Part 4 of the Employment Practices Data Protection Code was published late last year. It sets out best practice for employers, enabling them to comply with the provisions of the Data Protection Act 1998 (DPA) regarding acquiring, dealing with and releasing information about workers' health.
The code explains that it is concerned with "personal information", defined as information about a living person, which affects the privacy of his personal or family life and business or professional capacity. It is capable of identifying a person, whether or not it is stored with other information in the organisation's possession.
In 1991, it was confirmed that there is a basic common law duty on the employer to preserve confidential information given by employees. In Dalgleish v Lothian Borders Police Board , it was held that employees' names and addresses were confidential. The professions have long required confidentiality about patient/client information to be the ethical foundation of the working relationship. The law is clear that this ethical duty extends to occupational health practitioners.
The application of Part 4
The DPA sets out conditions governing the way an employer is permitted to collect, store and process sensitive personal data, including information on health and disability. Once a job candidate or an employee has consented to provide personal data, the code applies. The employment spectrum includes current and former successful and unsuccessful job applicants, current and former employees, as well as agency, casual and contract workers.
Records kept by the OH team are considered in law as sensitive data, as they contain health information covering a wide range of general matters that crop up in routine appointments, including telephone consultations, results of drug and alcohol tests, and any health information required to be kept by legislation or in anticipation of litigation.
Any personal information provided by a worker to an OH professional in the course of a consultation could be construed as personal data, whether through a counselling session, the completion of a health questionnaire at interview stage or during the course of a work assignment. Clearly, where fitness to work is assessed in relation to taking up or returning to employment, or in considering reasonable adjustments where the Disability Discrimination Act 1995 applies, personal data will be processed.