Health Data in the Workplace

Opinion of 4 December 2008 on a notification for prior checking regarding the "Coordination of medical, psychosocial and administrative support (COMPAS)" (Case 2008-428)

The European Commission designed a system called "Coordination of medical, psychosocial and administrative support" (COMPAS) to coordinate in a multi-disciplinary fashion the provision of help to staff in active employment. COMPAS will be a counselling facility designed to help individuals who are encountering serious health problem or serious social difficulties due to private or professional reason which interferes with their presence or performance at work. The system is based on the ad- hoc cooperation of several services within the European Commission. In principle COMPAS can only be seized for cases meeting certain criteria where all other single-service solutions and procedures have been properly tackled and exploited beforehand without success. The categories of concerned data subjects are officials and agents who are covered by the Staff Regulations and who encounter serious health problems or serious social difficulties. COMPAS will affect broad categories of personal data which will be used by the services in the interdisciplinary approach: administrative, medical and/or social data.

The EDPS analysis of the processing operations lead to a number of recommendations ensuring that the planned system will be in full compliance with Regulation 45/2001, inter alia: The COMPAS procedure should be run only with the express consent of the staff member concerned. Appropriate measures should be put in place to ensure that all working documents, not needed to be annexed to a COMPAS file, are destroyed by the persons involved from the concerned services once a case is closed. The right of access of the person concerned to his/her file also should include the right to take copies of the data related to him/her. The content of the privacy statement should be revised as to the legal basis and the categories of data recipients. COMPAS should make clear distinction related to the professional secrecy obligation of medical doctors/psychologist and any other professional involved in the COMPAS procedure. Measures should be put in place to ensure those principles.

Opinion of 19 November 2008 on the notification for prior checking on the invalidity procedure (Case 2008-555)

Article 59(4) of the Staff Regulations of Officials of the European Communities provides that "The Appointing Authority may refer to the Invalidity Committee the case of any official whose sick leave totals more than 12 months in any period of three years". Based on that Article, the European Economic and Social Committee has established a procedure to obtain a decision from the Invalidity Committee as to whether the official concerned should be granted invalidity or should resume professional activities. In fact the procedure concerns not only officials but also temporary and contract staff.

The proposed processing would not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided that the EESC gives appropriate guarantees regarding long term data storage, informs recipients that they may not use the data for other purposes, revises the information provided and the arrangements for providing it, and finally clarifies the rights of access granted to data subjects.

Opinion of 18 November 2008 on the notification for prior checking regarding the "management of individual medical files - Brussels, Luxembourg" case (Case 2004-225)

The opinion of the EDPS concerns the management of medical files by the European Commission. The medical service manages numerous medical files arising from a variety of medical activities to monitor the health of staff and fulfil its obligations to staff under the Staff Regulations.

After thorough analysis in the light of Regulation (EC) No 45/2001, the EDPS has concluded that the processing proposed does not involve any breach of the provisions of Regulation (EC) No 45/2001 provided, in particular, that the Commission:

• Adopts the pre-employment medical examination form as  adopted by the Interinstitutional Medical Board;
• States on the annual medical check up form that there is no obligation to take the HIV test;
• Reviews the annual medical check-up form that records the results of the physical examination and the list of tests required in the light of the principles of adequacy and proportionality;
• Adopts as a point of good practice the principle that the results of medical examinations carried out by a doctor chosen by the data subject will be passed on to the Commission medical service only with the freely given and informed consent of the employee;
• Sets a limited period for storing data on persons who are not recruited;
• Introduces a data access procedure for persons not recruited or others (temporary staff, private employees and scholarship holders working at the Commission in Luxembourg and in the JRCs) in respect of whom medical information has been recorded and who are also entitled to access under Article 13 of Regulation (EC) No 45/2001.

Opinion of 11 November 2008 on a notification for prior checking on the procedure in the event of absence owing to illness or accident (Cases 2008-271 et 2008-283)

At the Council, absences owing to illnesses are managed by a specific Medical Absences Management Department, responsible for officials, temporary staff, contract staff and detached national and military experts working at the Council.  Various data processing operations are carried out by this department, for the purpose of ensuring compliance with all statutory and other regulations concerning absence owing to illness or accident and to prevent unjustified medical absences (obtaining medical certificates, checking medical absences, etc.).

The EDPS has examined the processing of personal data in the context of the management of absences owing to illness and has concluded that it does not appear to involve any infringement of the provisions of Regulation (EC) No 45/2001 provided that certain recommendations are followed, and in particular that the department responsible for the processing changes the data retention period, puts in place a procedure to be followed in respect of applications for access to or rectification of data and informs data subjects in accordance with Articles 11 and 12 of the Regulation.

Opinion of 5 November 2008 on the notification for prior checking regarding occupational radiation exposure data (Case 2007-0383)