What is the GDPR?
The General Data Protection Regulation (GDPR) that came into force in 2018, replaces the former laws on the protection of privacy, and includes rules about processing personal details. Personal details are data that are specifically about an individual, or which could lead to the identification of a person. For example, name and date of birth tell you exactly which person you are dealing with, and via their social security number you can tell which person it is.
Sometimes data are sensitive because they tell you something about a person's sexual life, political preferences, their origins, religious beliefs or their health. These are special personal details.
These data are protected more thoroughly. Data about illnesses and time off sick fall into this category.
When do you process personal details?
Processing of personal details is defined by law to mean: collecting, recording and storing personal details. You may only do this subject to certain conditions, which you can find here on the site for the Personal Data Authority. For example, to be able to pay your employee a salary, you need their name, social security, tax and bank account numbers, but you do not need to know if they are a member of a trade union, or male or female. To be able to continue paying their salary during illness, you do need to know that someone is ill, but you do not need to know what is wrong with them.
Why you must pay attention to the GDPR
You may not even be aware of it, but you know a whole lot about your employees. A whole lot of data is collected at work: names, addresses, dates of birth, social security numbers, bank account numbers, also application letters, reports and assessments and absence data. Your employees provide you with these details and trust that you will treat them with due care. By respecting the law, you confirm that you can be trusted.
Personal details include sensitive information that can easily be abused by malicious people such as fraudsters and cybercriminals. That can be facilitated by a USB stick that someone leaves lying around. People, and also companies, can be damaged by this, maybe by a tarnished image, or identity fraud or misinformation when seeking jobs. This is why the DAP (Personal Data Authority) checks whether organisations are handling these data carefully.Extra protection for data about health and illness
Stricter rules apply to data that contain information about the health of people, such as medical information and information about illnesses. In fact, it is very simple: in principle you are not allowed to process data about someone's health. That therefore also means that you cannot collect, record, store or share any data about their physical and psychological symptoms or illnesses. There is an exception: the employer can process the health details of employees when that is necessary for payroll processing in the event of illness, or for follow-up on an absence due to illness.
Because information about someone's health is a particular form of personal details, you therefore cannot ask them very much when a person calls in sick. You cannot ask what is wrong with your employee and why they are calling in sick, and you may not record anything about it, even if your employee gives you permission to do so.
If an employee calls in sick and then spontaneously tells you what is wrong with them, you can of course discuss it with them, so long as you do nothing further with this information. So you cannot write down anything about it in an email to HR or to your own manager.
What you can ask when someone calls in sick
Luckily, there are a few things that you can ask an employee who is ill. You can ask for the information that is necessary to be able to judge what needs to be done about the work your ill employee was engaged in. Maybe the person has appointments they can no longer attend, then you can arrange to cancel them. Or perhaps there is a deadline that cannot be postponed, and you can make sure that someone else takes over that job.
You can ask about:
- the phone number and (care) address where your employee can be reached;
- how long they expect to be absent;
- current appointments and tasks under way;
- whether your employee falls under one of the catch-all provisions of the Sickness Law (but not which one);
- if the person is ill due to an accident at work;
- whether there has been a road accident with a third party involved who could be held liable (in which case a claim can be made; your employer can then probably claim back the damages from the person who caused the accident).
Protection of privacy is important for good relations
It may feel awkward that you can't discuss very much with an employee who is ill, due to the strict legislation, and that you can't ask them what is going on. But at the end of the day your relationship with the employee will benefit if you carefully follow the rules. This shows them that you respect people's privacy and that creates trust.
If you have a good relationship with your employee, then the conversation when they report sick will flow quite naturally and your employee will likely volunteer information about what is happening. If that is not the case, then restrict yourself to the necessary questions.Involving the company doctor
The company doctor is the only person who is allowed to process data about an employee's health. This can be a good reason to involve them early on when someone reports sick. For example, if you have a feeling that there is more going on, or if a conflict at work is involved. If you also suspect that an illness may become long-term, you can involve the company doctor sooner than is required by the Improved Gatekeeper Law.
The company doctor is the only one who can provide the necessary data to the employer, such as what is needed to reintegrate the employee. In exceptional situations, he can in fact share medical information, but only if the employee themselves has authorised the doctor to do so. If, for example, an employee has asthma or a pacemaker, it can be useful if this is known about at work. Then colleagues and company first-aiders will know what to do in case of an emergency.These articles might also be of interest:
How do you lead a good performance review?
Organisations are increasingly demanding more agility, flexibility and ownership from employees. Something you can only achieve with a continuous dialogue about motivation, skills, talents and results. In addition, every human being needs positive feedback. As a manager you can therefore not get away with just asking twice a year about how things are going. And it's easy to do much better. This article will tell you everything you need to know about a good performance review.
Read moreThe influence of ownership on fitness for work
Ownership is a term that we are hearing more and more often over the last few years in relation to fitness for work. What exactly do we mean by ownership? How does it affect fitness for work? And what can you as a manager do about it for yourself or your employees?
Read more