In our August newsletter, you will find the following topics: |
|
|
|
|
|
Dutch DPA fine for Wi-Fi tracking in Enschede definitively set aside |
On 29 July, the Administrative Law Division of the Council of State handed down a ruling on the €600,000 fine that the Dutch Data Protection Authority (AP) had imposed on the municipality of Enschede for Wi-Fi tracking in the city centre. The Division upheld the earlier ruling by the district court, which had annulled the fine because the AP had failed to provide sufficient evidence that the municipality was processing personal data. This makes the annulment of the fine final.
The municipality had signals from mobile devices recorded for the purpose of counting passers-by. In doing so, MAC addresses were processed into pseudonymised identifiers. According to the AP, this data constituted personal data because individual devices could be distinguished from other devices over a certain period. The AP therefore argued that the municipality was processing personal data without having a legal basis as referred to in Article 6(1) GDPR.
The Division ruled that, in the fine decision, the DPA had failed to provide sufficient grounds to demonstrate that the recorded data related to identified or identifiable natural persons. In making that assessment, it is not only important whether devices can be recognised individually, but also whether the data can be traced back to natural persons using means that can reasonably be expected to be employed. The DPA was required to establish the elements of the infringement in its administrative decision-making and to substantiate them sufficiently. The DPA could not supplement this substantiation only during the appeal proceedings.
This judgment underscores that, in an enforcement procedure, the AP must fully establish and adequately substantiate the alleged infringement in its primary decision. An inadequate statement of reasons cannot simply be remedied during the appeal proceedings by providing new substantiation. We regularly advise clients on supervisory and enforcement proceedings under the GDPR, including the assessment of administrative fine decisions and the procedural avenues available to challenge them. |
|
|
|
| |
|
|
Dutch DPA clarifies privacy rules regarding signs of abuse in childcare |
On 29 July, the AP provided guidance on the options available to childcare organisations under data protection legislation to gather information about signs of abuse during the recruitment process and to mitigate risks associated with job applications. The guidance is set out in a letter to sector organisations and covers, amongst other things, questions put to applicants, consulting referees and the use of internal blacklists.
According to the AP, childcare organisations may ask applicants questions necessary to assess their suitability for a post. These questions may also relate to relevant incidents and the manner in which a previous employment contract was terminated. In addition, organisations may, subject to certain conditions, gather information online and contact referees. The AP clarifies that there is no fixed maximum number of referees and that an organisation may ask a referee about any doubts they may have regarding the applicant’s suitability. The AP also addresses the use of blacklists. Childcare organisations with multiple branches may, subject to certain conditions and within the framework of existing legislation, maintain an internal blacklist. Stricter requirements apply to the sharing of a blacklist with other organisations.
It is important for organisations to assess their existing recruitment and selection procedures, reference checks and internal flagging processes against these guidelines. At the same time, the AP emphasises that additional legislation may be required for a broader exchange of information between different organisations. The Ministry of Social Affairs and Employment is currently exploring such measures. |
Transparency obligations under the AI Act in force from 2 August |
On 2 August, the transparency obligations set out in Article 50 AI Act came into force. These obligations apply to providers and operators of certain AI systems and are intended to make it clearer to users when they are interacting with an AI system or encountering AI-generated or manipulated content.
Article 50 AI Act sets out various obligations for providers and controllers. Providers of AI systems designed to interact with individuals, such as chatbots and voice assistants, must ensure that individuals are aware they are interacting with an AI system. In addition, individuals exposed to systems for emotion recognition or biometric categorisation must be informed of this. Furthermore, in the case of deepfakes, it must be made clear that the relevant image, audio or video content has been artificially generated or manipulated. An obligation to disclose information also applies to AI-generated or manipulated texts published to inform the public about matters of general interest. An exception to this applies if the content has undergone human assessment or editorial review and a natural or legal person bears editorial responsibility.
The European Commission has published guidelines providing further clarity on the scope of these obligations and their practical application. The Commission also refers to the voluntary Code of Practice on Transparency of AI-Generated Content, which provides support for flagging AI-generated content and labelling deepfakes.
For organisations that develop or use AI, it is important to assess whether these transparency obligations apply and whether existing processes are aligned with them. We support organisations in assessing their AI applications, implementing the AI Regulation and establishing appropriate compliance processes. |
|
|
|
| |
|
|
Cybersecurity Act and Critical Entities Resilience Act have come into force |
On 15 August, the Cybersecurity Act (Cbw) and the Critical Entities Resilience Act (Wwke) came into force. The Wwke implements the European CER Directive. The Cbw implements the European NIS2 Directive and replaces the Network and Information Systems Security Act. This is expected to bring over 8,000 organisations within the scope of the new cybersecurity framework.
