ICO publishes guidance for employers on processing workers’ health data

On 31 August 2023 the Information Commissioner’s Office (ICO) published detailed guidance on processing workers’ health data to help employers comply with their obligations under the UK GDPR and the Data Protection Act 2018. Health data is categorised as special category personal data and is granted enhanced protection.

The first part of the guidance explains how the UK GDPR and Data Protection Act 2018 applies to the employer and steers them through the essentials of:

• Complying with the stricter statutory requirements for processing special category data.
• Providing employees with information about the employer’s processing of their data.
• Performing a data protection impact assessment before processing any health data.
• Data minimisation and security.

The second part focuses on how data protection law applies to specific workplace scenarios such as managing sick absence records and occupational health schemes, conducting drugs and alcohol testing, and how to approach sharing employee health data. The ICO confirms the legal requirements the employer must comply with for each aspect of employment practice covered and sets out recommended good practice that it expects should be adopted by the employer to comply with legal requirements.

There is also a set of checklists included to give employers an overview and quick guide to help run through their data protection considerations whenever they need to process workers’ health information.