Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Estonia: DPI publishes recommendations for health data processing by employers

On April 16, 2024, the Data Protection Inspectorate (DPI) published recommendations for employers processing health data. The DPI noted that health data must be protected more carefully than ordinary personal data and generally, employers must not process employee's health data.

The DPI recommended the following:

  • if an employer is offering health-related services to the employees, the employers must identify ways to offer such services without receiving detailed information about it. For example, agree with the occupational health service provider to what extent the employee can be referred to a specialist;
  • document all processing activities; and
  • adhere to the duty of professional secrecy and not release more information than is permitted by law.

In relation to workplaces that would require daily alcohol testing (e.g. bus drivers, forklift drivers, etc.), the DPI stated that it must first be mapped in the risk analysis of the workplace and the employees must be sent to a healthcare provider or a person with a corresponding medical education must be invited to the institution on site. Intoxication may not be checked even if the person voluntarily consents to it since it is not possible to guarantee consent in the employment context.

You can read the recommendations, only available in Estonian, here.