This could lead to a non-compliance issue during an audit under NEN 4400-1, which in turn could affect the certificate.
In and of itself, it is a good thing that organizations are more cautious when handling personal data, such as a copy of an ID. If companies have unlawfully (without a legal basis) included a copy of an ID in their records, this constitutes a risk under the GDPR.
Identity document or proof of identity: What’s the difference?
An identification document allows a person to prove their identity. It contains the BSN number and a passport photo, enabling a person to demonstrate that they are the individual associated with that BSN number. An example of an identification document is a Dutch driver’s license or a valid driver’s license, issued by the competent authority in another member state of the European Communities (or in another state that is a party to the Agreement on the European Economic Area, provided the holder resides in the Netherlands).
An identity document allows a person to identify themselves. Identification is only possible with a document that states the holder’s nationality. Examples of identity documents include a passport, a Dutch identity card, an ID card, a passport from an EEA country, or a Dutch alien’s identity document.
When do you need which document?
Employers Have a Duty to Verify Identity
When an employee first starts work, the employer has an obligation to verify their identity. This obligation consists of several components, which are:
- Verification requirement
- Retention obligation
- Duty of care
Verification obligation
The verification requirement means that the employer must ask the employee to present an original and valid form of identification and check it for authenticity. This allows you to verify that the person standing before you matches the identification document presented, that it is genuine (and not counterfeit) and valid. You should also ensure that the employee is permitted to work for you without, for example, requiring a work permit.
Retention Requirement
The retention requirement means that you must make a copy of the valid identification document. This is stipulated, among other things, by the Wage Tax Act. The copy must be clearly legible, and you must copy both the front and back sides. This is only required upon the employee’s start date. It is not necessary to make a new copy if an ID has expired. Furthermore, you are required to retain the copy for up to 5 years after each employee’s termination of employment.
Duty of Care
The duty of care means that you must remind your employees to always carry a valid form of identification with them while on the job. After all, it is possible that another authorized person or organization (such as the hiring company, the (main) contractor, or an official from the Inspectorate SZW) may need to verify the document. When it comes to work where the identification document could be damaged or lost, the duty of care also requires that you, as the employer, provide, for example, lockers at the worksite or make clear arrangements regarding this with the client or (prime) contractor. This is because employees must always be given the opportunity to comply with their identification requirement, but they must not suffer any damage to the document as a result of performing their work.
Conclusion
If you employ workers, you must keep a legible copy of the front and back of a valid identification document for each employee in your personnel records as of the date of hire. This retention requirement applies for up to 5 years after the date the employee leaves the company.
When Is a Copy Not Required?
If there is no law requiring you to make a copy of the ID—such as the Wage Tax Act—then there is no legal basis for doing so, and therefore it is not permitted to make a copy or scan of an identity document (nor of the identification card!). The Wage Tax Act applies only when an employee is in a direct employment relationship with your company. This is therefore not the case for employees you hire through an agency or who perform work via a subcontractor. It is also not permitted to make a copy of a self-employed person’s identification document.
Secure your copies and do not keep them longer than necessary!
You must adequately secure the collected personal data (such as a copy of an ID) through organizational and technical measures against loss, theft, and other unauthorized use. This is to prevent identity fraud. This means that not everyone should have unrestricted access to the data. Access is permitted only when necessary for the performance of a job function (or legal obligation). If data is accessed by unauthorized persons within the organization (or outside of it), this constitutes a data breach. It is also important to ensure that you do not retain the copy of the ID longer than necessary or required by law. After that, the data must be destroyed so that it cannot be reused later. Be sure to destroy the data properly.
