Recording staff vaccination data

Firstly, a couple of links as reference...though they don't really tell you the answer - especially the second one which doesn't seem to have been updated post-August 16th:

https://ico.org.uk/global/data-protection-and-coronavirus-information-hub/coronavirus-recovery-data-protection-advice-for-organisations/vaccination-and-covid-status-checks

https://www.gov.uk/government/publications/what-parents-and-carers-need-to-know-about-early-years-providers-schools-and-colleges-during-the-coronavirus-covid-19-outbreak/step-4-update-what-parents-and-carers-need-to-know-about-early-years-providers-schools-and-colleges#symptoms-and-testing

https://faq.covid19.nhs.uk/article/KA-01397/en-us?parentid=CAT-01033&rootid=

The changes in stage four easing mean that there is "no need to isolate based on vaccine status", and the ICO advice remains that the standards applied to recording vaccination status are the same as testing, therefore recording vaccination status "just in case is not enough". You aren't required to keep test results, and action you take is only required on the basis of a positive test result.

Therefore, we recommend verifying vaccination status when there is a positive test. i.e. positive test reported - tell only those who were close contacts to isolate unless exempt due to being fully vaccinated. That is the snapshot in time that matters - recording this data prior to the event is not necessarily up-to-date and accurate, which is a GDPR requirement (e.g. has someone been vaccinated since). Plus, you are only validating the information of those affected, so there is no data minimisation issue.

Whilst we can see the argument that knowing in advance the likely impact of non-vaccinated staff might have would be useful, this would be dependant on whether you would do any meaningful contingency planning with this information. And also whether not doing the contingency planning would have any significant impact on your activities as a public body - after all, only when there is a positive case (or cases) will check on vaccination status be confirmed and isolation requirements confirmed - individuals need to be informed of close contact, even if vaccinated in order to monitor themselves.

So our advice is to request the vaccination status of only the impacted staff only when there is a positive case to consider unless there are demonstrable benefits as a public body to knowing in advance. Collecting and storing this data also poses issues - which are covered on the ICO page I reference. That page is worth a careful read.