Health Data and Special Category Data

Medical records, counselling notes, employment medicals — the stricter rules for the most sensitive data, and how to use your rights over it.

The GDPR ring-fences special categories of personal data — health, genetic and biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life and sexual orientation — behind a general prohibition on processing, lifted only where a specific condition applies: explicit consent, medical care, employment law obligations, legal claims and a handful of others.

For most people the practical centre of this topic is health data: getting your own records, controlling who else sees them, and the employment medical reports that sit between you, a doctor and your employer. Those are the questions this guide answers.

Accessing your medical records

Your right of access applies fully to health records — GP files, hospital charts, consultants' correspondence, test results, and private clinic records, along with counselling and psychology notes. The route is a standard access request to the practice or hospital's records office, with the same one-month clock as any request.

Limited qualifications exist: Irish law permits withholding health data where disclosure would be likely to cause serious harm to your physical or mental health — a narrow provision applied on clinical advice, not a general veto — and third-party information within records (family members, other patients) may be redacted. Deceased persons' records fall outside the GDPR and run under different rules, which matters frequently in probate contexts.

Employment medicals and occupational health

When your employer refers you to occupational health, three parties hold different positions: you, the clinician (who owes you clinical confidentiality), and the employer (entitled to fitness-for-work conclusions, not your file). The well-run version: the employer receives a report addressed to the referral questions — fit, unfit, adjustments recommended — while the underlying clinical detail stays with the clinician.

You are entitled to access the occupational health file about you, and in disputes about sick leave, capability or dismissal, that file plus the referral correspondence (what the employer actually asked) is frequently decisive. Employers holding detailed diagnoses they never needed is a recurring compliance failure — and a live issue in any subsequent dispute.

Who else can see health data

Insurers, solicitors in litigation, and family members all regularly seek health information, and the rule is consistent: disclosure needs a lawful gateway — your explicit consent (read what you sign for insurers and PIAB processes: the scope of the consent is the scope of the disclosure), a court process, or a statutory basis. Practices disclosing to family without authority, or employers ringing GPs directly, are classic infringements.

Where health data is wrongfully disclosed, the compensation route is at its strongest: courts treat health information as the paradigm sensitive category, and genuine distress from its exposure is the clearest form of non-material damage. See our compensation guide.

Biometrics and the workplace clock

Fingerprint and facial-recognition time-and-attendance systems process biometric data — special category — and need more than administrative convenience to justify them: a specific condition, a proportionality analysis asking whether a card or PIN would do, and genuine alternatives for those who object. European regulators have repeatedly found workplace biometric attendance systems disproportionate where less intrusive options exist, and Irish employers deploying them casually are carrying unexamined risk.

Frequently asked questions

Can my GP refuse me my own records?

Only narrowly — health data can be withheld where disclosure would be likely to cause serious harm to your physical or mental health, applied on clinical judgment, and third-party details may be redacted. A general refusal of access is not lawful.

Is my employer entitled to my diagnosis?

Generally no — occupational health referrals should return fitness-for-work conclusions and recommended adjustments, not clinical detail. An employer holding diagnoses it never needed is a compliance failure worth challenging, especially in a dispute.

Can I access counselling or psychology notes?

Yes — they are health records within your right of access, subject to the same narrow serious-harm and third-party qualifications as other health data.

Can my employer require fingerprint clock-in?

Biometric attendance needs a special category condition and a proportionality justification, and regulators have often found it disproportionate where cards or PINs would serve. At minimum, expect genuine alternatives for objectors.

What about a deceased relative's medical records?

The GDPR applies to living persons, so deceased records run under separate rules and access routes — a question that arises regularly in probate matters, where we can advise through the estate context.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.