New ICO Guidance on information sharing in workplace mental health emergencies

Although the guidance specifically refers to mental health emergencies,  employers should remember that data protection law doesn’t distinguish between mental health information and health information generally. This guidance applies to volunteers, gig and platform workers in addition to employees.

The key point is that employers “will not get in trouble for sharing necessary and proportionate information with relevant and appropriate emergency services or health professionals” where this is done to mitigate the risk of serious harm to the worker or to others.

Employers are encouraged to develop an emergency mental health information sharing policy, and conduct a data protection impact assessment (DPIA).

Key Obligations:

• Employers must identify an applicable lawful basis and a special category condition for sharing employee health information
• Workers must be informed that their health information may be shared in an emergency (including a mental health emergency) and be aware of any relevant policies.

Applicable Lawful Bases:

• Vital interests – this generally only applies in matters of life and death. You cannot use this basis if the worker is capable of giving consent.
• Legal obligation – this applies where you’re required by statute or common law (but not under a contract) to conduct necessary and proportionate information sharing.
• Legitimate interest – this may apply, unless the reason for protecting the worker’s personal information outweighs the employer’s interests in sharing it.

The first two lawful bases also provide corresponding special category conditions.

Further reading:

Guidance 

---

Authors

Aaron Moss

Call 2013

J Ockenden

Other articles in this edition

Overriding an express refusal of consent

---

Endemol Shine: no loophole for oral processing

---