Personal data during screening
When screening an applicant or employee, you as an employer may only request information that is necessary to mitigate the risks of a particular position as much as possible. On this page, you can read what you should pay attention to and what data you are not allowed to request, or only in exceptional cases.
On this page
Necessary data
Screening should not be the same for all positions within your company or organisation. It should only concern the specific risks associated with a particular position. You can therefore only request data that are important for the position. For example:
- In a position where someone often works with large sums of money or with confidential information, you may request more information than for positions where this is not the case.
- It is not necessary to carry out a credit check in all cases. This is probably only necessary for certain finance positions.
Recent data
The screening process must take place over the shortest possible period of time. It is rarely necessary to request data from 20 years ago, because they are no longer relevant to the current situation. You must therefore make a good assessment of what information about the past of your applicant or employee is still necessary in order to properly assess that person. Only that data may form part of the screening process.
Health data
You do not request data about the health of the applicant or employee unless there are special job requirements for the position, which makes it necessary for the person to take an eye test, for example. Such a medical examination may also be required by law. Only a company doctor may carry out the medical examination.
Criminal data
Some positions may require you to be aware of an applicant’s or employee’s criminal history. It is usually sufficient if you ask them to apply for a certificate of conduct (Dutch: VOG). This is a statement showing that a person’s past behaviour does not constitute an objection to fulfilling a specific (future) position.
You can request (other) criminal data only when applying for a certificate of conduct is not sufficient. In that case, you are allowed to process criminal data to employ someone or to transfer that person to another position at their request. An example is screening during an application procedure for a confidential position.
Identity check
Checking the identity of an applicant or employee can be part of the screening process. To this end, you are allowed to check this person’s identity document.
Note: You are not allowed to make a copy, scan or photo of the identity document.
Blacklist
In some industries, employees who have stolen or committed fraud can be blacklisted. If there is such a blacklist in your industry, you can consult it as part of a screening process.
A blacklist is subject to strict conditions. For example, a permit from the Dutch Data Protection Authority (DPA) is required if organisations want to share a blacklist (within a sector, for example) that includes criminal data and/or data about a court-imposed ban due to unlawful or unwanted behaviour.