POPIA defines ‘personal information’ as information relating to: Living natural persons and existing juristic persons. This includes information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person. Aspects such as criminal and employment history, physical address, telephone numbers and biometric information are also included under the definition.

Any form of ‘personal information’ may only be processed where:

• a person has provided consent;
• it is necessary for the conclusion of a contract;
• it is imposed by a law;
• it protects a legitimate interest of the person;
• it is required for the performance of a public law duty by a public body; or
• it is needed for pursuing the legitimate interest of the responsible party.

The word ‘process’ is widely defined in POPIA to include: Collection, collation, storage and retrieval of information.

Section 26 of POPIA prohibits the processing of ‘special personal information’. Given the sensitive nature of this information, this is a special category which attracts a higher degree of protection. This information relates to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information. Also included in this category is information relating to the alleged commission of any offence or any proceedings in respect of any offence allegedly committed and the outcome of such proceedings. In the absence of consent, processing ‘special personal information’ is prohibited.

However, in terms of section 27 of POPIA, there are a few instances where consent will not be required. This includes instances where the processing of such information is necessary by law and when such information is needed for historical, statistical or research purposes that serve the public interest. The exceptions to the prohibition of processing ‘special personal information’ are limited compared to the exceptions to the prohibition of processing ‘personal information’.

When South Africa gets to the point of vaccinations, the question of whether an employee or applicant for employment has been vaccinated will arise. There are many reasons why an employer may legitimately require such information. So, can an employer require that an employee disclose their vaccination status? Can employees object to the request?

There is likely not to be any law which will require that employees disclose their vaccination status. As an inoculation will be a voluntary act (assuming there to be no mandatory policy in a workplace), this means the issue will be regulated by the law of privacy and obviously POPIA. The same would apply in the instance of the imposition of a mandatory vaccination policy in the workplace. An employee’s vaccination status would constitute ‘special personal information’. 

This aside, as part of the pre-planning by an employer on the application of a vaccine policy, during the consultation phase, this is also an important topic to be raised in consultation with employees.  Under POPIA this information should not be retained for longer than is necessary for achieving the purpose for which the information was collected. Planning around this subject would require input and direction of the Information Officer and Human Resources.