GDPR and drug testing in the workplace – everything you need to know
Drug test results are sensitive personal data under Article 9 of the GDPR. Here is how to handle the legal basis, storage, recipients and rights in a legally sound way.
Drug test results are among the most sensitive personal data an employer handles. The GDPR imposes strict requirements on everything from the legal basis to the retention period. This article goes through what you need to have in place. For broader legal background, see our guide on the employer's right to drug test.
Which category of personal data?
Drug test results are classified as health data and therefore fall under Article 9 of the GDPR – special categories of personal data. This means that the usual legal basis in Article 6 is not enough; you must also have a basis in Article 9.
Legal basis – why consent is problematic
The simple answer would be "we obtain consent from the employee". The problem: in an employment relationship, it is difficult to argue that consent is freely given – the relationship is unequal. The Swedish Data Protection Authority (Datainspektionen, now IMY) has warned against relying on consent as the legal basis in employment relationships.
The robust basis for drug testing is instead Article 9(2)(b): processing that is necessary for carrying out obligations in the field of employment and social security law – combined with the requirements of the Swedish Work Environment Act (Arbetsmiljölagen). This must be clearly documented in the policy.
Purpose and proportionality
Processing may only take place for the specific purpose (as a rule, occupational safety and a safe workplace). The purpose should be as narrow as possible and documented in the record of processing activities.
Recipients – who may see the result?
Only people who need the result in order to take action. For most workplaces, this means the HR manager + the immediate manager in the event of a positive result – not the entire management team, not the finance department, not the IT administrator. The MRO physician has separate protected handling under the Swedish Patient Data Act (Patientdatalagen).
Storage and deletion
Negative results can be deleted fairly quickly – often within 6 months. Positive results may need to be kept longer if they lead to action, but no longer than necessary for rehabilitation or any legal proceedings. Define a deletion schedule in the policy.
The rights of the data subject
The employee has the right to:
- Receive information about the processing (transparency)
- Request a copy of their data
- Request rectification
- In certain cases request erasure – but this is often limited because the work environment responsibility takes precedence
- Lodge a complaint with IMY
Data processor – about the lab
When you engage Provsvaret for analysis, we handle personal data as a data processor on your behalf. A data processing agreement (DPA) is required and is included in our agreement. We use accredited laboratories within the EU and have strict technical and organisational security measures.
Data protection impact assessment (DPIA)
System-level drug testing (random checks, all employees) is usually considered to require a DPIA. It is a requirement that is often missed – plan for it.
Summary
GDPR compliance in drug testing requires: a legal basis in the policy (not consent), a clear purpose, a narrow group of recipients, a defined deletion schedule, a working record of processing activities, a DPIA, and DPAs with external processors. Provsvaret helps you check that everything is in place – contact us for a review.
Want to know more?
Contact us for personalized advice on drug testing and how we can help your organization.
