Employee Health Data

Employee Health Data

Overview

Employee health data is among the most sensitive categories of personal data processed in the employment context. It falls under Art. 9(1) GDPR as "data concerning health," defined in Art. 4(15) as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status." Employers routinely process health data for absence management, fitness-for-work assessments, occupational health surveillance, workplace adjustments for disability, and return-to-work programmes. Each of these processing activities requires identification of a valid Art. 9(2) exception, strict data minimisation, and clear boundaries between what the employer needs to know (fitness/unfitness and any required adjustments) and clinical details (diagnosis, treatment, prognosis) that must remain with the occupational health provider.

Legal Framework

Art. 9(2) Exceptions for Employee Health Data

Art. 9(2)(b) — Employment Obligations

This is the most commonly relied upon exception. It requires:

1. National law authorisation: The processing must be authorised by EU or Member State law (not merely the employment contract)
2. Appropriate safeguards: The national law must provide appropriate safeguards for the fundamental rights and interests of the data subject
3. Necessity: The processing must be necessary for carrying out obligations — not merely useful

National implementations:

Art. 9(2)(h) — Health Professional Exception

Processing is permitted when carried out by or under the responsibility of a health professional subject to professional secrecy. This applies to:

• Occupational health physicians conducting fitness-for-work assessments
• Company nurses providing on-site health services
• Employee Assistance Programme (EAP) counsellors

Critical limitation: The health professional may share with the employer only the conclusion (fit/unfit/fit with adjustments) and not the underlying clinical details. The diagnosis remains confidential between the health professional and the employee.

Processing Scenarios

Scenario 1: Sickness Absence Management

What the employer needs: Dates of absence, whether the absence is certified, expected return date, any workplace adjustments required.

What the employer must not receive: Diagnosis, treatment details, prognosis, medication, mental health specifics.

Data flow:

1. Employee notifies employer of absence per sickness absence policy
2. Employee provides a fit note (UK: Statement of Fitness for Work) or equivalent medical certificate from their GP or treating physician
3. The fit note states: (a) date range, (b) whether the employee is "not fit for work" or "may be fit for work with adjustments," and (c) any recommended adjustments
4. The employer records: absence dates, fit note dates, adjustment requirements
5. The employer does not require or record the diagnosis (the diagnosis field on UK fit notes is visible but the employer should not record it in HR systems unless the employee voluntarily shares it for adjustment purposes)

Atlas Manufacturing Group Example: Atlas's sickness absence policy states that employees self-certify for absences up to 7 days and provide a fit note for absences exceeding 7 days. The HR system records absence dates and the fit/unfit conclusion only. The diagnosis field from fit notes is not entered into the HR system. If an employee's absence exceeds 4 weeks, a referral to occupational health is offered — the occupational health report to the employer addresses fitness, adjustments, and anticipated return date, but not clinical diagnosis.

Scenario 2: Fitness-for-Work Assessment

Trigger: Safety-critical roles (drivers, machine operators, work at height), return from long-term absence, concerns about an employee's capacity to perform their role safely.

Data flow:

1. Employer refers employee to occupational health provider with a specific, written referral question (e.g., "Is the employee fit to operate forklift equipment? Are any workplace adjustments required?")
2. The referral must not contain health information the employer does not already legitimately hold
3. The occupational health provider examines the employee (with the employee's cooperation)
4. The provider issues a report to the employer addressing the referral question only: fit/unfit/fit with adjustments
5. If adjustments are recommended, they are described functionally (e.g., "reduced lifting to a maximum of 10kg for 6 weeks") without clinical explanation
6. The employee receives a copy of the report and may request amendments before it is sent to the employer (Access to Medical Reports Act 1988, UK)

Art. 9(2)(h) application: The occupational health provider is a health professional bound by professional secrecy (GMC, NMC, or equivalent registration). The processing is carried out under their responsibility. They share with the employer only what is necessary for the employment decision.

Scenario 3: Occupational Health Surveillance

Scope: Statutory health surveillance required for employees exposed to occupational hazards (noise, vibration, hazardous substances, ionising radiation, asbestos, lead).

Legal basis: Art. 9(2)(b) — legal obligation under national health and safety law implementing Framework Directive 89/391/EEC.

Key obligations:

• Health surveillance must be conducted by a competent occupational health professional
• The employer receives a fitness certificate indicating whether the employee is fit for the specific exposure
• Individual health records are maintained by the occupational health provider, not the employer
• The employer receives aggregate statistical data (number of employees fit/unfit) for risk assessment purposes
• Individual results may only be shared with the employer if the employee consents or if national law specifically authorises it

Scenario 4: Disability and Reasonable Adjustments

Legal basis: Art. 9(2)(b) read with national disability discrimination law (UK: Equality Act 2010; EU: Framework Employment Directive 2000/78/EC).

Data minimisation principle: The employer needs to know:

• That the employee has a condition meeting the legal definition of disability (or may have such a condition)
• What functional limitations arise from the condition in the work context
• What adjustments would enable the employee to perform the role

The employer does not need: The specific diagnosis, medication, treatment history, or prognosis — unless the employee voluntarily shares this information to support the adjustment process.