12/03/2024

NEW ICO GUIDANCE: INFORMATION SHARING IN MENTAL HEALTH EMERGENCIES AT WORK (1 March 2024)

‘What can you do, and what information can you share, when you are worried about an employee’s mental wellbeing?’ This is a question that we commonly get asked when an employer has serious, and genuine, concerns, that an employee’s mental ill health may pose a risk to them or others.

Helpfully, on 1^st March 2024, the ICO produced guidance on this issue ‘ Information Sharing in Mental Health Emergencies at Work’. This guidance is in the same format as previous guides (i.e. uses the must, should, and could do to comply).

The Guidance provides advice on when and how it is appropriate to share workers’ information when the employer believes that someone is at risk of causing serious harm to themselves, or others, because of their mental health.

You can read the full guidance, and there is also a data sharing hub with useful guides on when and how to share personal information.

The ICO guide also contains worked examples and links to additional resources and sets out a pathway for business to ensue they are complying with their obligations under GDPR.

 

What is a Mental Health Emergency?

This is defined as situation in which you believe that someone is at risk of serious harm to themselves, or others, because of their mental health including a potential loss of life.

 

Sharing Workers’ Information?

In a mental health emergency the guide states that Employers should share necessary and proportionate information without delay with relevant and appropriate emergency services and/or health professionals.

It states Employers could also share necessary and proportionate information with the worker’s next of kin / emergency contact and cautions that they need to use their judgement on appropriateness of doing so.

 

Planning Ahead?

Here the Guide sets out information about how an Organisation can plan ahead, which includes mandatory (must do) steps such as:

• identifying the lawful basis to share the sensitive personal information
• identifying the additional special category needed to share sensitive personal information
• informing workers you may share their information in health emergency
• sharing the policy for sharing personal information with existing workers and new workers

In terms of what Employers should do, this includes:

• carry out a data protection impact assessment (DPIA)
• Develop a policy
• Ensure workers are aware of the policy.
• Train staff
• Ensure that workers keep next of kin and emergency/mental health emergency contacts up to date

In terms of what Employers could do, this includes:

• Include this in broader training & awareness around mental health.
• give workers the opportunity to identify separate emergency contacts for general emergencies and mental health emergencies

 

Lawful Basis and Special Category Conditions 

When sharing personal information in a mental health emergency,

Organisations must identify both a lawful basis to share information and as the data is special category data, it must also identify a special category condition.

The lawful basis could be:

• Vital interests
• Legitimate interest
• Legal obligation

Special category conditions could be:

• Vital interests
• Employment, social security and social protection law

 

The Guidance reassures employers that during a mental health emergency  they should share necessary and proportionate information without delay with relevant and appropriate emergency services or health professionals.

 

Any Organisations requiring advice should contact the Legal Team.