Information Sharing in Health Emergencies at Work

Summary

This is guidance from the Guernsey Office of the Data Protection Authority (ODPA) explaining how employers can lawfully share information about an employee experiencing a health emergency (physical or mental) under The Data Protection (Bailiwick of Guernsey) Law, 2017. It confirms that data protection law does not block necessary and proportionate information sharing in genuine emergencies, and sets out how employers should plan ahead for this.

• Sharing in the moment: Employers may share necessary and proportionate information without delay with appropriate emergency services, health professionals, or a worker's next of kin/emergency contact, using judgement on how much detail is appropriate for each recipient.
• Lawful basis: Because health information is special category data, employers must identify and document a lawful basis for sharing, most likely explicit consent, vital interests, a regulation/enactment basis, or the legal obligation relating to employment basis.
• Transparency: Employers must tell workers that their information may be shared in a health emergency and make any related policy available to them.
• Planning ahead: Employers are encouraged (though not strictly required) to develop a written policy, train staff, carry out a DPIA covering everyday and emergency handling of health data, and keep next of kin/emergency contact details up to date.

The guidance also notes that other legal constraints, such as duties of confidence, may apply alongside data protection law and should be considered separately.

Key obligations

• Employers must identify and document a lawful basis before sharing a worker's health information in an emergency.
• Employers must inform existing workers, as soon as possible, that their personal information may be shared in a health emergency and must make any related policy available to them.
• Employers must provide this information to new workers within one month of obtaining their information.
• When sharing information, employers must limit disclosure to what is necessary and proportionate to the recipient and circumstances.
• Employers should ensure workers' next of kin and emergency contact details are kept up to date through regular review.

Applies to

employers, data controllers

Deadlines

• as soon as possible: Employers must inform existing workers that their information may be shared in a health emergency.
• within one month of obtaining their information: Employers must inform new workers of the health emergency information sharing policy.