New guidance: ICO publishes draft guidance on handling workers’ health information

Health information comprises ‘sensitive’ personal data, a special category that enjoys particular safeguards under data protection law. The draft guidance ‘Employment practices and data protection: information about workers’ health’ explains those safeguards and how to comply with them.

For example, it gives an explanation and useful, practical guidance on:

• the rule that an employer may only process health data it needs, so that employers should collect ‘as little health information about as few workers as possible’;
• which data security measures are appropriate for health data – for example, keeping data on a secure system separate from other data about the employee, with restricted access and accessible only for specified, legitimate purposes;
• when and how employers should carry out data protection impact assessments;
• different types of records, such as those for sickness, injury and absence - what they are and when each is required;
• which health information might be shared under an occupational health scheme, when that might happen, and why;
• when medical testing can be carried out at work, and how to carry it out in the least intrusive way.

The guidance also refers employers to other sources of useful information and online tools.

The ICO plans to launch the final new guidance relatively early in 2023.

Operative date

• Now

Recommendation

• Employers should check out the draft guidance, review the implications for their organisation and plan any changes needed.
• Particularly, they should consider whether there is still a need to retain data collected during and for the purposes of the pandemic.