Anyone who thought that the General Data Protection Regulation (AVG) only applies to companies operating in healthcare or government agencies is wrong. Once you employ staff, your company too has to comply with the rules of the AVG. After all, you have to keep a lot of data on your staff. Think about a copy of an ID, but also pay slips, employment contracts and other mutations. These are all documents that contain personal data.
Coauthor: Mandemaker, Anouk
The obligation to follow the AVG already starts at the application stage. An applicant will make himself known to you, and for this the sharing of personal data is necessary. Often this will be fairly basic data such as name, address and phone number. However, more and more job applicants are sharing a profile picture, which suddenly makes personal data not so innocuous. After all, a photo is a means of determining an applicant's race, and that is not allowed just like that. Therefore, you should always give the applicant the opportunity to apply without a photo. Merely organizing a video application is thus no longer an option.
If you want to conduct a screening, this is allowed only if you disclose to the applicant in advance that this is part of the application process. Googling the applicant may be tempting, but it is not permitted. Even if you wanted to look up an applicant on LinkedIn, pre-eminently a business channel, you would have to make this known in the job posting. You understand that unannounced requesting a Certificate of Good Conduct (VOG) or reference from an applicant is definitely not allowed. Always record in your privacy statement how you handle applicant information. This way everyone is clear about their mutual rights and obligations.
As long as the legal obligation exists to record information, the AVG will not hinder in any way. Just think of the citizen service number (BSN) that you will have to record under the Payroll Tax Act. And if you were not allowed to use a bank account number (because yes, that too is personal data), it would be almost impossible to pay wages, right?
Before you're put off by all the information, we'd like to explain a simple solution to you. We understand that you need the data, but it is important to inform your staff about all these processing steps. Besides the privacy statement you (hopefully) published on your website, you provide your staff with an internal privacy statement. This is similar to the privacy statement on your website, but focuses exclusively on the information you collect from your staff. Of course, you do not have to publish this document on your website. Issuing it to (new) employees is sufficient.
This article can also be found in the files Privacy in the workplace and AVG
Melanie Hermes teaches the Privacy in the Workplace course on Oct. 29
