Most employers will be well aware of their obligations to keep data relating to their employees confidential. There are, however, difficult situations that could arise for employers in terms of managing the welfare and safety of their employees and others in contact with the employer’s business against the obligation to keep data confidential. One such example is when an employee appears to be having a mental health emergency, which could in turn put the employee’s life and/or the lives of others at risk. The Information Commissioner’s Office (ICO) has recognised the difficulty that a mental health emergency could cause an employer and accordingly has published guidance on how to approach such a situation.
ICO guidance – Information sharing of employee data in mental health emergencies
There is a particular emphasis in the guidance on planning ahead. It suggests that it is good practice to carry out a data protection impact assessment (DPIA) and as part of that process to analyse what should happen in a mental health emergency.
As part of the DPIA process, the ICO recommends that an employer should:
- “Develop a policy on sharing personal information in a mental health emergency…
- Ensure that your workers are aware of the policy and make it available to them.
- Train staff on how to handle personal information in a mental health emergency situation…
- Ensure that workers keep the details of their next of kin and emergency/mental health emergency contacts that you have on file up to date through regular review…”
As health information is defined in the UK GDPR as special category data, in order to lawfully process the data (‘processing’ would include disclosing mental health data to the emergency services), an employer must have a lawful basis and a special category condition for the processing to be lawful. Click here for further information on available lawful bases for processing data. More information on special category conditions can be found here. The ICO suggests that the lawful bases for processing data in a mental health emergency could be:
- Vital Interests (although the ICO does make it clear that this would only really apply where there is a matter of life or death);
- Legitimate Interest; or
- Legal Obligation.
The ICO further suggests that the likely special category conditions that could apply, could be:
- Vital Interests; or
- Employment, Social Security and social protection law.
Chris Hogan, who is the ICO Head of Regulatory Strategy, said:
“We want to reassure employers that during a mental health emergency they should share necessary and proportionate information without delay with relevant and appropriate emergency services or health professionals. It is a good idea to plan ahead, as this will help you to make well informed decisions if you need to. Our guidance will help you do that and includes useful case studies to illustrate how the law can work in practice.”
Comment
The writer totalling agrees with the ICO’s comments about planning ahead. If the necessary thought is put into the process at an early stage, appropriate policies setting out when and what data will be shared in certain circumstances can be created and each employee can be asked for express consent to use of their data in such circumstances. This would avoid the need for a complicated analysis of what information is proportionate and necessary and/or what is the lawful basis for processing of an employee’s data in a time of emergency.
How can Nelsons help?
Kevin Modiri is a Partner in our expert Dispute Resolution team, specialising in civil disputes, insolvency, inheritance disputes, data breach claims and defamation claims.
If you have any questions concerning the subjects discussed in this article, please do not hesitate to contact Kevin or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.