Mandatory vaccinations in the workplace: what do employers need to consider?

COVID-19 Cyber Employment & Safety Insurance

Numerous employment and privacy law issues at play

With the effects of the COVID-19 Delta variant placing increasing strain on workplaces, the weight of health expertise is clear that vaccination of a high proportion of the population is a necessary part of providing long-term protection against the virus. Employers are therefore grappling with questions around can (and should) they make vaccinations compulsory for workforces and all the legal issues this could raise.

In this Insight, our cross-practice experts cover the employment, safety, privacy, regulatory, insurance and liability considerations that confront employers navigating these complex and rapidly changing public health settings.

Key takeaways

  • In the absence of a government mandate, those employers who wish to mandate vaccinations or to collect information about the vaccination status of their employees will need to consider a number of employment and privacy law issues.
  • Employers can mandate vaccination if required to do so under a public health order or if it would be lawful and reasonable to do so for work health and safety reasons.
  • Those employers who wish to encourage or incentivise (instead of mandating) vaccinations should be aware of specific guidance issued by the Therapeutic Goods Administration (TGA) around promoting COVID-19 vaccines generally and incentivising individuals to get vaccinated.
  • The supply and use of rapid antigen tests is regulated by the TGA. There is not yet widespread use of rapid antigen testing in Australia and it is not considered to be a genuine alternative to vaccination. Importantly, there is a current prohibition on the use of rapid antigen tests for 'home testing' and the TGA has published guidance for businesses on the safe implementation of rapid antigen testing.
  • Employees who suffer an illness or injury from an employer-mandated vaccination are likely to turn first to the No Fault COVID-19 Indemnity Scheme recently announced by the Federal Government. Depending on the circumstances, the employee may also be able to pursue a claim under the employer's workers' compensation insurance.
  • Employers should continually assess the health and safety risks to their employees in light of rapidly changing circumstances to assess whether, in addition to their existing control measures, making vaccination a condition of employment could be justified as a work health and safety control measure, taking into consideration current public health orders and the nature of their industry.
Employment and safety considerations
  • A fundamental principle in Australian employment law and one which underpins the legal considerations regarding the issue of mandatory vaccinations in the workplace is that an employer's direction to their employees must be both lawful and reasonable.
  • The law as it presently stands, and the current policy position of state and federal governments and relevant regulators (including public health orders and guidelines from the Fair Work Ombudsman and SafeWork Australia), do not require employers to mandate the COVID-19 vaccination unless a public health order applies.
  • Employers can only mandate the COVID-19 vaccination in their workplace if it is a lawful and reasonable direction.
  • In the absence of a Public Health Order requiring it, making the COVID-19 vaccination a condition of employment will likely only be reasonable if it can be justified on work health and safety grounds.
  • An employer would need to demonstrate that mandating vaccinations in order to permit attendance in the workplace is a reasonably necessary control measure to address the identified risks of COVID-19. If the employees are able to work remotely (eg work from home), it may be difficult to establish that mandatory vaccinations are reasonably necessary control measures for work health and safety reasons.
  • Employers should assess any non-compliance with their mandatory vaccination policy (if one is implemented) on a case-by-case basis, to mitigate the risks of employee claims of discrimination, unfair dismissal or unlawful adverse action.
Privacy considerations
  • In line with recent guidance from the Office of the Australian Information Commissioner (OAIC) for employers covered by the Privacy Act 1988 (Cth) (Privacy Act), employers should only collect and use information about the vaccination status of their employees in very limited circumstances, and should only collect the minimum amount of information necessary to maintain a safe workplace.
  • Unless an exception applies under the Privacy Act (eg the collection being required or authorised by law), employers should only collect vaccination status information if:
    • the employee consents; and
    • the information collected is reasonably necessary for the functions and activities of the business.
TGA considerations
  • A new TGA Permission allows for the offering of rewards or incentives (such as cash or other prizes) to individuals to support vaccination. It also permits certain advertisements that promote the use or supply of COVID-19 vaccines generally. Certain conditions must be met when promoting or incentivising COVID-19 vaccines, such as ensuring that promotional content is consistent with government messaging on the national vaccination program, does not contain comparisons between COVID-19 vaccines and does not contain references to trade names or active ingredients.
  • The TGA has also imposed conditions on the supply of rapid antigen tests, including how they can be advertised by suppliers, in what circumstances the tests can be used, who can perform the test and the requirements for supervision of testing and reporting positive test outcomes. These conditions may be adjusted in the future, consistent with changes made to public health settings towards tolerating low-level community transmission of COVID-19 in a higher vaccinated population (as compared to maintaining a goal of zero or extremely low community transmission).
Employer's exposure to liability and insurance
  • With the recent introduction of the No Fault COVID-19 Indemnity Scheme, an employee who suffers adverse effects, injury or death is likely to turn first to that scheme in order to pursue compensation. While the details of the scheme are still being finalised, it is likely to provide a simpler route to obtaining compensation than pursuing a claim against an employer or a workers' compensation claim.
  • That said, it is still possible that an employee who suffers an illness or injury from an employer-mandated COVID vaccination will make a claim for workers' compensation or damages for personal injury. These claims are likely to be covered by the employer's workers' compensation insurance, provided a sufficient connection between their employment and the receipt of the vaccine can be established.
  • As mentioned above, another possible exposure for employers who mandate vaccines is claims by those employees who refuse to be vaccinated. Such employees may then bring claims for discrimination, unfair dismissal or unlawful adverse action. Employment Practices Liability insurance – for those employers who have such policies – are likely to respond to claims of that kind.

