{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Houthoff","Thomas de Weerd"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","Netherlands"]
["Key Legislation Overview"]
["What is the key legislation?","Since May 25, 2018, radical changes to data privacy laws in the European Union have come into effect. The \nGeneral Data Protection Regulation (\"\nGDPR\") has impacted businesses, regardless of whether they have a corporate presence in the EU or use EU-based assets to process data (which was the former test for EU data protection rules application). If a business offers goods or services to EU-based customers or monitors their behavior, they potentially are within the scope of the \nGDPR (please see below for more details).\nThe extra-territorial reach means that in practice, many businesses operating internationally need to adopt European data privacy standards, which are becoming the default global standards. The increased sanctions under the \nGDPR (up to 4% of global revenue or EUR 20 million, whichever is higher), together with general public expectations about data privacy, mean that compliance with data privacy laws cannot be treated as a minor regulatory issue. Potential fines and other penalties under the \nGDPR will put data privacy and cybersecurity at the same level as antitrust or anti-bribery and corruption programs on the corporate compliance agenda. This will require board-level awareness and leadership and the combined input from a range of professionals including legal, IT, finance, procurement and vendor management and HR.\nThe \nGDPR is directly effective in all EU Member States without the need for further national legislation. However, the \nGDPR has specific areas in which the Member States are either permitted or required to enact national legislation to give effect to its provisions, for example, in relation to the procedure for imposing an administrative fine; the processing of special categories of personal data; the age of consent for processing personal data in the context of online services; and the restrictions and limitations on the application and exercise of data subject rights. \nIn the Netherlands, the \nGDPR is complemented by the \nGDPR Implementation Act (\nUitvoeringswet Algemene Verordening Gegevensbescherming) (\"\nDutch GDPR Implementation Act\").\n"]
["Key Data Protection Provisions"]
["What data is protected?"," The  GDPR  regulates the processing of personal data which is defined as information relating to an individual who can be identified, either directly or indirectly, in particular by reference to an identifier such as a name, ID number, location data, online identifiers or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The  GDPR  does not apply however to fully anonymized or aggregated data where a living individual cannot be identified. \n\n “Special categories of personal data” attract a greater level of protection under the  GDPR . Special categories of personal data cover any data revealing a data subject's: \n\n \n\t Racial or ethnic origin, political opinions, religious or philosophical beliefs,  \n\t Trade union membership, \n\t Data concerning health, sex life or sexual orientation, \n\t Genetic data, biometric data for the purpose of uniquely identifying a natural person. \n \n\n Data relating to criminal convictions or offenses are subject to specific protection under the  GDPR  and may only be processed under the control of official authority or where authorized by Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. \n\n For detailed information on how this aspect of GDPR is enacted in the Netherlands please contact Houthoff directly. \n"]
["Who is subject to privacy obligations?"," The  GDPR ’s obligations primarily apply to data controllers, defined as any natural person, corporate entity or other legal person, public authority, agency or other body that determines the purposes and means of data processing (alone or together with others). It also provides for certain direct obligations on data processors which are any natural person, corporate entity or other legal person, public authority, agency or other body that processes personal data on behalf of the data controller.  \n\n The  GDPR  applies to: \n\n \n\t The processing of personal data in the context of the activities of a data controller’s or data processor’s establishment in the EU (i.e. implying the effective and real exercise of activity through stable arrangements), regardless of whether the data is processed in the EU or not or regardless of whether the data relates to EU residents or not.  \n\t The processing of personal data of persons within the EU by data controllers or data processors who are established outside the EU, where the processing is related to: \n\t \n\t\t the offering of goods or services to such data subjects in the EU (irrespective of whether payment is required); or  \n\t\t the monitoring of the behavior of such data subjects as far as the behavior takes place in the EU. \n\t \n\t \n \n"]
