The Code

The Information Commissioner has recently published Part 4 of the Employment
Practices Data Protection Code (the "Code"). The Code does not
impose new legal obligations on employers, rather it is intended to help
employers comply with the Data Protection Act (the "Act") and to
encourage employers to adopt good practice.

The Code is designed to help employers to meet the basic legal requirement
to comply with the Act itself. Employers should only deviate from the Code
following careful consideration of the alternative ways they intend to meet
the requirements of the Act. Relevant parts of the Code are likely to be cited
by the Information Commissioner in any enforcement action taken by him.

Information about Workers' Health

Part 4 of the Code emphasises that the Act's rules about sensitive personal
data come into play whenever an employer wishes to process information about
workers' health. These rules do not prevent the processing of such information
but limit the circumstances in which processing can take place. Processing
includes the initial obtaining of personal information, the retention and
use of personal information, access and disclosure and final disposal of
personal information.

As Part 4 addresses the collection and subsequent use of information about
workers' physical and mental health or condition, this part of the Code is
likely to be of most relevance to larger organisations and those with specific
health and safety obligations but organisations of all sizes may find the guidance

Good Practice Recommendations

The Code contains a number of good practice recommendations under the following
6 headings:

  • Information about workers' health: general considerations
  • Sickness and injury records
  • Occupational health schemes
  • Information obtained from medical examination and testing
  • Information obtained from drug and alcohol testing
  • Information obtained from genetic testing

There are too many good practice recommendations to summarise in this briefing
but it may be useful to note that under the first heading of 'Information about
workers' health: general considerations', the Code sets out the following core
principles which apply generally to information about workers' health:

  • it will be intrusive and may be highly intrusive to obtain information
    about your workers' health;
  • workers have legitimate expectations that they can keep their personal
    health information private and that employers will respect their privacy;
  • if employers wish to collect and hold information on their workers' health,
    they should be clear about the purpose and satisfied that this is justified
    by real benefits that will be delivered;
  • one of the conditions allowing processing of sensitive personal data must
    be satisfied; an employer might require to carry out such processing to comply
    with its legal obligations including the requirement not to discriminate
    against workers on the grounds of disability.
  • workers should be aware of the extent to which information about their
    health is held and the reasons for which it is held;
  • decisions on a workers' suitability for particular work are properly management
    decisions but the interpretation of medical information should be left to
    a suitably qualified health professional.

Amongst other things the Code contains detailed provisions in relation to
drug and alcohol testing and although random testing is not completely prohibited
the Information Commissioner's view is that the circumstances in which random
testing will be justified are very limited. Any employer currently carrying
out drug and alcohol testing may require to revisit the relevant policy to
make sure that it complies with the Code.

The Information Commissioner has also published useful supplementary guidance
in relation to Part 4 of the Code together with guidance aimed specifically
for small businesses. Part 4 of the Code together with the additional guidance
can be found at

If you would like any further information on Part 4 of the Code or on the
Code in general, please do not hesitate to contact Kim Pattullo on 0131 473
5143 or,
Roy Drummond on 0141 566 8576 or and
Sheila Gunn on 0141 566 8555 or

Back to Search