This guide covers your rights and your employers responsibilities regarding data protection at work.
The General Data Protection Regulations came into force on the 25 May 2018, detailed information is available from the Information Commissioner's Office. This includes frequently asked questions for the health and social care sector.Back to contents
The term 'personal data' includes photos of any individuals. If you have any concerns about your employer using or displaying your photo, please discuss this with your manager in the first instance. This includes displaying your photo in your workplace, online or in any promotional material.
It is likely that the use of the photo would be ‘fair and lawful’ if your objection is simply that you do not want it displayed.
The use of your photo may be a breach of data protection legislation if you raise a reasonable objection. For example, in a clinical environment staff may raise personal safety and security concerns because they have access to drugs in the course of their employment.
If your employer takes your photo, you should be told why it is being taken. It should not be used for any other reason without your permission.
If you are unable to resolve any concerns informally, please call us for further advice.Back to contents
Employers may be able to monitor workers, as long as this is done in a way which is consistent with data protection legislation. Employers must also consider Article 8 of the European Convention on Human Rights which creates a right for each individual to respect for private and family life, including their correspondence.
An example of data which may be collected in certain circumstances is biometric data, including fingerprints.
Your employer may also be able to monitor your use of the Internet while you are at work and your workplace emails. They should have a local policy which defines 'acceptable use' and outlines how this will be monitored.
Please also refer to the Acas guidance on being monitored at work.Back to contents
Covert recordings should only be undertaken when there is no alternative. For example, to investigate or prosecute a serious crime or protect someone from serious harm. It is not appropriate to record conversation unless the parties involved have given their consent.
The Information Commissioner’s Office (ICO) has guidance on covert monitoring. Please see section 3.4 of the Employment Practices Code. Please note that the ICO are in the process of updating their guidance following the introduction of the Data Protection Act 2018. We believe that the advice on covert recording is still relevant at this time.
If you feel your privacy has been breached in this way, please contact us. You may have a number of options available including a complaint to the Information Commissioner.Back to contents
If a patient or family member is audio or film recording then the reasons for this should be discussed. Unless there is good reason for doing so (e.g. the patient is unable to recall oral advice or there is a problem with interpreting written material) this action should be stopped.
Health-related information is confidential and can only be shared if consent is given. So, if other patients are being recorded without their consent, it is a clear breach of confidentiality.
The Nursing and Midwifery Council (NMC) Code places a professional duty on registrants to take action to ensure that anyone in their care is protected from risk. Failure to take such action could amount to professional misconduct.
If this happens to you:
The Care Quality Commission (CQC) has produced guidance for families, carers and people who use health and care services on using hidden cameras to monitor care. They also have an article titled Thinking about using a hidden camera or other equipment to monitor someone's care?Back to contents
The ICO suggests that employers should communicate the details of their drug and alcohol policy to staff.
Regular drug testing is usually only justified where there is a reasonable suspicion of drug use that has an impact on safety. Any test must provide real evidence of impairment/potential impairment at work that will put the safety of others at risk. Drugs taken outside of work would not normally concern your employer unless there is any sign of impairment at work. In this situation, your employer may be able to take action.
When undertaking testing, your employer must be clear about what they are looking for and why the test is being conducted. They should take particular care where drug testing is justified on health and safety grounds.
Covert medical testing should only be used in exceptional circumstances with police involvement. A reliable interpretation of the test results requires a high level of technical expertise.
Please also check your local policy and should there be any concerns please contact us for support.Back to contents
Data protection legislation defines a health record as "information relating to someone's physical or mental health that has been made by (or on behalf of) a health professional". It must have been prepared "in connection with the care of that individual". Health records which fall within this definition are protected - this includes manual and computerised records.Back to contents
Under data protection legislation, health records are "sensitive data". This is any information concerning the physical or mental health or condition of a job applicant or employee. For example, pre-employment questionnaires, drug and alcohol test results, information about disabilities and any information that has been revealed through an occupational health examination.
Before information about your health is shared your employer must ensure:
Your employer must ask for your consent before accessing your health records or requesting a medical report. Under the Access to Medical Reports Act 1988 you have the right to decline consent however it is important that your employer explains the implications of this.Back to contents
Everyone has the right to view their health records. You should:
You may be denied access if it likely to cause serious harm to you or another person’s physical or mental health.Back to contents
Please see our clinical pages for more information about appropriate disclosure in occupational health nursing.Back to contents
The ICO 'Employment Practices Data Protection Code' states that you have the right to access copies of the information that an organisation holds about you.
The Code covers:
Please note that the ICO are in the process of updating their guidance following the introduction of the Data Protection Act 2018. We believe that the above advice is still relevant at this time.Back to contents
As an applicant you will normally be entitled to access your interview notes. These will be kept for a reasonable time whether you are successful or not. The collection and storage of this information is covered by current data protection legislation.Back to contents
If your own employee data has been compromised or you are the victim of a data breach, please contact your employer’s Data Protection Officer immediately. Once the breach has been reported they will talk you through the process and advise you of the next steps. You may also wish to obtain a copy of your employers Data Protection policy which will outline the rights and responsibilities of both yourself and your employer.Back to contents
Page last updated - 09/11/2018