Already an account? Log in

    Try HRM Rendement

    With 13 published issues in a calendar year HRM Rendement offers the most up to date answers to your professional questions with news, themes and articles.

    Subscribe to HRM Rendement for the next three months for only € 3, excluding VAT (normal price is € 99 per year). This offer applies to a business trial subscription, valid until cancellation. The General Terms and Conditions can be found on

    Fill out the form below and subscribe

    Are you interested in similar English publications? Rendement also offers (about Dutch payroll regulations), (about Dutch tax regulations) and (about Dutch financial SME-news).Try these publications for three months each for € 3, excluding VAT. Normal price is €99 per year.

    Try these publications for three months each for € 3, excluding VAT. Normal price is €99 per year.

    Promo code (when available)

    We ask you to agree to our General Terms and Conditions and Privacy Policy.

    When clicking on subscribe, you automatically give permission to receive the newsletter and offers, with which we inform you about relevant products and services of Rendement Uitgeverij BV. If you do not want this, please contact us via You can also withdraw the consent at any time by clicking on the unsubscribe link at the bottom of each email.

    Registering employees’ medical data could result in a fine

    Due to violations in the rules regarding the processing of medical data of ill employees, the Netherlands Authority on Personal Data – called ‘Autotiteit Persoonsgegevens (AP)’ – imposed a € 15,000 fine on a maintenance company. Among other things, the company had failed to properly secure the data included in their absenteeism registration.

    The absenteeism registration contained highly privacy-sensitive data about the physical and mental health of employees. Because the company included e.g. the names, specific health complaints and indicated signs of pain of individual employees in the registration, more privacy-sensitive data was registered than is permitted by law. According to the General Data Protection Regulation (GDPR), registering such data is not required for the purpose of reintegrating employees after illness.

    Verifying identity through multi-factor authentication

    Moreover, the absenteeism registration was accessible online without having to go through any type of security. Although an online absenteeism registration is in principle not prohibited by law, it may only include information about the instances of absenteeism. The reason for absenteeism may not be included in the registration. Moreover, only authorized staff may have access to the online absenteeism registration and they must verify their identity through multi-factor authentication using at least two different factors.

    Employee has an acute condition

    Only in exceptional cases may an employer include information about the cause and nature of an employee’s illness in the absenteeism registration. For example, if an employee has an acute condition and may therefore suddenly and rapidly develop symptoms, such as in the case of epilepsy. Colleagues are then aware of this and know what to do in the event these symptoms develop. An employer is allowed to ask the respective employee any necessary questions to determine the possible future duties and tasks of the employee at work.

    Responsibilities of ‘Arbodienst’ or occupational health physician

    Medical data is regarded ‘exceptional’ data, which means that each employee has the right to keep this data to him/herself as much as possible. Privacy law prohibits employers from registering information about the cause and nature of an employee’s illness and absenteeism. This is instead the responsibility of the ‘Arbodienst’ (Occupational Health and Safety Service) or the occupational health physician. They can then relate information about the expected duration of the illness and possible workload for the employee in question to the employer.

    Share this article on: