INTRA/PS/PS012Records concerning health held for security purposes
Records of absence, illness, or fitness held for the purposes of the program.
| Control | Jurisdiction | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|---|
| PS012/EUMandatory | European Union | Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026 | The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule. | Data concerning health are one of the categories article 9 prohibits the processing of outright, so a security purpose is not on its own what makes holding them lawful. The prohibition lifts only on one of that article’s grounds, and the employment one requires that Union or member state law or a collective agreement authorize it and provide appropriate safeguards. |
| PS012/ITMandatory | Italy | Provvedimento n. 107, Amazon Italia LogisticaGarante per la protezione dei dati personali · read 16 Aug 2026 | That records of illness, union activity, and family circumstances kept by managers had no lawful basis, and attract the stricter regime. | A record of absence or illness held for the program falls in the stricter category, and holding it for security purposes does not move it out. |
| PS012/GBMandatory | United Kingdom | Regulation (EU) 2016/679 as it has effect in domestic law, articles 6, 9, 22A to 22D, and 35Retained under the European Union (Withdrawal) Act 2018 · read 30 Aug 2026Data Protection Act 2018, section 10 and Schedule 1Parliament of the United Kingdom · read 30 Aug 2026 | The grounds, the closed categories, when an assessment is owed, and a rule on deciding about someone by machine that is not the Union’s. | Data concerning health are one of the prohibited categories, and the prohibition lifts only where the processing also rests on a ground in article 6(1) and one of the article 9 grounds applies. A security purpose is not among them. In turn, holding such a record for the program runs through the employment condition, which asks whether the processing is necessary to perform an obligation or a right imposed by law, and which requires the appropriate policy document to be in place when it is carried out. |