How will GDPR affect consent in obtaining Occupational Health report about an employee?Posted in : Seamus Says - Employment Law Discussion on 6 April 2018
Q. How will the GDPR affect consent in obtaining an occupational health report about an employee?
Seamus: Well, we know that GDPR comes in around five, six weeks at this point.
Scott: 25th May.
Seamus: The 25th of May. So, we're not far off. In terms of the change that it makes, I don't think it will make a substantial amount of difference in terms of what we're doing at the occupational health level. A couple of aspects of occupational health, I suppose one is getting the employee to go. Second is getting the employee's consent in terms of the information that you're going to provide for occupational health. We all know that we can get those standard forms from occupational health where we tick the boxes and put a bit of information in. Sometimes we might send our own letter across to occupational health, but we are sending information and we are processing data in relation to the employee?
I think really, what we need to look at is this issue of consent. This is a big issue that has come in for GDPR. There's so much focus on consent. We tend to forget about the other ways that we can legitimately process data as well. To go through the first is, is there contractual necessity to process the data?
If we're thinking here in terms of occupational health and arranging appointments and sending information across, whether it's GP and medical records or whether it's just boxes ticked on the form, your contractual obligations with your employee and your employee's contractual obligations with you to be able, in fact, to attend the workplace. I think there's an argument there in terms of it being a contractual necessity.
Being due to the vital interest of your employee is another issue. If you're looking at things like reasonable adjustments for occupational health, getting that information from occupational health is vital to the employee maintaining their ability to work.
Scott: Effectively, don't rely on consent, but even if the doctor says, the OH person turns around and says, "I'm not going to send you that report unless this person consents to it," if they block consent, you're going to have to make your decision on the basis that you don't have the evidence available, you point that out to them and say, "You're not giving us the advice. We're going to have to make it based on the information that we have and it's not going to be in your interest."
So, the bottom line is that consent isn't the only thing in GDPR. We spoke about that with the covert recordings. People might not have consented to it, but tribunals will still listen to it.
Seamus: Yeah, exactly.
Scott: So, consent isn't the be all end all.
Note: Legal-Island is running a Contracts for the Modern Employment Relationship conference at the Merchant Hotel, Belfat on 17th May 2018.
More on Data Protection & Freedom of Information
- What factors do employers need to consider in relation to testing employees for Covid-19?
- Quiz: Are you Cyber-Aware Amongst COVID-19?
- 5 COVID-19 scams your organisation should be aware of (and how to prevent them)
- ICO Guidance On Covid-19 Workplace Testing
- Must employers still comply with the 30 day response timeframe for subject access requests during the COVID-19 pandemic?
The information in this article is provided as part of Legal-Island's Employment Law Hub. We regret we are not able to respond to requests for specific legal or HR queries and recommend that professional advice is obtained before relying on information supplied anywhere within this article.