How can you ask for your employees? medical records under GDPR?

it’s essential to have a medical report for an employee if you’re considering dismissing for capability reasons or looking at whether an employee has any medical issues which may constitute a disability, and as a result require reasonable adjustments at work.

Medical reports can be obtained from a doctor, or from Occupational Health, but clearly, it’s a very sensitive piece of information, so how can an employer lawfully access these reports?

GDPR provides more protections for data, and in particular, sensitive data. Obtaining a report amounts to processing personal data under the GDPR, and according to the regulations, there must be lawful grounds for processing the information.

What constitutes lawful grounds under GDPR?

Article 6(1) of the GDPR identifies six lawful grounds for processing personal data:

• Consent
• Contract
• Legal obligation
• Vital interests
• Public interest task
• Legitimate interests

Consent may be the lawful ground to depend upon when asking an employee to allow access to a medical report. Consent requires a positive opt-in, which means that the employee cannot be sent a pre-ticked form presuming consent.

Obviously, you can’t force an employee to see a doctor, so regardless of the GDPR, obtaining consent is key.

Generally, a doctor would provide a report to the patient and this is only released to employers with explicit consent. It is key to note that patients are in control of all and any information that is released to an employer, and they have the right to review and ask for changes before it is submitted to an employer.

So, consent is key both to see a doctor, and then for the doctor to release the report. Even then it gets more complicated for ‘special categories, as the employer has to have a valid reason for processing the data, and also has to satisfy an additional condition under Article 9.

__________________________________________________________________________________

 

The questions you should be asking in an employee’s return to work interview

Absence has a significant effect on the bottom line of a business, but companies also want healthy and happy employees, who are fully engaged at work.

__________________________________________________________________________________

What is Article 9?

The GDPR accepts that not all data is the same, and so gives extra protection to ‘special categories? which are generally those categories which could be used to discriminate unlawfully against an employee.

As a result, the employer needs to give a specific reason for processing the data. In GDPR terms, one given reason may be that processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment.

In more simple terms, it can be justified by stating that it meets the employer’s legal obligations not to unfairly dismiss, not to discriminate against a disabled employee, to identify reasonable adjustments where applicable and to ensure they are fit to return to work.

Using a pre-employment questionnaire to determine whether or not to employ someone would contravene the Equality Act 2010 as well as GDPR as it is discriminatory and there is, therefore, no valid reason to process the data.