Ethics Guidance for Occupational Health Practice 9th Edition - Book - Page 99
5.28. Under the Genera Data Protection Regulation, second data protection principle,
personal data collected for one purpose may be used for a different purpose
“for archiving purposes in the public interest, scientific or historical research
purposes or statistical purposes”.
5.29. It is good practice to inform workers that the information collected during
interaction with occupational health such as completing a pre-employment
health questionnaire or result of health surveillance can be subject to quality
assurance exercise such as anonymised / pseudonymised audit. Where possible
this should be in form a written statement on the relevant form. If the
information collected during interaction with occupational health may be used
for research, if planned or anticipated, it must be clearly stated on the form or
other written media including signposting for further information and an offer
of the opportunity to opt out.
Confidentiality and data protection
5.30. The normal occupational health arrangements relating to confidentiality and
data protection apply to research (see Chapter 3, Information). As with the
provision of management information, research information should be
anonymised (stripped of any information that might enable identification of the
individual) at the earliest opportunity. It should be noted that linked
anonymised (pseudonymised) or coded data do not constitute properly
anonymised data. Data that is already anonymised at the point of access will
not normally fall within the scope of data protection legislation. If it is proposed
that routine occupational health records or personal exposure data might be
used to generate anonymised information for research purposes, the
occupational health professional must, where possible, ensure that workers are
informed prospectively. Workers should be told that their data might be used
for audit or research, how it might be used and how confidentiality will be
protected. It is prudent to consult with worker representatives at an early stage
in the process.
5.31. If subsequent access to occupational health records is requested by a third party
(such as an academic team) for research purposes, the occupational health
professional must ensure that the third party has appropriate procedures to
comply with the principles of data protection, and that all personnel accept a
duty of confidence.
Page | 98
