Is information about being under the influence of alcohol considered special category data at all?
It should be emphasized that this issue is of significant importance for assessing whether there is a legal basis for conducting sobriety tests on employees and indicating what that basis would be.
Receive a package of free GDPR guides and micro-trainings
A broader explanation of the concept of health data can be found in Recital 35 of the GDPR:
„Health-related personal data includes all data concerning the health status of the individual to whom the data relates, revealing information about the past, present, or future physical or mental health status of that individual. Such data includes information about a natural person collected during their registration for healthcare services or during the provision of such healthcare services, as defined by Directive 2011/24/EU of the European Parliament and of the Council; a number, symbol, or identifier assigned to a natural person for the purpose of uniquely identifying that individual for health purposes; information derived from laboratory or medical examinations of body parts or bodily fluids, including genetic data and biological samples; and any information, for example, about disease, disability, disease risk, medical history, clinical treatment, or physiological or biomedical condition of the individual to whom the data relates, regardless of its source, which may be, for example, a doctor or other healthcare professional, a hospital, a medical device, or an in vitro diagnostic test.”
Important
It should be emphasized that it is difficult to define concepts such as physiological or biomedical state, hence it cannot be unequivocally determined whether information about the amount of alcohol in exhaled air constitutes special category data.
In the publication “GDPR. General Data Protection Regulation. Commentary” edited by Edyta Bielak-Jomaa and Dominik Lubasz (Warsaw 2018), the authors state that data about addictions should be classified as data revealing information about a person's health (commentary on Article 4 point 15). However, it should be noted that an addiction is different from a one-time intoxication. It is also worth mentioning Article 27 of the non-binding Act of August 29, 1997 on the Protection of Personal Data, which separately indicates health data and data on addictions among “sensitive” data. This suggests that the creators of the “old” Personal Data Protection Act did not treat information about addictions as health data.
In the publication “EU Regulation on the Protection of Natural Persons in Relation to the Processing of Personal Data and on the Free Movement of Such Data. Commentary” authored by Paweł Litwiński (editor), Paweł Barty, and Maciej Kawecki (Warsaw 2018), there is an opinion that the mere information about addictions (e.g., frequent smoking, drinking alcohol, or using psychoactive substances) will not constitute information about health status (commentary on Article 4 point 15).
Legal Bases for Conducting Tests Assuming that Data on Intoxication is Ordinary Data
Assuming that data on being under the influence of alcohol is ordinary data, the legal basis for conducting breathalyzer tests by the employer should be indicated as:
- Article 6 paragraph 1 letter c GDPR, i.e., processing is necessary for the fulfillment of a legal obligation to which the data controller is subject (the obligations are discussed below) and accordingly Article 221§ 4 of the Labor Code
- Article 6(1)(f) of the GDPR, i.e., processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, whereby the legitimate interest of the employer will be to ensure the safety of persons and property with which the employee comes into contact – the interests of the employer and the third party will here take precedence over the interest of the employee;
- Article 221a § 1 of the Labour Code, i.e., the consent of the employee, which must relate to personal data provided by the employee at the request of the employer or transferred to the employer at the initiative of the employee.
From a number of legal provisions, one can deduce the obligation for the employer to conduct breathalyzer tests.
The provision of Article 94 point 4 of the Labour Code states that the employer is obliged to ensure safe and hygienic working conditions, whereby the employer is required to provide the employee with actual safety, not just to fulfill obligations arising from generally applicable health and safety regulations (thesis of the judgment of the Court of Appeal in Szczecin of 12.10.2017, case file III APa 7/17, Legalis 1720068). It is worth emphasizing that the employer's liability under Article 415 of the Civil Code also occurs in the event of the employer's failure to ensure safe working conditions when the indications in this regard do not arise from legal norms (thesis of the judgment of the Supreme Court of 13.09.2016, case file III PK 146/15, Legalis 1507266).
Similarly, according to Article 207 § 2 of the Labour Code, the employer is obliged to protect the health and life of employees by ensuring safe and hygienic working conditions with appropriate use of scientific and technical achievements. In particular, the employer is obliged, among other things, to ensure compliance with the regulations and principles of occupational health and safety in the workplace.
The employee is obliged to be sober at work, which directly follows from Article 108 § 2 of the Labour Code, which states, among other things, that for non-compliance by the employee with safety and hygiene regulations or fire regulations, or for reporting to work in a state of intoxication or consuming alcohol during work, the employer may impose a financial penalty. This was confirmed by the Supreme Court in its judgment of December 4, 2018 (case reference: I PK 194/17, Legalis 1852725), in which it stated that being sober is an unexpressed expressis verbis fundamental obligation of the employee.
