We will put in place the following protections:
• Your individual vaccination status data will only be used to generate summary reports (e.g. by Clinical Board, department or staff group) which are anonymised.
• Summary reports will not report data where there are low numbers. A typical minimum number for anonymous reporting is 6 i.e. where the number is 5 or less, either no figure is given or the number is reported as 5.
• Summary reports will also consider the total numbers of people in a category so that where there are low numbers who are not vaccinated, reporting will be adjusted to accommodate this.
• The Covid-19 vaccination status of any given individual member of staff will not be available to occupational health staff. The data is available for anonymised reporting purposes only.
• As an occupational health responsibility, influenza vaccination status will be available in the occupational health database as an individual record.
• We will not use data on vaccination status to make decisions about individual workers, either directly or indirectly.
In addition, there are legal protections that will relate to the data:
• It is a potential offence under Section 171 of the Data Protection Act 2018 for anyone to try to get around measures intended to ensure the anonymity of data. Data that is anonymous must stay anonymous.
• It is a potential offence under Section 170 of the Data Protection Act 2018 for anyone to access data outside of the limits and controls that apply to it.
• Uses of the data contrary to what is described here may be breaches of the Data Protection Act and must be dealt with promptly. In some cases, they may need to be reported to the Information Commissioner under the statutory breach notification requirements.