The Cbw applies to essential and important entities in eighteen sectors, including energy, drinking water, digital infrastructure, healthcare, government and transport. Entities concerned are subject to, amongst other things, a registration requirement, a duty of care and a reporting obligation. They must register with the National Entity Register of the National Cyber Security Centre (NCSC) and take appropriate and proportionate technical, operational and organisational measures to manage security risks, prevent incidents and mitigate their consequences.
The Cbw also explicitly assigns responsibilities to the board. Directors must be able to assess cyber risks, oversee the implementation of security measures and possess sufficient knowledge and skills in the field of cyber security. Furthermore, executive directors of essential and important entities are subject to a statutory training obligation, which must be met within two years of the Act coming into force.
The Wwke has a different application regime. The responsible ministry designates organisations as critical entities. Following designation, an organisation must carry out a risk assessment within nine months and implement appropriate technical, organisational and physical resilience measures within ten months. Incidents that cause or may cause a significant disruption to essential services must be reported within 24 hours. The Act covers not only digital threats, but also, amongst other things, sabotage, terrorist offences, extreme weather and other physical disruptions.
For many organisations, the new statutory obligations entail additional compliance and governance requirements. We assist clients, amongst other things, in determining whether the legislation applies to their organisation, establishing governance and incident reporting processes, making incident notifications, and ensuring compliance with the new legal requirements. We also advise organisations that wish to challenge their designation as a critical entity. |
|
|
|
| |
|
|
Dutch DPA imposes a fine of nearly €825 million on Uber for automated decision-making |
On 21 August, the AP announced that it had imposed a fine of €824,990,000 on Uber for breaching the rules on automated decision-making under the GDPR. According to the AP, between 2018 and 2022, drivers’ accounts were automatically deactivated in cases of suspected fraud or low customer ratings, without human intervention.
The AP concluded that Uber had thereby breached Article 22 GDPR. Under this article, individuals must not, in principle, be subject to decisions based solely on automated processing that have significant consequences for them. The AP also ruled that Uber had failed to adequately inform drivers about this automated decision-making. Uber has announced that it will appeal against the fine.
The investigation followed a complaint from 171 French drivers, lodged via the French human rights organisation Ligue des droits de l’Homme. As Uber’s European headquarters are based in the Netherlands, the AP acted as the lead supervisory authority under the GDPR one-stop-shop mechanism. The investigation and the final decision on the fine were coordinated with other European data protection authorities.
The fine emphasises that organisations must take a critical look at the use of algorithms and AI systems for decisions that may affect individuals, for example in the areas of employment, service provision or access to platforms. We advise organisations on the scope of Article 22 GDPR, the use of automated decision-making and the implementation of appropriate governance and compliance measures. We also assist organisations in investigations and enforcement proceedings conducted by the AP. |
Data Protection Omnibus Act to enter into force on 1 September |
In our June newsletter, we highlighted the adoption of the Data Protection Omnibus Act by the Dutch Senate. It has now been confirmed that the Act will enter into force, almost in its entirety, on 1 September 2026. One provision will not yet enter into force: the new exemption for accountants who are required to process special categories of personal data when conducting statutory audits.
The Omnibus Act introduces a broad range of amendments to the GDPR Implementation Act (UAVG) and related legislation, with the aim of updating data protection law and clarifying certain aspects of it. The Act contains various technical and sector-specific amendments, including changes affecting accountants and other regulated professions. For a more detailed overview of the contents of the Omnibus Act, we refer to our June newsletter. |
|
|
|
| |
|
|
|
|
Marc Elshof
attorney-at-law | partner
T: +31 70 376 06 87
M:+31 6 46 37 61 08
marc.elshof@barentskrans.nl
|
|
|
|
|
Lars Groeneveld
attorney-at-law | senior associate
T: +31 70 376 06 48
M:+31 6 46 11 04 57
lars.groeneveld@barentskrans.nl
|
|
|
|
|
Job Julicher
attorney-at-law
T: +31 70 376 08 10
M:+31 6 27 42 99 77
job.julicher@barentskrans.nl
|
|
|
|
|
Julius Louter
attorney-at-law
T: +31 70 376 06 40
M:+31 6 15 43 37 52
julius.louter@barentskrans.nl
|
|
|
|
|
|
BarentsKrans
The Hague | Amsterdam
+31 70 376 06 06
communicatie@barentskrans.nl
www.barentskrans.nl |
| |
|
|
| |
|
|
|
