Most of the case you gave is illegal in The Netherlands under the AVG (GDPR). There are several requirements for keeping a dossier about personnel, and this breaks most of them. You can find a list of these requirements (in Dutch) here: https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/werk-en-uitkering/personeelsdossiers