Introduction

How do I handle the issue of background checks, including those involving sensitive personal data such as criminal records?

Legal framework

In the Netherlands, a selection procedure is restricted by fundamental rights of privacy, non-discrimination, and equal treatment. Also important are the European Privacy Regulation, the General Data Protection regulation (“GDPR”) and the Medical Test Act (in Dutch: “Wet medische keuring”). Furthermore, various rules of conduct regarding recruitment and selection have been drafted by Dutch (professional) associations, for example the (non-binding) recruitment code of the Dutch Association for Personnel Management and Organisational Development (in Dutch: “Nederlandse Vereniging voor Personeelsmanagement &

Organisatieontwikkeling”, “NVP”). Finally, Collective Labour Agreements may contain binding rules on selection and recruitment.

Background checks in general

In general, based on the Dutch constitutional principles and the GDPR an employer wanting to carry out background checks on applicants, may do so with the prior unambiguous and explicit permission from the applicant. As a general rule, the employer should restrict its enquiries to information which is necessary and relevant for the assessment of the suitability for the particular applicant for the job. This means that an employer can only ask about, for instance, nationality, if this is relevant for the position.

Criminal background checks

An applicant is in principle not obliged to answer questions about his criminal background. An employer is however entitled to investigate the criminal background of an applicant of this is relevant for the performance of the job. The applicant is obliged to inform the employer in this respect. This information obligations for example applies for an accountant who was convicted for fraud or for a primary school teacher who was convicted for child abuse.

Under Dutch law, certain public positions (e.g. at the policy, army, civilian airports, or department of foreign affairs) are considered positions which require a security investigation. With permission of the applicant, the Dutch General Information and Safety Department may investigate whether any objections exist against the hiring of the applicant for national security reasons.

An employer may further request the applicant for a Certificate of Conduct (in Dutch: “Verklaring omtrent gedrag”, “VOG”). It is allowed to make a job offer contingent upon the applicant submitting such certificate at the start of employment. The applicant has to apply for the certificate. The employer will have to answer certain questions with respect to the position of the applicant and the type of crimes that would be relevant to the performance of the job concerned. The Ministry of Justice will then investigate whether the applicant has a criminal record, including pre-trail diversions, relevant to the performance of the position for which the certificate is requested.

Processing personal data

When performing a background check, an employer should ensure that personal data is transferred in a secure manner and that the applicant is informed about the possibility that his personal data might be processed. In the Netherlands, most employers inform their applicants about this possibility in a data protection notice on their website.

In principle no sensitive personal data (e.g. criminal records or data concerning health or a person’s sexual orientation) may be screened. This is only allowed if there are exceptional requirements for the vacancy that make this type of screening necessary. In addition, stricter rules apply for the processing of sensitive personal data. Sensitive personal data can only be processed if a specific legal exception, such as the protection of the vital interests of the data subject, and a general legal basis in the GDPR is applicable.

Consequences of violating Dutch laws and regulations

It is not always clear what the consequences are of violating Dutch laws and regulations while recruiting new employees. Applicants may bring claims for unlawful discrimination against a prospective employer, based on one of the characteristics protected by equality legislation. The protected characteristics are for example, gender, pregnancy or maternity, sexual orientation, race, disability, age and religion or belief.

Apart from going to court certain institutions exist, such as the Committee for Human Rights (in Dutch: “College voor de Rechten van de Mens”), where applicants can file complaints. The rulings of the Committee are non-binding to the parties, but, if published, could cause a bad reputation for the employer.

Are there particular issues in checking candidates’ social media profiles?

It is unclear whether employers may use information on the applicant that is in the public domain. In practice employers tend to use this information. As it is not yet clear whether this is permitted, an employer should avoid citing this as the reason for a possible rejection. Employers should reference the potential use of public information in the job advertisement and should also attempt to verify the accuracy of any such information before relying on it.

It is permissible to search for an applicant on social media, provided there is a legitimate purpose relating to the position the applicant is applying for. The employer must inform the applicant in advance when it carries out a social media check, explain the reasons for it, and discuss the information with the applicant.

LinkedIn is considered the only suitable business-related social media source to check an applicant.

Can I ask candidates about their covid-19 vaccination status?

The Dutch government, and subsequently the Dutch Data Protection Authority, have taken the position that an employer is allowed to ask applicants whether they have been vaccinated. However, employees are under no obligation to answer. In addition, it is not possible for the employer to directly process (i.e. register) this data.

Are employees entitled to lie or to omit information; if information is subsequently found to be false, what can I do?

Under Dutch law an applicant should provide the employer with information that gives a true and fair picture of his professional competence (education, knowledge and experience) and should not withhold information that he knows or should know to be important to the fulfilment of the vacancy for which he is applying.

Providing false information can -depending on the circumstances- have consequences for applicant’s employment later on and could even be a ground for a summary dismissal. An example from case law shows that a musician working with a theatre group was allowed to be summarily dismissed when it turned out he could not read sheet music.

However, any questions that cannot be considered relevant for the position do not have to be answered by an applicant. An applicant may even lie in response, for example, when asked if the applicant is pregnant or wants to have children in the near future.

How should I deal with the personal data of unsuccessful candidates?

All the personal data of an unsuccessful candidate – such as the application letter, references and correspondence with the applicant – should be deleted within 4 weeks after finishing the application process, unless the applicants consents with longer retention, in which case the details can be kept for a maximum of 1 year after finishing the application process.