The respondent is a limited company which provides domiciliary care services in the community. The claimant had been employed as a Care Assistant and later as a Team Leader until he resigned. He commenced a period of sick leave due to depression.  A number of ‘welfare meetings’ were held to ascertain the claimant’s state of health. Later, an email was sent by one of the Directors to another employee containing information about the claimant being a patient at a particular hospital. The claimant alleged that this breached confidentiality and disclosed his personal data in breach of data protection legislation. The respondent initially accepted this, and disciplinary action was taken. The Director involved subsequently undertook training in relation to data protection and GDPR and fully accepted that it was inappropriate to send the email. However, the tribunal held that the sending of the email did not amount to a disclosure of confidential information as the employee was fully aware that the claimant was a hospital patient. Therefore, there was no repudiatory breach of the contract of employment. The claim for constructive dismissal was dismissed.

Practical lessons

Breaching data protection rights of staff can potentially breach various duties owed to them. Many issues around data protection will involve how employees are monitored when using emails and making phone-calls etc. Such matters should be clearly laid out in a contract or indeed the organisation’s GDPR data protection policy. This case involved an incident that was not covered by either- but sending emails to employees including personal data could well be viewed much more seriously by a tribunal and could amount to a repudiatory breach of contract. For employers, taking the matter seriously and listening to concerns is important, but clear communication of GDPR policies to staff should always be a priority.