TUC advice for safety on GDPR 


TUC head of health and safety Hugh Robertson says some employers are using the new GDPR to stop safety reps getting information they are legally entitled to and has provided guidance for safety reps (see: www.tuc.org.uk/blogs/gdpr-and-health-and-safety-representatives). 


Chapter 4 of this booklet sets out safety reps rights, including those contained in Regulation 7, which says employers “have to make available to safety representatives the information…necessary to enable them to fulfil their functions.” 


Robertson reports that a lot of employers are saying that the GDPR restricts what information they can supply, with examples including refusing to hand over information from accident report forms or instructing their auditor to stop sharing safety audits on the grounds they contain some personal data.


“The GDPR does not change the information that can be given to union health and safety representatives in the least,” he makes clear. “Both the SRSC regulations and the Data Protection Act 1998 already restricted personal information being given out, which is why employers had to anonymise it or get the permission of the individual. In fact, the official accident report form published by the TSO has a box asking the person to consent to the information going to the safety representative.” 


He confirms HSE advice remains as follows: “Employers are required to provide documents and information requested by safety representatives under Regulation 7 as before.”


However, he also makes clear that when handling personal data, safety reps must make sure they keep the information securely. At the very least, he says, safety reps can demand a locked filing cabinet and any other secure facilities they need to keep data secure.