Key Benefits:
Law of 6 July 2000, laying down rules on the protection of personal data (Personal Data Protection Act)
We Beatrix, at the grace of God, Queen of the Netherlands, Princess of Orange-Nassau, etc. etc. etc.
All of them, who will see or hear these, saluut! do know:
In this regard, we have taken into consideration that it is necessary to Directive No 95 /46/EC of the European Parliament and of the Council of the European Union of 23 November 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (PbEG L 281) implement;
Having regard to Article 10, second and third paragraphs, of the Constitution ;
In this way, we, the Council of State, and with the mean consultations of the States-General, have been well-regarded and understood to be right and to be understood by the following:
For the purposes of this Act and the provisions based thereon, the following definitions shall apply:
a. Person given: each given concerning an identified or identifiable natural person;
b. processing of personal data: any act or set of acts relating to personal data, including at least the collection, recording, organization, storage, updating, modification, retrieval, consultation, use, provision bringing together, linking, linking together, fencing, erasing, erasing or destroying data by means of transmission, distribution or any other form of posting;
c. file: any structured set of personal data, whether it is centralised or disseminated in a functional or geographical manner, which is accessible by certain criteria and relates to a structured set of personal data, different persons;
d. Responsible: the natural person, legal person or any other person or management body that determines, alone or jointly with others, the purpose and means of processing personal data;
e. Editor: the person processed for the purposes of the personal data responsible, without having been subject to his direct authority;
f. data subject: the person to whom a person relates;
g. third: each, not being the person concerned, the person responsible, the editor, or any person empowered under the direct authority of the person responsible or the editor to process personal data;
h. Receiver: the person to whom the personal data are provided;
i. consent of the data subject: any free, specific and information-based will by which the data subject accepts that personal data relating to him are processed;
j. Our Minister: Our Minister of Security and Justice;
k. the College Protection Personal Data or the College: the College as intended in Article 51 ;
(l) Officer: The Data Protection Officer as referred to in Article 62 ;
m. prior investigation: an investigation as intended Article 31 ;
(n) The provision of personal data shall mean the disclosure or use of personal data;
o. Collection of personal data: the acquisition of personal data;
p. the Framework Law: the Framework Law on self-employed administrative bodies ;
(q) "binding designation" means the self-employed person to be charged for an infringement;
r. self-employed burden: the single burden of performing certain acts, specified in Article 5:2, 2nd paragraph, of the General Law governing the administrative law , in order to promote compliance with legal requirements.
1 This Act applies to the entirety or partially automated processing of personal data, as well as the non-automated processing of personal data contained in a file or intended to be used in it Included.
2 This Act does not apply to the processing of personal data:
a. For the purpose of activities with purely personal or domestic purposes;
b. By or for the benefit of the intelligence and security services, intended in the Act on the intelligence and security services 2002 ;
c. for the execution of the police task, intended to be carried out in the Articles 3 and 4, 1st paragraph, of the Police Act 2012 ;
d. which is regulated by or under the Basic registration law ;
e. for the purposes of the implementation of the Law and punitive data law and
f. for the purposes of the implementation of the Electoral law .
3 This law does not apply to the processing of personal data by the armed forces if our Minister of Defence decides to do so for the purpose of deploying or making the military in order to maintain or promote the international legal order. The decision shall be communicated to the College as soon as possible.
1 This Act does not apply to the processing of personal data for purely journalistic, artistic or literary purposes, subject to the other provisions of this Chapter, as well as the Articles 6 to 11 , 13 to 15 , 25 and 49 .
2 The prohibition of personal data as referred to in Article 16 not applicable to the extent necessary for the purposes referred to in the first paragraph.
1 This Act applies to the processing of personal data in the context of the activities of an establishment of a responsible person in the Netherlands.
2 This Act applies to the processing of personal data by or for the benefit of a responsible person who has no establishment in the European Union, using whether automated or non-automated means to be used in the Netherlands Unless these funds are used only for the transit of personal data.
3 It shall be a responsible person as referred to in paragraph 2 to process personal data unless he designates, in the Netherlands, a person or body acting on his behalf in accordance with the provisions of this Act. For the purposes of this Act and its provisions based thereon, it shall be regarded as the person responsible.
1 If the person is a minor and has not yet reached the age of sixteen, or has been placed under receipor, or has a mentorship established for the benefit of the person concerned, the place of consent of the person concerned shall be that of the person concerned. His legal representative is required.
2 A consent may be revoked at any time by the person concerned or by his legal representative.
Personal data shall be processed in accordance with the law and in a proper and careful manner.
Personal data shall be collected for specific, expressly defined and justified purposes.
