Employee Data Sharing Policy
This policy establishes the standardized, legally compliant processes for disclosing current or former employee data to third parties, as well as the governance framework for mandatory criminal background screenings (VOG). Designed to meet ISO/IEC 27001:2023 (A.06.02- Terms and Conditions of Employment, A.05.34- Privacy and Protection of PII) and NIS 2 personnel security requirements, this policy minimizes legal and reputational exposure under the GDPR / AVG and Dutch employment law.
This framework undergoes mandatory evaluation and re-validation annually or immediately following updates to the corporate Risk Inventory and Evaluation (RI&E).
1. Scope & Categorized Disclosures
This policy governs all verbal, written, or electronic responses to employment verification, reference checks, and performance inquiries. It applies across both domestic and international boundaries, separating out three specialized statutory instruments:
- Employment Certificate (Getuigschrift): A formal written document issued at an employee's explicit request under Art. 7:656 of the Dutch Civil Code, detailing factual employment durations, duties, and (if specifically requested) performance evaluations.
- Employer Statement (Werkgeversverklaring): A standardized, strictly factual document containing employment and salary parameters utilized exclusively by financial institutions for mortgage or credit auditing. This standard statement is excluded from the verbal-only reference rule.
- Reference: Informal or structured verbal disclosures provided to prospective employers regarding an individual's past performance, conduct, and role suitability.
2. Core Legal Principles & Prohibitions
Any disclosure of information regarding an identifiable past or present employee constitutes the processing of personal data under the GDPR.
- The Lawful Basis: anDREa B.V. relies exclusively on the voluntary, specific, informed, and unambiguous consent of the data subject to execute a reference check.
- Core Privacy Principles: Disclosures must align with Lawfulness, Fairness, and Transparency (clearly informing the individual), Purpose Limitation (using data only for the reference context), and Data Minimization (sharing only what is strictly necessary).
- Absolute Prohibitions: Under no circumstances will anDREa disclose data relating to:
- Health status, sickness logs, or medical/absence history.
- Personal circumstances, including pregnancy, marital status, sexual orientation, religious beliefs, or political opinions.
3. Step-by-Step Reference Verification Procedure
To prevent unauthorized data exposure, all incoming third-party queries must advance through the following five-stage workflow:
-
Acknowledge & Freeze Inbound Request: Immediate. Upon receiving a reference check via phone or email, acknowledge receipt to the requesting organization. Do not verify employment status or disclose any metadata at this stage.
-
Decline Written Forms and Questionnaires: Immediate. Politely refuse to complete external evaluation sheets, digital forms, or written questionnaires. Inform the requesting party that anDREa operates strictly under a factual, verbal-only reference policy.
-
Capture Explicit Written Employee Consent: Prior to Disclosure. Contact the (former) employee to notify them of the request. Require them to execute the formal Consent for Disclosure of Employment Information form. The form must explicitly define the named recipient, specific categories of data authorized for disclosure, and the underlying purpose.
-
Conduct Factual Verbal Reference: SLA Window. Assign a designated, informed corporate contact to deliver the reference. Restrict the conversation strictly to the job-relevant data points authorized in the consent form. Deliver the reference in a concise, professional, and factual manner, avoiding unsupported subjective opinions.
-
Archive Notes and Securely Delete: Post-Reference. File the executed consent form alongside the brief verbal reference notes within a secure, access-restricted directory. Maintain the log file for exactly 4 weeks before triggering permanent, irreversible erasure under the Retention & Destruction Policy.
International Transfer Boundary: If the requesting organization is located outside the European Economic Area (EEA) in a jurisdiction lacking an active EU Adequacy Decision, the employee must execute a specialized international transfer rider explicitly acknowledging the cross-border privacy risks before any data is communicated.
4. Criminal Background Check (VOG) Protocol
To protect multi-tenant infrastructure integrity, all roles within anDREa require a validated criminal background check (Verklaring Omtrent Gedrag - VOG) upon onboarding. The complete financial cost of this application is fully covered by anDREa B.V. and retained in Identity Checks.
Recertification Cycles
┌─────────────────────────────────────────────────────────────────────────────┐ │ MANDATORY VOG RENEWAL CYCLES │ ├────────────────────────────────────────┬────────────────────────────────────┤ │ 🔑 Management Team & Architects │ 💻 All Other Employee Roles │ ├────────────────────────────────────────┼────────────────────────────────────┤ │ Operations Manager, Business Manager, │ System engineers, support │ │ Director, and Solutions Architect. │ personnel, and contractors. │ │ 👉 Renewal Cadence: EVERY 2 YEARS. │ 👉 Renewal Cadence: EVERY 5 YEARS. │ └────────────────────────────────────────┴────────────────────────────────────┘
Ingestion & Minimization Rules
- Application Routing: HR initializes the VOG application during the pre-onboarding checkpoint. Depending on the candidate's country of legal residence, the individual receives a secure application link directly from the competent national authority and completes submission independently.
- Access Isolation: The final certificate is shared strictly on a need-to-know basis with HR and, where required for access governance, the direct manager.
- Data Minimization Floor: anDREa never requests, reviews, or stores underlying criminal records. Only the binary fact of whether the VOG was Granted or Refused is recorded inside the personnel dossier, adhering strictly to storage limitation principles.