Reporting sick leave in Teams – convenient, but is it legal?

Many workplaces have made Teams the hub for everything, sick leave included. It is convenient, but it can mean that sensitive health data about employees is spread and stored in ways that do not hold up under the General Data Protection Regulation (GDPR). Here is what applies, and what you can do about it today.

Health data needs extra protection

Under the GDPR, data about a person’s health counts as a special category of personal data. The main rule is that such data may not be processed at all. There are exceptions, however, and one of them concerns employers.

An employer may process health data where it is necessary to fulfil their obligations under employment law. That can mean paying sick pay, running work-related rehabilitation or adjusting the work. The legal basis is therefore there. What decides whether the handling is lawful is how the data is collected, stored and protected.

Three common pitfalls

1. You collect more than you need

When someone reports in sick, the employer in principle needs to know that the employee is ill and from which day. The employee does not have to say why during the first seven days, and the employer should not ask.

In a chat thread, more detail slips in all the same: “Stomach bug again”, “She has had a rough time at home”, “Probably burnout”. Every line like that is health data you must be able to justify. If you cannot, you are breaching the principle of data minimisation.

2. The data is not protected well enough

Teams is built for collaboration, not for handling sensitive personnel data. Some typical risks:

• Chats are often kept with no time limit, are searchable and sync to private phones.
• A message can end up in the wrong channel, or be forwarded on.
• Notes and documents in shared folders often inherit permissions from a team, so more people than necessary have access.
• There is often no logging of who has actually read the information.

The GDPR requires the level of security to be proportionate to how sensitive the data is. For health data that means need-based access, logging and clear routines.

3. The data stays far too long

Personal data must be erased once it is no longer needed. A sick leave message in a chat from 2022 is rarely needed today. Without a retention routine, and without settings in Microsoft 365 that actually clear out chats and files, it becomes hard to show that you follow the rule.

It is not only about the absence being reported

A chat solves the simplest part of the job: the manager finds out that someone is off today. But the purpose of recording sickness absence is larger than that. You also need to be able to read the patterns over time.

Repeated short-term absence is one of the clearest early signals that something is wrong, and it gives the employer reason to act while it is still straightforward. That presupposes that the absence can be followed as statistics: the number of occasions per employee over a rolling twelve-month period, differences between departments, changes across the year.

That follow-up is in practice impossible when the reports sit scattered across chat threads belonging to different managers. No one can add them up, no one sees that the same employee has reported in sick six times since the spring, and no one notices that a whole team has twice the short-term absence of the rest of the organisation. The data comes in, but it cannot be used.

A system that gives sickness absence a structure solves both things at once. Permissions can be limited and data erased automatically, and you can follow the trend at an aggregated level and put preventive measures in place before a short absence turns into a long one.

What happens in an inspection?

If the Swedish Authority for Privacy Protection (IMY) examines your handling, you may need to show:

• that the processing appears in your record of processing activities and has a legal basis
• what data you record, and why
• who has access, and how that access is limited
• how you log and follow up access
• what retention routines you have, and that they are followed
• what information employees have been given about the handling
• whether you have carried out a data protection impact assessment (DPIA), which is often warranted where health data about employees is concerned

If an unauthorised person has gained access to the data — a colleague in a shared team, for instance — that counts as a personal data breach. It must be reported to IMY within 72 hours. Shortcomings in the handling of sensitive data can lead to substantial administrative fines.

In the public sector there is more to consider: chat messages can be official documents, and confidentiality rules for personnel matters and archiving legislation govern both protection and preservation.

How to get it right

• Give sick leave reporting its own channel. Use a sickness absence system, the phone or a form rather than chat.
• Decide what may be recorded. Produce a simple guideline for managers: dates and extent yes, diagnoses and speculation no.
• Keep rehabilitation documentation in one place. Choose a rehabilitation system or a locked space where only HR and the immediate manager have access, and where access is logged.
• Clean up what is already there. Go through existing chats and folders, and introduce retention rules in Microsoft 365.
• Update the documentation. Review your record of processing activities, the information given to employees and your impact assessment.
• Train the managers. Most mistakes are not down to carelessness but to no one having explained where the line runs.

Rehabilitation and data protection belong together

Handling sickness absence well is about more than compliance. Employees who trust that their data is treated carefully find it easier to be open about how they are doing. That in turn makes early rehabilitation work more effective.

Helo Hälsa supports employers across Sweden with routines for sickness absence and rehabilitation, systematic work environment management and leadership training. Would you like to review how your organisation handles sick leave reports and health data? Get in touch and we will help you find an approach that works day to day and holds up in an inspection.

This article gives a general description of the rules and is not legal advice in an individual case.