Do occupational health reports have a special retention period under GDPR?

Would there be a retention period difference between occupational health reports and anything else in the personnel file proposed to hold for six years after the employee leaves that would form an argument from keeping health records separate from the rest of the personnel files?

Scott: So, this is about retention periods, but specifically, it's health. It's special category data. Is there a justification for separating it out and perhaps keeping it longer?

Seamus: Justification is the keyword there, Scott. Obviously, GDPR has been with us now for just over a week, since 25th May [2018]. Everybody, I'm sure, it seems to me, has been getting an abundance of emails about GDPR and providing consent for this and for that. It's very much on all of our minds here.

This specific question was in relation to retention under GDPR, retention specifically on the personnel file. The query here is around how long we retain those records for. Certainly, the idea of retaining those for six years seems to be what the standard is in terms of retention of a personnel file after someone leaves. I'm assuming from this question that it is about someone that isn't leaving their employment.

Sometimes whenever I've been looking at it, it's six years plus the last year of their employment, a total of seven years. But six years seems to be the standard there. What we're looking at here is the aspect of the occupational health reports. I think my own view in terms of that is the occupational health records are synonymous with the personnel file, I think essentially where there haven't been any issues that have arisen with the employee in terms of their health.

That is perfectly fine to discard and delete those records after the period of six years. There are circumstances where I can foresee that you may need to maintain the occupational health records for longer. I'm talking here about there being a justification for it in that possibly that there has been specific issues have arisen with this employee that may lead to some sort of litigation down the line or some sort of inquiries that are going to be made further down the line post the six years.

Scott: Or it may be that you're in a particularly dangerous occupation where health issues arise and you're saying, "We're going to hang on to all of those so we can show not just occupational health," but what they've been doing, their job descriptions to say you've never worked in that area of the factory. So, it's unlikely you're going to pick up this dust illness. But it's all about justification on each case.

Seamus: Absolutely. I think it is a case by case scenario where you're grouping employees together within that department. The interesting aspect, I suppose, would be the likes of those hidden illnesses that we hear about that can be industrial deafness or asbestos or maybe there has been a chain of claims arising. It would be difficult, really, to know about that within the first few months of the employee leaving.

The other thing that I thought about was maybe the aspect of psychological claims that would be made later down the line, and specifically if you've had a very difficult or severe bullying harassment case, where the employee has had psychological issues arising from that, maybe nervous breakdowns and times like they may be into psychiatric care and things like that. There's always the risk that the normal statutory time limits will not apply in circumstances like that. Maybe the person is ill and unfit to bring the claim forward.

The usual period is three years for physical injuries and things like that. But where there's an extension of where you think there's going to be a problem, a good idea from an insurance purpose is just to retain the records. Again, it's about having the justification. I think key to that is where you are retaining them that you have a policy and procedure that commits you to do that and also you're putting a note on the file that you're retaining with the reason why you're retaining it for longer.

Scott: Of course, it's not the whole file that necessarily you keep. There could be documents on the file that you should be sifting through, getting rid of them. They fulfilled their usefulness throughout the time, because you're only supposed to maintain the personal data for as long as is necessary and some if it's not necessary, quite frankly, and you don't need it six years.

Seamus: Great opportunity with GDPR is to review all of our policies and procedures to look at the information that we don't need to have and either to no longer require it on our forms or our applications and also to discard that information if we really don't need it because, again, information that you have is making you liable for that information that you're retaining.

Is there any risk if you are to have all records for the same retention schedule?

Scott: For example, six years after leaving or duration of employment rather than keeping the likes of absence and recruitment records for say three years?

Retention schedules have different timeframes for different records and it's going to prove difficult come destroying the information. The bottom line is that data is data. Everyone is separate. You really ought to have different retention periods because you don't need them.

Seamus: Yeah, absolutely. Certainly, any of the retention policies that I have assisted clients with absolutely we have a schedule at the back of the policy where we detail the types of records that are retained and we set out the reasons as to why they're retained and there are different. Within one personnel file, that could be an inch thick, there can be 50 different types of documentation contained within that. You're not going to keep it all.

Certainly, things like pension details that people come back at a later date and require, those are things that are important to retain and where there's a clear justifiable reason for doing it. Definitely, within each personnel file, there will be certain documents you retain for longer periods than others.