TOOL
A short path through
the privacy questions.
| The situation | Next step |
|---|---|
| You are setting up a general arrangement. | Use knowledge about needs and working conditions. Avoid collecting private health stories. |
| An employee needs individual support. | Clarify the necessary information about function, the lawful basis and the right access. Use the approved follow-up procedure. |
| Someone tells or sends more than necessary. | Do not spread or copy it on. Clarify secure handling and limitation of unnecessary data with the responsible function. |
| Something must be shared to carry out a measure. | Explain what, with whom and why. Share only what is necessary and lawful, through the right channel. |
| A report gets too detailed. | Reduce detail, access and the possibility of linking. Consider whether refill alerts are enough. |
A note about function can also contain health data. Processing health data requires both a basis under Article 6 and a relevant exception under Article 9 of the GDPR. Consent is no automatic shortcut in an employment relationship.
If something is sent to the wrong person or accessed without authorisation: follow your organisation’s procedure for personal data breaches. Do not improvise deletion of necessary documentation or promise that “this stays between us”.
REMEMBER THE DIVIDING LINE
HSE Scan is for general documents without personal data. Individual notes belong in the proper follow-up process, not in the scan.
The Body Comes to Work · 40 / 50 · revision 1