Health Data, Which Is Different
Special category data needs a condition on top of a lawful basis, and employment is one of the few places this arises constantly.
HEALTH DATA HANDLING
Per type, because the conditions differ
- TypeSickness absence reasons, occupational health reports, adjustmentsEach with its own answer
- Lawful basisUsually legal obligation or legitimate interestsThe ordinary basis, still required
- ConditionEmployment, social security and social protection lawA second gate. Without it you may not process
- Policy documentRequired in several regimes for this conditionThe document nobody has
- Who sees itNamed roles, minimallyLine managers generally should not see diagnoses
- What the manager getsFitness for work and adjustments, not diagnosisThe single most useful separation
- RetainedShorter than general employment recordsAnd deleted on schedule
- Occupational healthA controller in its own right, usuallyTheir report to you is a separate processing
Health information about employees arrives constantly: absence reasons, fit notes, occupational health reports, adjustment requests, accident records.
The practical lesson in “Health Data, Which Is Different” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching ethical employee monitoring, ethical employee monitoring can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
It is special category data, and processing it requires two things rather than one.
For a separate benchmark relevant to “Health Data, Which Is Different”, consult the AuditBoard internal-investigation guide. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
The two gates
A lawful basis, as for any processing.
And a separate condition permitting special category processing. In employment the usual one concerns obligations and rights in the field of employment and social security law.
Both are required. An employer with a basis and no condition is processing health data unlawfully regardless of how reasonable the processing is.
The policy document nobody has
Several regimes require a written policy document where the employment condition is relied on: what you process, why, how it complies, and retention.
It is short, it is specific, and in most organisations it does not exist — which is the second commonest documentary gap after the legitimate interests assessment.
The separation that matters most
A line manager needs to know whether somebody is fit for work and what adjustments are required.
They do not need the diagnosis, the treatment or the prognosis.
Most organisations pass occupational health reports to managers in full because that is how the report arrived. Asking the provider for a fitness-and-adjustments summary, with the clinical detail held separately, costs nothing and resolves most of the exposure in this area.
Absence reasons
Recording that somebody was absent is ordinary. Recording why, in medical terms, is special category processing and needs the condition.
Which means the absence system should hold a category rather than a diagnosis, and the detail — where it exists at all — should sit with whoever genuinely needs it.
Occupational health as a controller
The provider usually determines its own purposes in assessing the person and is a controller, not a processor.
Which means the employee has rights against them directly, their report to the employer is a disclosure between controllers, and the employer cannot simply demand the underlying notes.
Employers routinely treat occupational health as a supplier, which produces both a contractual error and a request handled by the wrong party.
The policy document for the condition
Several regimes require one where the employment condition is relied on: what you process, why, how it complies, retention. Short, specific, and the second commonest documentary gap after the legitimate interests assessment.
Absence reasons against diagnoses
Recording that somebody was absent is ordinary. Recording why in medical terms is special category processing. The absence system should hold a category, with detail only where somebody genuinely needs it.
Fitness and adjustments, not diagnosis
Asking the occupational health provider for that summary, with clinical detail held separately, costs nothing and resolves most of the exposure in this area.
Two gates, not one
A lawful basis and a separate condition. An employer with the first and not the second is processing health data unlawfully however reasonable the processing is.
What the manager actually needs
Fitness for work and required adjustments. Not the diagnosis, the treatment or the prognosis — and the provider will supply that summary if asked, at no cost.