor, an employee of an independent contractor, a volunteer, or a student on placement.
Data permitted to be collected, recorded, held and used under the Regulations included information about:
- whether the specified person has received a dose of a vaccination against COVID-19, and if so, every date on which the person received a dose of the vaccine; and
- whether the specified person is unable to receive a dose, or further dose, of a vaccination against COVID-19 due to a medical contraindication, an acute medical illness, or because of their age.
Destroying COVID-19 vaccination information: What has to be done, when and how
Businesses that relied upon the Regulations (or a pandemic order predating the Regulations) to collect, record, hold or use vaccination information from "specified persons" must destroy all such data by 11 August 2023.
Failure to do so may give rise to a breach of health privacy legislation, including the Privacy Act 1988 (Cth) and Health Records Act 2001 (Vic) which regulate the handling of health information about individuals in Victoria.
The Regulations do not specify how the relevant information ought to be destroyed, but we would recommend that you:
- notify affected persons that the information is now being destroyed; and
- destroy the data securely, and in a manner that avoids inadvertent disclosure of the information to a third party.
The requirement to destroy this information does not apply to employers that are otherwise permitted or required under other laws to collect, use, record, or hold vaccination information.
For advice or assistance with managing your obligations as a Victorian employer, please get in touch below.