In our September newsletter, you will find the following topics: |
|
|
|
|
|
Consultation on implementation of the revised Consumer Credit Directive |
On 7 September, the Ministry of Finance launched the consultation on the implementing regulation for the revised Consumer Credit Directive (Directive (EU) 2023/2225). The regulation forms part of the Dutch implementation package, which also includes the Implementation Act and the Implementation Decree for the revised Consumer Credit Directive. This legislative package replaces Directive 2008/48/EC with a modernised European framework for consumer credit.
The consultation regulation amends, among other things, the Exemption Regulation under the Financial Supervision Act (Wft), the Implementing Regulation under the Wft and the Regulation on financing financial supervision one-off activities. In addition, the Regulation on the Approach to Payday Loans will be repealed. An important element of the regulation concerns intermediaries that do not themselves provide credit but connect consumers with credit providers. Examples include retailers and service providers that, as an ancillary activity, offer payment or credit options when selling products or services. Subject to certain conditions, these parties will be exempt from the Dutch Authority for the Financial Markets (AFM) licensing requirement for credit intermediation and from certain conduct-of-business rules.
For organisations that offer or facilitate consumer credit, it is important to assess in a timely manner whether the new rules affect licences, information obligations and existing business models. We regularly advise on financial regulation, digital consumer services and the processing of financial personal data. |
|
|
|
| |
|
|
Cyber Resilience Act reporting obligations become applicable |
On 11 September, the reporting obligations under the Cyber Resilience Act became applicable. These obligations apply to manufacturers of products with digital elements that are made available in the European Union. This is a broad concept that may include both hardware and software products.
Under the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products through ENISA’s central reporting platform. An early warning must be submitted within 24 hours, followed by a full report within 72 hours. A final report must also be submitted.
These reporting obligations are the first provisions of the Cyber Resilience Act to become applicable. The regulation aims to strengthen the cybersecurity of products with digital elements and requires manufacturers to design, maintain and update products in a manner that better protects users against security risks. The principal remaining obligations under the regulation will become applicable from 11 December 2027.
For organisations developing or offering hardware, software or other connected products, it is important to assess whether they fall within the scope of the regulation and whether their incident response and reporting processes comply with the new requirements. We regularly advise on the Cyber Resilience Act and compliance with reporting obligations. |
|
|
|
| |
|
|
Data Act: access by design obligation for connected products becomes applicable |
On 12 September, an important part of the Data Act became applicable. From that date, newly marketed connected products and related services must be designed and developed in such a way that users can easily access the data generated through the use of the product or service.
The obligation affects manufacturers of connected devices, providers of IoT solutions and suppliers of digital services. Organisations must ensure that users can access and share data in a structured, commonly used and machine-readable format.
For organisations developing connected products or digital services, it is important to assess in a timely manner whether products and systems comply with the new design requirements. We regularly advise on the implementation and impact of the Data Act. |
Advocate General of the Court of Justice of the EU: consent for marketing by ‘partners’ valid only if partners are identifiable |
On 17 September, Advocate General (AG) Spielmann of the Court of Justice of the European Union delivered his Opinion in case C-317/25 (Groupe Canal+). The case concerns whether consent for direct marketing is valid where data subjects merely consent to the use of their personal data by an organisation’s “partners”, without those partners being specifically identified.
The proceedings arose from a marketing campaign by Groupe Canal+ targeting approximately 3.9 million individuals. Their data had been collected by internet service providers, and the individuals had consented to marketing by those providers’ “partners”. According to the French data protection authority CNIL, Groupe Canal+ therefore did not have valid consent, resulting in a fine of EUR 600,000.
According to the AG, consent for such marketing can be valid only if it is freely given, specific, sufficiently informed and unambiguous. To be informed, the data subject must know the identity of the controller. The fact that a person has consented to the use of their data by “partners” does not mean that every company within that category may send marketing communications. If the identity of the organisation sending the marketing communication was not known at the time consent was obtained, fresh consent must be sought before any communication is sent, at the latest upon first contact with the data subject in view of Article 14(3) GDPR. The AG also states that an unsubscribe option provided after receipt of the first message cannot remedy the absence of prior consent. In addition, he considers the term “partners” too vague.
The Opinion highlights the importance of transparency in obtaining consent for direct marketing and sharing personal data with third parties. Organisations relying on consent for group companies, partners or other recipients for marketing purposes should assess whether these parties have been identified with sufficient clarity to data subjects or whether consent has been obtained through another valid mechanism. |
|
|
|
| |
|
|
EDPB publishes new GDPR fining guidelines and final DSA-GDPR guidelines |
On 21 September, the European Data Protection Board (EDPB) adopted new guidelines on the application of administrative fines under the GDPR. In addition, the EDPB adopted the final version of its guidelines on the relationship between the Digital Services Act (DSA) and the GDPR. According to the EDPB, the new guidelines should contribute to more consistent GDPR enforcement across the European Union.
The fining guidelines introduce a five-step methodology for supervisory authorities when assessing whether an administrative fine should be imposed. Supervisory authorities must consider, among other things, whether an infringement is subject to a fine under the GDPR or national law, whether the controller or processor is liable, whether there was intent or negligence, and which aggravating or mitigating circumstances are relevant. The EDPB notes that, in the case of a non-minor infringement, there is a strong presumption that a fine will be imposed in addition to any other corrective measures. The guidelines are open for consultation until 13 November 2026 and will complement the existing guidelines on calculating administrative fines under the GDPR.
In addition, following consultation, the EDPB adopted the final guidelines on the interaction between the DSA and the GDPR. These guidelines are intended to support the consistent application of both regulatory frameworks, particularly where DSA obligations relate to the processing of personal data by providers of intermediary services and refer to GDPR concepts and definitions. |
|
|
|
|
|
|
|
Marc Elshof
attorney-at-law | partner
T: +31 70 376 06 87
M:+31 6 46 37 61 08
marc.elshof@barentskrans.nl
|
|
|
|
|
|
BarentsKrans
The Hague | Amsterdam
+31 70 376 06 06
communicatie@barentskrans.nl
www.barentskrans.nl |
| |
|
|
| |
|
|
|
