What if we use medical examinations and drugs and alcohol testing?

In detail

• What does this section cover?
• Why might we want to obtain information from medical examinations and drugs and alcohol testing?
• What do we need to consider if we want to introduce medical examinations and testing?
• Can we use medical examinations and testing as part of our recruitment process?
• How do we limit the purpose of the examination or testing and the information we obtain?
• What do we tell workers about examinations and testing?
• Can we retain information obtained from medical examination or testing?
• How do we ensure drugs and alcohol testing is appropriate?
• How much personal information can we collect from drugs and alcohol testing?
• How do we select workers for drugs and alcohol testing?
• Can we use random testing?
• How do we ensure testing is of a good standard and quality?
• Checklist

What does this section cover?

This section of the guidance considers your data protection responsibilities when you want to collect health information about your workers. This covers both medical examinations and medical testing, such as for drugs and alcohol use. Many of the considerations are the same, whether you are collecting information from medical exams or from testing of workers. However, where these are different, we highlight specific issues for you to take into account.

This guidance does not address consent for any physical intervention involved in taking a sample from a worker in the course of medical testing.

Why might we want to obtain information from medical examinations and drugs and alcohol testing?

There may be several reasons why you want to collect health information from the testing and medical examination of workers. This will often be for health and safety reasons, but you may also want to enforce your organisation’s rules and standards (for example, through drugs and alcohol testing). You may also want to carry out medical examinations and testing when assessing the suitability of potential workers during a recruitment process. See 'Can we use medical examinations and testing as part of our recruitment process?' below.

You can collect such information if you are satisfied that it is a necessary and justified measure to:

• prevent a significant risk to the worker’s health and safety or others;
• determine a particular worker’s fitness for carrying out their job;
• determine whether a worker is fit to return to work after a period of sickness absence, or when they might return;
• determine the worker’s entitlement to health-related benefits, eg sick pay;
• prevent discrimination against workers on the grounds of disability or assess the need to make reasonable adjustments to the working environment; or
• comply with other legal obligations (such as the obligation on an employer under the Control of Asbestos of Work Regulations 2002 or the Control of Asbestos at Work Regulations (Northern Ireland) 2003 to keep workers who are exposed to asbestos under adequate medical surveillance).

You may also want to provide an optional occupational health and wellbeing programme, for example to promote physical and mental health and wellbeing. This may include an element of testing workers’ health. However, this should only take place where workers have a free choice to participate. You must clearly explain to them how you might use their personal information and the potential consequences of taking part.

Workers employed on overseas contracts may need to undergo a degree of medical examination and testing that is substantially more intrusive than that carried out on workers in the UK. For example, workers contracted to work in certain countries may be exposed to particular risks. Certain countries may also have a legal requirement for medical testing. You must make sure that you are transparent with workers about any examination or testing that they need to undergo at an early stage.

What do we need to consider if we want to introduce medical examinations and testing?

You must record the purpose of your proposed programme of examination or testing of workers. You must identify your lawful basis and special category condition for processing. You may wish to do this as part of your data protection impact assessment (DPIA).

You should also document:

• who you are going to test or examine;
• what precisely you are testing or examining them for;
• the frequency of testing or examinations; and
• the consequences of a positive or negative test or the result of an examination.

You should consider whether there are any less intrusive ways of meeting your objectives as an employer, unless you are legally required to carry out a test or examination. This might mean, for example, collecting information via a health questionnaire either as a first stage or as an alternative to a medical examination, if this is appropriate given the nature of the role.

Can we use medical examinations and testing as part of our recruitment process?

Medical examination and testing are, even if needed for the role, inherently intrusive. You should only use them to obtain information where this is necessary to meet your purposes. This means employers should not by default submit all job applicants, or even those shortlisted, to medical examination or testing. You should only obtain information through medical examination or testing of applicants at an appropriate point in the recruitment process. This is, in many cases, going to be where there is a likelihood of appointing them subject to satisfactory examination or test results.

You should also satisfy yourself that the testing or examination is a necessary and justified measure to:

• determine whether the potential worker is fit or likely to remain fit to carry out the job in question;
• meet any legal requirements for testing or examination; or
• determine the terms on which a potential worker is eligible to join a pension or insurance scheme.

