12/10/2023

We previously wrote to members regarding an ICO consultation in relation to Employment Practices and Data Protection. That consultation closed on 26 January 2023 and, following the responses received,  the ICO has made the decision not to replace the Employment Practices Code but rather publish topic specific guidance on employment practices and data protection. The first of these Guides have now been published which are:

1. Guidance on Information about workers’ health
2. Guidance on Monitoring in the Workplace

 Further details about these Guides and links are set out below.

 Guidance on Information about workers’ health

One of the first of these Guides was published on 31 August 2023, namely the Guidance on Information about workers’ health  The purpose of the Guidance is to assist employers handle health information of workers in compliance with the GDPR Principles.

The Guidance is divided into 2 main parts:

1. Overview of how data protection law applies to the processing of workers’ health information which is special category data and so stricter requirements apply.

2. How these data protection principles apply to common types of employment practices that process workers’ health information.

In the Guidance, the ICO have adopted a must, should and could approach,  which it explains is to help employers  understand which parts  of the guidance are the must that are (1) mandatory, (2) recommendations and (3) good practice. This approach is adopted in all their Guides.

The Guidance provides a number of a number of practical scenarios pertaining to the management of employees’ health information whilst at work, such as:

• How do we handle sickness and injury records?
• What if we use occupational health schemes?
• What if we use medical examinations and drugs and alcohol testing?
• What if we use genetic testing?
• What if we carry out health monitoring?
• When can we share workers’ health information?

At the end there is also a set of checklists included to give employers an overview and quick guide to help run through their data protection considerations whenever they need to process workers’ health information.

• Checklist: Data protection and workers’ health information
• Checklist: Sickness and injury records
• Checklist: Occupational health schemes
• Checklist: Medical examinations and drugs and alcohol testing
• Checklist: Genetic testing
• Checklist: Health monitoring
• Checklist: Sharing workers’ health information 

Guidance on Monitoring in the Workplace

On 3 October 2023, ICO published its Guidance ICO Guidance on Monitoring In Workplace

The guide recognises that increase in remote working has increased checks on workers and again the purpose of guidance to help employers comply with law if wish to monitor workers.

Like the Health Data Guidance it follows the must, should, could approach

It states monitoring can include tracking calls; messages; keystrokes; taking screenshots; webcam footage and audio recordings; using specialist software to track activity.

If monitor workers, businesses then they must:

1. Making workers aware of nature, extent & reasons for monitoring.
2. Have clearly defined purpose & using it in least intrusive way .
3. Have a lawful basis for processing workers data.
4. Tell workers about monitoring in way that is easily understood.
5. Only keep info which is relevant to purpose.
6. Do a Data Protection Impact Assessment for any data that is high risk to workers’ rights.
7. Make data collected through monitoring available in Subject Access Request.

The Guidance gives overview of data protection law and considers specific monitoring practices e.g. use of biometric data to monitor timekeeping and attendance.

The contents includes (not limited to):

• What do we mean by monitoring workers?
• How long should we keep information obtained from monitoring workers?
• What must we tell workers about our monitoring?
  Can we use covert monitoring?
• Can workers object to being monitored?
• What do we need to consider if we use a third party provider or an application provided by a third party to carry out monitoring?
• What do we need to consider if we transfer personal information of workers OUTSIDE UK?

At the end there are Checklists that business can use to assess compliance with the Guidance.