Privacy obligations when collecting COVID-19 vaccination status
Hand Out of the Cookie Jar: CJEU Issues Long-Awaited Decision on Cookies
HealthEngine under fire for profiting from disclosure of patient information

Privacy obligations when collecting COVID-19 vaccination status

By Cameron Abbott, Rob Pulham and Ella Richards

Some Australian jurisdictions have imposed obligations on businesses and employers to either sight, or collect and hold, information about their workers’ COVID-19 vaccination status, or to take reasonable steps to ensure unvaccinated individuals do not enter their worksites or premises. For example, on 7 October 2021, the Premier of Victoria released Directions that require employers to collect information about workers’ COVID-19 vaccination status before allowing them to work anywhere outside of the employees’ usual place of residence. Industry-specific obligations (with some differences to those Directions) also apply to some settings such as education, construction and healthcare. Similarly, under public health orders in New South Wales, certain businesses from 11 October 2021 must take reasonable steps to ensure people who are not fully vaccinated do not enter their premises.

The Victorian Government Directions for workers are in effect from today, 15 October 2021, meaning that many employees must provide proof of either receiving their first dose or having booked their first dose by 22 October 2021.

To comply with privacy obligations (including under applicable health records legislation), employers must provide employees with a clear collection statement that outlines, among other things:

  1. the types of sensitive information that the employer is collecting;
  2. the purpose of the collection;
  3. who the employer may disclose the information to, including specifying if any of these parties are outside of Australia; and
  4. a reference to the employer’s Privacy Policy that applies to the information collected about employees.

Even where a business is not subject to these mandatory collection requirements, they may wish to collect this information from employees to assist the business to maintain a safe and secure working environment (including, for example, to provide encouragement to staff to get vaccinated – subject to the requirements around providing incentives to do so).

If you would like advice on your Privacy obligations as an employer, please reach out to Cameron Abbott from our Privacy team. For further information on the Victorian Government Directions, see the Alert from our K&L Gates employment team here.

Hand Out of the Cookie Jar: CJEU Issues Long-Awaited Decision on Cookies

By Cameron Abbott and Max Evans

Earlier this month, the Court of Justice of the European Union (CJEU) issued a long-awaited decision with respect to the requirements necessary for entities to satisfy in order to attain the valid consent of a user to the use of cookies to track and analyse his or her personal information.

Read More

HealthEngine under fire for profiting from disclosure of patient information

By Cameron Abbott, Michelle Aggromito and Alyssia Totham

The Australian Competition and Consumer Commission (ACCC) is taking on Australia’s largest online health marketplace, HealthEngine. In return for a fee, HealthEngine provided without adequate disclosure, patient information to nine private health insurance brokers. 

The MedTech platform functions as an online booking service for many health care providers Australia-wide. During the booking process, HealthEngine would ask users two additional questions. Firstly, they would ask if the user had private health insurance. Secondly, they would ask if the user would like to be contacted with health insurance comparison information. By clicking ‘Yes’ to the second question, users had their personal information transferred to health insurance brokers. This information comprised the user’s name, contact details, date of birth and private health care status.

Read More

Copyright © 2024, K&L Gates LLP. All Rights Reserved.