Occupational health records sit in the same shared drive folder as ordinary manager KPI spreadsheets. What is the key compliance failure?
Select an answer to reveal the explanation.
Short Explanation
Medical notes next to sales scorecards is like leaving X-rays on the break-room fridge. Health data is special-category stuff—lock it down and separate who can see it. Shared-drive soup fails that test.
Full Explanation
Occupational health records sitting in the same shared drive folder as ordinary manager KPI spreadsheets primarily fail because employee health data requires heightened protection and role separation; co-mingling with general manager files undermines confidentiality. Medical information next to sales scorecards is a classic special-category exposure pattern that can stigmatise workers if mis-seen. Saying health data may be freely mixed with performance metrics if both concern employees fails Article 9 seriousness and need-to-know. Claiming KPI data must always be stored in the same system as medical files for accuracy fails—accuracy does not require co-mingling sensitive health files with managerial spreadsheets. Asserting shared drives eliminate Article 9 conditions because access is ‘internal only’ fails: internal access is still processing and does not waive special-category rules. Exam caveat: occupational health processing needs an Article 9 condition plus strong TOMs; segregation of duties between HR managers and occupational-health professionals is a common control expectation. Operational check: move health records into a restricted occupational-health system, revoke manager drive access, document Article 9 grounds, encrypt and log access, and train staff on special-category handling.