ICO guidance
Data protection is a thorny issue for employers to navigate on a daily basis, let alone where the data is “special category data” such as medical information.
To help assist employers in navigating this issue, the Information Commissioner’s Office (ICO) has recently issued guidance on when it is appropriate to share employees’ personal data during a mental health emergency. The guidance applies beyond just the employment relationship to include workers, contractors, volunteers, gig and platform workers.
The ICO recognises that there are times when employers must communicate necessary and proportionate details to emergency services and healthcare professionals to help prevent harm occurring, including in a mental health emergency. The guidance defines “mental health emergency” as “a situation in which you believe that someone is at risk of serious harm to themselves, or others, because of their mental health”.
In such mental health emergencies, the guidance states that employers:
- should share necessary and proportionate information to relevant and appropriate emergency services and healthcare professionals;
- should consider whether their ability to share such information is subject to other legal constraints such as the duty of trust and confidence between the employer and employee;
- could share such information with the employee’s next of kin or emergency contact if appropriate.
The guidance emphasises that employers will not face penalties for sharing necessary and proportionate information if it is done with a view to preventing harm from occurring – the priority is the safeguarding of the individual’s health and safety, as well as that of anyone else who might be affected.
Data protection considerations
Employers should always cast their minds to what information is (i) necessary and/or (ii) proportionate, and who are the appropriate recipients of the information. This should always be assessed on a case-by-case basis. For example, if the employer has concerns of domestic abuse, they should consider whether contacting the employee’s partner would be appropriate. It is therefore crucial for employers to exercise discretion and judgement in deciding what information to share and with whom, tailoring their approach to the particulars of each individual situation.
As the health information is special category data, a lawful basis for sharing the information must be identified and one of the specific conditions must be met prior to processing that personal information. In situations relevant here, lawful bases/specific conditions for processing the data are likely to be:
- Vital interests: This should only be relied upon in life or death situations. This is also a specific condition.
- Consent: This may not be given, or even possible to obtain, in the circumstances.
- Legitimate interest: This can be appropriate where the data is used in ways the employee might expect, which have minimal impact, or where there is a compelling justification. In a genuine mental health emergency, there is likely to be a compelling justification.
- Legal obligation: You can use this justification when the law mandates that you share information under certain conditions. This legal requirement could be rooted in statutory law or common law, but does not extend to obligations set by contract. When sharing information to fulfil this legal duty, it must be essential for compliance, and the manner in which you share the information should be reasonable and proportionate. For example, an employer, upon learning that an employee is facing a mental health crisis during a shift, fulfils its duty of care under the Health and Safety at Work etc Act 1974 by alerting emergency services. The provider shares necessary details about the worker to ensure a safe and appropriate response for the employee in distress.
- Employment, social security and social protection law: This is a specific condition. Employers have a duty under the Health and Safety at Work etc Act 1974 to ensure the health and safety of all their workers as far as reasonably possible. Sharing information with emergency services may be proportionate in fulfilling this obligation.
What should employers do?
The guidance urges employers to prepare proactively for situations in which they may be faced with deciding whether or not to share personal data in a mental health emergency. Having considered the possibilities in advance will assist employers in handling such situations which are often time-pressured. Employers should consider the following measures:
- Having a policy that outlines the procedures for sharing personal data during a mental health emergency. This may be included in a data protection policy or privacy notice. Employers must let their employees know that they may share their information in a health emergency. Employers should include details or examples of what types of data might be necessary to share, with whom, and the methods it will adopt to ensure secure sharing. Employers should ensure employees are informed about and have access to the policy. Any such policy should also set out the lawful basis and special category conditions for processing the data.
- Carrying out a data protection impact assessment which should include the sharing of information in mental health emergencies.
- Providing training to staff on managing personal data in such situations. This may be most appropriate for managers, first aiders and mental health champions. If specific individuals are designated to handle these emergencies, ensure that staff know who the responders are and how to reach them. This training could be part of wider mental health awareness and education initiatives.
- Regularly prompting employees to update their next of kin and emergency contact information, including specific contacts for mental health emergencies.
- HR departments can assist managers in recognising and addressing mental distress among employees by coordinating mental health awareness training, creating templates for personalised support action plans, and fostering an environment of open dialogue to remove the stigma from mental health conversations.
Please do not hesitate to get in touch with a member of the team if you wish to discuss the contents of this blog post further.