Data Protection issues with ‘Nature of Illness’ on Doctors Certs
The 24th annual report of the Office of the Data Protection Commissioner highlights an interesting concern which the Office has about the need for Doctors certs to contain ‘Reason for Illness’ information about the employee who is absent from work due to illness.
The comment in the report arises from a complaint the Office received relating to a circular from the Department of Education regarding sick leave for teachers. The circular states that the reason for being out sick / the nature of the illness must be stated on the Doctors cert for it to be valid and accepted.
Under the Data Protection Acts, medical data falls into the category of “sensitive personal data.” The annual report concludes that the employer has a right to know how long the employee is likely to be out and, on return to work, he/she is capable of doing his/her work. It states that requiring employees to produce standard medical certificates to cover absences due to illness does not therefore present any data protection issues. However, it further states that the employer ‘would not normally have a legitimate interest in knowing the precise nature of the illness’ and it would therefore be at risk of breaching the Data Protection Acts if it sought such information. It says that even the consent of the employee may not allow the disclosure of such information to an employer as there may be a doubt as to whether such consent could be considered to be freely given in an employment context.
Many employers would agree with the Department of Health who stated that the purpose of the information was to ensure the health and safety of students and teachers in schools for which the Department has responsibility and a duty of care.
The Office states it raised the matter with the Department of Education. The Department indicated that the purpose of the information was to ensure that there was sufficient information available to the employer to make an informed decision as to whether or not to make a referral to the Occupational Health Service and/or to take appropriate steps, where necessary, in relation to health and safety matters. It said that in the context of a school, where the employer has a duty of care to its students and staff and where a teacher often has sole and unsupervised access to, and responsibility for, children this was particularly important. It stated that in the Department’s view, there was a strong legitimate public interest in ensuring that there was sufficient information to enable the employer to deal with any health and safety issues that may arise.
Since the Commissioners intervention, the Department are no longer advising teachers that the nature of the illness is required to be stated in cases where a medical certificate is required. The Department also undertook to reflect this change when revising the current sick leave circular for teachers in order to ensure compliance with the Data Protection Acts. In addition, the Department indicated that relevant staff had been notified of the Commissioners findings on this matter.
The Commissioner did concede that in very specific circumstances a doctor may be legally required to report certain illnesses to an employer for health and safety reasons. It cites the case of contagious diseases as an example. It states:
“However, any general practice of requiring all employees to specifically disclose their condition or illness to account for their sick absences from work does give rise to serious concerns from a data protection perspective as it does not adequately protect the sensitive personal data of those employees who may have an illness/condition which they consider private or sensitive.”
The view of the Commissioner poses further questions for employers who have significant obligations under health and safety and under the disability ground of the Employment Equality Act to provide a safe place to work for the employee and to provide reasonable accomodation to an employee with a ‘disability’ e.g. certain medical conditions.
If the employer is not made aware of the nature of the illness, how can the employer be expected to act responsibly? For example, if the employer is not made aware of say, depression, as the reason for the absence, what can the employer be reasonably expected to do?
The annual report, however, is clear as it states:
“This case study highlights that employers should be aware that, in general, only limited relevant information should be sought from an employee submitting a medical certificate to account for a period of sick absence. Seeking excessive sensitive personal data in that context is a clear breach of the Data Protection Acts.”
Source: 24th Annual Report of the Data Protection Commissioner, 2012 – Case Study 11
More from CollierBroderick
Keep Me Updated
Want to stay updated and get insights on the latest developments?
“The Personal Profile was a great way for our management team to really understand their individual strengths and weaknesses (as well as t…
“Thank you for the training day. I have been on employment law training days before…and I have to say they did not compare to your course, i…
“The Employment Law Hotline is brilliant – I don’t know why every company doesn’t have it or rather how they manage without it!Exper…
“Just wanted to say well done and thanks for a very informative seminar yesterday, we very much enjoyed it.I think it is a great idea to r…
“The support from CollierBroderick has always been to the highest standards.Whenever we have a HR requirement, they are there to help and …
“CollierBroderick have been working with us on a number of HR fronts and we are very pleased with the quality of their work, the knowledge…
“Thank you for the great service to date.”
“I would like to say that we are very pleased with both the quality of the finished handbook and the timelines and costings also the HR Cons…
“I just want to convey appreciation and thanks for your courtesy and professional assistance in the matter of our climate survey, and brin…
“Donal and myself really enjoyed the course.We have implemented a few hints given already on our everyday business and I have to say that …