["What are the principles applicable to personal data processing?"," Under the  GDPR , a data controller must comply with the following principles under Article 5:  \n\n \n\t Lawfulness, Fairness and Transparency  – the data shall be processed lawfully (i.e. based on one of the six specified legal bases), fairly and in a transparent manner (e.g. pursuant to a privacy policy that meets the requirements of the  GDPR ) in relation to the data subject; \n\t Purpose Limitation  – the data\n\t \n\t\t shall be collected for specified, explicit and legitimate purposes;  \n\t\t shall not be further processed in a manner incompatible with those purposes. \n\t \n\t \n\t Data Minimization  – the data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed or are further processed; \n\t Accuracy  – the data shall be accurate and, where necessary, kept up to date; \n\t Storage Limitation  – the data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the personal data is processed;  \n\t Integrity and Confidentiality  – the data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental, loss, destruction or damage, using appropriate technical or organizational measures; and  \n\t Accountability  – The data controller shall be responsible for and be able to demonstrate compliance with the above principles. \n \n"]
["How is the processing of personal data regulated?"," To be processed lawfully, the  GDPR  requires that personal data processing are based on one of the specified legal bases, which include the following: \n\n \n\t Consent \n \n\n Personal data may be processed based on the data subject’s specific, freely given and informed consent. \n\n \n\t such consent must be provided by way of “a statement or by a clear affirmative action” (pre-ticked boxes and implied consent fall short of the standard); \n\t Data subjects have the right to withdraw their consent at any time and in an easy manner. \n \n\n The controller is under an obligation to demonstrate the data subject’s consent where the processing is based on consent.   \n\n Consent from a child in relation to online services will only be valid if authorized by a parent or guardian. According to Article 8 of the  GDPR , a child can consent from 16 years old, though the Member States may reduce this age to 13 years old. The Netherlands did not reduce the age to consent. A child can validly consent from the age of 16 years. \n\n \n\t Legitimate Interests \n \n\n A data controller may process personal data based on its legitimate interests or those of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.   \n\n The data controller must, however, inform the data subject of the particular legitimate interest pursued and the data subject has the right to object to the legitimate interest-based processing on grounds particular to his or her situation (see  Right of Objection  below).  \n\n Public authorities may not rely on this legal basis in the performance of their tasks. \n\n \n\t Contractual Necessity \n \n\n Personal data may be processed where it is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering a contract. The processing must, however, be necessary to contract performance rather than merely facilitative.  \n\n \n\t Legal Obligations \n \n\n A data controller may process personal data where it is necessary to comply with a legal obligation to which it is subject.  \n\n \n\t Vital Interest of the Data Subject \n \n\n The data controller may process personal data where it is necessary to protect the vital interests of the data subject or another natural person.  \n\n \n\t Public Interest or in the exercise of Official Authority \n \n\n The data controller may process personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.  \n\n Special Categories of Personal Data \n\n The processing of special categories of personal data is prohibited, except where it relies on one of the exceptions set out in Article 9: \n\n \n\t The data subject has given explicit consent; \n\t Processing is necessary for compliance with obligations or exercising rights underemployment and social security and social protection laws, as set out in EU or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the rights and freedoms of data subjects; \n\t Processing is necessary to protect the vital interest of the data subject or another natural person where the data subject is physically or legally incapable of giving consent; \n\t Processing is carried out in the course of its legitimate activities with appropriate safeguards by a political, philosophical, religious or trade union foundation, association or not-for-profit body and relates to the personal data of its members, former members and persons in regular contact only which are not disclosed outside without consent; \n\t The personal data processed are manifestly made public by the data subject; \n\t Processing is necessary for the establishment, exercise or defense of a legal claim or whenever courts are acting in their judicial capacity; \n\t Processing is necessary for reasons of substantial public interest on the basis of EU or Member State law which is proportionate, respect the essence of the right to data protection and provides for suitable and specific measures to safeguard the rights and interests of the data subjects; \n\t Processing is necessary for the purposes of preventative or occupational medicine, medical diagnosis, provision of health or social care or treatment or management of health or social care systems and services on the basis of EU or Member State law or pursuant to a contract with a health professional; \n\t Processing is necessary for reasons of public interest in the area of public health on the basis of EU or Member State law; \n\t Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes on the basis of EU or Member State law. \n \n\n Member States may have further conditions with regard to the processing of genetic data, biometric data or data concerning health. \n\n Please note that in the Netherlands, specific rules apply for genetic data, biometric data and data concerning health. \n\n The prohibition to process genetic data does not apply if such processing is carried out in relation to the data subject from whom the data have been collected. In addition, the prohibition to processing genetic data does not apply if: (i) a substantial medical interest prevails, or (ii) the processing is necessary for scientific research that serves a public interest or for statistical purposes. For purposes of scientific research or statistics, the data subject must give its explicit consent and appropriate safeguards for the protection of the privacy of the data subject must be in place. \n\n The prohibition to process biometric data for the purpose of uniquely identifying a natural person does not apply if the processing is necessary for authentication or security purposes. \n\n The prohibition to process data concerning health does not apply if the data is processed by: \n\n \n\t Administrative bodies, pension funds, employers or institutions that perform activities on their behalf in so far as this is necessary for:\n\t \n\t\t Compliance with legal requirements, pension schemes or collective labour agreements that provide entitlements depending on the data subject's health status; or \n\t\t The reintegration or support of employees or benefit recipients in connection with illness or disability. \n\t \n\t \n\t Schools, where such processing is necessary for special support of students or making special arrangements in connection with their health status. \n\t A probation institution, a special probation officer, the Child Care and Protection Board for the performance of the statutory duties assigned to them. \n\t The Minister for Legal Protection or the Minister of Justice and Security where such processing is necessary for the enforcement of custodial measures. \n\t Healthcare providers, institutions or health care or social services facilities, where such processing is necessary for the proper treatment or care of the data subject or the management of the institution or the professional practice. \n\t Insurers or financial service providers who act as a broker in insurances, where such processing is necessary for (i) the assessment of the risk to be insured and the data subject has no objections, or (ii) the performance of an insurance agreement. \n \n\n In addition to these special categories of data mentioned in Article 9, Member States may also further determine the specific conditions for the processing of a national identification number or any other identifier of general application. \n\n In the Netherlands, a national identification number, including the citizen service number ( Burgerservicenummer )(\" BSN \"), may only be processed to implement the law that provides for that number or for purposes provided for by law. This means that national identification numbers may only be processed if that is explicitly provided for by law. \n\n For detailed information on how this aspect of GDPR is enacted in the Netherlands please contact Houthoff directly. \n\n Risk-Based Approach  \n\n Data controllers must also have “appropriate technical and organizational measures” in place to ensure and to be able to demonstrate that processing is performed in accordance with the  GDPR , taking a risk-based approach (Article 24). This requires that the controller takes account of the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons. The measures must be reviewed and updated where necessary and shall include the implementation of appropriate data protection policies.  \n\n Privacy by Design and Privacy by Default \n\n The  GDPR  also introduces new concepts of ‘privacy by design’ and ‘privacy by default’ under Article 25. This requires that a controller shall implement appropriate technical and organizational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to: \n\n \n\t the amount of personal data collected; \n\t the extent of their processing; and  \n\t the period of their storage and their accessibility. \n \n"]
["How are storage, security and retention of personal data regulated?"," The  GDPR  requires that “appropriate technical and organizational measures” are in place to protect the security of personal data and that personal data not be retained for longer than is necessary for the purpose or purposes for which the data are processed. \n\n Article 32 provides some detail on the standards that controllers and processors should take account of in determining appropriate security measures against unauthorized or unlawful processing, accidental damage, destruction or loss of data. The data controller must take into account: \n\n \n\t the state of the art;  \n\t the cost of implementing the measures;  \n\t the nature, scope, context and purposes of processing; and \n\t the risk of varying likelihood and severity for rights and freedoms of the data subject posed by the processing, in particular, those presented against unauthorized or unlawful processing, accidental damage, destruction or loss of data. \n \n\n The  GDPR  notably states that pseudonymization and encryption be considered where appropriate and that controllers maintain system resilience and security testing, backup, recovery and continuity measures. \n\n Data controllers and data processors must ensure all of their employees comply with the security measures in place and not process personal data other than on the instructions of the controller. \n\n Personal data may not be kept for longer than is necessary for the specified purpose or purposes for which it was collected and a data retention procedure or policy should be implemented in this respect.  \n"]
