GDPR e legge olandese di attuazione (UAVG): cosa si applica?

Data protection in the Netherlands rests on two instruments: the General Data Protection Regulation (GDPR), which applies directly across the EU, and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG), which only fills in the national choices the Regulation leaves open. The UAVG also designates the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) as supervisor; it does not create a lighter regime.

Because the Regulation is directly applicable, the GDPR itself is what your organisation must comply with. The UAVG matters where a national choice has been made, and those are exactly the points organisations active in several member states tend to overlook.

Quali novità introduce la legge di attuazione?

A limited number of national choices. For information society services offered directly to a child, the Netherlands kept the GDPR’s default age of sixteen under Article 8 GDPR, and Article 5 UAVG extends that rule: in other situations where consent is the basis, a child under sixteen also needs the consent of a parent or guardian, who may withdraw it at any time.

The UAVG also sets exceptions for special category data. Article 29 UAVG allows biometric data to be processed for unique identification where this is necessary for authentication or security purposes, an exception used for access control and login systems. Articles 31 to 33 UAVG regulate the processing of criminal data, and the Act contains exemptions for journalism, research and archiving.

Quali obblighi contano nella pratica?

Four things account for most of the work. First, a record of processing activities under Article 30 GDPR: the document the AP asks for first, and the one that forces you to know what you actually hold. Second, a lawful basis under Article 6 GDPR for each processing operation, chosen deliberately rather than defaulting to consent, which can be withdrawn at any time.

Third, a data processing agreement with every processor under Article 28 GDPR, and adequate safeguards where personal data leave the European Economic Area. Fourth, a working procedure for data subject requests and for breach notification to the AP within 72 hours under Article 33 GDPR.

Come viene applicato il GDPR?

The AP can investigate, order measures, impose processing bans and fine organisations. Under Article 83 GDPR, fines run up to €10 million or 2% of worldwide annual turnover for breaches of administrative obligations, and up to €20 million or 4% of turnover, whichever is higher, for breaches of the core principles, data subject rights or transfer rules.

Individuals can also claim compensation under Article 82 GDPR, and since the collective damages regime (WAMCA) took effect in 2020, collective actions over data breaches have become a real exposure in the Netherlands.

Cosa dovresti controllare in qualità di controller?

• Is your record of processing activities (Article 30 GDPR) complete and current?
• Have you documented a lawful basis for each processing operation?
• Is there a signed processing agreement with every processor?
• Can you notify a breach to the AP within 72 hours?
• Do you need a data protection impact assessment (Article 35 GDPR) for high-risk processing?

Cosa dovresti controllare in qualità di responsabile del trattamento dei dati?

• Do you process personal data only on the controller’s documented instructions (Article 28 GDPR)?
• Do you use sub-processors only with the controller’s authorisation?
• Are your security measures described and tested?
• Will you inform the controller without undue delay after a breach?

What can we do for you with GDPR compliance?

Avvocati informatici start from what your organisation actually does with data, not from a template. We can:

• Draft or review your record of processing activities and privacy statement.
• Assess the lawful basis for each processing operation.
• Draft and negotiate data processing agreements and transfer clauses.
• Guide you through a data protection impact assessment.
• Assist with a breach notification to the AP and with an AP investigation or fine.

Sintesi

• The GDPR sets the substantive rules directly; the UAVG only fills in the national choices.
• Children under sixteen need parental consent where consent is the basis (Article 8 GDPR and Article 5 UAVG).
• Article 29 UAVG allows biometric data for authentication or security purposes.
• A processing record, a lawful basis per operation, processor agreements and a 72-hour breach procedure account for most compliance work.
• Fines under Article 83 GDPR run up to €20 million or 4% of worldwide turnover; individuals and groups can claim compensation separately.

Domande frequenti