Personal data may only be processed if:
(a) the data subject has given its unequivocal consent to the processing;
b. The data processing is necessary for the execution of an agreement where the person is a party, or for the taking of pre-contractual measures following a request from the person concerned and necessary for the conclusion of the contract. of an agreement;
c. Data processing is necessary in order to fulfil a legal obligation to which the person responsible is subject;
Data processing is necessary in order to safeguard a vital interest of the data subject;
(e) data processing is necessary for the proper performance of a public-law task by the governing body concerned or the administrative body to which the data are supplied; or
f. the data processing is necessary for the defence of the legitimate interest of the person responsible or of a third party to whom the data is supplied, unless the interest or fundamental rights and freedoms of the data subject, in in particular, the right to protection of privacy shall prevail.
1 Personal data shall not be further processed in a manner that is incompatible with the purposes for which they were obtained.
2 When assessing whether a processing is incompatible as referred to in the first paragraph, the person responsible shall take into account in each case:
a. the relations between the purpose of the intended processing and the purpose for which the data were obtained;
b. the nature of the data in question;
c. the consequences of the intended processing for the person concerned;
d. the manner in which the data was obtained and
(e) the extent to which the person concerned is provided with adequate safeguards.
3 Further processing of data for historical, statistical or scientific purposes shall not be considered to be incompatible where the person responsible has taken the necessary provisions to ensure that the information processing is carried out exclusively for the purposes of those specific purposes.
4 The processing of personal data shall not be automatic to the extent that the obligation of professional secrecy on the grounds of office, occupation or legal requirement is in the way of such processing.
1 Personal data shall no longer be kept in any form which allows identification of the person concerned, than is necessary for the realization of the purposes for which they are collected or subsequently processed.
2 Personal data may be kept for longer than determined in the first member to the extent that they are retained for historical, statistical or scientific purposes, and the person responsible has taken the necessary provisions to the end of ensure that the data in question is used exclusively for these specific purposes.
1 Personal data shall be processed only in so far as they are adequate, relevant and not excessive, having regard to the purposes for which they are collected or subsequently processed.
2 The person responsible shall take the necessary measures to ensure that personal data, having regard to the purposes for which they are collected or subsequently processed, are accurate and accurate.
1 Any person acting under the authority of the person responsible or of the editor, as well as the editor himself, to the extent that they have access to personal data, shall process them only on the instructions of the person responsible, except in the case of different legal persons. Obligations.
2 The persons referred to in paragraph 1 who are not subject to the obligation of professional secrecy by virtue of the duties, appeals or legal provisions shall be liable to the confidentiality of the personal data of which they are notified, except in so far as any such person is required to disclose personal data. (i) legal provision oblii ing them to communicate the need for communication. Article 272 (2) of the Code of Criminal Law does not apply.
The person responsible shall implement appropriate technical and organisational measures to secure personal data against loss or against any form of unlawful processing. These measures shall ensure, taking into account the state of the art and the costs of implementation, an appropriate level of security, having regard to the risks involved in the processing and the nature of the data to be protected. The measures are also designed to prevent unnecessary collection and further processing of personal data.
1 If the responsible personal data is processed by an editor for the purposes of its processing, it shall ensure that it offers adequate safeguards with regard to the technical and organisational security measures relating to the operation to be taken into account. perform processing operations, and in relation to the notification of any security breach, as referred to in Article 13 , which results in the significant risk of serious adverse effects or has serious adverse effects on the protection of personal data processed by him. The person responsible shall monitor compliance with those measures.
2 The execution of processing operations by an editorial shall be governed by an agreement or by any other legal act creating a commitment between the person responsible for the operation and the person responsible.
3 The person in charge shall ensure that the editor:
a. The personal data processed in accordance with Article 12, first paragraph ;
b. fulfilling the obligations incumbent upon the responsible rest Article 13 , and
Compliance with the obligations incumbent upon the responsible rest on the obligation to report security breach, c. Article 13 , which results in the significant risk of serious adverse effects or has serious adverse effects on the protection of personal data processed by him.
4 The person responsible for ensuring that the person responsible fulfils the law of that other country shall, by way of derogation from paragraph 3 (b) and (c), be responsible for ensuring that the person responsible is responsible for ensuring that the person responsible is responsible for ensuring that the person responsible for the operation is responsible.
5 With a view to keeping the evidence, the parts of the agreement or legal act related to the protection of personal data shall be the security measures referred to in Article 5. Article 13 , and the obligation to report a security breach leading to the significant risk of serious adverse effects or serious adverse effects on the protection of personal data processed by him, fixed in writing or in any other equivalent form.