["What are the data subjects' rights?","Under the \nGDPR, data subjects have enhanced rights in relation to their personal data, most of which only apply in specific circumstances. \nThe data controller shall provide information on action taken on a request within one month of receipt, which period may be extended by two further months where necessary, taking account of the complexity and number of requests and provided that the controller informs the data subject of such extension within one month of the request. \nWhere requests are manifestly unfounded or excessive, in particular, because of their repetitive character, the data controller may charge a “reasonable fee based on administrative costs” or refuse the request.\nRight of Access The data subject can ask a data controller for a copy of his or her personal data being processed by the data controller. \nRight of Rectification The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her and to have incomplete personal data completed.\nRight of ErasureIn certain circumstances, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay.\nRight of Restriction of ProcessingThe data subject has the right to obtain from the controller restriction (i.e. suspension) of the processing in certain circumstances such as where the accuracy of the data is being contested, the processing is unlawful or the data subject has objected to the processing. \nRight to Data PortabilityThe right to data portability of personal data is the right to receive the personal data provided by the data subject to the controller (on the basis of consent or contractual necessity) in a structured, commonly used and machine-readable format and to transmit those data to another controller.\nRight to ObjectThe data subject has the right to object, on grounds relating to his or her particular situation, to the processing of the personal data based on the performance of a task carried out in the public interest or for the legitimate interests of the controller or a third party.\nThe controller must no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. \nWhere personal data is processed for direct marketing purposes, the data subject has the right to object to the processing of his personal data at any time.\nAutomated Decisions with Legal or Significant EffectsData subjects have a right not to be subject to automated decision-making in respect of the personal data, including profiling, with no human intervention where such decision produces legal effects concerning the data subject or similarly significantly affects him or her (e.g. creditworthiness check or e-recruitment). This does not apply where explicit consent is provided, the processing is authorized by EU or Member State law or the processing is necessary for the purposes of entering into or performing a contract with the data subject. \nPursuant to Article 23 of the \nGDPR, these data subject rights may be subject to limitations or restrictions as prescribed by Member State law where necessary and proportionate to safeguard various matters specified in Article 23 ranging from issues of national security to the enforcement of civil law claims.\nFor detailed information on how this aspect of GDPR is enacted in the Netherlands please contact Houthoff directly."]
["Are there restrictions on cross-border data transfers?"," The  GDPR  also restricts the transfer of personal data to a country outside the European Economic Area (\" EEA \") unless certain conditions or safeguards are in place.  \n\n Transfer to Adequate Countries Outside the EEA \n\n Transfers of data to a third country or international organization are permitted where the European Commission has taken an adequacy decision under Article 45 of the  GDPR  that there is an adequate level of protection of personal data in that country or organization. \n\n The existing list of countries that have been approved by the EU Commission will remain in force. Transfers of personal data to the following countries can take place without too much concern: \n\n \n\t Andorra \n\t Argentina \n\t Canada (partial adequacy decision for personal data transferred to recipients subject to the  Canadian Personal Information Protection and Electronic Documents Act 2000 )  \n\t Faroe Islands \n\t Guernsey \n\t Israel \n\t Japan \n\t Jersey \n\t New Zealand \n\t Republic of Korea \n\t Switzerland \n\t The Isle of Man \n\t United Kingdom \n\t Uruguay \n \n\n While the  Privacy Shield  was a partial adequacy decision covering transfers toward organizations that complied with the  Privacy Shield Principles  in the United States, it has been invalidated by the decision of the European Court of Justice in case C-311/18 dated 16 July 2020 (\" Schrems II decision \") and is not applicable anymore. \n\n Transfer to Non-Adequate Countries \n\n Where the country to which the personal data will be transferred does not appear on an approved list of countries (such as the U.S.), the transfer of personal data can still take place only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies are available.  \n\n The appropriate safeguards may be provided for by: \n\n \n\t a legally binding and enforceable instrument between public authorities or bodies;  \n\t binding corporate rules in accordance with Article 47;  \n\t so-called standard contractual clauses adopted by the European Commission or the supervisory authority, which incorporate the EU standards into the contract; \n\t an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards; or \n\t an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards;  \n\t binding corporate rules pursuant to Article 47. \n \n\n The standard contractual clauses are the most used appropriate safeguard mechanism. However, according to the  Schrems II decision , controllers relying on standard contractual clauses or BCRs are required to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data in the third country, if the law of the third country ensures a level of protection of the personal data transferred that is essentially equivalent to that guaranteed in the European Economic Area. Where necessary, supplementary measures (i.e. legal, technical or organizational measures) have to be implemented to ensure such an essentially equivalent level of protection. \n\n The  GDPR  also provides for derogations to the prohibition of personal data transfers, for instance where the data subject has explicitly consented to the transfer, after having been informed of the possible risks due to the absence of an adequacy decision. \n"]
["Are there any notification requirements for data breaches?","The \nGDPR introduces a compulsory requirement for controllers to report data breaches to the competent national supervisory authority(ies) (please see below) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to data subjects.  \nA risk assessment will, therefore, need to be taken by the controller in evaluating whether the obligation to report arises. Where a breach poses a high risk to data subjects, the \nGDPR also requires that the controller communicate the breach to the affected data subjects without undue delay. Regardless of whether notification to the regulator is made or not, controllers must document all personal data breaches, comprising the facts, its effects and remedial action taken. \nWhere a processor has suffered a personal data breach, the processor must notify the controller “without undue delay” after becoming aware of the breach.\nProviders of publicly available electronic communications services in public communications networks in the EU are subject to a mandatory reporting obligation in accordance with \nEU Regulation No 611/2013.\n"]
["Who is the privacy regulator?"," Supervisory Authority \n\n Article 55 provides that each national supervisory authority has the competence to act in relation to matters in its territory. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens : www.autoriteitpersoonsgegevens.nl . \n\n Lead Supervisory Authority \n\n In circumstances where a controller or a processor is engaged in “cross-border processing” (being the processing of personal data which takes place in the context of activities of establishments of that controller or processor in more than one Member State or processing which substantially affects or is likely to substantially affect data subjects in more than one Member State), then the supervisory authority of the main or single establishment of the controller or processor shall have the competence to act in respect of such cross-border processing. \n\n Tasks and Powers of a Supervisory Authority \n\n The  GDPR  provides for enhanced, wide-ranging powers of enforcement to supervisory authorities, who may impose substantial fines for breaches of the  GDPR .  \n\n The tasks of a supervisory authority are set out in Article 57 of the  GDPR  and include, among others: \n\n \n\t monitoring and enforcing the application of the  GDPR ;  \n\t promoting awareness; \n\t handling complaints;  \n\t conducting investigations; \n\t cooperating with other supervisory authorities; \n\t administrative tasks such as drawing up codes of conduct, reviewing certifications and approving standard contractual clauses for transfers of personal data outside the  EEA .  \n \n\n The powers of a supervisory authority are set out in Article 58 and include, among others: \n\n \n\t ordering the production of information from controllers and processors; \n\t conducting investigations in the form of audits including onsite investigations; \n\t issuing warnings, reprimands, enforcement orders,  \n\t ordering the suspension or ban of non-compliant processing activities; \n\t the imposition of administrative fines; and \n\t advising, for example in relation to high-risk processing or issuing opinions. \n \n"]
