Psychosocial risks enter the European campaign, and the DPO is involved more than you think

Why a mental health campaign lands on the DPO's desk

The question looks misplaced: mental health belongs to the occupational physician and the prevention officer, not to the data protection officer. But campaigns like this always produce the same practical consequence: companies start measuring. Wellbeing questionnaires, climate surveys, work-related stress assessments, psychological support platforms offered as a benefit. Every tool collects data, and almost always health data.

• A stress questionnaire that allows tracing back to the person processes health data, and needs an Article 9 condition
• Aggregation is not automatic: if a department has six people, 'aggregated by department' identifies
• A psychological support platform offered to employees is the provider's processing, not the employer's: the employer must not know who uses it
• Employee consent is a fragile legal basis given the imbalance, and that does not change because the initiative is benevolent
• The retention period must be decided before the survey goes out, not after seeing the results

What the case studies say

The interesting distinction is between the six systemic cases and the three company ones. The former concern national or sectoral initiatives to raise awareness and strengthen prevention, the latter interventions decided and run inside a single firm. It is the same distinction the DPO needs: a sectoral initiative works on aggregate data and rarely raises issues; a company intervention works on identifiable people and almost always does.

The campaign says it will look at 'new and overlooked occupational groups, sectors and areas'. Translated for consultants: the sectors where the topic has never been addressed are also the ones with no procedure, no privacy notice and no retention period. Those are the clients who will call in six months.

The link to risk assessment

In several member states work-related stress is already subject to mandatory assessment inside the risk assessment document. What a European campaign changes is not the obligation, it is the attention: more inspections, more questions, and documents still based on a template downloaded ten years ago become visible. For the DPO it is the chance to look at that chapter and check whether the assessment relied on data collected from workers, and under which notice.

The campaign starts in October and runs for three years. Long enough to become a recurring topic with clients, short enough that it pays to arrive with the procedures already written rather than after the first request.