Your questions answered

Are vaccinations mandatory in the workplace?

So far, the Federal Government has only mandated vaccinations for residential aged care workers from 17 September 2021. Certain states have followed suit by mandating vaccinations through public health orders for workers in specific industries and local government areas.

In the absence of a public health order or term in the employment contract, employers who wish to mandate vaccinations in their workplace will need to issue a lawful and reasonable direction.

When is an employer's direction lawful and reasonable?

The Fair Work Ombudsman has emphasised that the coronavirus pandemic does not automatically make it reasonable for employers to direct employees to receive COVID-19 vaccinations. The FWO has introduced a 'work tier' approach which provides guidance on whether an employer's direction is likely to be reasonable for personnel who perform certain tiers of work.

The FWO's 'work tier' approach acknowledges that workplaces may have a mixture of employees who perform work across different tiers. As such, the reasonableness of a mandatory vaccination requirement will likely vary across the employer's workforce, depending on the risk of exposure to COVID-19 based on the nature of the employees' work. A mandatory vaccination direction to employees performing work in Tier 1 (eg employees engaged in customer facing / retail work) is more likely to be reasonable than the same direction to employees whose work can be performed remotely from home (that is, Tier 4).

Even if a direction mandating COVID-19 vaccination of employees is reasonable, there is a risk it could be found to be unlawful or unfair in certain circumstances. Employers should remain alert to a number of legal considerations under employment, WHS and anti-discrimination laws.

The lawfulness and reasonableness of an employer's direction should be determined on a case-by-case assessment.

Can I collect information on the vaccination status of my employees?

In some situations, such as complying with state / territory public health orders, an employer may be able to collect vaccination status information where required or authorised by law – this should be considered carefully and on a case-by-case basis.

As a general rule, if the collection is not required by law, under the Privacy Act, employers should only collect vaccination status information if the employee consents and the information is reasonably necessary for the functions and activities of the business.

What is 'reasonably necessary'?

The OAIC has released guidance for employers (OAIC Guidance)1 which states that relevant 'functions and activities' may include preventing or managing COVID-19. However, the guidance also states that factors such as the health and safety risks in the relevant workplace will be relevant to what is reasonably necessary to collect, and that the information should not be collected 'just in case'. Businesses that face a higher risk of COVID-19 transmission in their workplace (such as those that require on-site attendance as opposed to remote working) will clearly have a stronger basis for demonstrating that the collection of vaccination status information is reasonably necessary.

What type of consent do I need?

Health information (which includes vaccination status information about an individual) attracts additional protections under the Privacy Act and can generally only be collected with the consent of the individual employee.

The recent Fair Work Commission appeal decision in Jeremy Lee v Superior Wood2 makes it clear that consent is required to collect vaccination status information and the employee records exemption under the Privacy Act only applies once the information is actually 'held' by the employer. The employee's consent must be informed, voluntary, current and specific and the employee must have capacity to give consent. This means that, as a general rule, an employee should not face disciplinary action for failing to provide their consent for the collection of their vaccination status information – any options available to employees if they choose not to consent, or any consequences they may face if they refuse to consent, should be clearly explained.

Employers considering collecting vaccination status information should also consider what employment contracts they have in place and whether these may require compliance with reasonable policies or conditions relevant to consent. However, employers should be cautious of relying on general consent clauses that may not be specific enough to operate to permit the collection of vaccination status information.  

Importantly, employers should minimise the scope of the vaccination status information they seek to collect. For example, employers should consider whether it is necessary to enquire as to the type or brand of COVID-19 vaccine their employee has received, or if they are not vaccinated, whether or not they have scheduled an appointment to get vaccinated.

Can I require my employee to provide information on their vaccination status?

A key element of consent for the provision of health information is that it must be voluntary. An employer who directs their employee to provide their vaccination status information will, in most circumstances, not be able to demonstrate that they have obtained genuine consent.

However, health information may be collected if it is required or authorised by law. This will be relevant to employers that may be required to ensure a vaccinated (or, at least, part-vaccinated) workforce, eg due to a public health order, or have work locations in local government areas of concern. There may be some other limited circumstances in which an employer may direct an employee to provide information on their vaccination status. However, other than in these limited situations, the safest position is to presume that the consent of the employee should be freely given.

It has been recently reported that the Federal Government will also provide guidance that allows employers to ask employees for their vaccination status.3 However, at this stage, it is not clear what the legal effect of such guidance will be.

Can I promote COVID-19 vaccines generally?

