For works council elections, an association of employees (or union) can submit a list of candidates (Section 9 (2) WOR). However, this is only possible if there are eligible voters in that company who are members of the trade union in question. In order to submit the list, consultation must take place between the union and its members on the composition of that list.
In some industries, it is not always clear whether and if so how many union members are working within a company. Therefore, when elections are approaching, the works council often sends a letter to several unions that includes the name and address of the company, the election date and date of the willingness statements of the candidates the unions want to put forward. In response to this letter, the union often requests from the company (or sometimes from the works council) the details of all persons employed (eligible) within the company for the purpose of comparing those details with its own membership file. Increasingly, disagreements arise between the entrepreneur and the union over such a request. On the one hand, the entrepreneur argues that these data may not be provided because of privacy laws. On the other hand, the union argues that in the context of good employee participation, this data must be provided. Which is correct?
Previously, the Personal Data Protection Act (Wbp) applied in the Netherlands. This law covered the processing of personal data, including the distribution or transmission of data. Personal data could only be processed in a limited number of cases (article 8 Wbp). The provision of personal data to the trade union fell into the category that states that provision is possible if "the data processing is necessary to serve the legitimate interest of the responsible party or of a third party to whom the data are provided, unless the interest or fundamental rights and freedoms of the data subject, in particular the right to privacy, prevail."
The provision of certain data to the trade union in the context of Works Council elections did not have to be reported to the Data Protection Authority. The so-called 'Wbp Exemption Decree' included a special exemption for this purpose. For the election of members of an employee participation body regulated by law, personal data could be provided to the trade union or a trade union federation without notification (article 7 paragraph 2 sub h jo. paragraph 3 Exemption Decree). However, there were two conditions for this in the law (article 7 paragraph 4 sub c Exemption Decree):
The only personal data that may be provided without notification are: name, first names, initials, titles, gender, date of birth, address, zip code, place of residence, telephone number and similar data required for communication, as well as bank and giro account numbers of the person concerned. The employer may not pass on the fact that a person is a member of a trade union. It is up to the union itself to compare the data with its own membership database.
The intention to disclose the data to the union must be communicated to the employees and they must be given the opportunity to object to the disclosure for a reasonable period of time (Article 40 paragraph 1 Wbp).
The Wbp thus created the space for the entrepreneur to be able to hand over the personal data to the union without reporting to the CBP. However, there was no duty on the entrepreneur to do so.
As of May 25, 2018, the Wbp and the Exemption Decree have expired and have been replaced by a European law called the General Data Protection Regulation (AVG). This privacy law is the same across Europe and much stricter than the Wbp.
The AVG sets general principles for processing personal data (lawful, transparent, accurate, up-to-date, minimization) and establishes that personal data may only be processed when there is a basis for doing so. The processing must be proportional and subsidiary (never provide more than necessary and always in the least intrusive way) and take place only for a specifically defined purpose. Processing of personal data includes the transfer of personal data from one organization to another, or from business owner to union.
The AVG lists a limited number of possible bases for processing. It seems that the transfer of a list of personal data of employees from the entrepreneur to the trade unions for the organization of Works Council elections will henceforth not be possible on the basis of the AVG. The only possible exception is when the entrepreneur receives from an employee, freely and without any pressure, the unambiguous consent to pass on his or her personal data to the trade union solely for the purpose of elections. The employees should then be clearly informed before processing what personal data is being passed on for what purpose. It is impossible to see why an entrepreneur would want to take on this labor-intensive process. After all, there is no duty for the entrepreneur to undertake this process. Thus, it would be a favor to the union.
After all, there is no real need for disclosure, since the union can make an appeal among its own members to report when someone is working in the company in question. The union can also choose to systematically record the corresponding employer(s) for each employee in its own membership file. The union must then keep this data accurate and up to date. The union then always has the necessary information about employees who can take part in Works Council elections.
In short, a smart business owner, given the rules in the AVG, keeps out of providing personal data to the union, and a smart union makes sure its own data is always up to date!
This article can also be found in the file AVG and Privacy in the Workplace
More from De Voort Lawyers | Mediators
