Conditions for disclosure
Data processing must be effected in accordance with the law, properly and with all due care. The personal data collected must be intended for specific, explicitly defined and legitimate purposes. Processing must have a legitimate basis and may not be incompatible with the purpose for which your employer collected the data in question. Section 8 of the Wbp contains a summary of the grounds applicable for admissible data processing. Processing comprises all activities involving personal data, from the time of their collection up to time of their destruction. The disclosure of data to third parties is a form of processing.
Most important grounds for the disclosure of employee data
Your employer may disclose your data to third parties where necessary for the performance of a contract that you have entered into or are about to enter into with him, if he is obliged to disclose your data in accordance with a particular legal obligation, or where you have given your unequivocal consent for your employer to do so.
Contract performance
Data may be disclosed to third parties where this is necessary for the performance of a contract that you have entered into, or are about to enter into, with your employer (the employment contract). Where the above applies, it will be assumed that you were aware, when entering into the contract, that certain data must be disclosed. For example, if you are given a lease car, your details will be disclosed to the lease company.
Legal obligation
Your employer may be obliged to disclose certain personal data that are necessary for the performance of a legal obligation. For example, under Section 47 of the Algemene wet inzake rijksbelastingen [State Taxes Act], your employer is obliged to disclose all data that could be relevant for taxation purposes to the tax authorities. Or, pursuant to an injunction from the examining magistrate, your employer will be obliged to disclose certain personal data pertaining to an employee involved in criminal proceedings.
Consent
Your consent forms another basis for your employer’s disclosure of employee data to third parties. However, you may withdraw this consent at any time. Where you choose to do this, the ground applicable for the disclosure in question will lapse and disclosure will become unlawful. The consent of the works council for a particular disclosure will not replace your individual consent. If your employer requests your consent, he must clearly explain the reason for which consent is required and the consequences resulting from consent. A number of examples can be given of situations in which consent must be requested: the publication of individualised production figures on the (internal) network or notice board, and the publication of a ‘mugshot book’ containing photos of employees.
Practical examples
- Under Section 475g(3) of the Wetboek van Burgerlijke Rechtsvordering [Code of Civil Procedure], your employer may be obliged to disclose certain information to a court bailiff. If a court bailiff requests information, your employer may request the relevant cause-list number and judgment date before disclosing the information requested.
- Some multinationals have intranet sites containing
personal data pertaining to their employees or a
central database containing employee data. Where
either of the above is the case, employee data may
sometimes be disclosed to a country outside the European
Union. This will be allowed where you have given
your consent in this respect. The consent given must
relate to incidental disclosures. Where standard
provisions are made on a structural basis, your consent
will not be sufficient and your employer should apply
for a permit from the Minister of Justice. Also see
the fact sheet entitled The
Transfer of Your Data to Third Countries [Doorgifte van uw gegevens naar derde landen].
- Your employer may use employee data for purposes other than those for which they were obtained. This will only be permitted where compatible with the original purpose for which they were intended. Whether or not this is the case will depend on the specific circumstances involved. For example, it may occasionally be necessary for the school at which you work to disclose your telephone number to pupils (or their parents) in situations where pupils have a limited amount of class contact time with you. Where you have given your consent in this respect, disclosure will virtually always be compatible with the purpose for which your data have been obtained. If you have good reasons for wishing to withhold your telephone number, this wish must be respected.
- When a union is putting together a list of candidates, your employer may disclose the data necessary for communication, such as the names, dates of birth and addresses of his employees. The above pertains to the disclosure of data to a trade union in the framework of works council elections. Since your employer does not know which of his employees are union members, he will disclose data pertaining to all of his employees should he decide to disclose the information requested. Incidentally, this will only be permitted where employees have been given a reasonable period of time to lodge an objection.
- Once an employee has been ill for a period of thirteen weeks, the employer must notify the UWV [a body implementing employee insurance schemes] of this fact. This is laid down in Section 38(1) of the Ziektewet [Sickness Benefits Act]. When doing this, the employer discloses data including the employee’s tax and SoFi-nummer [social security number] and the first date of his inability to work.
- When wishing to disclose employee data to another organisation for direct marketing purposes, your employer must obtain the employees’ consent. After all, the use of employee data for this purpose is not self-evident. Sometimes, an organisation will ask an employer to send postal advertising to its employees (for affordable medical insurance, for example). An employer may do this on an organisation’s behalf and, as such, will not need to disclose any employee data. Where the employer decides to do this, it is advisable that employees be informed of this beforehand, providing them with the opportunity to lodge an objection. This ensures that only those employees that are interested receive postal advertising. If an employer is intending to send postal advertising on a more frequent basis, it must obtain the consent of the works council.
The role played by the works council
Section 27 of the Wet op de ondernemingsraden
[Works Councils Act] lists the situations in which works
councils have right of approval. For example, a works
council will have right of approval where employee monitoring
systems are used or in the event of the intended disclosure
of employee data. The Dutch Data Protection Authority
(Dutch DPA) [College bescherming persoonsgegevens (CBP)]
has prepared a list detailing a number of criteria relevant
for works councils (also see the brochure entitled Privacy:checklist
voor de OR [Privacy: Checklist for Works Councils]).
Other rights
Besides the right of objection arising for employees
in respect of direct marketing, you will also be entitled
to information on your personal data and also to access
to, supplementation, correction, erasure and blocking
of said data . Also see the fact sheet entitled Data
Subjects and Their Rights [Rechten van de betrokkene].
Should you feel that your employer has wrongfully disclosed
your personal data to a third party, you should lodge
a complaint with your employer in this respect. Also
see the fact sheet entitled Your
Complaint and the Dutch DPA [Uw klacht en het CBP].