IMY investigates ICA's use of drug tests on job applicants

The investigation

On 30 September 2026, IMY announced that it had opened a supervisory case against ICA Gruppen and ICA Sverige for their use of drug tests on job applicants ^[1]. The companies had reported to IMY that they had used the tests without a lawful basis under GDPR. According to the announcement, ICA says it stopped the practice in August 2026 and is now reviewing its procedures.

The details of how the tests were used, and for which roles, are not yet public. IMY's investigation will look at whether there was a lawful basis for the processing, whether the data collection was necessary and whether the companies can document what they did.

What GDPR says

GDPR's data minimisation principle, in article 5.1(c), says personal data must be adequate, relevant and limited to what is necessary for the purpose ^[2]. Drug test results are health data, which article 9 treats as a special category. Processing health data is prohibited unless one of the exceptions applies, for example explicit consent, a substantial public interest defined in law or occupational health needs ^[2].

Every processing of personal data also needs a lawful basis under article 6. For a job application, that is typically the necessity of taking steps before entering into a contract, under article 6.1(b), or a legitimate interest under article 6.1(f), balanced against the applicant's rights. If the data isn't necessary, or if the legal ground doesn't hold, the processing is unlawful.

It's like asking someone for their bank statement before you let them borrow your lawnmower. You might have a reason to want it, but that doesn't mean you're allowed to demand it, or that they have to give it to you.

The evidence question

When IMY investigates, the organisation has to show what personal data it processed, on what legal ground, for what purpose and for how long. In a case like this, where the company itself has reported that the processing was unlawful, the question shifts to what happened, when it stopped and what the company has done since.

That means being able to show:

• which applicants were tested, and when,
• what the results were used for,
• who had access to the data,
• when the practice stopped, and
• what has been done to prevent it happening again.

A hiring process that documents each step, including the lawful basis and the necessity assessment at the time, is in a better position than one that tries to reconstruct the logic a year later.

If AI is involved

The AI Act's provisions on high-risk AI in recruitment apply from 2 December 2027 ^[3]. Under annex III, AI systems intended for recruitment or selection of people, or for making decisions on promotion and termination, count as high-risk. That includes systems that screen CVs, rank candidates or support hiring decisions.

If ICA's drug testing was part of an automated or AI-supported screening process, the question is whether that system will fall under the high-risk category once the AI Act applies. High-risk systems must meet a set of requirements: risk management, data governance, technical documentation, automatic logging, human oversight and a conformity assessment before being placed on the market ^[3].

Article 26 of the AI Act sets out duties for users of high-risk AI. One of them, in article 26.7, is that employers must inform workers' representatives and the workers themselves before a high-risk AI system is put into use in the workplace ^[3]. Another, in article 26.11, is that natural persons subject to a decision must be informed that they have been subject to the use of a high-risk AI system ^[3].

Automated decisions about people already attract attention under GDPR article 22, which gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them ^[4]. The AI Act's recruitment provisions layer further duties on top.

What happens next

IMY's investigation is ongoing. The authority will look at the facts, the legal basis and the documentation. If it finds that GDPR was breached, it can issue a reprimand, order corrective measures or impose a fine. Under article 83.5 of GDPR, violations of the data minimisation principle or the lawfulness requirements can lead to fines of up to 20 million euro or 4 per cent of global annual turnover, whichever is higher ^[2].

For other organisations, the case is a reminder that decisions about job applicants sit in a part of the law that regulators watch closely, and that the evidence question—being able to show what you did, and why—matters as much as having the right policy.

What this means for you

If your organisation screens job applicants, ask:

• Do we process special category data, such as health data, about applicants? If so, on what legal ground?
• Can we show, if asked, which applicants were processed in which way, when and by whom?
• If we use an automated or AI-supported system to screen, rank or shortlist candidates, have we documented the lawful basis, the necessity and the logic?
• If the system will count as high-risk AI from 2 December 2027, have we informed workers' representatives and applicants that it is in use?

Documentation is not just about having a policy. It is about being able to show, when asked, what happened and when.

How a digital witness would work for recruitment decisions

If drug test results or other screening data feed into a hiring decision, the thing to seal is each decision record as it is made: the candidate reference, the screening result, the system or model version, the output and the reviewer. Sealing takes a fingerprint of the record, not the record itself, so the data never leaves your systems.

When a decision is questioned—by the applicant, by IMY or in a dispute—anyone you share the record with can check that it matches the sealed fingerprint. If it does, the record hasn't changed since the day it was made. Change a single character and it won't match.

Who checks: internal audit, supervisors, the applicant and, if it comes to it, a court.

What it shows: that the record is exactly what was written at the time of the decision.

What it doesn't: it doesn't show that the decision was lawful, fair or necessary, or that the log is complete. It shows that the record hasn't been rewritten.

Your system can seal records through the REST API, the SDK or the MCP server. The content stays with you, and WitniumChain keeps only the fingerprint. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Your hiring system writes a decision record (candidate ID, test result, model version, output and reviewer) and sends a fingerprint to the sealing service.
2. The service seals the fingerprint and returns a witness ID.
3. When the decision is questioned, you share the record and the witness ID. The recipient calculates the fingerprint and checks it against the sealed one. If they match, nothing has changed.

What to watch

IMY's decision in the ICA case, expected in 2027 or 2028, will clarify how the authority applies the necessity and lawfulness tests to health data in recruitment.

From 2 December 2027, the AI Act's high-risk provisions apply to AI systems for recruitment and selection ^[3]. Organisations using such systems will need to meet the article 26 duties, including informing workers and applicants that the system is in use.