Hi All,

Has anyone amended their report forms to make allowances for sensitive data and the form being shared with legal representatives and insurers to cover themselves under GDPR or are the reasons for collecting the data considered reasonable enough cause as not to do so?

Many thanks

GDPR is related to 'Personal Data' that can identify an individual.  What you need to do, is identify in your data register what you have, why you have it e.g. reason (which is one of 6 - for RIDDOR its 'legal') e.g.

What is the Data Held - e.g. Injured Party (Name) 

Purpose of Collecting Data - 

Lawful Basis for Collecting Data - e.g. Legal Requirement (weakest reason is consent as it can be removed)

Then you need to identify where it is kept, what the security measures are and how long you are keeping it, what is the source of information e.g. IP, has the employee given express consent and security measures.

Remember the last revision of the BI510 "Accident Book" tried to cover the first pass of data protection - i,e, the IP's consent to have non-anonnamised form data shared with those with legitimate interest e.g. Safety Representatives.

A recent post asked about the "signature" of the IP

http://forum.iosh.co.uk/posts/t127007-Signing-The-Accident-Book

"Legal" rights to hold data are not the same as the right to disseminate data

Then again, what if there is an injury to a third party (or member of the public)? In multi-occupancy sites, such as ports and shopping centres for example it is easy to envisage a scenario where a name and details etc can be circulated through several organisations after an accident. 

I didn't get a clear answer on data protection issues when I raised this point a few years ago when I worked somewhere like this - with GDPR hitting the headlines so  much recently Joe Public is more aware these days and perhaps more likely to raise the question themselves?

I agree, your legal people and insurers are amongst those who probably need to know the details of incidents, but back when I worked in a multi-occupancy / user site (I'm trying not to let on where it was) my concern was how easily and quickly details could get circulated - always with good intentions - to all the attendees of the daily operations meeting - at which you would typically have cleaning contractor rep, security contractor rep, site owners, fanchise operators & retail and possibly police / emergency services (depending on what was going on). 

A first aider collecting Mrs Smith's age, address and the 'fact' that she has diabetes and had been drinking that morning when she slipped / tripped / fell over, can very quickly be shared amongst half a dozen organizations - some of whom may then pass the info up their reporting structures for their own reasons.

Like I said, never got a straight answer on data protection implications, but it did make me uneasy

I don't dispute that the collection of data is a legal requirement, and therefore the investigator is entitled to collect it, my concern (which predates GDPR) is that often the collected information is then 'shared' (OK, sometimes in verbal report to an Operations Team) with no consent given for name and address, age, medical conditions and possibly (in the example of ports, raileay stations, etc) travel plans to be shared with the duty manager of WH Smiths and Boots .. .. That's what I'm bothered about.