The  GDPR and the sick employee

If an employee becomes ill, rules regarding the processing of data apply on the basis of the AVG and the AVG Implementation Act. The basic principle of the GDPR is that it is prohibited to process health data, but there are exceptions. Health data may be processed if:

• there is a legal basis for processing, as referred to in Art. 6 GDPR (lawfulness of the processing);
• the other requirements for the lawful processing of personal data are met; and
• one of the grounds for exception to the prohibition to process special categories of personal data can be invoked.

Record sick leave in administration

Employers have a legal obligation to include a sick report in their administration. After all, they must report sick leave to the UWV and can determine whether they must continue to pay the sick employee's wages and fulfill their reintegration obligations. under art. 30, paragraph 1 under a of the GDPR Implementation Act, the necessary exception to the prohibition to process health data has been included.

XpertHR contains extensive information about the processing of data of a sick employee and the privacy of the sick employee in the knowledge document. It states, for example, how you can deal with the e-mail account of employees who are long-term sick and which questions you can ask if an employee calls in sick or is sick for a long time right to be forgotten pros and cons.

Dealing  with a data breach

A data breach is a breach of security that leads to the destruction, loss, alteration or disclosure of personal data without the intention of the organization. For example, if an employee loses a USB stick with personal data, there is a data breach, but also when an employee e-mails data to an incorrect e-mail address.

If there is a data breach, this must be reported immediately to the person responsible. The responsible party can then take up the handling of the data breach. It is therefore important that the person responsible is known within the organization.

The controller can then map out the nature and seriousness of the data breach and assess which follow-up steps should be taken. According to the GDPR, the following actions must be taken:

• Registration of the data breach in a data breach  ;
• Notification of the data breach to the Dutch Data Protection Authority, unless it is unlikely that the data breach poses a risk to the rights and freedoms of natural persons. Views that play a role in this assessment include the scope of the data breach, the nature of the data leaked, the number of individuals involved whose personal data has been leaked and the position of the affected individuals. The notification to the Dutch Data Protection Authority must take place within 72 hours after the discovery of the data breach;
• If the data breach poses a high risk to the rights and freedoms of natural persons, you must also report the data breach to the data subject.