Can an employer see an employee’s wearable data?
It is the first question asked when a wellbeing scheme runs on devices people already own, and it usually arrives hopefully: if employees opt in, can we see the data? The answer is almost always no, and the scheme is better for it.
- Consent at work is rarely a sound basis, because the employee is not free to refuse comfortably.
- Health data is special category data. It is prohibited by default and needs a specific condition.
- A DPIA is effectively expected for anything touching workers’ health information.
- What a scheme can have instead: counts. Issued, activated, over time, nobody named.
Not legal advice. This is a summary for someone making a decision without a lawyer in the room. Your own counsel and your regulator have the final word.
The ICO works through this directly in its guidance on workers’ health information. Its own example concerns a company requiring a movement-monitoring device and asking consent for heart-rate collection, and it concludes the consent is not freely given.
“you will generally be in a position of power over your workers. They may fear adverse consequences.”
“a person must expressly confirm their explicit consent in a clear statement”
ICO, Data protection and workers’ health information. The page is flagged as under review following the Data (Use and Access) Act, so check the current wording before quoting it in a paper.
Consent can work where participation is genuinely optional and there is no consequence for opting out. That is a high bar, and it is easier to clear if the employer never receives the data in the first place.
- It changes what the scheme is. A benefit that reports upward is a monitoring programme with a benefit attached, and people read it that way immediately.
- It suppresses the take-up you wanted. The people who would gain most are the most careful about what their employer learns.
- It creates a duty you did not plan for. Once you hold health information about a named employee, questions follow about what you knew.
- It is a worse breach. An HR system holding health data is a different risk class from one holding addresses.
| You receive | You never receive |
|---|---|
| How many codes were issued | Who activated one |
| How many were activated | Any individual’s readings or scores |
| Counts over time | Anything that could identify a person |
| Whether the scheme is used | Whether a named employee uses it |
That answers the only questions a sponsor legitimately has: is this being used, and should we renew it. It does not let you manage an individual, which is the point.
- 1Who is the controller for employee health data in your model?
- 2What exactly does the employer see? Show me the screen.
- 3Can an administrator see an individual’s activity if they go looking?
- 4What happens to someone’s data when they leave the company?
- 5If we asked you for individual-level data, what would you say?
The last one is the most revealing. A supplier that would hand it over on request has built something that becomes surveillance on a single internal decision.
Can we see data for a team rather than a person?
Small-group reporting is re-identification with extra steps. A count across a team of six is about six people, and the room can usually name them.
Can we tie an incentive to someone’s readings?
Not through Humotron. Rewarding a biological measurement makes participation conditional on health, which creates a fairness problem as well as a data protection one.
What if an employee wants to share with us?
Individuals can share things with their employer and some will. The design question is whether the scheme makes sharing the default or the exception. Build it as the exception.
Does this work across different devices?
Yes. People use what they already own and nobody is asked to buy anything.