["What are the consequences of a privacy breach?"," Administrative Fines \n\n The imposition of administrative fines by a supervisory authority is subject to appropriate procedural safeguards in accordance with Union or Member State law and therefore the mechanism and procedure for imposing a fine may vary from Member State to Member State. \n\n For detailed information on how this aspect of GDPR is enacted in the Netherlands please contact Houthoff directly. \n\n The level of administrative fines is set out in Article 83 together with examples of aggravating and mitigating factors in determining whether to impose a fine and if so, the level of such fine. In each case, the supervisory authority is to ensure that the imposition of fines is effective, proportionate and dissuasive. The amount of a fine depends on the nature of the infringement in question with the applicable thresholds being up to: \n\n \n\t 2% of the total global annual turnover of an undertaking for the preceding financial year or EUR 10,000,000, whichever is higher; or \n\t 4% of the total global annual turnover of an undertaking for the preceding financial year or EUR 20,000,000, whichever is higher. \n \n\n In the Netherlands, the Dutch Data Protection Authority (\" AP \") has published policy rules concerning administrative fines. These policy rules elaborate on how the amount of fines for infringements of the GDPR will be calculated and specify the fines for different categories of violations. The AP has created a four-tiered structure categorizing the different types of violations. Each category sets a basic amount for the fine and the corresponding bandwidth within which this amount can be altered. The top category prescribes a bandwidth of EUR 450,000 to EUR 1,000,000. The severity, scope and duration of the violation and whether there is intent or repeated infringement play, among others, a role in determining the fine. The fining policy rules will be applied by the AP until European guidelines concerning the calculation of fines have been established, It is noted that the EDPB is in the process of adopting its final guidelines on the calculation of administrative fines under the GDPR . \n"]
["How is electronic marketing regulated?","Direct marketing to individuals is currently regulated at a Member State level under national legislation that gives effect to the \ne-Privacy Directive (\"\nDirective 2002/58/EC\"). \nThe use of publicly available electronic communications services to send unsolicited communications or to make unsolicited calls for the purpose of direct marketing is restricted. Generally, such communications by electronic means require consent or are subject to a right to opt-out.\nIn the Netherlands, article 11.7 of the \nTelecommunications Act requires prior consent to send unsolicited digital direct marketing (e.g. by email or text message), except if (i) the receiver is a legal entity and the sender of the direct marketing makes use of the electronic contact details of the legal entity provided for that purpose, (ii)  the receiver is located outside the European Economic Area and the sender complies with the regulations with regard to the transmission of unsolicited communications for commercial, non-profit or charitable purposes applicable in the country where the receiver is located or (iii) the direct marketing is sent to existing customers regarding similar goods or services as already supplied to such customers, provided that the customer was explicitly offered the possibility to opt-out when the data were obtained and is offered the possibility to opt-out in each communication.\nIn January 2017, the European Commission published its proposal for an \ne-Privacy Regulation, which will replace and modernize the existing\n e-Privacy Directive and should particularize and complement the \nGDPR as its \nlex specialis on the protection of privacy and confidentiality of electronic communications. On February 10, 2021, the Council of the European Union finally agreed on a draft text of the \ne-Privacy Regulation, along with a mandate for its Presidency to start negotiations with the European Parliament in order to reach a consensus thereon. The 1st political trilogue concerning the e-Privacy regulation took place on 20 May 2021, under the Portuguese Presidency. The e-Privacy scope of application is set to have a broader reach than the \nGDPR, as inter alia concerns EU end-users – to whom electronic communications data (including both the content and metadata thereof) refer – regardless of whether they are natural or legal persons.\nFor detailed information on how this aspect of GDPR is enacted in the Netherlands please contact Houthoff directly."]
["Are there any recent developments or expected reforms?"," There is currently a legislative proposal pending to amend the current  Dutch  GDPR  Implementation Act . The proposal includes, among others, a new exception to the prohibition to process special categories of personal data if such processing is necessary for a mandatory accounting audit. Furthermore, the proposal contains an amendment to the exceptions on the prohibition to process genetic data and health data. \n\n In addition, the  AP  has been paying more attention to the use of biometric data and facial recognition technologies. The  AP  has given formal warnings to supermarkets regarding the use of facial recognition technologies and has been critical of the processing of biometric data. According to the  AP , facial recognition technologies may only be used with the data subject's explicit consent or if it is necessary for security and authentication purposes, provided that there is significant public interest. \n\n Finally, the AP currently (2020-2023) focuses on: \n\n \n\t Data brokers, with key areas as supervising the resale of data, internet of things, profiling and behavioral advertising. \n\t Digital government focuses on, among others, data security, smart cities, and microtargeting. \n\t Artificial intelligence and algorithms. \n \n"]