How will GDPR affect consent in obtaining Occupational Health report about an employee?

Q. How will the GDPR affect consent in obtaining an occupational health report about an employee?

Seamus: Well, we know that GDPR comes in around five, six weeks at this point.

Scott: 25th May.

Seamus: The 25th of May. So, we're not far off. In terms of the change that it makes, I don't think it will make a substantial amount of difference in terms of what we're doing at the occupational health level. A couple of aspects of occupational health, I suppose one is getting the employee to go. Second is getting the employee's consent in terms of the information that you're going to provide for occupational health. We all know that we can get those standard forms from occupational health where we tick the boxes and put a bit of information in. Sometimes we might send our own letter across to occupational health, but we are sending information and we are processing data in relation to the employee?

I think really, what we need to look at is this issue of consent. This is a big issue that has come in for GDPR. There's so much focus on consent. We tend to forget about the other ways that we can legitimately process data as well. To go through the first is, is there contractual necessity to process the data?

If we're thinking here in terms of occupational health and arranging appointments and sending information across, whether it's GP and medical records or whether it's just boxes ticked on the form, your contractual obligations with your employee and your employee's contractual obligations with you to be able, in fact, to attend the workplace. I think there's an argument there in terms of it being a contractual necessity.

Being due to the vital interest of your employee is another issue. If you're looking at things like reasonable adjustments for occupational health, getting that information from occupational health is vital to the employee maintaining their ability to work.

Scott: Effectively, don't rely on consent, but even if the doctor says, the OH person turns around and says, "I'm not going to send you that report unless this person consents to it," if they block consent, you're going to have to make your decision on the basis that you don't have the evidence available, you point that out to them and say, "You're not giving us the advice. We're going to have to make it based on the information that we have and it's not going to be in your interest."

So, the bottom line is that consent isn't the only thing in GDPR. We spoke about that with the covert recordings. People might not have consented to it, but tribunals will still listen to it.

Seamus: Yeah, exactly.

Scott: So, consent isn't the be all end all.

-------------------------------------

Note: Legal-Island is running a Contracts for the Modern Employment Relationship conference at the Merchant Hotel, Belfat on 17th May 2018.