Workplace Alcohol Testing and Personal Data Guidance
Summary
Finland's Data Protection Authority (Tietosuoja) has published guidance on workplace alcohol and drug testing and the collection of personal data from employees and job applicants. The guidance clarifies that occupational health care may not disclose an employee's health information to the employer without the employee's consent; the information remains secret and confidential. It also reiterates the core data minimisation principle: employers may only process personal data that is strictly necessary with regard to the employment relationship, and unnecessary data may not be processed even with the employee's consent.
“The employer may only process information that is necessary for the employment relationship”
Finnish employers should audit their existing health check and personal data collection processes to confirm alignment with this guidance. The DPA's emphasis on data minimisation means that even employee-consented data collection may be impermissible if the data is not strictly necessary for the employment relationship. Occupational health providers should review what they disclose to employers, particularly for roles subject to compulsory health checks.
About this source
GovPing monitors Finland Tietosuoja (EN) for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 1 changes logged to date.
What changed
The guidance addresses two related topics: alcohol and drug testing in the workplace, and the collection of personal data from employees and job applicants. For health checks, the DPA clarifies that occupational health care cannot disclose employee health information to employers without consent; certain compulsory health checks for specific roles may include alcohol/drug assessments, but employer certificates contain only general work ability assessments, not individual results or diagnoses. For personal data generally, the DPA emphasises that employers may only process data necessary for the employment relationship; unnecessary data may not be collected even with consent.
Employers operating in Finland should review their practices against this guidance to ensure compliance with data minimisation principles. Healthcare providers delivering occupational health services should ensure their confidentiality practices align with the guidance, particularly regarding what information can be shared with employers.
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
We completed the guidance on the alcohol testing of employees and processing of personal data in the workplace
6.8.2025 12.46 | Published in English on 22.8.2025 at 10.45 News item We have put together answers to frequently asked questions about alcohol and drug testing in the workplace on our website. We also added information on what employers should consider when collecting personal data from employees and job applicants.
Our website provides answers to topical questions about alcohol and drug testing for employees.
- What is the law on alcohol and drug testing for employees?
- What information does the employer receive about an employee’s work ability? Can occupational health disclose to the employer information about an employee’s alcohol or drug test result?
- Does an employee have the right to refuse a health check or alcohol or drug test on the grounds of privacy?
- Can an employee’s alcohol consumption be tested without their knowledge? Occupational health care may not disclose an employee's health information to the employer without the employee’s consent. The information is secret and confidential, with right of access only for the patient and the health care system.
Certain occupational groups and jobs are subject to compulsory health checks to demonstrate work ability. The health check may also include an assessment of alcohol or drug use. Such health checks are required by law and the employee cannot refuse them without good reason. The certificate given to the employer also contains a general assessment of the person's work ability. It does not include individual test results, diagnoses or a specific medical condition that might make the employee unsuitable for the job.
The employer can also offer voluntary health checks or other services to support the employee’s work ability. An employee has the right to choose whether or not to undergo these voluntary checks or tests.
Health checks and tests must always be carried out in agreement with the employee, and the employee must be informed if, for example, a blood test will measure alcohol consumption.
The employer may only process information that is necessary for the employment relationship
We also completed the guidance on the collection of personal data from employees or job applicants, and updated the answers on the employer’s right to process personal data.
- What should an employer take into account when collecting personal data from employees and job applicants?
- What personal data of an employee or jobseeker is the employer allowed process?
- When and how can the employer process an employee's health information? The general rule for all processing of the personal data of employees and job applicants is that they may only process data that is necessary with regard to the employment relationship. The employer is therefore not allowed to process any personal data relating to the employee, and unnecessary data may not be processed, even with the employee’s consent.
The employer must collect the data primarily from the employee and the job applicant themselves. If data is obtained from elsewhere, the employee’s consent to the collection of the data must be obtained in principle.
Further information:
Frequently asked questions about data protection in working life
Related changes
Get daily alerts for Finland Tietosuoja (EN)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from Tietosuoja.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Finland Tietosuoja (EN) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.