Employees’ health data is the category of information that is most strictly protected under the General Data Protection Regulation. This is not because it is more important than other personal data, but because its misuse has direct consequences for people’s working lives, dignity and equal treatment. A company that mishandles its staff’s health data is not only in breach of the GDPR: it makes decisions about people based on information it should not have, with the legal and human risks that this entails.
Why employees’ health data is the most sensitive category under the GDPR
Article 9 of the GDPR classifies health data as a special category, the processing of which is prohibited except in specific, limited cases. In the workplace, there are two main exceptions that permit such processing: compliance with obligations relating to social security and social protection (compulsory medical examinations, management of temporary incapacity for work) and preventive or occupational medicine. Apart from these exceptions, any processing of an employee’s health data is unlawful, even if the employee has provided it voluntarily. The risk of non-compliance is particularly high because many companies are unclear about what health data they are permitted to process, who is authorised to access it, and how it should be stored.
Who can access employees’ medical data, and under what circumstances?
The principle of functional separation It is the key to the proper management of health data within the organisation. Not all roles involved in the employment relationship can access the same information, and blurring these boundaries is the most common and most costly mistake.
Sick leave and the GDPR: what information can an employer ask an employee for?
When an employee takes sick leave, the company is entitled to receive the official Social Security certificate of termination of employment, which includes the start date, the estimated duration and the type of leave (general or professional), but never the diagnosis or the medical cause. HR can and must manage the administrative details of sick leave, plan for cover and handle the necessary procedures with Social Security. What it cannot do is find out or keep a record of the diagnosis, pressure the employee to disclose it, or make employment decisions based on the nature of the illness. Sick leave confirmation forms that include the diagnostic code (ICD-10) must be sent directly to the occupational health service or the company doctor, never to HR.
Occupational health examinations: consent, voluntary participation and confidentiality
The Article 22 of the LPRL stipulates that the monitoring of workers’ health is, as a general rule, voluntary. It is only compulsory where the law expressly provides for it (jobs involving specific risks), where the medical examination is essential to assess the effects of working conditions on health, or where the worker’s state of health may pose a risk to themselves or to third parties. The results of the medical examination are confidential: The company doctor may only inform the company of the employee’s fitness for the post (fit, fit with restrictions, unfit); under no circumstances may they disclose the diagnosis or clinical results. The employee’s consent to the medical examination must be obtained on an informed and documented basis, specifying the purpose for which the data will be processed.
Technical and organisational security measures to protect health data within the organisation
The security measures required for the processing of health data are stricter than those for other personal data. The minimum dimensions These include: encryption of files containing health data, role-based access control (access is granted only to those with a justified functional need), activity logging (who accesses the data, when and for what purpose), and a data protection impact assessment (DPIA) when processing is carried out on a large scale. If the company uses an HR management system that includes health data, the supplier must sign a data processor agreement and guarantee the same security measures. The AEPD may request all this documentation in the context of an inspection or in response to a complaint from an employee.
Training for staff who handle health data: who needs to know what
Training in healthcare data protection is not just for the DPO or the legal department. Anyone who accesses health data in the course of their duties requires specific training: HR on what it can and cannot manage, occupational health doctors and health and safety officers on their obligations regarding confidentiality and functional separation, and guidance on the limits of access to health information and the legal risks associated with decisions based on employees’ state of health. From the Health and Wellbeing catalogue y Copyright Educa.Pro You will find specific training on the protection of health and safety data in the workplace, for which FUNDAE funding is available for all relevant roles.
Employees’ health data is not just another file: it is information that can determine a person’s future in the workplace if it is mishandled. Proper protection is not just a legal obligation: it is a sign that the company treats its staff as people.
