>Chris is a partner in the Employment Law Group of the Arthur Cox Belfast Office in Northern Ireland.
Chris has extensive experience dealing with both contentious and non-contentious employment law matters. Chris advises a range of employers on all aspects of employment law including executive appointments, severance, grievances, disciplinary issues and trade union matters. Chris has represented clients before the Industrial Tribunal, Fair Employment Tribunal and the Court of Appeal in Northern Ireland in employment litigation such as unfair dismissal, equality/discrimination and whistleblowing. Chris’ practice area includes advisory work and corporate transactions.
How should we obtain an employee’s medical data post-GDPR?
There are various reasons why an employer will wish to obtain a medical report on an employee in the context of the employment relationship. For example, recording sickness absence, determining if the employee is entitled to permanent health insurance and for health and safety purposes.
Under the GDPR, health information is deemed “special category” personal data, i.e. data that is more sensitive and so requires additional protection. Therefore, prior to processing health information relating to an employee or a prospective employee an employer will need to ensure it has a lawful basis for doing so as per Article 6(1) and also that it has a specific condition for processing in line with Article 9(2).
Prior to the GDPR employers often relied on explicit consent as their lawful condition for processing employee health data. However, under the GDPR employers are being advised not to rely on consent given the imbalance of power in the employer-employee relationship, unless an employer can demonstrate that consent was “freely given”.
While this may suggest that employers will have difficulty in being able to obtain employee medical data, the GDPR provides a range of conditions under Article 9(1) that employers can rely upon. The most prominent is likely to be Article 9(2)(b) where processing is necessary for the purposes of carrying out obligations and exercising specific rights…in the field of [employment].
Employers should bear in mind that under Part 1 of Schedule 1 to the DPA 2018, they should have an appropriate policy in place covering data processing in the context of the employment relationship. This is not something to be concerned about as this information should be covered off in the privacy notice(s).
Continue reading
We help hundreds of people like you understand how the latest changes in employment law impact your business.
Please log in to view the full article.
What you'll get:
- Help understand the ramifications of each important case from NI, GB and Europe
- Ensure your organisation's policies and procedures are fully compliant with NI law
- 24/7 access to all the content in the Legal Island Vault for research case law and HR issues
- Receive free preliminary advice on workplace issues from the employment team
Already a subscriber? Log in now or start a free trial