You might not be aware that health information is deemed to be ‘special category data’ under the General Data Protection Regulations (GDPR). This means is needs greater protection than other personal data because it is sensitive.
What is ‘Health Data’
The GDPR sets out that ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”. This includes about an individual’s past, current or future health status and anything about the state of someone’s health not limited to medical conditions, tests or treatment.
This is particularly pertinent for employers, who usually hold sickness absence records, and may have more detailed information following the outbreak of Covid-19, including copies of letters to employee’s family or household members setting out the need to shield.
What do I need to do?
- In order to process health data, you must identify both a lawful basis under Article 6 (as for other less sensitive types of data) and under Article 9 (usually explicit consent or for the purpose of employment) and document these before you begin to process the data.
- Note that while there are ten conditions for processing special category data, five of these require you to meet additional conditions.
- In many cases you also need an ‘appropriate policy document’ in place.
- You also need to complete a data protection impact assessment (DPIA) for any type of processing which is likely to be high risk, to be sure you are aware of and manage any risks of processing.
Where can I go for more information?
While this sounds highly technical, there is a huge amount if information and support available through the Information Commissioner’s Office, and ultimately this is all about making sure that your processing is lawful, fair and transparent.
So act now to be sure you are acting in line with the legislation. If not, make a plan to the steps you need to take, who is responsible for taking them and when they need to be completed.
For further advice, get in touch with us at Redway HR.