UK: Health Warnings on Health Information

Part IV of the code, published last year, appears, on first reading, severely to restrict any employer’s ability to assemble health data. The Code goes as far as to say that "...it will be intrusive and may be highly intrusive to obtain information about your workers’ health".

Does this mean that employers should cease to monitor and consider the health of their workers? Of course not! There are still a number of legitimate reasons for collecting health data.

This Article considers a number of issues which frequently cause concern.

Unless consent is given, a medical examination amounts to an assault on the individual concerned. Clearly if the individual attends a medical examination, consent will be assumed to have been given and there is not likely to be a problem.

Problems are more likely to arise where an individual refuses to undertake a medical. Unless there is a contractual obligation that the medical examination be conducted, the individual is probably fully within his or her rights to refuse to be examined.

To overcome that, a provision can be built into the employment contract such that the individual agrees to undergo a medical examination. Even if this provision is included, however, the purpose for which a medical examination is permitted may be limited.

If there is a right to impose medical examinations, then that right is probably fettered by an implied term that the information would be collected reasonably. If it was not collected reasonably it might be in breach of the employer’s duty of trust and confidence.

As a matter of contract law, therefore, one can assemble health information with consent and in practice there is little restriction on its use.

Until the 1998 Data Protection Act, that probably would have been the end of the matter. Some health information might have been subject to the 1984 Data Protection Act but, since the earlier Act only applied only to information held on computer records, its scope was limited.

The 1998 Act extended regulation to health information contained on paper records. Under the new 1998 Act information relating to an employee’s health is far more likely to be caught, so much so, that the Information Commissioner published a specific code regarding information about workers’ health records.

In terms of working out how the Code works, it is easiest to think of it as creating an entirely separate set of requirements. The result is that some information may be gathered quite legitimately under contract law, viewed in isolation, but yet run foul of the Data Protection Code.

Although it appeared very restrictive initially, the application of the Data Protection Act was severely limited by the courts in the case of Durant (see our Update dated July 2004). The Information Commissioner himself acknowledges the limited application of the Data Protection Act when he writes, in the Code, that the Act "only comes into play when personal information is or will be held electronically or recorded in a structured filing system. This will often be the case, but sometimes it may not, for example, where a line-manager enquires about a worker’s health but does not keep or intend to keep any record of the conversation, or only keeps a note in a general notebook".

In fact, the Act is arguably more limited than that and information contained in a manual personnel file where items are filed in date, rather than subject, order is probably outside the scope of the Data Protection Act. In the absence of a separate section in the personnel file relating to health matters, one comes to the surprising result that health information held by employers is usually going to be outside the control of the Date Protection Act.

The Act applies to health data which it regards as being particularly sensitive and such information is subject to particularly strong regulation.

Holding or using such information is treated in the jargon of the Act as being "processing" and processing has to be fair. The Act and the Code together set out Parliament’s and the Information Commissioner’s views on what might be considered fair.

First of all, the employee has to consent to information about his or her health being held or used. Consent must be explicit which the Information Commissioner takes to mean that the worker must know the use to be made of the information. Further, the consent has to be freely given, that is to say, there must be no penalty imposed for refusing to consent.

This has led to some to argue that consent contained in the employment contract, which is the obvious place to put it, is not freely given because, if the employee refused to sign, he or she might not be awarded the job and would therefore be penalised.

Another area of difficulty is that the Information Commissioner appears to discourage using health information for anything more than checking the employee is fit to work. That would not allow an employer, for example, to carry out drug and alcohol testing where it wanted to ensure that the quality of output was maintained, whether or not health and safety was an issue. The Information Commissioner suggests that the collection of information through drug and alcohol testing is unlikely to be justified unless it is for health and safety reasons and that stance is supported by case law. However, medical information obtained in order to assess the validity of sickness absence appears to be permitted, although the emphasis should be on fitness to work rather than precise medical details.

If there is breach, the individual who suffers damage by reason of the breach is entitled to compensation which could include compensation for distress. We are not aware of any reported cases where compensation has been awarded under the head of "distress". Having said that, the possibility of just such an award was acknowledged in the case of Hayes and another v Whitbread plc decided in 1999.

If the information collected is not collected or used in accordance with the "fair processing" principles in the Act, then, perhaps surprisingly, the employer will not be guilty of an offence. What might happen in that instance, is that the Information Commissioner could, if aware of the contravention of the fair processing principle, serve an enforcement notice. One might describe this as a ‘light touch’ approach. Of course, subsequent failure to comply with an enforcement notice could give rise to penalties.

Conclusion On the assumption that there is little point in creating a high powered filing system for most small to medium sized companies, the Data Protection Act is unlikely to apply to health information. The fear surrounding the application of Data Protection Principles is unwarranted. Employers will find that the instances in which they are guilty of a breach of the Act or the Code will be very limited and, even where there is a breach, there is likely to be the opportunity to repair the situation without penalty.

© RadcliffesLeBrasseur

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.