Additionally, as rightly noted by the Supreme Court in the aforementioned judgment:
„There is no doubt that an employee's presence at the workplace and during working hours (while performing their employment duties) in a state of intoxication (Article 46(3) of the Act on upbringing in sobriety and counteracting alcoholism), or even merely in a state after consuming alcohol (Article 46(2) of this Act), may be treated as a serious violation of fundamental employee obligations within the meaning of Article 52 § 1 point 1 of the Labour Code. Moreover: The employer's control actions are justified in this case by the necessity to verify the employee's compliance with the obligation of sobriety, which consequently enables proper accounting of working time (e.g., classifying a given working day or part of it as an unjustified absence from work, without retaining the right to remuneration), holding the employee accountable for disciplinary (Article 108 of the Labour Code) or material (Article 122 of the Labour Code) responsibility, and finally terminating the employment relationship with the employee (Article 52 § 1 point 1 of the Labour Code)”.
Finally, according to Article 17(1) of the Act on upbringing in sobriety and counteracting alcoholism, the manager of the workplace or a person authorized by them is obliged to prevent an employee from working if there is a justified suspicion that they reported to work in a state after consuming alcohol or consumed alcohol during work.
Legal grounds for conducting an examination assuming that data on the state of intoxication is sensitive data
Even if we assume that data on the state after consuming alcohol is sensitive data, the legal basis for processing it by the employer may be:
- art. 9 para. 2 lit. b GDPR, i.e., processing is necessary for the fulfillment of obligations and the exercise of specific rights by the data controller in the field of labor law, provided that it is permitted by Union law or the law of a Member State, in connection with art. 221 § 4 of the Labor Code, which states that the employer may request the provision of other personal data than those specified in § 1 and 3, when it is necessary to realize a right or fulfill an obligation arising from a legal provision – as this provision applies to both ordinary data and special categories of data;
- art. 9 para. 2 lit. f GDPR, i.e., processing is necessary for the establishment, exercise, or defense of legal claims – as a number of claims may arise in the context of an employee being in a state of intoxication, both between the employer and the employee, and between the employer and third parties;
- art. 9 para. 2 lit. a GDPR in connection with art. 221b § 1 of the Labor Code, which states that special categories of data referred to in art. 9 para. 1 GDPR may be processed based on the employee's consent, provided that they were provided at their initiative – it is rather unlikely that an employee would voluntarily wish to be tested with a breathalyzer, although it is not excluded.
Interpretation of art. 17 para. 1 of the Act on Prevention of Alcoholism and Promotion of Sobriety
Preventive sobriety testing using a breathalyzer may serve as a specific tool to establish reasonable suspicion that an employee is under the influence of alcohol, which obliges the employer to prevent them from working. In the judgment of December 4, 2018 (case no: I PK 194/17, Legalis 1852725), the Supreme Court states:
„The suspicion must be justified; it cannot be based solely on a subjective belief about the employee's intoxication. It must arise from objective circumstances that would allow any average person to form such a suspicion. These may include, for example, motor disturbances, staggering gait, slurred speech, inappropriate reactions, or the smell of alcohol. It is commonly accepted (based on life experience) that such behavioral symptoms may indicate that a person is in a state of alcohol intoxication”.
Important:
While it is necessary to agree with the position of the Supreme Court that the behaviors mentioned are commonly recognized as symptoms of alcohol intoxication, it cannot be overlooked that a significantly more objective basis for forming a reasonable suspicion would be to verify the employee's condition using a breathalyzer. Behaviors such as inadequate reactions or slurred speech may result from various medical conditions, and only a breathalyzer test would allow for a much greater certainty in establishing that there is a reasonable suspicion, and consequently, appropriate services should be engaged to conduct a proper examination.
Behaviors such as inadequate reactions or slurred speech may result from various medical conditions, and only a breathalyzer test would allow for a much greater certainty in establishing that there is a reasonable suspicion, and consequently, appropriate services should be engaged to conduct a proper examination.
Interpretation of Article 17(3) of the Act on Prevention of Alcoholism and Promotion of Sobriety
For the assessment of the permissibility of conducting breathalyzer tests by the employer, the proper interpretation of Article 17(3) sentence one of the Act on Prevention of Alcoholism and Promotion of Sobriety is of great importance (“At the request of the employer, a person authorized by them, as well as at the request of the employee referred to in paragraph 1, the sobriety test of the employee shall be conducted by an authorized body appointed to maintain public order”). As indicated by the analysis of case law, this provision should be understood in such a way that it does not exclude the employer from conducting the test independently using a breathalyzer, however, it obliges them to call upon the authorized body in situations where such a request is made by the employee or when the employer intends to draw consequences from the test results.
