Are you allowed to keep a VOG? This is what the AVG says about processing Statements of Good Conduct

As an employer, you may want to conduct screening for some positions. For example, it may be important to have insight into the criminal past of an applicant, employee or volunteer. You can then ask for a Certificate of Good Conduct (VOG), which makes it clear that past behavior does not constitute an objection to filling a specific (future) position.

When are you allowed to keep a VOG?

There is no law in the Netherlands that explicitly prohibits, permits or requires organizations to retain a VOG, or a copy thereof. In most cases, retention is not necessary. For example, because a person has gone through the screening process. In such situations, storage of the VOG is not permitted. After all, under Article 5 of the AVG, organizations may not retain personal data longer than strictly necessary for the purpose for which it was collected.

An organization may retain a VOG only if:

• It is demonstrably necessary for a legitimate purpose; or
• the applicant, employee or volunteer explicitly consents to this.

If there is a basis to retain a VOG, then the organization is obliged to store the personal data carefully and securely. This includes recording in writing why it is necessary to keep the VOG, and what measures are taken to ensure the security of the personal data.

Is there no legal basis for keeping a VOG? Then it is possible to make a list of persons who have issued a VOG. This list of names - like the VOGs - must be kept securely. Moreover, the files can only be accessed by those authorized to do so. Think of the HR team.

Points of interest for practice

The responsible handling of VOGs is part of your organization's privacy policy. After all, a VOG contains personal data to which the AVG applies. The processing of VOGs is not explicitly mentioned in the AVG. But the privacy law sets out general principles that govern how personal data may be processed. These rules also apply to VOGs.

Thus, when processing VOGs, you take into account the privacy of those involved and compliance with the AVG. Some practical concerns in this regard are:

• Make sure you receive an original VOG. A copy is not legally valid.
• The principle of data minimization from Article 5 of the AVG means that the storage of a VOG is no longer justified if there is no longer a specific and legitimate purpose for it. This is the case, for example, if a VOG has been applied for as part of the screening for a job application or for a specific position, and the screening has been completed. The VOG must then be destroyed. As with other confidential data, such as an ID card, it is important to securely delete the data.
• Create explicit guidelines and practices for dealing with VOGs. In them, provide answers to questions such as: why is it necessary for (potential) employees to show a VOG? How are VOGs stored? Who has access to files containing information on VOGs? What are the procedures for storing and disposing of VOGs?

Getting everything right around the VOG

It should be clear: as an organization, it is not a matter of course to keep a VOG, or a copy thereof. A continuous point of attention is to properly secure the personal data surrounding an application and screening, including the information about VOGs. Clear policy rules on dealing with VOGs are essential in this regard. In this way, you comply with laws and regulations while protecting the privacy of applicants, employees and volunteers.