Health Data in the Workplace

Opinion of 20 May 2009 on the notification for prior checking regarding the management of safety at work at the Joint Research Centre's Institute for Health and Consumer Protection in Ispra (Case 2008-541)

The Notification and the EDPS Opinion concern a dedicated filing system: "Management of Safety at Work" used by the Institute. Personal data with an implication for safety at work are collected and stored in this filing system and consulted when needed. The purpose of the processing is to comply with the employer's obligations on safety at work under Italian laws. The processing operation covers all employees of the Institute.

With regard to data quality and proportionality, the EDPS recommended that the Institute should reconsider whether the safety officer indeed needs direct access to general training data in SYSLOG Formation, as well as training data on languages and e-learning, in addition to training information directly relevant to safety at work. On rights of access, the EDPS recommended that the Institution should establish a minimum set of safeguards to ensure that access requests will be addressed in a timely manner and without restraints. With regard to information to data subjects, the EDPS recommended that notice with respect to certain items under Articles 11 and 12 of the Regulation should be provided in a more specific manner.

Opinion of 27 April 2009 on a notification for prior checking on the management of the medical data of children attending the inter-institutional crèches and kindergartens managed by the OIB (Case 2009-088)
On 27 April 2009, the EDPS adopted an opinion on the prior checking of the management of the medical data of children attending the inter-institutional crèches and kindergartens managed by the OIB. Given the particularly sensitive nature of the data being processed, the EDPS recommends that a specific legal basis should be put in place for the processing of data relating to health in the context of the crèches and kindergartens, and that at the very least the unambiguous consent of data subjects should be obtained to the medical monitoring of the children and the processing the data relating to their health by the medical service in the crèches and kindergartens. The EDPS also recommends that only data which is strictly necessary for the purposes of the processing operation should be collected, and therefore invites the medical service to re-evaluate whether the data collected on the medical form and during attendance at the crèches and kindergartens is proportionate. Regarding the storage of the medical files, the EDPS recommends that a storage period which is in proportionate to achieving the purposes of the processing operation should be adopted.

Opinion of 16 January 2009 on the notification for prior checking regarding the "Invalidity Committee procedure" (Case 2008-626)

The Council of the European Union has established a procedure defining the arrangements for referrals to and the functioning of an invalidity committee responsible for evaluating the invalidity of an official, temporary member of staff or contract member of staff, the opinion of which will be used as a basis for a decision on whether the person concerned should be granted invalidity or resume work.

The EDPS recommends, inter alia, that the administrative departments dealing with social medicine be reminded that they are subject to professional secrecy, and that health-related data be disclosed only to persons authorised to receive such data and who are subject to professional secrecy. The EDPS also recommends that the information note be revised to include information on data recipients and on whether replies to questions are obligatory or voluntary and the possible consequences if the individual refuses to produce medical certificates.

Opinion of 15 January 2009 on the notification of prior checking concerning the "management of the crèche of the General Secretariat of the Council and billing" case (Case 2007-441).

The processing operation concerns, firstly, the procedure for enrolment and admission, as the case may be, of children to the GSC crèche through the examination of administrative and financial data provided by the persons having legal responsibility for the child. It is also designed to monitor the child's presence at the facilities, particularly with a view to monitoring attendance, controlling access of persons dropping off children and reimbursing crèche expenses.
It follows that the processing operation in this case is intended to evaluate the personal and family circumstances of parents and their children in the light of the eligibility criteria for admission. The processing operation also concerns data relating to health.
In its recommendations, the EDPS stressed, inter alia, that the GSC should:

• remove the requirement to submit a medical form from Article II of the crèche rules and clarify Article VIII so that it is understood that there will be no medical examination until after the child has obtained a place at the crèche;
• refer in the crèche rules to the existence of a waiting list;
• ensure that the administrative arrangement with the OIB specifies that the processor can act only on instructions from the controller, and that it sets out the security measures applicable to the data to which the OIB has access.

Opinion of 4 December 2008 on a notification for prior checking regarding the "Coordination of medical, psychosocial and administrative support (COMPAS)" (Case 2008-428)

The European Commission designed a system called "Coordination of medical, psychosocial and administrative support" (COMPAS) to coordinate in a multi-disciplinary fashion the provision of help to staff in active employment. COMPAS will be a counselling facility designed to help individuals who are encountering serious health problem or serious social difficulties due to private or professional reason which interferes with their presence or performance at work. The system is based on the ad- hoc cooperation of several services within the European Commission. In principle COMPAS can only be seized for cases meeting certain criteria where all other single-service solutions and procedures have been properly tackled and exploited beforehand without success. The categories of concerned data subjects are officials and agents who are covered by the Staff Regulations and who encounter serious health problems or serious social difficulties. COMPAS will affect broad categories of personal data which will be used by the services in the interdisciplinary approach: administrative, medical and/or social data.

The EDPS analysis of the processing operations lead to a number of recommendations ensuring that the planned system will be in full compliance with Regulation 45/2001, inter alia: The COMPAS procedure should be run only with the express consent of the staff member concerned. Appropriate measures should be put in place to ensure that all working documents, not needed to be annexed to a COMPAS file, are destroyed by the persons involved from the concerned services once a case is closed. The right of access of the person concerned to his/her file also should include the right to take copies of the data related to him/her. The content of the privacy statement should be revised as to the legal basis and the categories of data recipients. COMPAS should make clear distinction related to the professional secrecy obligation of medical doctors/psychologist and any other professional involved in the COMPAS procedure. Measures should be put in place to ensure those principles.