The first part of the guidance on processing workers' health data explains the key rules relating to:
- Complying with the stricter statutory requirements for processing special category data
- Providing employees with information about the processing of their data
- Performing a data protection impact assessment before processing any health data
- Data minimisation and security
The second part focuses on how data protection law applies to specific workplace scenarios, including sickness absence records and occupational health schemes, conducting drugs and alcohol testing, and how to approach sharing employee health data. The ICO sets out recommended good practices that it expects employers to adopt in order to comply with legal requirements. The guidance also contains a set of checklists.
Practical Point
The ICO's guidance on email and security has been published to help organisations understand the law and good practices around protecting personal information when sending bulk emails.
In addition, the ICO has published the first phase of draft guidance on biometric data. This explains how data protection law applies when biometric data is used in biometric recognition systems. The consultation on the first phase of this guidance closes on 20 October 2023, with the second phase opening for a call of evidence in 2024.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.