With the entry into force of the Energy Act on January 1, 2026, the Electricity Act 1998 and the Gas Act will be replaced. The Energy Act assigns an important role to the availability of accurate data, for example with regard to consumption and feed-in. Various market parties involved in creating and collecting data will be required to maintain a register, which will then be made accessible in a centralized manner. The GDPR is also explicitly taken into account; the Energy Act sets requirements for the handling of energy data, including in the areas of privacy and data quality. This blog discusses the framework for data processing as laid down in the Energy Act.
The Energy Act regulates data exchange in Chapter 4 and distinguishes between the following processes:
Data within the scope of the Energy Act is stored in a limited number of registers, which are managed by designated register administrators. These are the system administrators of an energy system or the party responsible for metering. The register contains the data collected by the register administrator itself and the categories of data listed in Article 4.8 of the Energy Act that other market parties (such as a supplier, active customer, and balancing responsible party) collect and then submit. The specific data that fall within the categories included are specified in more detail by ministerial regulation. A central Data Exchange Entity (the Normo) is responsible for access to and disclosure of the energy data in the various registers.
The Energy Act and associated regulations aim to ensure that the principles of the GDPR and the associated rights are applied equally to all data within the Energy Act system.[3]
The general principle is that the party that collects and supplies the data also bears primary responsibility for the quality of this data (correct, timely, complete).[4]The law also guarantees access options, so that consumers and end users can gain better insight into their own data and share it with third parties if they wish.
Based on the Energy Act, lower-level regulations may stipulate that the processing of personal data is mandatory in certain cases. A second basis is that the processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR). The Energy Act specifies the tasks, and the processing party will have to assess whether a particular processing operation is necessary for the performance of that task. In addition, parties remain free to use the other GDPR bases, such as consent, performance of a contract, and legitimate interest.[5]Further details of the bases to be used in the processes referred to in Chapter 4 of the Energy Act will follow in a ministerial regulation.[6]
Supervision of data processing is the responsibility of both the Autoriteit Persoonsgegevens AP) and the Netherlands Authority for Consumers and Markets (ACM): the AP supervises the processing of personal data, while the ACM supervises the functioning of the energy market and consumer protection.
The collection, use, and processing of data play a central role in the Energy Act. There is an overlap between the Energy Act and the GDPR, which requires careful choices to be made with regard to the principles for data processing, responsibilities, and risk management.
[1]Section 4.1(2) of the Energy Act.
[2]Article 4.15 et seq. of the Energy Act.
[3]Parliamentary Papers II 2022/23, 36 378, no. 3, Explanatory Memorandum to the Energy Act bill, p. 106.
[4]Article 4.2 Energy Act; Parliamentary Papers II 2022/23, 36 378, no. 3, Explanatory Memorandum to the Energy Act bill, p. 106.
[5]Parliamentary Papers II 2022/23, 36 378, no. 3, Explanatory Memorandum to the Energy Act bill, pp. 107-108.
[6]Section 4.1(3) of the Energy Act.
