Data inspectorate takes Viljandi Hospital urine sample case to Supreme Court

The Estonian Data Protection Inspectorate (AKI) has filed an appeal with the Supreme Court regarding a lower-tier court's decision to annul a €40,000 fine that the AKI levied on Viljandi Hospital for obtaining urine samples from staff, allegedly without the latter's consent.
The Tartu County Court last year annulled the misdemeanor ruling issued by the AKI, which became public last fall.
The authority had charged the hospital with collecting urine samples from employees without valid consent.
The samples were allegedly taken in an effort to identify an individual thought to be responsible for missing medications and to ensure patient safety.
However, the Tartu County Court, which reviewed the hospital's appeal, found that consent in this case had been given, and that the evidence presented did not demonstrate that employees feared negative consequences for refusing to provide samples, nor did any such consequences become a reality.
Therefore, the court annulled the fine of €40,000 that the AKI had issued to the hospital.
The AKI rejected the court's conclusions and has now submitted its appeal to the Tartu-based Supreme Court.
The AKI's argument is that the court has not justified what extraordinary circumstances made the consent voluntary in this case.
According to the AKI, collecting urine samples to identify a person responsible for a missing medication is not a minor data processing activity for the individuals involved.
The AKI stated: "Valid consent under the General Data Protection Regulation must be voluntary, specific, informed, and unambiguous."
"The AKI and the European Data Protection Board maintain that in employment relationships, consent is generally unlikely to be truly voluntary, since the employer holds a position of power. Voluntary consent is thus only possible in very exceptional circumstances," the AKI's statement went on.
In January of last year, the hospital, investigating missing psychotropic drugs, requested urine samples from 18 of its employees.
According to the AKI, the hospital failed to meet the requirement for voluntary consent when processing employees' personal and health data.
The appeal will be heard at the Supreme Court in cassation, meaning the top court will not re-examine the facts of the case and will only interpret the relevant legislation.
--
Follow ERR News on Facebook and Twitter and never miss an update!
Editor: Andrew Whyte, Mirjam Mäekivi