Search

Did you receive a message from an organisation that they have become the victim of a data breach? And that bank account numbers have been leaked as a result? This is what you can do in such case:

• Be alert to phone calls or messages by email, text or WhatsApp in which people try to obtain information from you, such as your PIN code. Your bank will never ask you to provide a certain code or to send your bank card to a certain address, and certainly not in this way.
• Pay frequently attention to any debits from your bank accounts. Criminals may use your bank account for buying things.
• For more information see Veiligbankieren.nl (in Dutch).

You do not have to apply to the Dutch Data Protection Authority for a permit for sharing criminal data. However, you do need a permit under the Dutch Private Security Organizations and Detective Agencies Act (Wbpr). You apply for this permit to Justis, the Dutch Ministry of Justice Agency for Scrutiny, Integrity and Screening.

See also: Private detective agencies.

No, but only if you meet these two conditions:

1. You are only permitted to share criminal data on staff that is employed within your group.
2. You must have asked the works council for consent before sharing the criminal data. This follows from Article 27, paragraph 1 under k of the Dutch Works Councils Act.

You can attend a class through video calling. When you do this, your educational institution may film you at home. This is an invasion of your privacy. But it is allowed when teaching in any other way is not possible. In that case, your school or university has to ensure that the invasion of your privacy is minimised.

For example, your school or university has to choose a software supplier that meets the requirements of the privacy law. Here it is particularly important that the supplier does not retain all data longer than necessary.

Your school or university also has to provide you (or your parents) with clear information about what exactly happens with your data, such as why your data are processed and when your data will be erased. Take a look at the privacy policy, for example. Or ask a teacher or an employee of your school or university.

Make sure that you keep things that are very personal to you outside the range of the camera as much as possible, such as things that have to do with your religion or political preference.

Your school or university is not allowed to retain the images made during class through video calling if pupils or students are visible in them and if they do not have a good reason for retaining them.

Images without pupils or students

Your school or university is allowed to retain a recording of the class or the lecture without the interaction with pupils or students in it. An example of this is to be able to watch the class or lecture at a later time.

It is advisable here that your school or university indicates beforehand when the recording will start so that you will know when you have to turn off your microphone and camera.

Images with pupils or students

Only in exceptional situations will your school or university be allowed to retain images in which pupils and students can be recognised.

In that case, your school or university must have a good reason to do this. And recording the images must be necessary for that purpose, such as if interaction with pupils or students is an important component of the study material. Or if watching the images at a later time is necessary for the evaluation of the teachers.

The school or university has to explain clearly beforehand why retaining those images is necessary and how long the images need to be retained.

Erasing images

Does you school or university retain images in which you are visible, but do you not want this? Then you can ask for erasure of the images. Your educational institution will then decide if the images will be erased.

Some schools and universities opt for software to conduct online surveillance (online proctoring). The question of whether your school or university is allowed to use online proctoring cannot simply be answered with yes or no. In any case, your school or university will have to meet strict requirements because online proctoring has a significant impact on your privacy.

Is proctoring necessary?

Firstly, your school or university will have to assess whether using proctoring is necessary.

Are there less intrusive ways of examining that also limit the chance of fraud? Then your school or university is not allowed to deploy proctoring. An alternative may be to have pupils or students submit a paper, an essay. or an open book examination.

Is proctoring indeed necessary? Then your school or university will have to ensure in any case that the invasion of your privacy is minimised.

More information

More requirements that your school or university has to meet can be found in Recommendations for online proctoring in education (in Dutch).

If you apply for a job with an employer, it may conduct a screening. Once you’re employed, your employer can screen you if this is necessary due to the nature of your position. For example, if you work for the police. Screening is required by law for some positions, such as jobs in childcare.

Screening can be very intrusive on your privacy. Therefore, an employer is only allowed to screen you if it meets the (statutory) conditions for screening. These conditions are intended to protect your privacy.

No, it is usually not necessary for you to undergo screening again every time your employer seconds you or lends you to another organisation. Unless special (safety) requirements apply to working at this other organisation, or if the organisation can demonstrate that screening is necessary for another reason. In that case, you may be screened again. See also: Screening during secondment.

No, this is not allowed. You are obliged to tell the applicant or employee you want to screen in advance:

• that screening will take place;
• why screening is necessary;
• what data you are examining;
• why these data are relevant for the position in question.

After the screening process, you must inform the applicant or employee about the results thereof.

No, consent from applicants or employees is not legally valid. Due to their dependent position in relation to you as a (future) employer, they cannot give the consent freely as required by law. See also: Consent not valid.

No permit is needed if there is a cooperative working arrangement under public law. These types of cooperative working arrangements are mentioned separately in the GDPR Implementation Act as an exception.
However, these 2 conditions apply:

1. The processing is necessary for these governmental organisations for the performance of their task.
2. The governmental organisations implement such safeguards that the privacy of the data subjects is not disproportionally affected.

Yes, you are. You are allowed to use fictitious (made-up) citizen service numbers (BSNs) for testing your information systems.