ZUS too progressive for GDPR?
24 July 2019
3 min
-
Employers have been able to receive information on sick notes being issued by a doctor for their employees by text message or e-mail since 1 December 2018. Meanwhile, in view of the restrictions arising from the GDPR, the content of the messages sent to employees from the Social Insurance Institution (ZUS) has become limited since 21 July of this year.
-
The system of electronic sick notes (so-called e-ZLA) assumes that the doctor provides the medical certificate electronically to ZUS, which then makes it available to the payer of the contributions (the employer) on his profile on ZUS’ Electronic Services Platform (PUE) no later than on the next day after receiving the medical certificate (but without giving the statistical number of the disease). The employers then receive notices by text messages or e-mail that a medical certificate has been issued.
-
As ZUS stated in the message on its website, from 21 July 2019, the messages will only contain information that a sick note has been issued or cancelled, but without the employee’s details or any further information on the sick note itself. Consequently, this method of communication is losing its major advantage, which was the notification of the employer forthwith about the indisposition of a specific employee. This is because, in practice, this “system of rapid notification” has enabled employers to react immediately in the case of a staff shortage because of the indisposition of a sick employee.
-
However, the change is justified. On the one hand, a text message about a sick note issued to an employee specified by name is in fact “health data” and therefore a special category of personal data, the processing of which, in accordance with Article 9 of the GDPR, must have legal grounds, unless the employee himself were to agree to the processing of the data in this way. Meanwhile, the solution used by ZUS, despite its functionality for employers, is not, in fact, supported by the regulations.
-
The solution to this situation would be for the employee to give his consent at the doctor’s surgery to the transmission of his data to the employee, although this would be a further, additional obligation (to collect such declarations) for the health centre.
-
Employers will still have access to the medical certificates of their employees through their profile on ZUS’ PUE. ZUS also announced the messages would contain the name of the payer, whose insured received the sick note, which will be a convenience, especially in larger groups employing numerous employees in many companies, but having a common HR department.
Listen