The Lower Saxony data protection authority ('LfD Niedersachsen') published, in December 2022, a note on data processing in connection with employees' submission of work incapacity certificates and their continued remuneration in the event of illness. In particular, the LfD Niedersachsen stated that, within the framework of the assessment procedure for determining incapacity for work and continued payment of remuneration, employers engage in the processing of employees' personal data pursuant to the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), including processing of employees' contact details, health insurance details, and special categories of personal data.

In this regard, the LfD Niedersachsen highlighted that its note is intended to provide both the controller/employer, as well as employees an overview of the data protection requirements to be observed in the assessment procedure mentioned above. As such, the LfD Niedersachsen clarified that the note covers data protection considerations, including the following:

• legal bases for private and public bodies processing employees' data;
• authorising access to employees' personal data;
• transfer of data between health insurance funds and the employer;
• retrieval of certificates for incapacity to work;
• technical and organisational measures for processing health data; and
• notes for implementation in practice.

You can read the note, only available in German, here.