Grounds for employee files
The processing of personal data for employee files is permitted where necessary in the framework of the performance of a employment contract or an appointment as a civil servant under public law.
Conditions applicable to the processing of employee data
The following obligations, amongst others, arise from the Wbp:
- your employer is responsible for the accuracy and exactness of the data held on you in its staff records;
- data held on you in an employee file must be adequate, relevant and not excessive, given the purpose for which they will be processed;
- your employer is obliged to inform you
as to the purposes for which he/she/it collects
data relating to you. For further information,
please see the fact sheet entitled Your
right to Information [Recht op informatie]
- your employer must ensure that the appropriate
technical and organisational measures are put in
place to protect your personal data against loss
or any form of unlawful processing. For more information,
please see the brochure entitled Doe het zelf met
privacy [Privacy DIY];
- your personal data
may only be retained while necessary for the achievement
of the purposes for which it was collected, or for
which it is subsequently used. For more information,
please see the fact sheet entitled Bewaartermijnen
van uw persoonsgegevens [Retention
Periods for your personal data];
- your employer must offer you the opportunity to
access and, if necessary, correct your data. In principle,
the right to access applies for the employee file
as a whole. For more information, please see the
fact sheet entitled
Data Subjects
and Their Rights [Rechten van de betrokkene].
Content of employee file
In principle, the only data permitted in an employee
file is the data necessary for the purpose for which
the employee file has been created. Article 7 of the
Vrijstellingsbesluit [Dutch data protection (exemptions)
decree] indicates the sub-goals and data applicable
in this respect. Data such as complaints, warnings,
absenteeism, appraisal interviews and personal working
notes made by your immediate manager may be held in
an employee file, although, in principle, medical data
may not. In the framework of reintegration and absenteeism
management, your employer must limit the data included
in employee files to information on the functional
limitations of an employee on sick leave and the corresponding
modifications required on the work floor (a modified
chair, for example). For more information, please see
the study entitled The
Sick Employee. Rules for the processing of personal data
of sick employees. [De
zieke werknemer. Regels voor de verwerking van persoonsgegevens
van zieke werknemers].
Applicant data
Should the employer wish to seek additional information (screening) in relation
to applicants for a position of employment, the prior consent of the applicant
must be obtained. In the majority of cases, screening involves checking the
information given on the applicant’s CV and seeking employment references.
For each individual case in which screening is carried out, the employer should
carefully consider what data is actually of relevance to the position being
applied for and how these can be obtained. The reason for this is that personal
data may actually only be used in so far as they are relevant. This means that
in the case of an administrative assistant, for example, extensive screening
is not required. For positions that will involve handling large amounts of
money or confidential information, however, an employer is entitled to seek
additional information. For certain positions, legislation exists that enables
an employer to seek a Verklaring omtrent het gedrag [Criminal background check].
Furthermore, screening for positions involving an element of trust, such as
police officers, employees of private security companies, employees of detective
agencies, airline personnel and certain other positions in government organisations
may be subject to specific statutory requirements.
In the event that an employer employs a detective agency in order to
carry out screening, the applicant must be informed.
Detective agencies are required to adhere to the Gedragscode
sector particuliere recherchebureaus [Sectoral code of conduct for private
detective agencies]. In the event that it is known in advance that information
relating to criminal background will be involved, screening may only
take place with the express consent of the applicant. There is no provision
within the law that requires an applicant to give an answer to the question “Do you have a criminal
record?” when this is asked during an employment interview. The
applicant should however take into account that screening may reveal
that he/she has a previous conviction. It is not permitted for screening
to be carried out into the health of an applicant. Subject to strict
conditions, an employer is, in certain cases, entitled to have a medical
examination carried out by a medical doctor. The results of a medical
examination may only be disclosed to an employer (the party that commissioned
the test or examination) with the applicant’s consent.
When establishing a policy with regard to the screening of applicants,
an employer is required to obtain the consent of the Works Council. Even
if the company concerned does not have a Works Council or any form of
employee representation, it is still advisable to seek internal agreement
with regard to the policy relating to the screening of future employees.
It may well be the case that your (future) employer applies the Sollicitatiecode
[Applications code] of the Nederlandse
Vereniging Personeelsbeleid (NVP)
[Dutch Association for Personnel Management]. In that
case, you may submit any complaints to the NVP, which
will then assess your complaint against its own Applications
Code.
If you have any questions or complaints
Your first course of action should always be to contact
the organisation itself about your questions or complaints.
For information on your right to access to your data
in the event of a dispute, please see the fact sheet
entitled Mediation
by the Dutch DPA in Respect of Your Data [Bemiddeling
door het CBP inzake uw gegevens]. If you believe that
your personal data has been used wrongfully and the controller
fails to respond to your complaints, or fails to respond
to your satisfaction, please refer to the fact sheet
entitled Your
Complaint and the Dutch DPA [Uw klacht en het CBP] for information on the subsequent action open to you.
Your rights
In addition to your right to access, the provisions of
the Wbp (Dutch Data Protection Act) entitle you to
request that an organisation provide you with information
on your personal data and/or the opportunity to have
your data supplemented, corrected, erased and/or blocked.
You are also entitled to lodge an objection to certain
types of use to which an organisation puts your data.
For information on how to exercise these rights, please
see the fact sheet entitled Data
Subjects and Their Rights [Rechten van de betrokkene].