At the last minute so before the end of the year, the General Data Protection Regulation (UAVG) Implementation Act has been submitted to the second chamber. The regulation will enter into force on May 25, 2018. At the same time, the Implementation Act will have to enter into force. The current Personal Data Protection Act (Wbp) will then be repealed. This law is necessary, despite the direct effect of the AVG, because national legislation must, among other things, provide for the implementation and enforcement structures necessary for the implementation of the regulation (see also our earlier blog on this subject). In addition, in certain parts the AVG leaves room for member states to set additional rules or make exceptions. What does this look like for the Netherlands?
In the bill for the UAVG, efforts were made to achieve a policy-neutral implementation. This means that where the regulation leaves room for national choices, the existing choices made in the current Data Protection Act have been adopted unchanged as much as possible. This is important to make the transition from the old to the new situation as smooth as possible and also contributes to legal certainty. The smaller the differences, the easier the transition.
This policy-neutral implementation can be seen, for example, in the adoption of the existing exceptions to the ban on processing special categories of personal data. However, the AVG introduces two new types of data that fall under special categories: genetic data and biometric data processed for the purpose of uniquely identifying a person. Genetic data fell under the Wbp under special personal data on health to which further processing requirements were imposed. They are now explicitly mentioned in the UAVG and exempted as a separate category. The exception concerning biometric data processed for the purpose of uniquely identifying a person is regulated in a separate provision in the UAVG. These data may be processed when necessary for authentication or security purposes.
The national identification number, BSN, was considered a special personal data under the Wbp, no longer in the UAVG. However, nothing substantively changes in the UAVG, just as under the Wbp, the BSN may only be processed if there is a legal basis for doing so.
The UAVG provides exceptions for the processing of personal data that are part of archival documents held in an archive repository. These exceptions were not yet explicitly regulated in the Wbp, although the explanatory memorandum to the Wbp contained a specific explanation of the articles on the right of inspection and the right of rectification for records. The UAVG continues the line taken in the explanatory memorandum to the Wbp. In addition, in this relevant provision, Article 20 AVG is rendered inapplicable because the new right to data portability conflicts with the essence of the preservation of records in an archive repository.
Article 4 of the UAVG defines and expands the territorial scope. The UAVG applies not only to any establishment in the Netherlands that processes personal data, but also to the processing of personal data of data subjects located in the Netherlands by a controller or processor outside the European Union (being present in the Netherlands is sufficient).
The Autoriteit Persoonsgegevens (AP) will have more powers under the UAVG, such as the power to advise the national parliament, the government and other institutions and bodies. In addition, the AP must also be formally designated as a supervisor.
Another, remarkable, new power is that to issue administrative fines to governments for violations of the AVG. There was still some uncertainty about this, but this has now been explicitly removed. In doing so, the legislature is sending a clear signal that all organizations must comply with the law, including the government itself.
This article was not written to provide a complete and exhaustive overview of the UAVG. Some of the changes that stand out for us have been highlighted.
This article can also be found in the AVG file
