Employers may provide personnel data both to persons within the organization and to certain persons or authorities outside of the organization, such as the tax authorities, a lawyer, or the union. However, employees have provided their data in confidence. Therefore, employers are not allowed to share personnel data just like that and should meet a number of conditions.
The Personal Data Protection Act BES (PDPA BES) provides the conditions for disclosing personnel data:
Employers, too, have a right to personal data protection. For example, a letter signed by employees in which they request attention for work-related matters cannot just be posted online in its entirety.
The main situations in which your employer is allowed to disclose your data are when such disclosure is necessary to perform a contract, when the employer has a legal obligation to disclose the data, or when you have unequivocally consented to the disclosure.
Performing a Contract
Your employer may disclose your data if this is required to perform a contract you have entered into, or are going to enter into, with your employer (such as your employment contract). In such case, it is presumed that, at the time you sign the contract, you are aware that your employer needs to disclose certain data. For example, if you are getting a lease car, your employer will disclose your data to the leasing company.
Your employer may have a legal obligation to disclose certain personal data. For example, your employer has an obligation:
If your employer plans to disclose personnel data while this is unnecessary, your employer may ask for your consent. In doing so, your employer should clearly explain what he or she is asking your consent for and what the consequences are if you give consent.
Your consent is only valid if you gave it voluntarily for a specific situation and based on adequate information. If you deny consent, this denial should have no negative consequences for you. You may revoke your consent at any time. As of that moment, your employer is no longer allowed to disclose your personnel data.
Consent is not easily viewed as a valid reason for disclosure of your data, because you have a position of dependence in relation to your employer.
Your employer may only disclose data to the police if the police explicitly and specifically asks for it while stating the statutory regulations that require your employer to disclose data. For example, disclosure may be required by order of the investigating judge in criminal cases.
Yes. If a court has ordered garnishment of your wages, your employer has an obligation to provide a bailiff with certain data relating to you.
When a bailiff asks for information, your employer may inquire about the docket number and the date of the judgment (ordering the wage garnishment) before disclosing the requested information.
This is allowed in the event of a labor conflict or dismissal.
No. If a company asks your employer for personnel data with a view to sending employees advertising material, your employer is not allowed to meet this request. The reason is that disclosing personnel data for advertising purposes is incompatible with the purpose for which your employer obtained your data.
This is only allowed if you have consented to it. Your consent is only valid if you gave it voluntarily for this specific situation and based on adequate information.
If you deny consent, this denial should have no negative consequences for you. You may revoke your consent at any time. As of that moment, your employer must remove your photo from the intranet facebook.
Your temporary employment agency can decide for itself whether you are suitable before you start working for a customer as a temporary worker. It will then be unnecessary to disclose your criminal data to the customer.
When handling a complaint about undesired behavior, such as sexual harassment, a complaints commission or confidential adviser will collect sensitive information about the employee against whom the complaint was filed. The complaints commission or confidential adviser should treat these personal data in a proper and careful manner.
During the complaints process, nothing has been proven yet. This means that the complaints commission or confidential adviser should exercise great restraint in disclosing information.
Whether the direct supervisor of the employee concerned should be informed of the pending complaints process varies for each case. Among other things, this depends on the nature and seriousness of the undesired behavior and on whether the behavior (also) occurs at the supervisor’s department.
A reasonable retention period for the information of the complaints commission or confidential adviser should not exceed two years after the complaint was handled. There is no need to keep this information indefinitely. It is important for the organization to agree on a clear retention period.
The opinion of the complaints commission or confidential adviser can be kept in the personnel file of the accused employee. It can also be kept otherwise, e.g. in a separate register of sealed envelopes managed by the director.
Yes, you can. Under the Personal Data Protection Act BES, you have a right to inspect your personnel file. This right means that, at your request, your employer not only has to give you all the information available about the source of your data, but also information about any recipients of those data.
First of all, you should go to your employer. If your employer does not respond or you are unhappy with the response, you can address your complaint to your union.
Going to Court
You can also go to court, where you can invoke the rights conferred to you under the Personal Data Protection Act BES. For example, you can ask the judge to prohibit the processing of your personal data, ask for reparation for the (adverse) consequences, or claim damages.