What are personal data?
The Personal Data Protection Act (Wbp) indicates that a personal data is any information about an identified or identifiable natural person. This means that information goes directly over someone or can be traced back to this person. The fact that it has to be a natural person means that data from deceased persons or organizations is not personal data.
Examples of personal data
There are many types of personal data. Obvious information is someone's name, address and place of residence. But telephone numbers and postcodes with house numbers are also personal data. Sensitive data such as a person's race, religion or health are also known as special personal data. These are extra protected by the legislator.
Protection of personal data
Protection of privacy is a fundamental right. This right is regulated in:
• Article 10, paragraph 1 of the Constitution;
• Article 8 of the European Convention on Human Rights and Fundamental Freedoms (ECHR);
• Article 17 of the International Covenant on Civil and Political Rights (ICCPR).
Storage of personal data
The content of a digital or paper file contains a lot of information about a person. For example, the GP knows which medicines his patient uses. And the employer can see when the salary of an employee has been increased for the last time. In order to keep a good record, an organization must keep certain personal data for a while. But organizations may not retain that data longer than necessary.
Based on the Personal Data Protection Act (Wbp), there is no specific retention period for personal data. Organizations decide for themselves how long they keep personal data. Here they look at how long the data is needed for the purpose for which they were collected or used.
However, there are concrete retention periods in other laws that organizations must adhere to. For example, on the basis of tax legislation.
Destroy or archive
Is the storage period of personal data over or are the data no longer necessary? Then organizations have to destroy the data.
Organizations may store personal data in an archive if it is intended for historical, statistical or scientific purposes.
Unless the Archives Act or another law applies, no retention period applies to personal data in an archive. The organization must destroy the data if they are no longer needed for the purpose of the archive.
Providing personal data
An organization may not simply pass on personal data to individuals or other organizations. The general rule is that the provision of personal data is only allowed if it is compatible with the purpose for which the data was collected. Whether this is the case depends on the actual circumstances. That can therefore vary per situation.
Compatible with purpose
When deciding whether a dispensation is compatible, different factors play a role. For example:
• the kinship with the purpose of collecting;
• the nature of the data;
• the consequences of a dispensation;
• the guarantees that have been taken;
• the expectations of the person concerned (the person whose organization uses personal data).
Grounds for distribution
In addition to the general rule of compatibility, the provision of data must be based on one of the six grounds (also known as bases) from Article 8 of the Personal Data Protection Act (Wbp). Those are:
• consent of the person concerned;
• performing an agreement;
• legal obligation;
• vital interest of the person concerned;
• performing a public law task;
• legitimate interest of the organization.