Data protection-compliant handling of sick notes

by R. Olschewski

Handling certificates of incapacity for work within a company poses particular challenges for companies and data protection officers due to the highly sensitive nature of the information. Since the issuing authority—that is, the (specialist) physician—is identifiable, it may be possible to draw conclusions about the nature of the illness or treatment.

There are not yet any clear statutory or supreme court guidelines on this issue in the form of an Employee Data Protection Act, even though the Federal Labor Court ruled on the prompt provision of proof of incapacity to work in a recent decision dated November 14, 2012 (5 AZR 886/11). Nor do the provisions of the Act on the Payment of Wages on Public Holidays and in the Event of Illness (EFZG), in particular Section 5 EFZG, provide any guidance on how to handle this matter in compliance with data protection regulations.

According to the current Activity Report of the State Data Protection Commissioner of NRW (LDI NRW) Regulatory Authority (p. 65) states that certificates of incapacity for work should not be sent to the Human Resources Department via the line manager, but must be sent directly by the employee to the Human Resources Department. A Transmission The agency forwards the certificate to the line supervisor first, and the Regulatory Authority deems this unnecessary. In her view, it should be sufficient for the Human Resources department to inform the line manager of the sick employee’s inability to work and—to the extent known—the expected duration of the illness. The common practice of sending certificates of incapacity for work via the supervisor or the department secretary’s office is, in the opinion of the Chief Data Protection Officer of the State of North Rhine-Westphalia, not in compliance with data protection regulations. The rationale in his annual report indicates that references to the nature of the illness—for example, via the treating physician—should be avoided.

It is therefore advisable to establish and communicate a binding internal company policy so that, in the event of illness, employees are not left in the dark as to whom they must provide this proof. Whether advance notification by telephone to the relevant department is permissible was not the subject of the LDI NRW’s decision. However, for the reasons mentioned above, such notification is unlikely to pose any problems.

Of course, the employee must also report back to work once he or she has recovered; this should be done with both the Human Resources department and the immediate supervisor.

Further information:
www.ldi.nrw.de/