The employee in question is unable to work. In short, the reintegration process is not going smoothly and the employer ultimately decides to suspend the employee's salary. The employee's lawyer requests the personnel file from the employer. The employer then sends part of the file: the employment contract, the sick leave regulations, and the employer's license under the Alcohol and Catering Act.
However, the employee wants to receive the complete file, partly with a view to starting a mediation process. The employer continues to refuse to hand over the complete file. Ultimately, the employee initiates summary proceedings, invoking the right of access under Article 15 of the GDPR.
In the proceedings, the employer argues that it does not have to provide the employee with the missing documents from the personnel file because a) he has already received a copy of those documents or b) he is already familiar with the information contained therein.
The judge does not consider this to be a legitimate ground for refusing the documents. In his assessment, the subdistrict court judge takes the following aspects into account:
The principle of transparency is an important starting point of the GDPR: everyone must be able to access personal data collected about them, to exercise that right easily and at reasonable intervals, so that they can inform themselves about the processing and verify its lawfulness (see also recital 63 of the GDPR).
Article 15 of the GDPR therefore grants the right to access and obtain a copy of personal data, without imposing any restrictions other than "the rights and freedoms of others."
The right of access can only be refused in a limited number of cases. For the Netherlands, this is further elaborated in the GDPR Implementation Act (UAVG). A request for access may be refused, for example, if this is necessary and proportionate to safeguard national security, investigate criminal offenses, protect the data subject or the rights and freedoms of others, and collect civil law claims (Article 41 UAVG).
Whether the requested documents have already been provided to the employee or whether he is already familiar with the personal data contained therein is therefore not a valid reason for refusing a request for access.
Article 15(3) of the GDPR stipulates that the employer may not charge any costs other than a "reasonable fee" based on administrative costs for providing additional copies. According to the court, this provision also implies that an employee may request documents that have been provided previously (at some point in the past).
The judge concludes that the employee is entitled to receive the missing documents. The employer is ordered to provide those documents, subject to a penalty payment.
Conclusion
In practice, it often happens that employees lose documents they have received in the past. Think of performance reviews from years ago. There may come a time when the employee still needs those documents, for example during a labor dispute. By invoking the right of access under Article 15 of the GDPR, the employee can request a copy of those documents. The ruling states that the employer cannot refuse to provide them on the grounds that the documents have already been provided previously.
The GDPR imposes a series of (formal) requirements on the handling of access requests, including a response period of one month and an overview of the information to be provided. Failure to comply with these requirements (in a timely manner) may result in substantial fines. On the other hand, indiscriminately providing requested copies is not without risk for the employer. For example, there may be a situation in which the provision of that information harms the position of the company or hinders the investigation of criminal offenses (within the company).
It is therefore recommended that requests for access be handled on the basis of a protocol by a designated department within the company. This allows control to be maintained over the deadlines and the manner in which the request is complied with. At the same time, careful consideration can be given to whether there are reasons to refuse the request for access (in whole or in part).
