Health Data in the Workplace

Opinion on notifications for prior checking received from the Data Protection Officers of certain EU agencies concerning the "processing of health data in the workplace".

Opinion of 18 January 2010 on notification of prior checking received from the Sickness Insurance Management Committee in respect of the "Complaints by members" case (Case 2009-070)

Opinion reflected in a letter of 7 December 2009 on the notification for prior checking of the EudraVigilance Data Quality Management system (Case 2009-740)

Opinion of 11 November 2009 on the notification of a prior check in relation to the file ‘persons with reduced mobility – emergency plan’ (Case 2009-0014)

Opinion of 29 September 2009 on the notification for prior checking on the "Management of the Children's Centre (CPE) - day nursery and study centre: Loustic information system and medical files" (Luxembourg) (Case 2009-089)

The Commission's Office for Infrastructure and Logistics (OIL) is in charge of managing the CPE's day nursery and study centre in Luxembourg. In this context it has set up the manual and automatic processing of administrative data collected with a view to enrolment. It has also sub-contracted the Commission's medical service the management of the medical files of children for whom an application for enrolment has been made. As part of the prior check the EDPS has made the following recommendations: the EDPS recommends that (i) the medical data be transmitted only to persons subject to an obligation of secrecy equivalent to professional secrecy, (ii) access to the automated application by childcare staff and security staff be restricted to information they need to know, (iii) the data storage periods be reviewed according to the specific need for the data and files, (iv) data subjects' rights to obtain a copy of the administrative data concerning them without constraint, without delay and free of charge, and the right to have them rectified on simple request be guaranteed, (vi) parents be allowed to rectify data relating to their child's health upon presentation of medical evidence, and (vii) declarations of confidentiality informing the parents of the data processing be modified and communicated by all possible means in order to ensure that the parents are informed.