In May, a comprehensive amendment to the legislation introducing further changes related to RODO, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), entered into Polish law. The amendments covered 160 laws, including but not limited to the provisions of the Labour Code. Today, I invite you to read an article on the protection of personal data in a context that is Breathalyser testing of employees.
This issue has recently become a very interesting topic among employers and arouses much controversy. Therefore, it is worthwhile to take a closer look at this issue and discuss in more detail the rights and obligations of employers related to it. I encourage you to read, first of all, entrepreneurs, who have to answer the question whether their actions do not violate the provisions on personal data protection.
Sobriety status - health data?
To start with, it is worth recalling the concept of personal data and the classifications of personal data under the RODO. According to Article 4(1) of the RODO, personal data means:
, "information about an identified or identifiable natural person ('data subject')."
An identifiable natural person is one who can be identified, directly or indirectly, in particular by an identifier such as:
- name,
- identification number,
- location data,
- Internet ID or
- one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of an individual.
Ordinary personal data, business data and sensitive data
- Ordinary personal data are, for example, name, home address or telephone number.
- Business personal data, on the other hand, is data related to an individual's employment. Examples of this would be the business email or business phone of the employee concerned.
- Specific data, on the other hand, is listed in Article 9(1) of the RODO, while prohibiting the processing of such data in principle: "The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person or data concerning the health, sexuality or sexual orientation of that person shall be prohibited."
Intuitively, it is difficult to consider sobriety data as health data. This would imply significant limitations to their processing. Admittedly, information on the state of sobriety in some way refers to the physiological state of an individual, which can be deduced from recital 35 of the RODO according to which:
"Personal health data should include all data about the data subject's health which reveal information about the past, present or future state of the data subject's physical or mental health. Such data include information about an individual collected during his or her registration for health care services or during the provision of health care services to him or her, (...) information derived from laboratory or medical examinations of body parts or bodily fluids, including genetic data and biological samples; and any information, for example, about a disease, disability, disease risk, medical history, clinical treatment or physiological or biomedical condition of the data subject, regardless of its source, which may be, for example, a doctor or other health professional, a hospital, a medical device or an in vitro diagnostic test."
However, this is in my view an interpretation that goes too far.
Unfortunately, for the time being, the Office for the Protection of Personal Data (hereinafter: OPA) takes a different view, as discussed below.
Breathalyser testing of employees - changes in the Labour Code
One of the main changes related to the amendment of the legislation I mentioned at the beginning was the introduction of Article 22 (1b) to the Labour Code. According to the indicated provision, data concerning the employee's health can be processed by the employer, only with the employee's consent.
The UODO issued a communication indicating that, as the law currently stands, employers cannot carry out sobriety checks on employees on their own, as the added Article 22 (1b) of the Labour Code, which is effective as of 4 May 2019, specifies that so-called special category data, including health data, can be processed by the employer when the employee or job applicant gives his or her consent and provides such data on his or her own initiative. According to the DPA, knowledge of whether someone is intoxicated is therefore information about a health condition. Accordingly, an employer, in the opinion of the DPA, cannot perform a breathalyser test of an employee on its own.
Sobriety testing - what should it look like under RODO?
The DPA pointed out that the circumstances and principles under which an employee's sobriety test may be conducted are set out in Article 17 of the Act of 26 October 1982 on Upbringing in Sobriety Counteracting Alcoholism, hereinafter referred to as the 'Act'. According to Article 17 of the Act:
"The manager of the workplace or the person authorised by him/her shall be obliged not to allow an employee to work if there is a reasonable suspicion that he/she has come to work in a drunken state or has consumed alcohol while at work. The circumstances forming the basis of the decision should be made known to the employee." (...)
"At the request of the manager of the workplace, a person authorised by him or her, as well as at the request of the employee referred to in paragraph 1, a test of the employee's state of sobriety shall be carried out by an authorised body appointed to protect public order. (...)"
According to the above provision, two conditions must be met together:
- testing may take place on an employee who is reasonably suspected of having consumed alcohol while at work or of having appeared for work in an alcohol-impaired state,
- the test is carried out by an authorised law enforcement authority (e.g. police or municipal police).
It is worth noting that the provisions of the Act in this form have been in place for years. However, it is only now that attention has been drawn to the limitations arising from it. According to the DPA, random or preventive breathalyser tests of employees are excluded.
Every employer is probably asking himself at this point whether this restriction actually also exists in certain professions or industries. For example, in the construction industry, where, due to the need for public safety, employers should be able to carry out employee sobriety tests on their own, including random tests. Unfortunately, the DPA stresses that this restriction applies to all employers. However, the concerned employer communities should initiate relevant legislative work to amend the current legislation.
Sobriety tests for persons employed under civil law contracts
The issue of the possibility of breathalyser testing of employees has apparently been dealt with very strictly. However, the question arises as to whether a similar restriction also operates in relation to persons with whom the entrepreneur cooperates on a contract of mandate or on a B2B basis. The answer is not clear. Due to the fact that Article 17 of the Act only uses the concept of employees and does not explicitly mention, for example, contractors, a direct interpretation of the provision could lead to the conclusion that the restriction only applies to the examination of persons employed under an employment contract. However, in my opinion, such a conclusion would be too risky due to the analogous application of many labour law provisions to other types of contracts as well.
In the current situation, self-testing employees with a breathalyser involves certain risks. This also applies to contractors or persons cooperating on a B2B basis. However, our law firm has prepared a set of guidelines according to which the test should be carried out:
- Above all, it is safest if the breathalyser test has its basis in the terms and conditions of service presented to those working with you. This is because it must be made clear to your contractors that you have this right.
- Testing, as for employees, should only take place when there is reasonable doubt about the state of sobriety. Such information should also be included in the regulations. It is also necessary to obtain the consent of the principal.
- A record of the breathalyser test activity should be made. The record should refer to the relevant section of the regulations and state that the principal has consented to the test. The protocol should be signed by you and the principal.
- The client should also sign a consent to the processing of personal data in the form of sobriety status and read the information clause specially prepared for this purpose.
Breathalyser test for employees - podsummary
The above-mentioned guidelines, in my opinion, provide maximum security for your actions in this field. Of course, our law firm's team is available to assist you in the preparation of the above documents. At the same time, as I have mentioned above, I would like to stipulate that with the independent examination of contractors, there is a risk that such actions will be challenged by UODO. This issue therefore remains within the sphere of your business decisions.
