employee-health-data
Employee Health Data
Overview
Employee health data is among the most sensitive categories of personal data processed in the employment context. It falls under Art. 9(1) GDPR as "data concerning health," defined in Art. 4(15) as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status." Employers routinely process health data for absence management, fitness-for-work assessments, occupational health surveillance, workplace adjustments for disability, and return-to-work programmes. Each of these processing activities requires identification of a valid Art. 9(2) exception, strict data minimisation, and clear boundaries between what the employer needs to know (fitness/unfitness and any required adjustments) and clinical details (diagnosis, treatment, prognosis) that must remain with the occupational health provider.
Legal Framework
Art. 9(2) Exceptions for Employee Health Data
| Exception | Article | Employment Application |
|---|---|---|
| Explicit consent | Art. 9(2)(a) | Rarely valid due to power imbalance; may apply for genuinely voluntary wellness programmes |
| Employment law obligations | Art. 9(2)(b) | Primary basis: processing necessary for carrying out obligations in employment, social security, and social protection law — to the extent authorised by national law with appropriate safeguards |
| Vital interests | Art. 9(2)(c) | Emergency situations where employee is physically incapacitated and health data is needed for emergency response |
| Health professional processing | Art. 9(2)(h) | Processing for preventive or occupational medicine, assessment of working capacity, medical diagnosis — by or under the responsibility of a health professional bound by professional secrecy |
| Public health | Art. 9(2)(i) | Public health threats (pandemic response) — must be based on national or EU law |
| Substantial public interest | Art. 9(2)(g) | Where national law establishes a substantial public interest basis, e.g., disability discrimination legislation requiring processing to assess reasonable adjustments |