Netherlands

Overview

Stage of legislative progress 
Eg. pre-consultation, in consultation

Draft GDPR Execution Act consultation closed in January 2017. Revised Act expected late 2017. 

Approach to implementation 
Eg. amendments to existing law, total repeal of old laws

GDPR Execution Act to repeal the current Dutch Data Protection Act.

Timescale for implementation 
Eg. pre-consultation, in consultation

n/a


Areas where Member States must have local laws:

Personal data and freedom of expression 

Draft Act provides that Act will not apply where personal data is processed for journalistic purposes or for the purposes
of academic, artistic or literary expressions.

Penalties

n/a


Areas where Member States may have local laws:

Professional secrecy 

n/a

Scientific, historical or statistical purposes 

Draft Act provides that controllers may declare articles 15, 16 and 18 GDPR inapplicable. Data subjects will not have rights of access, rectification or restriction of processing for this data.

Employment

n/a

Personal data of deceased persons 

n/a

Children online

16

Special rules for special categories of data
Draft Act allows derogations for racial and ethnic origin, religious or philosophical belief, and political opinions.

Genetic, biometric or health data

Draft Act provides a limited list of purposes for which processing genetic data, biometric data and health data is allowed.

Designation of a Data Protection Officer

n/a

National identification numbers/any other identifier of general application

Draft Act provides national identification numbers may be processed where allowed by law, and only for those purposes as stipulated in the relevant legislation.


Other:

Any other areas under discussion
Draft Act stipulates that:
• Article 34 GDPR is not applicable where it concerns financial institutions;
• Article 22 GDPR does not apply where automated processing/profiling is necessary for compliance with a legal obligation or if processing is necessary for the performance of a task carried out in the public interest. This exception only applies if there is a specific legal basis for profiling.