The Citizen Service Number (BSN) is a personal identification number primarily intended for communication between citizens and the government. Non-governmental organizations may only use the BSN if required by law. Therefore, it must be verified whether there is a legal basis whenever the BSN is processed. In practice, our inspectors regularly observe that the BSNs of temporary employees are listed on invoices sent to the client. Is this permissible?
The BSN makes it easy to link information from different databases. Careless use of the BSN therefore poses privacy risks, such as the misuse of personal data and identity fraud. In cases of identity fraud, criminals misuse the data to, for example, purchase items in someone else’s name without paying.
For chain liability and hirer liability, the hirer or (prime) contractor may (among other things) include the BSN in their records. This is necessary if the hirer or (prime) contractor wishes to make a indemnifying deposit into the temporary employment agency’s g-account. The “Implementation Regulation on the Mandatory Use of the BSN” stipulates that the staffing agency may provide the BSN of the assigned worker to the hirer or (prime) contractor. However, this must be done in accordance with the GDPR.
This means that the parties must mutually agree on when (at what point in time), how (via which document or connection), and in what manner (security, use, and storage) the BSN will be provided.
The question is whether an invoice provides sufficient security for disclosing the BSN. An invoice can typically be accessed by multiple people within an organization who have no authority whatsoever to process the BSN (for example, the mailroom, reception desk, etc.) as well as by third parties (such as our inspectors, the accountant, etc.). If an “unauthorized” person processes a BSN, this may be considered a data breach.
Effective January 1, 2020, the Payroll Tax Manual has been amended, and BSNs may no longer appear on pay stubs.
Contact our specialist
During inspections, we regularly encounter clients who—intimidated by the GDPR—no longer know when a copy of an ID must be kept on file. We also see that copies have been made illegible and/or that the Citizen Service Number (BSN) has been removed.
We are often asked by customers whether it is necessary to enter into a data processing agreement with Normec VRO for inspections and audits. This is not the case.
The Netherlands Labor Inspectorate (NLA) found many errors during inspections in 2023 in the area of establishing the identity of workers using valid identity documents. In a large number of cases, the documents were expired, forged, not valid or the identity was not recorded at all. This is according to a report by the NLA.
Employers have many administrative obligations. Failure to fully comply with these administrative obligations carries risks. For example, one of the consequences may be that you have to apply the anonymous rate. In this article, we explain when an employer must apply the anonymous rate and how to process it in the payroll tax return.
An inspection can be an exciting time for a company. Especially if it is a first inspection. By being clear and transparent, we as an inspection body can hopefully relieve some of that tension. Therefore, in this article you will read the answers to the five most frequently asked questions to our NEN 4400-1 inspectors.
As of February 13, 2023, our inspectors have started testing against the revised SNA standard. The main purpose of this revision is to achieve a more risk-oriented approach. Companies that do not fall under the transitional arrangement and have to be tested against the new standard as of February 13 have been inspected by us in the past six months.
Stay up to date on the latest news, exclusive updates, and valuable insights.
