According to the Personal Data Protection Office, "Maintaining a good relationship with a business partner is not a reason that justifies the controller if he or she uses data to which he or she is not entitled. Even more so when it involves communicating information about the reasons for that employee's absence related to health." 

In other words, communication delays in the relationship with a business partner caused by an employee's illness is not a reason to provide that business partner with information about the details of the employee's illness. In this particular case handled by the Personal Data Protection Office, the business partner was informed that the employee was on L-4 sick leave due to “poor emotional state."

Although general information about an employee's illness (without going into details) is often a "fact of common knowledge" in an organization, we must not forget that even such general information constitutes special category data. It is therefore important to remember that an employer should not inform external parties that illness is the cause of an employee's absence.   

First, employers should manage autoresponders wisely and, in a situation where the autoresponder is set up by the organization, include only the necessary information such as the fact of absence itself and the details of the replacement person. 

Second, managers should be properly trained on what information about employees can be communicated externally. In the case of a sudden and unexpected absence of an employee, it should be sufficient to provide the business partner with information that such an absence is taking place. In exceptional situations, where the employee's role is crucial, to justify the delay it is permissible to provide information about illness, provided that no details are provided. 

Find more in the PRO HR November 2023