Say goodbye – Victorian employers must destroy COVID-19 vaccination information

By 11 August 2023, Victorian employers must destroy all COVID-19 vaccination information collected, recorded, held and used under the Occupational Health and Safety Amendment (COVID-19 Vaccination Information) Regulations 2022 (Regulations), unless the employer is permitted or required under other laws to collect, use, record, or hold the information.

The Regulations allowed employers to continue to collect, record, hold and use COVID-19 vaccination information from ‘specified persons’ in accordance with their occupational health and safety duties. Employers could request COVID-19 vaccination information from ‘specified persons’ who attended the worksite, including employees, volunteers and students, independent contractors and their employees.

On 12 July 2023, the Regulations were revoked, leaving employers with 30 days to destroy the COVID-19 vaccination information.

What information must be destroyed?

COVID-19 vaccination information is information about whether a specified person has:

1. 1. received any dose of a vaccination against COVID-19, and if so, the date on which the person received the dose or if the person has received more than one dose, every date on which the person received those doses; or
   2. not been able to receive a dose, or further dose, of a vaccination against COVID-19 due to a medical contraindication or an acute medical illness.

This could include:

1. 1. information from a record kept in the AI register under the Australian Immunisation Register Act 2015 of the Commonwealth;
   2. a letter from a registered medical practitioner; or
   3. a certificate issued by Services Australia that states that the person is unable to receive a dose, or further dose, of a vaccination against COVID-19 due to a medical contraindication or an acute medical illness.

What to consider when destroying the information

When destroying the COVID-19 vaccination information, employers should consider:

1. 1. informing affected specified persons about what information will be destroyed;
   2. implementing a process that will irrevocably destroy the information in a secure and confidential manner – this may involve discussions with IT specialists;
   3. ways in which the COVID-19 vaccination information may have been recorded, for example vaccination registers;
   4. conducting a review to confirm whether all vaccination information has been destroyed in accordance with the Regulations; and
   5. any amendments to policies, procedures and contracts.

If an employer has a need to continue to collect, hold and use COVID-19 vaccination information, this will need to be considered and undertaken in accordance with the Privacy Act 1988 (Cth) and Health Records Act 2001 (Vic).

If you have any queries about your obligations as to what information must destroyed and how to lawfully destroy the information, please reach out to our team.

If you found this insight article useful and you would like to subscribe to Gadens’ updates, click here.

Authored by:

Deivina Peethamparam, Partner
Erin Lynch, Partner
Grace Gunn, Senior Associate
Jessica Smith, Lawyer
Teresa Zhang, Lawyer