As the approved COVID-19 vaccines in Australia are classified as prescription medications, the direct advertising or promotion of these products to the public would ordinarily be prohibited under Australian law.

However, the TGA recently issued a permission (the TGA Permission)4 that will allow the promotion of COVID-19 vaccines (including providing incentives to encourage vaccination) until the end of 2022.

These promotions must meet certain conditions. Promotions must be consistent with government health messaging on the National COVID-19 Vaccination Program and cannot contain:

  • references to specific trade or sponsor names, active ingredients or anything that would identify the vaccine (unless the advertisement is made by an approved COVID-19 vaccination provider);
  • comparisons relating to the vaccine (eg between vaccines or with other medicines);
  • statements suggesting that the vaccine cannot cause harm or have no side effects; or
  • any false or misleading statements about the COVID-19 vaccines.

The associated TGA guidance is perhaps more restrictive than the terms of the TGA Permission itself. Whilst the TGA Permission provides that the advertisement must not contain reference to trade names or active ingredients, the TGA guidance goes further to say that an advertisement should also not reference 'any other information that would identify the vaccine (eg Pfizer or AstraZeneca)'. We suggest that the safer approach for those wishing to promote COVID-19 vaccination would be to comply with the TGA Guidance as well, by not seeking to identify any specific vaccine. Instead, communications should promote approved COVID-19 vaccines in Australia generally.

Can my business offer incentives for people to be vaccinated?

The TGA Permission also allows for the offering of rewards or incentives (such as cash or other prizes) for vaccination. Offers of rewards or other incentives can be made to certain groups (such as employees) or to members of the public more broadly. However, any incentives must:

  • be offered to those who are fully vaccinated (currently requiring two doses) (which means an incentive cannot be a condition on vaccination occurring after the offer / incentive is made);
  • state that the vaccination is to be undertaken on the advice of a health practitioner;
  • only refer to COVID-19 vaccines generically; and
  • (if involving alcohol) not encourage dangerous consumption of alcohol or contain an offer of alcohol that appeals to minors.

The TGA Permission and associated guidance provides clarity and comfort for those businesses that wish to encourage uptake of the COVID-19 vaccines.

Businesses wanting to offer such rewards or incentives should consider the data governance and privacy compliance arrangements they have in place and how such information will be dealt with. As set out above, vaccination status information (as health information) attracts special protections under the Privacy Act. For example, businesses should ensure appropriate consents are obtained and consider how they will protect such personal information from improper or unauthorised access, use and disclosure.

Can I encourage COVID-19 vaccines in the workplace?

The TGA guidance is also relevant for employers facilitating vaccination in the workplace through approved vaccine providers. In these circumstances the brand name of the vaccine being used can be advised to employees in a non-promotional way. This should be limited to logistical information that will assist employees to access the vaccinations.

For example, an email advising staff that a particular type of COVID-19 vaccine is being offered at particular locations and times within the business would be acceptable. However, these communications should be kept internal to the business and should not offer incentives for taking up a particular vaccine brand being offered by the employer.

What do I need to know about rapid antigen testing?

Rapid antigen testing is a screening tool that can help to detect COVID-19 in people who may not be displaying any symptoms of COVID-19.

Under certain public health orders, individuals may need to engage with rapid antigen testing programs in certain circumstances, such as if they live in an identified local government area of concern, they wish to leave that area to work and they have not had a first dose of a COVID-19 vaccine (and do not hold a medical exemption). These settings will be in place for authorised workers in NSW, for example, from 30 August 2021.

Suppliers of rapid antigen tests and testing service providers will need to ensure that the advertising of the tests is compliant with the Therapeutic Goods Advertising Code and the tests must be included on the Australian Register of therapeutic Goods (ARTG). A list of all rapid antigen tests approved for supply in Australia is also available on the TGA website.

Testing needs to be performed under the overall supervision of a health practitioner, medical practitioner or paramedic and the test needs to be undertaken by trained persons. There are also key obligations imposed on those performing tests with respect to notifying positive results.

Detailed guidance is available for businesses considering purchasing tests for their employees – this should be carefully considered as it will not be sufficient to rely on initial training provided by a supplier of the test.

Next steps

  • Hear from the experts: we hosted a mandatory vaccination webinar on 16 September 2021 where we dove into the critical issues and addressed the key questions.
  • Monitor relevant public health orders: we expect to see a considerable uptake of initiatives to support vaccination uptake and ensure safe workplaces, as well as incentives being used by businesses to promote vaccination. State/Territory public health orders should continue to be monitored. The TGA Permission is in force until 31 December 2022.
  • Be mindful of ongoing legal obligations when collecting vaccination status information: Employers should ensure ongoing compliance with their business-as-usual legal obligations that relate to the collection of personal information about their employees. Acting with urgency in a pandemic does not release an organisation from these obligations.
  • Reach out to the team to help navigate this evolving space: Employers are confronting these issues in the midst of prolonged lockdowns and evolving public health rules. This is a complex area, requiring the simultaneous navigation of employment law, privacy law and other laws (such as the TGA regulatory framework). We're here to help.


Relevant regulators
State-specific health orders