FAQs about COVID-19 vaccination information
This FAQ answers some of the most common questions OVIC is asked about privacy and COVID-19 vaccination information. This FAQ is current at 29 October 2021.
Can my employer collect my vaccination information?
Your employer can collect information about your vaccination status if this is required by law. Vaccination status relates to whether you are fully vaccinated, partially vaccinated, unvaccinated or you have medical grounds for being unable to be vaccinated.
In Victoria, most employers must collect, record, and hold vaccination information about any employee who is, or may be, scheduled to work outside their home. This is a legal requirement under Directions from the Chief Health Officer.
What documents can my employer collect as proof of vaccination status?
You may provide proof of vaccination status through a variety of documents such as a COVID-19 Vaccination Certificate or an immunisation history statement from the Australian Immunisation Register.
Your employer must make a record that it sighted proof of your vaccination status but does not need to keep a copy of any documents you provided as evidence. See ‘What information should be recorded by employers?’ at coronavirus.vic.gov.au for more information.
What are my employer’s obligations when handling vaccination information?
Employers must only use or disclose vaccination information for the purpose of confirming your vaccination status unless a specific exception under privacy law allows the use or disclosure for a different purpose.
Employers must also take reasonable steps to protect the vaccination information it holds from being lost, misused or subject to unauthorised access, modification or disclosure.
Can venues I attend collect my vaccination information?
Venues that you wish to attend as a patron (cafes, bars, cinema, theatres etc) must sight evidence of your vaccination status. This is a legal requirement under Directions from the Chief Health Officer.
These venues do not need to take a copy of any evidence you provide.
Who can I contact for more information?
There are three main privacy laws that apply in Victoria, each with a different regulator. The appropriate regulator to contact depends on the nature of the organisation and the nature of the information you are enquiring about:
- For enquiries about how medium and large private sector organisations handle personal or health information contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or via its enquiry form. OAIC also has a fact sheet about coronavirus vaccinations and employee rights.
- For enquiries about how Victorian Public Sector organisations or private sector organisations handle health information, contact the Health Complaints Commissioner (HCC) on 1300 582 113 or via its enquiry form.
- For enquiries about how Victorian Public Sector organisations handle personal (non-health) information, contact the Office of the Victorian Information Commissioner (OVIC) on 1300 006 842 or via email@example.com.
- For information about Victoria’s coronavirus response and regulations, visit vic.gov.au.