Data Protection for employers – Information sharing in mental health emergencies at work

On 1 March 2024, the ICO published guidance for employers on sharing the personal data of their workers in the event of a mental health emergency.

Currently, data protection law allows organisations to share sensitive personal information in an urgent or emergency situation, including to help them prevent loss of life or serious physical, emotional or mental harm. The new guidance provides advice on when and how it is appropriate to share a workers’ personal data in such an emergency, demonstrating that data protection does not act as a barrier to necessary and proportionate information sharing.

The guidance defines a mental health emergency as a ‘situation in which it is believed that someone is at risk of serious harm to themselves or others because of their mental health’. Data protection law does not distinguish between mental health information and health information and the definition of health information covers both physical and mental health information.

Sharing of workers’ information in a mental health emergency

The guidance underscores the importance of immediate action during a mental health emergency, emphasising the need to promptly relay pertinent information to the relevant emergency services or healthcare professionals. This proactive approach aims to safeguard the well-being of all parties involved, prioritising their safety, without the burden of repercussion. Furthermore, the guidance recognises the invaluable role that a worker’s next of kin can play in providing crucial support during such challenging circumstances, thereby highlighting the potential necessity of sharing data with them.

However, while sharing information is essential, the ICO states that exercising discretion is equally paramount. It’s imperative to assess each situation individually and share only what is deemed necessary and appropriate, taking into account the sensitivity of the circumstances and respecting the privacy of the individuals involved. Additionally, employers must remain mindful of their wider legal obligations, including confidentiality duties, which extend beyond the realm of data protection laws.

Planning ahead for information sharing in a mental health emergency.

The ICO encourages planning ahead to assist employers when dealing with the sharing of information with the right people in an emergency situation. The guidance suggests putting in place internal policies and processes for information sharing in such an emergency, which document the approach to take.

The guidance suggests that employers should consider the following:

• Develop a policy on sharing personal information in a mental health emergency. Think about the types of information that the employer may need to share, who it may be necessary to share it with and how it will be shared securely.
• Ensure that workers are aware of the policy and make it available to them. As part of an employer’s transparency obligations, workers must know that their employer may share their information in a health emergency – including a mental health emergency. Employers must provide this information to their existing workers as soon as possible; and to new workers within one month of obtaining their information. The obvious time to do this for a new worker, would be when asking them to identify an emergency contact.
• Train staff on how to handle personal information in a mental health emergency situation. If the employer has designated people who will respond in such situations, ensure staff know who they are and how to contact them. This could be included within broader training and awareness raising that the employer may have in place around mental health.
• Ensure that workers keep the details of their next of kin and emergency/mental health emergency contacts up to date through regular review. Employers could give their workers the opportunity to identify separate emergency contacts for general emergencies and mental health emergencies on an emergency contact form.

As part of the employers’ responsibilities, they should integrate a comprehensive Data Protection Impact Assessment (DPIA) into standard protocols for managing workers health-related data, encompassing the necessary steps for sharing information during instances of mental health emergencies. In this procedural framework, the lawful basis for information disclosure should be identified, particularly given the special category status of health-related data, necessitating the identification of a corresponding special category condition. These determinations should be recorded and incorporated into internal policies, ensuring transparency and compliance with data protection regulations.

Lawful basis and special category conditions

Clearly, the most appropriate lawful basis and special category condition will need to be assessed on a case-by-case basis. The ICO does however offer an indication of the most likely lawful bases that may apply when dealing with a mental health emergency, as well as the most likely special category conditions that may present themselves.

The lawful bases that are most likely to apply are:

• Vital interests – this may apply where the employer needs to share a worker’s health information to protect either their life or someone else’s. This is limited in scope and generally only applies in matters of life and death and it cannot be used if the worker is capable of giving consent.
• Legitimate interest – this may apply, unless there’s a good reason for protecting the worker’s personal information which either outweighs the interests of the employer or the interests of a third party.
• Legal obligation – employers may rely on this basis where they are required by law to share information in these circumstances. This might be either in statute or in common law, but it does not apply to a contractual obligation. The information sharing must be necessary to comply with the legal obligation and the employer must do it in a reasonable and proportionate way.

The special category conditions that are most likely to apply are:

• Vital interests– Similar to the vital interests lawful basis discussed above, this condition may apply in circumstances of life and death.

• Employment, social security and social protection law – this would apply where an employer has to safeguard the health, safety and welfare of workers. For this to apply employers must identify the legal obligation or right in question.

Should you have any queries in relation to the new ICO guidance on information sharing in mental health emergencies at work, or indeed any other employment law related query, please contact Linky Trott or any other member of our Employment Team.

If you aren’t receiving our legal updates directly to your mailbox, please sign up now