Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

Personnel Today

Register
Log in
Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

General Data Protection RegulationData protectionLatest News

How will the GDPR affect the processing of employee health information?

by Ruth Christy and Nicola Rochon 4 May 2018
by Ruth Christy and Nicola Rochon 4 May 2018

With the GDPR due to come into effect later this month, HR departments need to be careful when processing data relating to an employee’s health – even if they have the employee’s consent to do so. Ruth Christy and Nicola Rochon explain what employers should do.

Many employers include terms in their contracts or sickness absence policies requiring employees to consent to a medical examination. This is usually to enable an employer to gather information on fitness for work for long term absence, or possibly as part of a contractual sick pay scheme.

However, under the General Data Protection Regulation (GDPR) coming into force on 25 May 2018, and a new Data Protection Bill replacing the Data Protection Act 1998 (DPA), employers will need to make an important distinction between consent to a medical examination and their lawful basis for processing personal data in medical reports.

GDPR compliance

How to develop and implement a General Data Protection Regulation (GDPR) compliance programme

Podcast: How XpertHR can help you be GDPR ready

Obtaining a medical report amounts to processing personal data for the purposes of GDPR and information about an employee’s health is one of a number of “special categories of data” (sensitive personal data under the DPA).

According to both the current DPA and GDPR there must be lawful grounds for processing such information. To date, most employers have relied on employees’ consent to obtain the report and process the data, with the requirement for consent included in contract terms or policies.

Giving consent

However, the GDPR and official guidance clearly state that if there is an imbalance of power between the parties (giving the example of employer and employee) then consent will not be valid. Therefore from what we know so far, once GDPR comes into effect it will be almost impossible for an employer to rely on consent to process employees’ personal data, even if it is given specifically in relation to a particular medical issue.

In light of this, employers seeking to obtain medical reports need to identify another legal basis for processing the data and for processing “special categories” of data.

Legal bases could include being necessary for the performance of a contract, to comply with legal obligations, or for the employer’s legitimate interests. For special categories of data, employers are likely to rely on processing being, as the GDPR puts it, “necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of employment law”.

These bases often overlap. For example, it may be necessary to process a medical report to fulfil contractual obligations such as sick pay or to identify eligibility for permanent health insurance. In addition, the employer’s obligations in connection with employment law include not discriminating against a disabled employee, identifying reasonable adjustments, not unfairly dismissing and assessing fitness to return to work.

Once GDPR comes into effect it will be almost impossible for an employer to rely on consent to process employees’ personal data, even if it is given specifically in relation to a particular medical issue.”

The conundrum is that on a practical level, employers need consent from the employee to undergo a medical examination and to consent to the release of the report. However, this must be clearly separated from consent to process the data under GDPR, because consent for that can no longer be relied on.

Employers will need to review and update employment contracts, sickness policies and associated letters – to obtain consent for the examination/release of the report, but not for processing the data.

Sign up to our weekly round-up of HR news and guidance

Receive the Personnel Today Direct e-newsletter every Wednesday

OptOut
This field is for validation purposes and should be left unchanged.

They should ensure the collection of medical information is necessary, and be aware that asking the employee to obtain and give the employer their medical records (i.e. via a subject access request), as opposed to commissioning a medical examination/report, may amount to a criminal offence under the Data Protection Bill.

Under the Bill, employers will also need an “appropriate policy document” explaining how they handle special categories of data.

Ruth Christy and Nicola Rochon

Ruth Christy is a professional support lawyer and Nicola Rochon is a trainee solicitor in the employment law team at Blake Morgan LLP.

previous post
Morrisons case: employers’ responsibilities in preventing malicious data leaks
next post
Seven ways music can enhance employee wellbeing

1 comment

Graham Herbert 12 Oct 2018 - 6:50 am

How do you view a company that keeps asking for paperwork to be filled out that already exist within a company, i.e. excessive requests to give the same information?

Comments are closed.

You may also like

‘Polygamous working’ is a minefield for HR

14 May 2025

M&S pauses hiring as it deals with cyber...

2 May 2025

Remote working may have triggered jump in employee...

17 Apr 2025

GMC ‘erases’ records on doctors who change gender

21 Feb 2025

What’s HR’s role in ethical AI adoption?

6 Feb 2025

Top 10 HR questions January 2025: TUPE employee...

4 Feb 2025

LinkedIn accused of using user data to train...

23 Jan 2025

Deliveroo, Just Eat and Uber face calls for...

20 Jan 2025

EU AI Act: What HR needs to know

8 Jan 2025

AI Act comes into force in EU: how...

2 Aug 2024

  • 2025 Employee Communications Report PROMOTED | HR and leadership...Read more
  • The Majority of Employees Have Their Eyes on Their Next Move PROMOTED | A staggering 65%...Read more
  • Prioritising performance management: Strategies for success (webinar) WEBINAR | In today’s fast-paced...Read more
  • Self-Leadership: The Key to Successful Organisations PROMOTED | Eletive is helping businesses...Read more
  • Retaining Female Talent: Four Ways to Reduce Workplace Drop Out PROMOTED | International Women’s Day...Read more

Personnel Today Jobs
 

Search Jobs

PERSONNEL TODAY

About us
Contact us
Browse all HR topics
Email newsletters
Content feeds
Cookies policy
Privacy policy
Terms and conditions

JOBS

Personnel Today Jobs
Post a job
Why advertise with us?

EVENTS & PRODUCTS

The Personnel Today Awards
The RAD Awards
Employee Benefits
Forum for Expatriate Management
OHW+
Whatmedia

ADVERTISING & PR

Advertising opportunities
Features list 2025

  • Facebook
  • Twitter
  • Instagram
  • Linkedin


© 2011 - 2025 DVV Media International Ltd

Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+