The ICO code says obtaining details of workers’ health is “intrusive”, adding: “Workers have legitimate expectations that they can keep their personal health information private and that employers will respect their privacy”. Employers can only gather information about workers’ health if they can satisfy a “sensitive data condition”, for example, if they need the information to meet their obligations under health and safety law or to prevent discrimination, or if a worker has given their consent freely.