The Information Commissioner’s Office (ICO) is developing new guidance around how employee health data should be collected and used in light of the pandemic.
In particular, the guidance will highlight that “health data is considered special category data and has stricter requirements in order to process it”, the ICO said.
In its report responding to its initial call for views on employment practices and data protection, the ICO said it recognised the way employers collect and use health data had changed as had the nature, type and sharing of health data because of the pandemic.
The ICO confirmed it plans for upcoming guidance to address these developments and reflect changes in data protection law since then.
The regulator added that its new guidance will help employers process and share health data in a compliant way and it will provide practical examples as to how employers can achieve this.
Employees want privacy from employers
Commenting on the report, Peter Wright, managing director at Digital Law, told Health & Protection the processing of health data needs to comply with UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 legislation.
He added that third parties can collect mental health data on clients’ employees and an awful lot of employees do not want their employer knowing about their mental health status.
But Wright said some employers are now carrying out stringent health checks on employees and asking full disclosure of medical records and on occasion there is a question mark about what happens to those medical records.
“We’ve been involved in instances of employees being really concerned that in order to get an offer of employment they have to make full disclosure and provide all these medical records and then they’ve not been able to get a clear answer on what happens to them afterwards,” he said.
“Are they retained by a third party? Are they retained by the employers? What are they doing with them? Who were they sharing them with? And that’s a real point of concern for employees.
“Hopefully there’s going to be a lot more clarity from this guidance which the ICO will be producing for employers in terms of how far can you go when it comes to requesting this information from employees and then what you use it for and how it’s handled,” Wright added.
The ICO said it is considering comments received following its call for views which will feed into the development of the guidance. It added it plans to produce a web-based hub of employment guidance with content added over time.
Developing the guidance will be an iterative process with many opportunities for stakeholder involvement and feedback with the call for views being the first part of that process, the ICO said.