Health data starts from a position of total prohibition under GDPR, not permission — and even in the narrow cases where a check is lawful, your HR department is never supposed to see your actual medical file.
Absolute Prohibition and Special Category Protections (Article 9 GDPR)
Health data — including medical histories, psychological evaluations, disability disclosures, and fitness metrics — is classified as Special Category Data under Article 9(1) GDPR. The baseline legal rule across the EU is a complete prohibition on processing this category of data at all, unless a specific statutory exemption under Article 9(2) applies. This is a meaningfully stricter starting point than ordinary personal data, where processing is generally allowed as long as a lawful basis exists — here, the default is prohibition, and the employer has to affirmatively find a narrow exception.
General rule: employers are strictly prohibited from requiring general medical history questionnaires or pre-employment health clearances as a standard hiring condition, regardless of the role.
Narrow exemptions (Article 9(2)(b) and (h)):
- Compliance with a specific statutory employment or occupational health law mandate.
- Assessing the employee's working capacity — but only when carried out under professional secrecy by certified medical practitioners, never by HR personnel directly.
Proportionality, Confidentiality, and Non-Discrimination
Even where a health inquiry is potentially lawful, it must satisfy data minimization (Article 5(1)(c)) and proportionality:
- Occupational necessity: health inquiries are lawful only if directly relevant to whether the candidate can perform essential, statutory safety duties — commercial airline pilots or heavy machinery operators are the clear examples, not a general office role.
- The role of occupational health professionals: where a medical evaluation is legally permitted, the detailed medical history must remain confidential between you and the certified occupational health professional. HR is entitled to receive only the final operational determination — "fit for duty" or "fit with accommodations" — never the underlying medical records themselves.
- Prohibition of discriminatory inquiries: questions about pregnancy, family planning, chronic non-communicable conditions, or genetic information are strictly illegal, and any rejection resulting from them is void under EU non-discrimination frameworks, specifically Council Directive 2000/78/EC.
What This Means for You
If you're asked general health questions during a standard hiring process — not for a role with genuine, legally-defined safety requirements — you're not obligated to answer, and doing so may expose the employer to real liability rather than protect them. If a legitimate occupational health check is genuinely required for your role, confirm that HR is only receiving the final "fit for duty" determination, not your underlying medical details.
If your data was mishandled during this process, use our Employment Data Access Request generator to formally request what was collected and how it was used.
Related Kibbo Tools
- Employment Data Access Request (GDPR/Privacy) →
- GDPR Job Application Privacy Checklist →
- Privacy & Data Protection (Directory) →
Sources
- EUR-Lex — Regulation (EU) 2016/679 (GDPR), Article 9. eur-lex.europa.eu
- EUR-Lex — Council Directive 2000/78/EC, equal treatment in employment and occupation. eur-lex.europa.eu