The Information Commissioner’s Office (ICO) is engaged in a process of publishing topic-specific guidance on employment practices and data protection. As part of this process, the ICO has launched a consultation on its draft guidance on processing information about workers’ health.

In summary, the draft guidance:

• recognises that health information (ie personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about their health status) is some of the most sensitive personal information an employer might process about its workers
• confirms that data protection law will apply whenever an employer processes information about its workers’ health and that, as it is a type of special category data, the employer must comply with certain extra rules designed to respect the worker’s data
• provides a non-exhaustive list of examples of the circumstances in which an employer might need to process information about a worker’s health, including:
  • a questionnaire completed by workers to detect problems with their health
  • sickness absence forms
  • information about impairment or disability
  • the results of an eye-test taken by a worker using display screens
  • records of blood tests carried out to ensure a worker has not been exposed to hazardous substances
  • the results of an alcohol or drugs test
  • the results of a fitness to work assessment to determine entitlement to benefits or suitability for continued employment
  • records of vaccination and immunisation status and history
• recognises that gathering information about a workers’ health will be intrusive (and in some cases, depending on the sensitivity of the information, may be highly intrusive)
• confirms that an employer wishing to collect and use information on its workers’ health should be clear about their reasons why, satisfied that there are justified reasons for collecting it (eg to make reasonable adjustments for disability) and that the data collected is proportionate to the rationale
• reminds employers that they can only use health information for a new purpose if it is compatible with the original purpose, specific consent is obtained, or the employer is doing so to meet a clear legal obligation
• the draft guidance goes on to give specific practical advice about:
  • handling sickness and injury records
  • occupational health schemes
  • medical examinations and testing
  • genetic testing
  • health monitoring
  • sharing worker health information

The consultation on the draft guidance closes on 26 January 2023.