There are various reasons why an employer will wish to obtain a medical report on an employee in the context of the employment relationship. For example, recording sickness absence, determining if the employee is entitled to permanent health insurance and for health and safety purposes.

Under the GDPR, health information is deemed “special category” personal data, i.e. data that is more sensitive and so requires additional protection. Therefore, prior to processing health information relating to an employee or a prospective employee an employer will need to ensure it has a lawful basis for doing so as per Article 6(1) and also that it has a specific condition for processing in line with Article 9(2).

Prior to the GDPR employers often relied on explicit consent as their lawful condition for processing employee health data. However, under the GDPR employers are being advised not to rely on consent given the imbalance of power in the employer-employee relationship, unless an employer can demonstrate that consent was “freely given”.

While this may suggest that employers will have difficulty in being able to obtain employee medical data, the GDPR provides a range of conditions under Article 9(1) that employers can rely upon. The most prominent is likely to be Article 9(2)(b) where processing is necessary for the purposes of carrying out obligations and exercising specific rights…in the field of [employment].

Employers should bear in mind that under Part 1 of Schedule 1 to the DPA 2018, they should have an appropriate policy in place covering data processing in the context of the employment relationship. This is not something to be concerned about as this information should be covered off in the privacy notice(s).