Hi all,

Can I have your thoughts on this scenario please:

We have a number of labs. In some of our buildings we offer a 24h service, however our employees only work 9am-5pm. Therefore we use an out of hours provider from 5pm-9am. The OOH staff use our premises, equipment, substances, and deal with our customers face to face. 

All accidents involving the OOH staff are report by the OOH employee to their employer, which I agree with. However, the OOH provider is unwilling to share details of any accidents relating to their staff. These accidents have occured on our premises, they could involve our equipment, the fabric of the building etc. They are willing to share very limited information with us such as the date and time of the accident and the accident category (e.g. slip, trip etc.), but they are unwilling to share the details of the accident. They are reluctant to share any more information than this based on data protection legislation and that they'd be in breach of the DPA if they shared any more information. 

I've asked them to continue reporting the accidents to their employer but for their employer to share the report with us. Is this reasonable given it is our premises, equipment etc.?

FYI: I've requested the contract between the 2 employers to see what was agreed (as I'm fairly new to the organisation so not sure what was previously agreed).  

Thanks 

As Kate has said this is a reasonable request. It is, after all, your premises.

How has this request been broached? What is your relationship like with the OOH provider? 

I would offer to share my own relevant information with them and make it clear that I have a duty to them as they are on our premises to know any incidents. I would make it clear that it is about collaboration and the information would only be used in ensuring a safeer workplace and not as a witch hunt.

Hi abotto - sounds to me like somebody is using GDPR for reasons that it wasn't intended for, either deliberately or out of ignorance of the ways to share information without giving out personal data.

My guess is that the diplomatic approach that you intend should resolve the issues.

This is one of the legitimate business interests cited in GDPR, that said it may be that in the contractual terms data handling and processing has not been adequately addressed as it is one of those grey areas like so many which beyond price & delivery is looked after by someone other than sales.