Phil, I largely agree with you but the key word in the legislation is "necessary". Is it necessary? I suppose if people have availed themselves of the facility then maybe it is....
I'd be inclined to undertake a full LIA and see what it pulls out.
Simon.
-----Original Message-----
From: This list is for those interested in Data Protection issues <[log in to unmask]> On Behalf Of Phil Bradshaw
Sent: 22 August 2019 15:42
To: [log in to unmask]
Subject: [data-protection] Staff Welfare Support - Lawful Basis
You provide a staff welfare service to signpost and assist staff to obtain help and support across a wide ranging area covering physical health and wellbeing, mental and emotional health and wellbeing and financial health and wellbeing.
Necessarily that sometimes will require recording special category identifiable data in order to provide follow up etc. - without it the service will be much more limited
Which legal basis would you use:
A. Legal duty: e.g. Employers must do whatever is reasonably practicable to protect the health, safety and welfare of their employees s2 HSW Act. Problematic as enquiries will include things well outside the workplace. Necessity is also a clear problem. 95% of employers will not provide this service.
B. Legitimate interest: use of the service is voluntary but once engaged employer has a legitimate interest in keeping details of advice given - both for practical management and potential protection against legal claims
C. Consent - potentially problematic as would need to be explicit, and the hoops to be gone through to record that would militate against it being an open, friendly, accessible service. Operators are well trained, empathic, and the last thing they want is to read a formal explicit consent statement out at the start or as soon as a sensitive issue is raised - sometimes they will not be. Also might struggle with consent as a condition of service.
On the other hand if A or B (I lean strongly to B), we need an Art 9, Sched 1 condition. Is there any reason why we cannot squeeze this within "processing— is necessary for the provision of confidential counselling, advice or support or of another similar service provided confidentially" Sched 1 Para 17
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
