The Information Commissioner's Office (ICO) has published new guidance for employers clarifying how personal data sharing may be permitted during workplace mental health emergencies.
The guidance makes it clear that data protection does not act as a barrier to necessary and appropriate information sharing where a mental health emergency occurs. The ICO acknowledges that employers may need to share necessary and proportionate information with the relevant emergency services and health professionals, to mitigate against the risk of serious harm to the worker concerned or to others. The guidance also makes it clear that an employer will not get into trouble for sharing a worker's personal information with their next of kin or emergency contact, though it emphasises that employers are required to use care and judgment to determine the level of information to share based on each specific case.
The guidance encourages employers to forward plan how they will deal with personal data sharing in the case of a suspected mental health emergency of a worker. It recommends the following steps:
- Identify the correct lawful basis for processing and sharing personal data in circumstances where a mental health emergency occurs.
- Develop a policy on personal data sharing for mental health emergencies. This will describe the type of information involved, who the employer may need to share the information with and the security measures in place. This should be shared with all workers and training should be provided on handling personal data during a mental health emergency.
- Ensure that details of next of kin and emergency or mental health contacts for workers are kept up to date through regular review. As a way of enhancing confidentiality of their mental health information, consider allowing workers to provide separate emergency contacts for general emergencies, as compared to mental health emergencies.
