The Swedish Supervisory Authority (IMY) has reviewed two complaints involving sobriety testing of ship captains employed in public transport. The employers had conducted and stored the results of these tests for several months, raising concerns about compliance with GDPR.
While ensuring safety in public transport may justify sobriety testing, the prolonged storage of sensitive data, especially without a clearly defined purpose, prompted scrutiny. Following its review, IMY concluded that retaining the test results for such an extended period was unnecessary.
The Authority emphasised the importance of considering the power imbalance between employers and employees. It stressed that personal data must be processed lawfully, proportionately, and with respect for individual privacy. The results of sobriety tests can reveal health-related conditions, such as alcohol dependency. As such, this data qualifies as sensitive health information, which is subject to heightened legal protections under the GDPR.
Employers are reminded that, even when safety is at stake, data protection obligations remain. Proper safeguards and clear justification are essential when handling employees’ personal and health-related data.
