When assisting and reintegrating sick employees, various parties (such as employers, company doctors and reintegration companies) process personal data of these employees. The General Data Protection Regulation ("AVG") applies in that case. In this blog, we briefly highlight the role of reintegration companies. What aspects of data processing should they take into account? You can read it below.
According to the Work and Income according to Labour Capacity Act ("WIA"), a reintegration company is a natural person or legal entity that promotes the insertion of persons into employment in the exercise of their profession or business. Reintegration companies are hired by employers to support the reintegration process. Thus, the reintegration company can help the sick employee return to his or her own work, but also to find other work that matches his or her knowledge, skills and abilities.
The employer must provide the reintegration company with data necessary for the company to perform the work assigned by the employer. Think for example of name and address details, data around sick leave (such as expected duration of absence), progress reports, etc. The employer is also required by law to provide the employee's BSN.
Because of the information obligation, the employer must let the sick employee know what data will be provided to the reintegration company. This can be done, for example, through a privacy statement for its employees. On the other hand, the reintegration agency must also inform its clients (the sick employees) about the processing of his or her data (see also heading "Information duty").
In principle, health data may not be provided to the reintegration company. In certain situations, however, it is necessary for the company doctor to provide the information. For example, when it concerns a reintegration company that focuses on the reintegration of employees with back problems. The Autoriteit Persoonsgegevens ("AP") mentions this example in its Policy Rules 'The Sick Employee'. Incidentally, when providing health data, the company doctor must always weigh up whether provision is actually necessary for the reintegration activities.
Reintegration companies may thus only process health data if this is necessary to perform the task assigned to this company by the employer for the guidance and reintegration of the sick employee. The processing of health data must be done within the reintegration company by someone who is capable of assessing the data and on this basis to advise on the reintegration. Usually this will be a medically trained person.
The reintegration company can provide information to third parties and in some cases is even obliged to do so. For example, provision of information to the UWV in connection with determining entitlement to benefits.
There is no legal term for keeping the non-medical part of the reintegration file. The Autoriteit Persoonsgegevens advises to keep this part no longer than two years after completion of the reintegration. For the medical part of the reintegration file is a statutory retention period of 15 years.
Reintegration companies, like employers, must also comply with the information obligation under the AVG. This means that they must inform their clients (the sick employees), but also their principals (the employers) about the processing of their personal data. This can be done through a privacy statement. This must include what data is processed, who is responsible for it, for what purpose, what basis, whether data is provided to third parties, rights of those involved, retention periods, etc.
This article can also be found in the files Privacy in the workplace and AVG
