For the employer, it is important that a sick employee recovers as quickly as possible and can get back to work. To achieve prompt recovery, the employer needs information from the employee, for example to comply with the reintegration obligation. On the other hand, the right to privacy also remains an important fundamental right in the workplace. With the new privacy legislation, employers seem to end up in a duel between social security legislation and enforcement by the Dutch Data Protection Authority. What are you, as an employer, allowed to record about the sick employee, but above all: what is really not allowed? We briefly explain this to you in this blog.
What data may the employer record?
The Dutch Data Protection Authority applies a strict criterion for the processing of personal data of sick employees. These are set out in the policy rules ‘The sick employee’. The employer is responsible for reintegration guidance, and must therefore be broadly aware of the employee’s medical condition. It is therefore unavoidable for you, as an employer, to gain insight into the employee’s possibilities and limitations, in order to enable a sustainable reintegration. The employer is, however, allowed to ask the employee and register the following when they report sick:
- The phone number and the address where the employee is staying;
- The expected duration of the absence;
- What the current agreements and work duties are;
- Whether the employee falls under a safety-net provision of the Sickness Benefits Act; (note: not which safety-net provision applies to them)
- Whether the illness is the result of a workplace accident;
- Whether the illness is the result of a traffic accident involving a third party who may be liable;
- How often the employee is sick.
What is the employer not allowed to record?
The employer is not permitted to ask about the nature and cause of the illness. This is data that may only be requested and processed by the occupational health service or the company doctor. These rules already applied even before the GDPR came into force. The employer is also not allowed to ask about the employee’s limitations and possibilities themselves.
In practice, we do often see an employee providing information about the nature of the illness to their employer. Good employership means this may be listened to, but the details of it may not be recorded. There is only a single exception to this rule. If an employee has an illness of which the immediate surroundings need to be aware in case immediate action is required in an emergency (think of allergies or epilepsy), it is permitted to process this medical data.
Want to know more?
In practice, the Dutch Data Protection Authority checks whether organisations comply with the applicable privacy legislation. Our sister organisation The Legal Privacy Company is happy to help you make your organisation GDPR-proof, and to avoid sky-high fines. For more information, visit our website: www.thelegalprivacycompany.com. Also mark 22 November in your calendar already. On this day our masterclass on privacy and the employee will take place. We give this masterclass in collaboration with our sister company The Legal Privacy Company.
