When Can An Employer Process Health Data Under The GDPR?

The COVID-19 pandemic has drawn attention to the processing of health data and when such data may be processed, especially in light of the fact that employers are obliged to implement mitigation measures to ensure the safety of employees at the work place. In this article we will analyse some instances where health data may be processed by an employer.

Health data is considered to be a special category of personal data under the General Data Protection Regulation ('GDPR'). The GDPR defines the special categories of personal data in Article 9 and prohibits the processing of any these types of personal data unless such processing is necessary for the list of conditions set out in Article 9(2) of the GDPR or any laws enacted by Member States.