Occupational health examinations to change from 1 September 2024 – new data protection authority guidelines

From 1 September 2024, the regime for mandatory occupational health examinations will change: the obligation to undergo an occupational health examination will no longer be comprehensive, as

(i) legislation will specify the specific jobs for which an occupational health examination is mandatory, and

(ii) in other cases, it will be up to the employer to decide whether to require an occupational health examination.

According to the explanatory memorandum of the amending legislation, “In order to reduce the administrative burden on employers and employees, the mandatory occupational health examination will be abolished as a general rule. Legislation may specify the jobs and occupations for which health examinations will continue to be mandatory, or employers may, in addition to the legislation, require them by their own decision. In both cases, the employer must continue to provide occupational health examinations free of charge.

Which legislation is changing exactly?

According to Article 51(4) of Act I of 2012 on the Labour Code (Labour Code), in force from 1 January 2024 until 31 August 2024, “(4) The employer shall ensure that the requirements for safe and healthy work conditions are met. Before starting work and at regular intervals during the employment relationship, the employer shall provide the employee with free occupational health examination.”

From 1 September 2024, the above provision will be amended as follows: “(4) The employer shall ensure that the requirements for safe and healthy work conditions are met. In the cases provided for by law or if the employer so instructs, the employer shall provide, free of charge, an occupational health examination for the employee before the commencement of employment and at regular intervals during the employment relationship.

Section 75 (4) of Act CXCIX of 2011 on Civil Servants is amended in a similar manner.

As of 1 September 2024, the following new paragraphs will be added to Section 49 of Act XCIII of 1993 on Occupational Safety and Health (OSH Act):

(1a) In cases provided for by law or at the employer’s discretion, with the exception provided for in paragraph (1b), a decision on suitability for work shall be taken on the basis of a medical examination provided for by law.

(1b) Paragraph (1a) shall not apply where the legislation governing the employment relationship provides for a specific requirement of medical suitability for the person concerned.”

Until the publication of this summary, the Minister of National Economy has not specified the jobs for which a medical examination will be mandatory (According to Article 88 of the OSH Act, the Minister of National Economy, in agreement with the Minister of Health and the Minister of Employment Policy, shall specify in a decree the jobs and tasks (occupations) for which an occupational health examination will be obligatory.)

It is important to point out that the provisions of the OSH Act, which require employers to provide basic occupational health services to all employees, will not change. See the OSH Act: “Section 58 (1) In addition to the obligation provided for in Section 57 (1), the employer shall provide […] basic occupational health services to all employees as specified in a separate law. The occupational health service may be provided by an external service provider operated by the employer or under a contract with the employer. (2) The occupational health service shall, without prejudice to the employer’s responsibility, contribute to the creation of a working environment which does not endanger health, to the prevention of health hazards, and to the performance of tasks classified as occupational health activities and prescribed by special legislation.

It should be noted that the legislator has not amended Article 4(1) of Decree 33/1998 (VI.24) NM on the medical examination and opinion on the medical suitability for work, occupational and personal hygiene (for the time being), which requires new employees to undergo a medical examination before starting work. It is possible that Decree 33/1998 (VI.24) NM will be amended by 1 September 2024. However, in the absence of an amendment, the question arises as to whether, contrary to the stated purpose of the changes referred to in this summary, this provision will continue to require a pre-employment medical examination for all new entrants.

What are the data protection aspects of the change?

The change in legislation also raises data protection issues.

Among the most basic GDPR rules is the requirement that all processing must have a legal basis under Article 6(1) of the GDPR. Up to now, given that an occupational health examination was required by law, the legal basis for processing could be defined as the fulfilment of a legal obligation on the data controller (Article 6(1)(c) GDPR). However, the change raises the question of the legal basis for an employer to rely on in cases where the performance of an occupational health examination is not required by law but the employer requires the performance of the examination.

A recent guideline of the NAIH (Hungarian Data Protection Authority) provides guidance on this issue.

NAIH recalls that in cases where a legislation only provides for the possibility of data processing, but does not contain an obligation to carry it out, the legal basis for data processing cannot be the performance of a legal obligation. NAIH refers to its 2018 report: “There may also be cases where the law contains only a general authorisation to carry out a specific activity involving the processing of personal data. This is the case, for example, of the provision of the Labour Code that allows an employer to control an employee in the context of its employment-related conduct. In this case, the law provides for the possibility (and not the obligation) of control, does not impose any obligation to process data, and therefore the legal basis for the processing is different (the legitimate interest of the employer).

In the NAIH’s view, the situation is the same with the amendment in question, that will enter into force in September 2024: after the entry into force of this change, the Labour Code will only allow, but not require, employers to order an occupational health examination in cases when the legislator does not otherwise lay down an obligation to do so. Since the processing is not carried out by the coercive force of a statutory provision, the NAIH is of the opinion that the legal basis for the processing cannot be ‘the performance of a legal obligation’ (Article 6(1)(c) GDPR).

In NAIH’s view, the legal basis for processing in such cases may be the legal basis under Article 6(1)(f) GDPR, i.e. the legitimate interest of the employer, provided that its existence and priority can be established by a balancing of interests test.

The NAIH draws attention to the fact that the requirement that the employer may only process the fitness/unfit status of the employee as personal data, but not other personal data of the employee’s health, does not change. The change in the legislative background does not affect the issue of retention periods either, so data controllers are still obliged to comply with the relevant provisions of the GDPR and the Infotv (Act CXII of 2011, Hungarian Privacy Act).

What should employers do from a data protection perspective?

If an employer wishes to oblige its employees to undergo occupational health examination for a job where there is no legal provision for it, the employer’s legitimate interest must be established as the legal basis for data processing from 1 September 2024.

What to do:

  • Identify the jobs/positions concerned (possibly with the help of occupational health professionals, based on their detailed and job/occupation specific justification).
  • If there is a works council, the opinion of the works council should be requested within 15 days before the publication of the employer’s decision (since the definition of the jobs covered by the occupational health examination could be a measure that affects a larger group of employees)
  • Adopt relevant written instructions, communicate within the work organisation. 
  • Conducting a balancing of interests test. As a reminder, the balancing of interests test is a three-step process, which involves firstly identifying the legitimate interest of the data controller, secondly identifying the countervailing data subject interest, the fundamental right concerned, and finally, based on the completion of the balancing, determining whether the processing is permissible. The balancing of interests test should provide detailed and specific reasons why it is indispensable to carry out an health examination for the specific job or position.
  • Amendment of the privacy notice on data processing. A change in the legal basis will require a change in the employer’s privacy notice. Also, do not forget to specify the retention periods, which is essential for all data processing.