Jump to content

  • Quick Navigation
- - - - -

Medical screening BRC 7.3.1 & 7.3.2 vs privacy law

BRC v8 privacy law EU medical screening

  • You cannot start a new topic
  • Please log in to reply
3 replies to this topic

#1 ilonar


    Grade - AIFSQN

  • IFSQN Associate
  • 45 posts
  • 13 thanks

  • Netherlands

Posted 26 March 2019 - 09:08 AM

BRC has 2 specifc requirements for medical screening of employees, visitors and contractors:


7.3.1  The site shall make employees aware of the symptoms of infection, disease or condition which would prevent a person working with open food. The site shall have a procedure which enables notification by employees, including temporary employees, of any relevant symptoms, infection, disease or condition with which they may have been in contact or be suffering from.


7.3.2 Where there may be a risk to product safety, visitors and contractors shall be made aware of the types of symptoms, infection, disease or condition which would prevent a person visiting areas with open food. Where permitted by law, visitors shall be required to complete a health questionnaire or otherwise confirm that they are not suffering from any symptoms which may put product safety at risk, prior to entering the raw material, preparation, processing, packing and storage areas.


What my company is doing to comply with these requirements is:

- we have a form filled in by employees, visitors and contractors in which they have to declare that they have any of the folowwing diseases: hepatitis, food poisoning, open wounds, dysentery,  (and the list continues...) - this is something that the Technical Managers of British clients/customers want to see, specially if you have to comply with any other special standard from them.

- in the hygiene rules we put the sentence:  

·         All staff should inform their superiors and not enter production in case they are suffering of the following symptoms: fever, diarrhoea, vomiting, dizziness, nausea, open wounds, skin diseases, ear infections, influenza, severe coughing, stomach ache, nasal drainage.

·         In case of diarrhoea or vomiting, it is only allowed to re-enter production after a period of 48 hours without any symptoms. 

·         Inform the Management of any overseas travel. 

- at reception, in the canteen and at the entrance door in the production area we have a list with the symptoms from the hygiene rules and the sentence : don't enter production and inform Floormanager in case you are suffering of any  of these symptoms.


During our last internal audit we asked the internal auditor to sign the hygiene rules for visitors and the above mentioned form that they are not suferring from those diseases. He said that we should be carefull with that form because under the new EU privacy law it is not allowed anymore to ask from which diseases people might suffer. But then you get into contradiction with British clients who specifically ask for that. But at the same time first you have to comply with the law and after that you look at what your client wants and if it is not against the law, you can comply with it. The Dutch law goes so far that in case an employee is sick, he can only voluntarely say what he's disease is, the employer is not allowed to ask it. Also, this is an information that I found on the webpage of AVG (Authority for personal data)

"Uw werkgever mag ook niet rechtstreeks aan u vragen een vragenlijst in te vullen waarin medische gegevens worden gevraagd. Ook niet met uw toestemming."   This means that the employer is not allowed to ask the employee to fill in a questionnaire in which medical information is being asked. Even if the employee agrees with it. 

I recently had some experience with the company doctor, which had to evaluate the conditions under which I'm allowed to work. The company doctor doesn't have any access to my medical files from the hospital/family doctor, out of privacy reasons. After we discussed about my condition, he asked if my employer knows the nature of my disease/condition, because otherwise he is not allowed to mention it in the letter with recommendations that he will send to the employer. 


I checked the requerements of 7.3.1 and 7.3.2, and basically we comply with them if we remove the form with the names of the diseases that we ask everybody to sign at the moment. How are you complying with these requirements and how do you see the situation of law vs client requirement, whether you are in the EU or outside the EU?


#2 pHruit


    Grade - FIFSQN

  • IFSQN Fellow
  • 1,244 posts
  • 532 thanks

  • United Kingdom
    United Kingdom
  • Gender:Male
  • Interests:Composing/listening to classical music, electronics, mountain biking, science, sarcasm

Posted 26 March 2019 - 09:20 AM

We're in the UK so theoretically working under the same EU-level GDPR requirements. Last year our entire company went through a review with an external consultant in preparation for when GDPR took effect, and this looked at data collection and use across HR, factory/technical/QA, sales, finance etc.

We have made no changes to our visitor assessment, which being in the UK is very similar to that which you describe as being requested for your British clients. This form does include an explicit statement of consent, but as it contains sensitive personal data it must be stored and used accordingly - be clear that the data will only be used for one purpose, and stored securely.

Aside from obtaining specific consent (which is by far the simpler option), I believe there could also be justification under the "legitimate basis" provisions - the broader interest of protecting foodstuffs, and thus subsequent consumers, from transmissible diseases is almost certainly justification in its own right for needing to ask these types of question.


With the specific extra requirement that you have under Dutch law, whilst you may not be able to ask specifically what disease it was, surely you can mandate a signed doctors note confirming that the employee has recovered and has been free of symptoms for a sufficient period? This would cover your site medical requirements whilst avoiding directly asking for any information on specific conditions.

#3 Charles.C


    Grade - FIFSQN

  • IFSQN Moderator
  • 17,095 posts
  • 4765 thanks

  • Earth
  • Gender:Male
  • Interests:SF

Posted 26 March 2019 - 09:51 AM

these links appear generic so food may bring some exclusions but perhaps of related interest -






afaik, UK food facilities basically follow the requirements of a document attached several times on this forum - "fitness to work"

Kind Regards,



#4 ilonar


    Grade - AIFSQN

  • IFSQN Associate
  • 45 posts
  • 13 thanks

  • Netherlands

Posted 26 March 2019 - 01:27 PM

My company has an internal rule that however is sick has to call in the morning between 8 and 9 with the secretary  and report themselves sick. Usually (to be understood always) they immediatelly tell her what the problem is, so we always know what  is wrong with them . If it is something seriouse and they need to be for a longer time on sickness leave, the company doctor is informed and an appointment for a visit to the company doctor will be made. The company doctor comes with a recommendation for the return to work of the employee (how long he still has to stay at home, working conditions, how many hours per day he can work after return). The employer has to take this recommendation in consideration during the talks with the employee about his new working hours and conditions of work.


I'm more worried about how it will be interpreted in the future by  foreigners the fact that we don,t have the questionnaire. And even if you have the questionnaire, you might still get the "correct answer", while people are sick, just because they don't want to tell you that they are sick.   

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

EV SSL Certificate