The person responsible shall ensure compliance with the obligations provided for in the Articles 6 to 12 and 14, second and fifth members of this chapter.
The processing of personal data concerning a person's religion or belief, race, political affiliation, health, sexual life, as well as personal data relating to membership of a trade union is prohibited except in the case of personal data. in this paragraph. The same shall apply to personal data and personal data relating to unlawful or harmful conduct in relation to a prohibition on the basis of that behaviour.
1 The prohibition of processing personal data concerning a person's religion or belief as intended Article 16 , does not apply if the processing is carried out by:
a. denominations, self-employed parts or other societies on a spiritual basis in so far as they are data of persons belonging to it;
(b) religious or philosophical institutions, in so far as is necessary in the light of the objectives of the institution and the attainment of its foundation; or
(c) other institutions to the extent that this is necessary for the purpose of providing for the mental care of the person concerned, unless it has objected to it in writing.
2 In the cases referred to in paragraph 1 (a), the prohibition shall also not apply to personal data concerning religion or belief of the members of the family of the person concerned to the extent that:
a. the Society with those members of the family, under its objective, maintains regular contacts; and
(b) those members of the family have not objected in writing.
3 In the cases referred to in paragraphs 1 and 2, no personal data shall be provided to third parties without the consent of the person concerned.
The prohibition of processing personal data relating to a person's variety as intended Article 16 , does not apply if processing is carried out:
a. for the identification of the person concerned and only to the extent that this is unavoidable for this purpose;
(b) for the purpose of granting a privileged position to persons of a particular ethnic or cultural minority in order to eliminate or to reduce actual disadvantages linked to the land, and only if:
1 °. This is necessary for that purpose;
2. the data relate only to the country of birth of the person concerned, his parents or grandparents, or to other criteria laid down by law, on the basis of which it is objectively possible to establish whether or not a person is a member of a person. minority group as referred to in the chapeau of part b, and
3 °. the person concerned has not raised any objections in writing.
1 The prohibition of processing personal data relating to a person's political affiliation as intended Article 16 , does not apply if processing is carried out:
a. By institutions on a political basis as to their members or their employees or other persons belonging to the institution, in so far as it is necessary for the purpose of the institution to achieve its basis; or
b. In order to meet the requirements of political affiliation, which may be considered in relation to the performance of functions in administrative bodies and advisory colleges.
2 In the case referred to in paragraph 1 (a), no personal data shall be disclosed to third parties without the consent of the person concerned.
1 The prohibition of processing personal data concerning a person's membership of a trade union as referred to in Article 16 It shall not apply where the processing is carried out by the trade union or trade union unit of which it constitutes a part, in so far as it is necessary in the light of the objective of the trade union or central unit.
2 In the case referred to in paragraph 1, no personal data shall be disclosed to third parties without the consent of the person concerned.
1 The prohibition of processing personal data relating to a person's health as intended Article 16 , does not apply if the processing is carried out by:
a. Aid workers, institutions or facilities for health or social services to the extent that for the purpose of proper treatment or care of the person concerned, or the management of the institution or professional practice;
b. Insurers referred to in Article 1: 1 of the Law on Financial Supervision and financial service providers that provide funds in insurance as intended Article 1: 1 of that Act , to the extent necessary for:
1 °. the assessment of the risk to be insured by the insurer and the person concerned has not objected; or
2 °. the performance of the contract of insurance;
c. Schools in so far as is necessary for the special guidance of pupils or the taking of special services in connection with their state of health;
d. a probation institution, a special probation officer, the child protection council or the certified institution, intended to be used. Article 1.1 of the Youth Act and the legal person, referred to in Article 256, first paragraph , or Article 302, 2nd paragraph, of Book 1 of the Civil Code , to the extent necessary for the performance of the tasks entrusted to them by law;
e. Our Minister to the extent necessary in connection with the implementation of custodial sentences or measures involving deprivation of liberty or
(f) managing bodies, pension funds, employers or institutions working for the purpose of their work, to the extent necessary for:
1. a proper performance of statutory regulations, pension schemes or collective agreements providing for entitlements which depend on the state of health of the person concerned, or
2 °. the reintegration or mentoring of workers or beneficiaries of sickness or incapacity for work.
2 In the cases referred to in paragraph 1, the data shall only be processed by persons who are required by virtue of the office, profession or legal requirement, or by virtue of an agreement to keep it confidential. Where the data responsible are processed in person and are not subject to the obligation of professional secrecy by virtue of the office, profession or legal requirement, he shall be required to keep the information confidential, except in so far as the law provides for him to be kept confidential; The communication is compulsory or the need arises from the task of communicating the data to others empowered under the first Member State to process them.
