Privacy update: September 2018

27 Sep 2018

The ‘Algemene Verordening Gegevensbescherming’ (‘AVG’, GDPR, General Data Protection Regulation) has been in effect for three months now and the first judicial orders have been rendered. We would therefore very much like to bring you up to speed as to several interesting developments since the implementation of the GDPR.

Ilse Baijens

‘Joint explanation’ Policy sick employee

End July 2018, the Dutch Ministry of Social Affairs and Employment (‘SZW’) published a joint explanation about the regulations regarding the sick employee as issued by the Dutch Data Protection Authority (‘AP’) in February 2016. These regulations specifically concern information an employer may or may not request from a sick employee.

Prior to the implementation of the AVG, regulations stated that an employer was not permitted to enquire with an employee about diagnosis or treatment by a physician, nor  about his functional capabilities or limitations. An employer could for example not ask whether or not the employee was still able to walk, sit for a longer period of time, work in a hectic environment etc. The employer was only allowed to enquire into the expected duration of the absence.

With its joint explanation, the Ministry reconfirmed the regulations also applicable pursuant to the GDPR. It explicitly indicated that in case the employee provides information to the employer regarding his functional abilities, limitations or about a diagnosis or treatment, the employer is not allowed to record this information in the personnel file. The company doctor remains the sole person permitted to do so. In some instances it may therefore be necessary to send the employee to the company doctor in an earlier stage than the legally prescribed period of six weeks at most.

Practice will have to show how often employees complain about non-compliance with these rules and, if that happens, how severely the AP or the judge will enforce these regulations.

Is a non-digital personnel file covered by the AVG

The  Court of Midden-Nederland  rendered its opinion in August of 2018 about the issue of whether and to what extent a personnel file that is not processed automatically, ergo a paper personnel file, is covered by the GDPR. The court determined that a personnel file can be qualified as a file within the meaning of the GDPR, if there is a coherent set of personal data and if those personal data are systematically accessible. A coherent (‘structural’) whole means that the data processing or collection shows coherence on the basis of one characteristic. The court ruled that also in so far as the personnel file is not processed automatically, it contains several characteristics that are connected in such a way that all these data can be traced back to that employee.

In short: in as far as there were any doubts about the issue whether a paper personnel file is covered by the GDPR, this court has ascertained extensively in our view justly so that the GDPR is also applicable to paper personnel files, provided these constitute coherent wholes.

Is providing a negative reference about an ex-employee unlawful?

The Court of Arnhem-Leeuwarden on 21 August 2018 rendered its opinion on the legality of a negative reference with regard to an ex-employee.

This ruling concerned a teacher who had worked for some time at a secondary school (employer A) and applied for a job at another school (employer B) as a substitute. After this temporary employment contract was not renewed by employer B, the teacher applied for a job with employer C. In his application, the teacher submitted his employer B as a sponsor without any restrictions or prior consultation. Employer B had consulted employer A following an incoming request from a parent during employment at B. That employer A had told B about boundary transgressive behaviour of the teacher towards women, and that this was also the reason he had been dismissed at A. Employer B reported this to C. C subsequently did not hire the teacher because of this reference. The teacher held employer B liable for providing this information.

In the first instance, the court dismissed the claim, and on appeal the teacher’s claim was also waived. The Court of Appeal was of the opinion that if an employee in an application procedure designates his former employer as a sponsor without any restriction, he inherently authorizes the submission of data about his person and performance, even if this information is negative. If an employee wants certain data not to end up with the intended new employer, he must indicate this in advance. The employee has therefore, by including employer B as a sponsor, consented to the issuing of personal data by in this case employer B. And permission under certain conditions is a valid ground for data processing in accordance with the GDPR.

The Court explicitly paid attention to the legal liability of an ex-employer, towards both the employee and the intended new employer, in case this ex-employer intentionally or through gross negligence includes incorrect information in a reference. If an applicant wishes to exclude certain negative information from the reference about his person or performance, he must explicitly state this to the sponsor. The sponsor can then in turn decide whether he wants to give a reference.

The issue ended well for employer B because the teacher had listed this employer as a sponsor without further restrictions. However, caution is always advised when issuing references:

  • a carefully check needs to be made as to whether or not certain agreements were made with the ex-employee regarding the issuing of references.
  • and even before coming to such an agreement, the employer must remember not to make any commitments that might oblige him contractually (in the case of a termination agreement) to issue incorrect information.