You must record your purpose for introducing the examination or testing and your lawful basis and special category condition for processing. You can do this as part of your DPIA.

Remember to first consider less intrusive ways of meeting your objectives. For example, using a health questionnaire as an alternative to medical examination, or as a means to select those required to undergo a more detailed examination.

You should make it clear early on in the recruitment process that people may need to undergo medical examination or testing if you are likely to appoint them.

Decisions on a worker’s suitability to work are management decisions. However, you should leave the interpretation of medical information to a suitably qualified health professional.

How do we limit the purpose of the examination or testing and the information we obtain?

You must be clear from the outset about why you are carrying out the testing or examination, including what substances or conditions you are looking for. You should consider these issues as part of a DPIA, which can help you determine whether a medical examination or testing is a proportionate response to a particular problem you have identified.

You should design the testing or examination to only reveal information relevant to your purpose for carrying it out.

You should not use an existing sample, test result or other information obtained through a medical examination or test for a purpose other than that for which it was originally collected.

If you want to carry out a different test on an existing sample that you have not told the worker about and that they have not consented to, you must tell the worker about your intention to carry out additional testing. You must also obtain the worker’s freely given consent for this different test.

What do we tell workers about examinations and testing?

You must ensure that workers are fully aware when testing is taking place or where you require medical examinations, as part of your fairness and transparency obligations.

You should not conduct testing on samples collected without the worker’s knowledge. It would be deceptive and misleading to workers if you attempted to obtain information by collecting samples covertly, or by testing existing samples in a manner that you had not told workers about. Where this type of testing involves the processing of personal information, it is unlikely to comply with data protection law as it would be unfair to the worker concerned. You are unlikely to ever justify covert medical testing and it is difficult to envisage circumstances arising without the police being involved.

If you are testing workers to enforce your organisation’s rules and standards, you must make sure that you clearly set these out to your workers. You should set out:

• the circumstances in which medical testing may take place;
• the nature of the testing;
• how you intend to use the information obtained; and
• the safeguards in place for the workers that are subject to it.

You should explain similar considerations if you want your workers to undergo medical examinations, or the law requires them to do so.

Can we retain information obtained from medical examination or testing?

You must permanently delete information obtained from medical examination or testing that is not relevant for your purpose(s).

If you do need to retain medical information obtained from examination and testing (for example where necessary for the operation of an occupational health service), you must keep it securely and confidentially in an appropriate storage system.

How do we ensure drugs and alcohol testing is appropriate?

You should make sure that the information you collect from drugs and alcohol testing is designed to ensure safety at work rather than just to reveal the illegal use of substances in a worker’s private life. For example, you may need to employ testing due to the nature of a worker’s role, such as pilots, drivers or machine operators where they make safety-critical decisions. In other roles, you may not need to conduct testing. Instead, you may be able to handle performance or behavioural issues potentially related to drug or alcohol usage through staff conduct policies rather than through testing.

This is because testing workers for drugs or alcohol is intrusive and very few employers can justify testing to detect illegal use rather than on safety grounds. However, testing to detect illegal use may, exceptionally, be justified where illegal use would:

• breach the worker’s contract of employment, conditions of employment or disciplinary rules; or
• cause serious damage to the employer’s business, for example by substantially undermining public confidence in the integrity of a law enforcement agency.

Before obtaining any information from drug or alcohol testing, you should ensure the benefits justify any adverse impact on your workers, unless the testing is required by law. You should also consider the efficacy of the testing technique you wish to use to ensure the accuracy of the information you collect about your workers. See 'How do we ensure testing is of a good standard and quality?' below. You should do this via a DPIA.

