Disclosing Personnel Data
Employers may provide personnel data both to persons within the organization and to certain persons or authorities outside of the organization, such as the tax authorities, a lawyer, or the union. However, employees have provided their data in confidence. Therefore, employers are not allowed to share personnel data just like that and should meet a number of conditions.
The Personal Data Protection Act BES (PDPA BES) provides the conditions for disclosing personnel data:
- Employers should process personnel data in accordance with the law, properly, and carefully. Disclosing data is a form of processing them.
- Employers should have collected the personnel data for explicit, legitimate, and specific purposes.
- The disclosure should have a lawful basis. Article 8 of the PDPA BES states all the bases that allow organizations to process personal data.
- The disclosure should not be incompatible with the purpose for which an employer has collected the personnel data.
Employers, too, have a right to personal data protection. For example, a letter signed by employees in which they request attention for work-related matters cannot just be posted online in its entirety.
When is my employer allowed to share my personnel data?
The main situations in which your employer is allowed to disclose your data are when such disclosure is necessary to perform a contract, when the employer has a legal obligation to disclose the data, or when you have unequivocally consented to the disclosure.
Performing a Contract
Your employer may disclose your data if this is required to perform a contract you have entered into, or are going to enter into, with your employer (such as your employment contract). In such case, it is presumed that, at the time you sign the contract, you are aware that your employer needs to disclose certain data. For example, if you are getting a lease car, your employer will disclose your data to the leasing company.
Legal Obligation
Your employer may have a legal obligation to disclose certain personal data. For example, your employer has an obligation:
- to provide the tax authorities with all data relevant to tax collection;
- to disclose certain personal data of a suspected employee in criminal trials;
- to report you to the RCN Social Affairs and Employment Unit in the event of long-lasting illness.
Consent
If your employer plans to disclose personnel data while this is unnecessary, your employer may ask for your consent. In doing so, your employer should clearly explain what he or she is asking your consent for and what the consequences are if you give consent.
Your consent is only valid if you gave it voluntarily for a specific situation and based on adequate information. If you deny consent, this denial should have no negative consequences for you. You may revoke your consent at any time. As of that moment, your employer is no longer allowed to disclose your personnel data.
Consent is not easily viewed as a valid reason for disclosure of your data, because you have a position of dependence in relation to your employer.
Is my employer allowed to share my personnel data with the police?
Your employer may only disclose data to the police if the police explicitly and specifically asks for it while stating the statutory regulations that require your employer to disclose data. For example, disclosure may be required by order of the investigating judge in criminal cases.
Is my employer allowed to share my personnel data with a bailiff?
Yes. If a court has ordered garnishment of your wages, your employer has an obligation to provide a bailiff with certain data relating to you.
When a bailiff asks for information, your employer may inquire about the docket number and the date of the judgment (ordering the wage garnishment) before disclosing the requested information.
Is my employer allowed to share my personnel data with a lawyer or legal aid provider?
This is allowed in the event of a labor conflict or dismissal.
Is my employer allowed to share my personnel data for advertising purposesn?
No. If a company asks your employer for personnel data with a view to sending employees advertising material, your employer is not allowed to meet this request. The reason is that disclosing personnel data for advertising purposes is incompatible with the purpose for which your employer obtained your data.
Is my employer allowed to use my photo on the intranet?
This is only allowed if you have consented to it. Your consent is only valid if you gave it voluntarily for this specific situation and based on adequate information.
If you deny consent, this denial should have no negative consequences for you. You may revoke your consent at any time. As of that moment, your employer must remove your photo from the intranet facebook.
Is my temporary employment agency allowed to share criminal data relating to me with the customer?
Your temporary employment agency can decide for itself whether you are suitable before you start working for a customer as a temporary worker. It will then be unnecessary to disclose your criminal data to the customer.
How is a complaints commission or confidential adviser supposed to deal with information about undesired behavior?
When handling a complaint about undesired behavior, such as sexual harassment, a complaints commission or confidential adviser will collect sensitive information about the employee against whom the complaint was filed. The complaints commission or confidential adviser should treat these personal data in a proper and careful manner.
During the complaints process, nothing has been proven yet. This means that the complaints commission or confidential adviser should exercise great restraint in disclosing information.
Whether the direct supervisor of the employee concerned should be informed of the pending complaints process varies for each case. Among other things, this depends on the nature and seriousness of the undesired behavior and on whether the behavior (also) occurs at the supervisor’s department.
Retaining Information
A reasonable retention period for the information of the complaints commission or confidential adviser should not exceed two years after the complaint was handled. There is no need to keep this information indefinitely. It is important for the organization to agree on a clear retention period.
The opinion of the complaints commission or confidential adviser can be kept in the personnel file of the accused employee. It can also be kept otherwise, e.g. in a separate register of sealed envelopes managed by the director.
Can I get information about any disclosure of my personnel data?
Yes, you can. Under the Personal Data Protection Act BES, you have a right to inspect your personnel file. This right means that, at your request, your employer not only has to give you all the information available about the source of your data, but also information about any recipients of those data.
Where can I go if I have a complaint about the disclosure of my personnel data?
First of all, you should go to your employer. If your employer does not respond or you are unhappy with the response, you can address your complaint to your union.
Going to Court
You can also go to court, where you can invoke the rights conferred to you under the Personal Data Protection Act BES. For example, you can ask the judge to prohibit the processing of your personal data, ask for reparation for the (adverse) consequences, or claim damages.