Processing personal data is an extremely responsible task, especially when it comes to the category of more sensitive personal data outlined in Regulation (EU) 2016/679 (“the Regulation”). Information regarding a person’s health status, such as the results of alcohol and substance tests, is no exception.
1. Categorization of the data
The first fundamental question relates to the category of personal data that the information from such tests represents. According to the Regulation, such data falls under the category of “health data.” This is the understanding of the Commission for Personal Data Protection. It is natural since these tests contain information about the individual’s physical condition (alcohol or other substance concentration in the employee’s blood).
At the same time, the information also falls under the “special categories of personal data” as defined in Article 9(1) of the Regulation, as stated by the Commission for Personal Data Protection. In this provision, it again refers to data concerning “health status,” which is the basis for treating the information collected from the tests as “special” or “sensitive” personal data.
2. Legal basis for data collection
Article 9(1) of the Regulation establishes the general principle that the collection of the listed data is prohibited. However, the second paragraph lists exceptions under which the collection of such data would be permissible, subject to various obligations and considerations. The hypothesis that provides the basis for an employer to collect information from alcohol and substance tests is found in subparagraph “b” of the second paragraph. It relates to information processing “necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment law…”. This is where the connection with the provisions of the Labor Code regarding the employee’s obligation to report for work in a condition that allows them to perform their work duties arises – Article 126, point 2; Article 187, paragraph 1, point 2; Article 199. For some employers, the basis may be found in the legal requirements imposed on them. It is important to note that in such cases, the basis of “consent” is not applicable.
This obligation on the part of the employee corresponds to the employer’s right to conduct tests for the presence of alcohol or other substances in the blood. The aim is to establish a condition in which the employee cannot perform their work duties, thus realizing their disciplinary responsibility. It is through this path that the Commission for Personal Data Protection establishes the legal basis for collecting such data.
A seemingly insignificant but potentially significant clarification by the Commission for Personal Data Protection is that such tests should be conducted “on reasonable suspicion” regarding the employee’s condition. This serves as an argument against spontaneous random testing.
3. Employer’s obligations in the data collection process
Given the sensitivity of the data collected from such tests, the employer has several obligations regarding the collection and storage of the data.
Articles 12 and 13 of the Regulation outline several obligations on the employer in such a scenario. On one hand, it involves providing accessible information to the data subject regarding the processing of their collected personal data. On the other hand, the employee should receive clear and precise information about the data collection, particularly the reasons and legal basis for it.
An important obligation, applicable not only to this specific type of personal data but also to all others, is the requirement under Article 5(1)(d) of the Regulation for the data to be stored for a period compatible with the purposes for which they were collected. The Commission for Personal Data Protection refers to the timeframes for protecting rights and interests through legal proceedings, as set out in the Labor Code.
Last but not least, all actions taken regarding the collection and storage of this personal data should be duly recorded by the employer.
The article above is for information purposes only. It is not (binding) legal advice. For a thorough understanding of the subjects covered and prior acting on any issue discussed we kindly recommend Readers consult Ilieva, Voutcheva & Co. Law Firm attorneys at law.
