Employers could be unlawfully holding staff vaccination records