The Information Commissioner's Office (ICO) has released fresh guidance aimed at assisting employers in understanding their responsibilities when managing the health-related information of their workforce.

The guidance examines the legitimate grounds open to employers employers who collect and utilise health related data and outlines the rules that govern its use and handling. In addition, the new ICO Guidance helpfully covers several complex health data related scenarios, including drug and alcohol testing, genetic testing, and continuous health monitoring.

Basic Requirements

The guidance acknowledges that employers may have good reason for processing health information related to their workforce and individual workers and employees. It reiterates the "special category data" status of health information and emphasises the importance for employers of limiting its collection, treating it as confidential, and disposing of it promptly when it is no longer needed or required. Employers are also urged to exercise caution when processing health information - due to the potentially intrusive nature of processing health related information together with the legitimate privacy expectations of employees.

the new ico guidance differentiates between:

• Sickness Records: Containing details about the medical condition.

• Injury Records: Providing information on injuries.

• Absence Records: Solely recording the absence fact and its duration.

The ICO encourages employers to use absence records whenever possible and maintain sickness and injury records separately.

Occupational Health Referrals:

The guidance confirms that employees should receive clear information about the purpose of the occupational health referral and how the received information will be shared and used by the employer. It also suggests that in sensitive situations, employees should be permitted to request that the occupational health report be shared only with HR and their immediate supervisor.

The guidance also states that when requesting access to medical records, employers should target their inquiries to the specific condition at hand and avoid blanket requests for all records.

Drugs and Alcohol Testing:

The guidance recognises that there might be instances where employers can request a worker to undergo medical examinations or drugs and alcohol tests. However, this should follow a thorough assessment of the test's intended purpose, together with its potential consequences, and whether there might be less invasive alternatives. Importantly, the guidance states that drug and alcohol testing should primarily focus on ensuring workplace health and safety, rather than unveiling details of an individual's private life.

Genetic Testing:

Genetic testing is mentioned in the context of informing employers about the future general health of workers or their susceptibility to occupational diseases. The guidance acknowledges the ongoing development of genetic testing and notes that it presently has an uncertain predictive value. In light of this uncertainty, the ICO asserts that genetic testing of workers will seldom, if ever, be justified.

Health Monitoring:

The guidance also addresses the ongoing monitoring of workers' health, noting the rise of health-tracking technologies like apps and wearables, partly accelerated by the COVID-19 pandemic. It distinguishes between cases where monitoring serves health and safety purposes, in which employers should conduct a Data Protection Impact Assessment (DPIA) to balance benefits against privacy impact, and monitoring within employers' well-being initiatives, which must be entirely voluntary, relying on employee consent (which can of course subsequently be withdrawn at any time).

Please contact Nathan Combes if you’d like more information about the issues raised in this update and/or or to find out more about data protection related policies, documents, advice and training that we provide.

Disclaimer: the information set out above does not constitute legal advice and it is provided for general information purposes only. No warranty, whether express or implied is given and neither the author or Harrington Law shall be liable for any technical, editorial, typographical or other errors or omissions within the information provided.