You need to take particular care when carrying out a DPIA on whether the collection of information through drug testing is justified on health and safety grounds. You should take into account the following points:

• Your interest as an employer is usually in detecting drug use that puts at risk the safety of those to whom you owe a duty of care. This can arise from drugs that are legal as well as illegal. You should not test merely to find evidence of the use of illegal drugs.
• The drug testing you use should address the risk. You should ensure the testing is capable of providing real evidence of impairment or potential impairment at work that is sufficient to put the safety of others at risk.
• Other than in the most safety critical areas, you are unlikely to justify regular drug testing unless there is a reasonable suspicion of drug use that has an impact on safety.
• Consider whether drug testing provides significantly better evidence of impairment that puts safety at risk than less intrusive alternatives, such as a test of cognitive ability.
• You are more likely to justify testing after an incident involving a worker’s conduct where there is a reasonable suspicion of drug or alcohol use, rather than by carrying out random testing.

How much personal information can we collect from drugs and alcohol testing?

You must minimise the amount of personal information you obtain from testing for the presence of drugs and alcohol in your workers.

You should use drug or alcohol testing only where it provides significantly better evidence of a worker’s impairment than other less intrusive means. You should base any testing on reliable scientific evidence of the effect of particular substances on workers. In some cases, such as in illegal drug consumption and alcohol consumption, effects are well documented and this will be straightforward. You should limit testing to those substances and the extent of exposure that will have a significant bearing on the purpose(s) for which testing is conducted.

You could do this by limiting the number of substances being tested for, or by using tests that only detect recent exposure to the substances being tested for. A variety of techniques for carrying out alcohol and drug testing are available to employers. They vary in the level of intrusiveness, depending on the range of substances that can be detected and the time scales involved. For example, some tests are only designed to detect the use of a particular drug within the previous eight-hour period, whilst others are designed to detect the use of a wide range of substances over a much longer period. If you intend to carry out testing you should use the least intrusive methods available to deliver the benefits that the testing is intended to bring.

There are tests, computer programs and equipment that you can use to measure hand-eye coordination and response time. These do not involve any invasive medical procedures and so are more justifiable for tests in the first instance. Assisted performance tests may be more reliable for the employer in providing evidence of impairment and less intrusive for the worker.

How do we select workers for drugs and alcohol testing?

When you select workers for drugs and alcohol testing, you must ensure that you justify, properly document, adhere to and communicate to workers the criteria you use.

Can we use random testing?

You cannot justify collecting personal information by testing all workers in your organisation if, in fact, it is only workers engaged in particular activities or roles that pose a risk.

You should instead limit the collection of information through random testing to those workers who are involved in safety-critical roles that you consider require testing.

Even in safety-critical businesses such as public transport or heavy industry, workers in different jobs will pose different safety risks through their use of alcohol or drugs, depending on the type of work they carry out. Therefore, you can rarely justify collecting information through the random testing of all workers.

It is generally unfair and deceptive to lead workers to believe that you are carrying out random testing if, in fact, you are using other criteria. If you are using other criteria to trigger testing, you must ensure workers are aware of your true testing criteria.

If you do carry out random testing, you should ensure that you carry it out in a genuinely random way.

How do we ensure testing is of a good standard and quality?

It is important you ensure that any health information you obtain through testing is:

• of sufficient technical quality to support any decisions or opinions that you derive from it;
• subject to rigorous integrity and quality control procedures; and
• conducted under the direction of, and positive test results interpreted by, a person who is suitably qualified and competent in the field of drug testing.

To achieve this, you should use a professional service with qualified staff that meets appropriate standards. You should also ensure that workers have access to a duplicate of any sample taken, to enable them to have it independently analysed to check the accuracy of the results. You should not assume that the tests are infallible. You should be prepared to deal properly with any disputes arising from their use.

You may need to seek appropriate technical advice and use an approved laboratory to analyse samples to satisfy your legal duty to ensure results are adequate for the purpose(s) of the testing. This is because the reliable interpretation of test results can require a high level of technical expertise. However, you don’t need to employ health professionals to undertake tests for alcohol using breath analysis equipment.

Although sample kits that employers can use to test for various substances are available over-the-counter, you should not assume that the tests are infallible. Some test kits may fail to differentiate between an illegal drug and a legitimate pharmaceutical, or between a pharmaceutical that causes impairment and one that does not.

Checklists

You can also view and print off this checklist and all the checklists of this guidance on our checklists page.