In the aforementioned judgment of December 4, 2018 (case reference: I PK 194/17, Legalis 1852725), the Supreme Court states:
“The test should be conducted at the request of the employer if the employee does not make such a request, and the employer intends to subsequently draw legal consequences from the employee's sobriety (intoxication) status.”
Conversely, it should be assumed that if the employer does not intend to impose legal consequences on the employee, it is not necessary to conduct an examination by the authorized body. In a situation where a breathalyzer test does not indicate the presence of alcohol in the exhaled air, thereby dispelling the employer's doubts in this regard, it is obvious that the employer will not impose legal consequences on the employee. Furthermore, in the justification of this ruling, the Supreme Court indicated:
„As emphasized in the doctrine, […] the content of Article 17(3) of the Act on Sobriety Education in its current wording raises interpretative doubts. The issue of the permissibility of conducting a sobriety test on an employee by the employer or a person authorized by them is not entirely clear, which previously was not subject to discussion (and was considered permissible). […]
The use by the employer of a non-certified device to test for alcohol content in the body does not preclude accusing the employee of reporting to work after consuming alcohol if other circumstances support this (e.g., atypical behavior of the employee, detectable smell of alcohol), and the employee did not take advantage of the opportunity provided to verify the test result. […]
The essence of the case being considered was what actions the employee and employer should take in the event that a sobriety test conducted with a breathalyzer available to the employer indicates that the employee is inebriated. A positive test result (indicating the presence of alcohol in the employee's body) may be treated as a basis for factual presumptions that the employee is in a state of having consumed alcohol or is inebriated. Consideration was required regarding how the employer and the employee, who disputes the result of the conducted test, should behave in such a situation. […]
Provide employees
with valuable e-training - for free
It's simple - copy and send them the appropriate links.
The above quotes from the justification of the Supreme Court ruling indicate the acceptance of the permissibility of using a breathalyzer to test the employee's sobriety by the employer, who, however, in the event of a positive result, should call the appropriate services to carry out the proper test – which contradicts the main thesis of the ruling that only the competent authority could perform the sobriety test.
A similar thesis can be derived from the ruling of September 22, 2004 (case reference: I PK 576/03, Legalis 67232), in which the Supreme Court states: "The use by the employer of a non-certified device to test the alcohol content in the body does not disqualify the accusation made against the employee of reporting to work after consuming alcohol or consuming it during work, if other established facts support this, and the employee did not take advantage of the opportunities for further verification of the positive test result provided by the employer."
Will the GDPR definitely apply to breathalyzer tests?
Regarding the assessment of random breathalyzer testing without recording results from the perspective of Article 2(1) of the GDPR (This regulation applies to the processing of personal data in a fully or partially automated manner and to the processing of personal data that forms part of a data set or is intended to form part of a data set in a manner other than automated), it is worth noting the definition of automated processing contained in the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, done at Strasbourg on January 28, 1981., according to which “automated processing” means the following operations performed in whole or in part by automated procedures: collection of data, applying logical and/or arithmetic operations to them, modifying, deleting, selecting, or disseminating them. However, the indicated definition does not answer the question of whether testing for alcohol content in exhaled air will constitute automated data processing.
There is also doubt as to whether we will be dealing with even a potential data set. As indicated by the authors of the publication “EU Regulation on the Protection of Natural Persons in relation to the Processing of Personal Data and on the Free Movement of such Data. Commentary” by Paweł Litwiński (editor), Paweł Barty, and Maciej Kawecki (Warsaw 2018):
“As an example of situations that will not fall within the scope of the GDPR, one can refer to the position of the Inspector General for Personal Data Protection taken in connection with the assessment of whether personal data is being processed in relation to the verification of documents entitling individuals to discounts on public transport (Report of the GIODO for the year 1999, p. 17). In the opinion of the data protection authority, in such a case, data processing occurs; however, it does not take place within a data set, and therefore the provisions of the Personal Data Protection Act do not apply. Similarly, in legal scholarship, it has been pointed out that although the mere access to information about a person contained in their identity document is an operation performed on personal data, the data processed in this manner are not covered by the protection resulting from personal data protection regulations, as there is not even a theoretical possibility of their processing within a data set. However, if the data were recorded, for example, in a note, then this action would constitute the threshold at which the application of personal data protection regulations would begin, even if the data from the note never entered a data set (G. Sibiga, Proceedings, p. 50). This view remains fully relevant under the GDPR” (commentary on Article 2).
Summary
In the author's opinion, under the current regulations, there are legal grounds for the employer to conduct independent sobriety tests of employees using a breathalyzer. Let us also not forget that according to Recital 4 of the GDPR, the processing of personal data must be organized in such a way as to serve humanity. The right to personal data protection is not an absolute right; it should be viewed in the context of its social function and balanced against other fundamental rights in accordance with the principle of proportionality.
