Menu

Are you ready for the new privacy legislation?

Tuesday 3 April 2018

Privacy is currently a hot item. In two months, a new privacy legislation will come into effect that has a major impact on many organizations. Prepare your organization for this as well as possible and read on.

General Data Protection Regulation (GDPR)

In Nederland , privacy is currently regulated in the Personal Data Protection Act (Wbp). However, drastic changes are to be made regarding privacy and the processing of personal data. The Wbp will be replaced from 25 May 2018 by new European privacy legislation, the General Data Protection Regulation (GDPR). This means that the same rules regarding privacy will apply throughout Europe. 

Who does the GDPR apply to?

The GDPR provides guidelines on how personal data should be stored, used and processed. The new regulations therefore apply to all organizations that process personal data. This also applies to your organization. Just think of all HR data, such as your staff, applicants and former employees. 

What will change?

According to the GDPR, data protection is becoming much more important than it has been until now. The privacy rights of data subjects are strengthened and expanded. This gives people more options to stand up for themselves when processing their personal data. Additional rights that data subjects have are:

  • Right to inspect the personal data that has been recorded
  • Right to correction if data is not correct or up to date
  • Right to erasure
  • Right to data portability, also known as data portability

Data portability means that people have the right to receive their personal data in a standard format. This makes it easier to switch from one provider to another, for example.

What does the GDPR mean to you?

Due to the new privacy legislation, more responsibilities for the processing of personal data will lie with organizations. Compliance with this will also be checked after May 25, by the Dutch Data Protection Authority (AP), on pain of large fines. So make sure that you have aligned your business operations in time with the changed legislation.

Frequently asked privacy questions 

We have also noticed that the theme of privacy is alive in recent months from the amount of questions about this subject. We are happy to share some of the most common questions with you here. 

1. Do we have to conclude a processing agreement with Actief Werkt! ?
New. Because Actief Werkt! the personal data and determines the purpose, Actief Werkt! is the controller within the meaning of the GDPR and it is not necessary to conclude a processing agreement.

2. Which personal data of candidates is Actief Werkt! not allowed to provide?
When proposing candidates, information such as passport photo, nationality, may not be provided. Copy of ID proofs are also not provided, only from foreign nationals in the context of the Foreign Nationals Employment Act. BSN is only provided if a candidate is actually placed.

3. Can Actief Werkt! a copy of the VOG? 
No, only in exceptional cases. Een VOG may only be forwarded if necessary. This means that you can achieve the goal with a less drastic means, such as only reporting that a VOG has been issued. In most cases there will be no need to forward a VOG to the client. Een exception is eg childcare. They must have a copy of the VOG in their possession, because otherwise the temporary agency worker must stop immediately during an inspection. 

4. May Actief Werkt! pass on if no VOG has been issued? 
No that is not allowed. Actief Werkt! is not allowed to provide criminal information. Failure to issue a VOG can be regarded as providing criminal information. It may, however, be reported that there are no obstacles if the VOG has been issued to the temporary worker. Possible solutions are that it can be agreed that if the VOG is not issued, the temporary worker will not be presented, or that the temporary worker's candidacy will be withdrawn without further mentioning the VOG. If the temporary agency worker is already working, you can agree on the period within which a VOG must be issued. If the VOG is not issued, the temporary worker will have to terminate his work. This can be done with the statement that the temporary agency worker does not (any longer) meet the job requirements. 

5. If I receive a CV from a candidate, how long can I keep it?
The generally applicable rule is that personal data is kept for as long as is necessary for the purpose, after which it must be deleted. For CVs, this personal data must be deleted no later than 4 weeks after the application has ended, unless the applicant gives explicit permission to keep the data for a maximum of 1 year. The personal data must also be deleted immediately if the applicant so requests.

6. Can I ask temporary workers for personal data that Actief Werkt! does not provide?
Yes, you may request this information from the temporary worker. The purpose must then be clear to the temporary agency worker and he/she must give unambiguous permission for this. This permission may be withdrawn at any time.

Actief Werkt! ready

As a temporary employment agency, the collection and processing of personal data is closely linked to our services. The privacy of our candidates and temporary workers and compliance with the applicable privacy regulations are paramount. Even now, with the introduction of the AVG, they can assume that Actief Werkt! handles their personal data in a correct and careful manner. So we are ready! You too?

Questions or more information?

Please contact Margot Boehmer, Legal Affairs Manager. She can be reached on telephone number 076-5302060 or by e-mail privacy@actiefwerkt.nl.

More information about the GDPR and how you can best prepare for it can be found at autoriteitpersoonsgegevens.nl . There you will also find a handy step-by-step plan.