Increasingly, people are exercising their right to access their personal data under the General Data Protection Regulation (AVG). A survey by the Autoriteit Persoonsgegevens found that 86% of those surveyed were familiar with this right. An employee can submit a request for inspection to their employer. But what can an employee do with this?
Author: Leonie van Sloten
Under the AVG, almost everyone has a right to access their personal data at an organization. This right already existed under former Personal Data Protection Act (WBP). But the advent of the AVG has contributed to its familiarity. We see that clients are now dealing with this more often.
The right of inspection under the AVG did (possibly) change:
First, examples of data that may qualify as "personal data" have been added to the definition of personal data, including "identification number" and "online identifier," among others. While this does not change the scope, it clarifies that these data may fall under this term.
Second, under the AVG, "a copy" of the personal data must be provided. Article 35 WBP referred to "a complete overview." In this ruling, under the old European Privacy Directive (on which the WBP was based), the Court of Justice already determined that the organization in question was not obliged to provide a copy of the original document or file containing the personal data, but that a complete overview was sufficient on the basis of which the data subject can check his personal data for accuracy and lawfulness. The question arises whether the word "copy" in the AVG makes this conclusion different. The fact remains that the text of the AVG only requires a "copy of the personal data," not a copy of the underlying document containing the personal data (such as the personnel file). However, if an employer indicates that it is not objectionable for her to send a copy of the (entire) personnel file, a judge may grant this request(ECLI:NL:RBMNE:2018:3624).
The right of inspection has been extended materially, however. The data subject must be informed of more aspects when exercising this right, including the period for which personal data are stored.
Yet the right of inspection is not absolute. Article 41 of the AVG Implementation Act (UAVG) contains exceptions under which organizations may disapply the right of inspection. This may be necessary, for example, to protect the (privacy) rights of others (such as colleagues or customers). An employer cannot refuse a request for inspection on the grounds that the data is already known to the employee(ECLI:NL:RBDHA:2018:10910).
Exercising the right of inspection can be helpful for an employee to gather information (about him or herself), for example, for file construction for a procedure. Yet this does not mean that an employee can fish for documents containing his or her personal data without limitation. Often organizations are not allowed or required - even under the AVG - to provide a copy of the underlying documents containing the personal data, such as the personnel file.
As an employer, be alert to a request for inspection; is the employee requesting access to their personal data or is it an itemized request for access to their personal data in the personnel file?
If an employee requests access to his personal data, access must also be given to personal data processed about him in another capacity, such as as a customer. An employer may, however, ask to specify the request.
If an employee requests a copy of the personnel file, know that it is not said that your organization is required to provide all documents in the personnel file. The AVG only requires you to give a copy of the personal data contained therein.
Finally, keep in mind that in principle the employer must comply with a request for inspection within one month.
This article can also be found in the AVG file
More from Kennedy Van der Laan
