The AVG (GDPR) in care and support

What it is

The AVG (the Dutch name for the GDPR) has applied throughout the European Union since 25 May 2018, to everyone who processes personal data: large and small organisations, and the government too. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, supervises it.

• Personal data is any information about a person who can be identified: a name or a phone number, but also a photo or sound recording in which someone can be recognised.
• Processing is everything you do with that data: collecting, storing, viewing, forwarding and deleting it.
• Special categories of personal data are extra sensitive. Data about someone’s health is one of them, and it can also be in the file of a social worker.

Processing health data is forbidden, unless the law makes an exception for it. It is allowed, for example, if it is needed to give someone care or support, and the basis is then usually in a law, such as the Wet maatschappelijke ondersteuning (Wmo) 2015, the Dutch Social Support Act, or the Jeugdwet, the Dutch Youth Act.

For all data, the rule is: only collect it for a purpose set in advance. Do not collect more than needed, do not keep it longer than needed and protect it well. Your organisation must also be able to show that it follows these rules.

People may see their data, have it corrected, ask for it to be deleted and object to its use. An organisation must respond to such a request within a month, but if the request is complicated, carrying it out may take up to three months.

Why it matters

Your client must be able to count on data about their own health being safe, because such data is so sensitive that its use can have serious consequences for someone. Several professions also have a duty of confidentiality.

A message to the wrong person is a data breach, just like a lost phone with data that is not encrypted. Chatbots that use artificial intelligence (AI) are a newer risk. In August 2024 it turned out that employees had put data about, for example, patients into such a chatbot, and at one GP practice even medical data. That is risky, because most companies behind chatbots store everything you enter.

Data processing agreement and DPIA

If you use an app with a client, data may go to the maker. Does the maker process the data on behalf of your organisation? Then the maker is a processor, and your organisation must sign a data processing agreement: a contract about what the maker may do with the data. Among other things, it says how the maker protects the data, and that the maker deletes or returns it when the work together ends. If the maker has a data breach, it must inform your organisation as quickly as possible.

Sometimes a privacy assessment is also needed, a data protection impact assessment (DPIA). The rule of thumb is that one is required when two or more of nine risk criteria apply, and health data and data about vulnerable people, such as patients, together already make two.

How to do it

1. Use the channels your organisation has chosen. Each organisation decides for itself what security is needed, so what is allowed elsewhere may not be allowed where you work.
2. Only write down what is needed for the support, in a message and in the file.
3. Think before you email health data. It is not forbidden, but there are safer ways. If you still choose email, you must be able to explain why, and the email must be well secured.
4. Ask for consent before you share outside your organisation. Because of the duty of confidentiality, in healthcare you need consent to share health data with care professionals from another practice or organisation. Sometimes there is an exception, for example in case of serious danger. Then talk it over within your organisation first.
5. Do not put client data into an AI chatbot. Even if your organisation allows it, it is often not allowed by law. If your team has no agreements about chatbots yet, put it on the agenda of the team meeting.
6. Secure your devices. Turn on two-step verification: as well as your password, you then use, for example, a code on your phone. Let updates install automatically, and when you are out and about, use your phone’s mobile data instead of public wifi.
7. Do not just take or share a photo of your client. If someone can be recognised in the picture, the AVG applies. For your work you then need a valid reason under the AVG, for example consent from the person in the picture.
8. Report a mistake straight away within your organisation. Your organisation must report some data breaches to the AP within 72 hours, and sometimes also to the people concerned. Every data breach goes into the data breach register, even if it does not have to be reported.

Example: what goes into the file

You are helping a client who no longer opens her post. Together you make a network map of who can help her with it: her brother, a neighbour and a former colleague. In the file you only write: “Brother wants to help with the post once a week.” The rest of the map is not needed for the support, so it does not belong in the file.

Points to watch

• Do not ask for consent just to be on the safe side. Usually the law already covers it, and extra consent makes things needlessly complicated for your client. If consent really is the basis, your client must be free to say no, without any disadvantage. That is why consent usually cannot be the basis at a municipality, because residents often depend on their municipality.
• Ask your data protection officer (in Dutch: functionaris gegevensbescherming, FG). What is allowed in your situation depends on your organisation, your client and the tool, and this piece is not legal advice. The FG oversees the privacy rules within your organisation and gives advice. Is there no FG? Then ask your manager who is responsible for privacy.

Find out more

• The privacy checklist for an app: what to check before you use an app.
• Choosing a digital tool for your client: privacy is one of the points.
• Introducing a digital tool in your team: also about agreements in your team.
• The Autoriteit Persoonsgegevens (in Dutch) explains the rules.