The guidance can be found here https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/information-sharing-in-mental-health-emergencies-at-work/.

Crucially, data protection law allows employers to share health information in an urgent or emergency situation. The ICO have defined a mental health emergency as:

‘a situation in which you believe that someone is at risk of serious harm to themselves, or others, because of their mental health. This can include the potential loss of life’.

The focus of the guidance is to protect the mental and physical wellbeing of the person involved, and any others who it may have an impact on.

The ICO acknowledges in the guidance that there may be situations where employers need to share necessary and appropriate information with relevant health professionals and emergency services. This sharing of information is to reduce the risk of serious harm to the worker concerned and others who it may impact. The focus is sharing information with the right people to protect those involved. The ICO states that:

You will not get in trouble for sharing necessary and proportionate information with relevant and appropriate emergency services or health professionals that can help mitigate the risk of serious harm to the worker or to others.

Employers can also consider sharing a worker’s personal information with their next of kin or emergency contact. They must however, use utmost care and judgement to decide what level of information to share based on each specific circumstance. The amount of information shared must be ‘necessary and proportionate to the circumstances’. Therefore sharing all information is not always the right approach.

Employers are encouraged in the ICO guidance to plan ahead and implement a plan and policy for processing and sharing personal data if workplace mental health emergencies arise. The ICO suggest the following:

• Identify and record a lawful basis for processing and sharing special category health data in such a situation (you need to identify a lawful basis and a special category condition)
• Develop a policy on personal data for mental health emergencies. This policy should be shared with all staff and training should be provided. Such a policy should describe:

1. Type of information that may be shared
2. To whom the information may be shared with
3. Any security measures that are in place.

• Make sure all details of next of kin and emergency contacts for all workers are kept up to date. The ICO even suggests allowing workers to provide separate emergency contacts, one for general emergencies and one for mental health emergencies.

If you require any assistance or guidance in processing or sharing your employees personal data, please contact a member of our team.

This article contains a general overview of the guidance from the ICO and surrounding law. It does not replace bespoke, tailored legal advice which applies to any specific circumstances.