The General Data Protection Regulation ('GDPR') came into force in the UK via the Data Protection Act 2018. It controls the way personal information is used by organisations, businesses and the government.
Detailed information on the application of the law is available from the Information Commissioner's Office which includes information on the health and social care sector.
Everyone responsible for using personal data has to follow strict data protection principles. They must make sure the information is:
There is stronger legal protection for more sensitive information, including (but not limited to):
Here we address some of the data protection issues our members ask us about most often.
For more information about your obligations around patient confidentiality, see our confidentiality advice guide.
The term 'personal data' includes names and photos of any individuals.
If you have any concerns about your employer using or displaying your photo, please discuss this with your manager in the first instance. This includes displaying your photo in your workplace, online or in any promotional material.
It is likely that the use of the photo would be ‘fair and lawful’ if your objection is simply that you do not want it displayed.
The use of your photo may be a breach of data protection legislation if you raise a reasonable objection. For example, in a clinical environment staff may raise personal safety and security concerns because they have access to drugs in the course of their employment.
If your employer takes your photo, you should be told why it is being taken. It should not be used for any other reason without your permission.
If you are unable to resolve any concerns informally, please contact us for further advice.
Employers may be able to monitor workers, as long as this is done in a way which is consistent with data protection legislation. Employers must also consider Article 8 of the European Convention on Human Rights (ECHR) which creates a right to respect for your private and family life, including your correspondence.
An example of data which may be collected in certain circumstances is biometric data, including fingerprints.
Your employer may also be able to monitor your use of the internet while you are at work and your workplace emails. They should have a local policy which defines 'acceptable use' and outlines how this will be monitored.
Covert recordings should only be undertaken when there is no alternative. For example, to enable the prevention or detection of suspected criminal activity or gross misconduct. It is not appropriate to record conversations unless the parties involved have given their consent.
The Information Commissioner’s Office (ICO) has helpful guidance for individuals about data protection and information rights.
If you feel your privacy has been breached in this way, please contact us. You may have a number of options available including a complaint to the Information Commissioner.
If a patient or family member is audio or film recording then the reasons for this should be discussed. Unless there is good reason for doing so (e.g. the patient is unable to recall oral advice or there is a problem with interpreting written material) this action should be stopped.
Health-related information is confidential and can only be shared if consent is given. So, if other patients are being recorded without their consent, it is a clear breach of confidentiality.
The Nursing and Midwifery Council (NMC) Code places a professional duty on registrants to take action to ensure that anyone in their care is protected from risk. Failure to take such action could amount to professional misconduct.
If this happens to you:
The Care Quality Commission (CQC) has produced guidance for families, carers and people who use health and care services called Using cameras or other recording equipment to check somebody's care which may be helpful.
Employers should communicate the details of their drug and alcohol policy to staff. If you're unsure - look for the policy on the staff intranet (or similar) or ask your manager.
Regular drug testing is usually only justified where there is a reasonable suspicion of drug use that has an impact on health and safety. Any test must provide real evidence of impairment/potential impairment at work that will put the safety of others at risk. Drugs taken outside of work would not normally concern your employer unless there is any sign of impairment at work. In this situation, your employer may be able to take action.
When undertaking testing, your employer must be clear about what they are looking for and why the test is being conducted. They should take particular care to ensure testing is proportionate to risk i.e. the extent of testing reflecting the risks associated with a specific role and is backed up by scientific evidence as to the effect of specific substances on workers.
Please check your local policy and should there be any concerns, please contact us for support.
Data protection legislation defines a health record as 'information relating to someone's physical or mental health that has been made by (or on behalf of) a health professional'. It must have been prepared 'in connection with the care of that individual'. Health records which fall within this definition are protected; this includes manual and computerised records.
Under data protection legislation, health records are 'sensitive data'. This is any information concerning the physical or mental health or condition of a job applicant or employee. This includes:
Before information about your health is shared your employer must ensure:
Your employer must ask for your consent before accessing your health records or requesting a medical report. You have the right to decline consent however it is important that your employer explains the implications of this.
Everyone has the right to view their health records. You should:
You may be denied access if it likely to cause serious harm to you or another person’s physical or mental health.
Please see our clinical pages for more information about appropriate disclosure in occupational health nursing .
Keeping records about employees is a necessary part of running an organisation.
The Information Commissioner’s Office (ICO) is currently consulting on guidance on keeping of employment records.
As an applicant you will normally be entitled to access your interview notes. These will be kept for a reasonable time whether you are successful or not. The collection and storage of this information is covered by current data protection legislation.
If your own employee data has been compromised or you are the victim of a data breach, please contact your employer’s Data Protection Officer immediately.
Once the breach has been reported they will talk you through the process and advise you of the next steps. You may also wish to obtain a copy of your employer's Data Protection policy which will outline the rights and responsibilities of both you and your employer.
Our advice on investigations and statement writing may also be useful.