3 The prohibition of other personal data as referred to in Article 16 not applicable to the extent that this is necessary in addition to the processing of personal data concerning a person's health as referred to in point (a) of the first paragraph, in order to ensure proper treatment or care of the person concerned. Person.
4 Personal data relating to hereditary properties may only be processed in so far as such processing takes place in relation to the data subject from which the data concerned has been obtained, unless:
a. A serious medical interest shall prevail; or
b. The processing is necessary for the purposes of scientific research or statistics.
In the case referred to in point (b), Article 23, first paragraph, point (a) and second paragraph , mutatis mutandis.
5 The application of paragraph 1 (b) and (f) may be subject to detailed rules of application of the provisions of the general measure of management.
1 The prohibition of processing criminal personal data as intended in Article 16 , does not apply if the processing is carried out by bodies charged under the Act with the application of criminal law, as well as by those responsible who have obtained them under the Police Data Act or the Law and punitive data law .
2 The prohibition shall not apply to the person responsible for processing such data for the purposes of:
a. Assessment of a request from the person concerned to take a decision on him or to deliver a performance to him or
(b) protection of his interests in so far as they are criminal offences which are likely to be committed against him or against persons employed in his service on the basis of facts and circumstances.
3 The processing of this data on personnel employed by the person responsible shall be carried out in accordance with rules established in accordance with the procedure set out in the Law on Works Councils .
4 The prohibition shall not apply where this information is processed for the benefit of third parties:
a. by those responsible for the conduct of a licence under the conditions of Law of private security organisations and search agencies or
(b) if that third party concerns a legal person in the same group as intended to be Article 2:24b of the Civil Code , or
(c) if appropriate and specific safeguards have been taken and the procedure followed, Article 31 .
5 The prohibition of other personal data as referred to in Article 16 , to be processed, does not apply to the extent that this is necessary in addition to the processing of criminal data for the purposes for which this data is processed.
6 The prohibition does not apply to the processing of criminal data by and for the purpose of public sector partnerships of those responsible or of groups of persons responsible if processing is necessary for the purposes of the execution of the task of those responsible or groups of persons responsible and in the implementation shall be provided in such a way as to ensure that the privacy of the person concerned is not disproportionately damaged.
7 The second to sixth paragraphs shall apply mutatis mutandis to personal data relating to a prohibition on wrongful or obstructive behaviour imposed by the courts.
8 In the case of a general measure of management, rules may be laid down on the appropriate and specific safeguards referred to in point (c) of the fourth paragraph.
1 Without prejudice to: Articles 17 to 22 is the prohibition to provide personal data as intended Article 16 , to be processed not applicable to the extent that:
a. This is done with the express consent of the person concerned;
(b) the data has been clearly disclosed by the data subject;
(c) This is necessary for the purpose of establishing, exercising or defending a right in law;
This is necessary in defence of the vital interests of the person concerned or of a third party and the questions of his express consent are not found to be possible;
(e) This is necessary for the fulfilment of an obligation of international law; or
This is necessary for the sake of a serious public interest, provided that adequate safeguards are provided for the protection of privacy and that it is determined by law or has granted the College a waiver. The College may impose restrictions and regulations on the granting of a derogation;
g. the data are processed by the College or an ombudsman as referred to in Article 9:17 of the General Administrative Law and this is necessary for the fulfilment of the tasks entrusted to them by law, and is provided for in that performance in such a way as to ensure that the privacy of the person concerned is not disproportionate. would be harmed.
2 The prohibition of personal data as referred to in Article 16 , to be processed for the purposes of scientific research or statistics, does not apply to the extent that:
(a) the investigation has a general interest;
(b) processing for the relevant investigation or statistics is necessary,
c. Questions of express consent cannot prove or cost a disproportionate effort; and
d. has been implemented in such a way as to ensure that the privacy of the person concerned is not disproportionately damaged.
3 Operations referred to in point (f) of paragraph 1 shall be notified to the European Commission. Our Secretary of State shall make the notification if the processing is provided for by law. The College shall make the notification if it has granted a derogation for processing.
1 A number prescribed for the identification of a person by law shall be used in the processing of personal data only for the purposes of the law or for purposes specified in the law.
2 In the case of a general measure of management, other cases, other than those referred to in paragraph 1, may be used where a number to be designated as referred to in the first paragraph may be used. In so doing, detailed rules on the use of such a number may be laid down.
1 The organisation or organisations which intend to adopt a code of conduct may request the College to declare that the rules contained therein, having regard to the particular characteristics of the sector or sectors of society in which it is concerned, are organisations are working, forming a proper form of this law or of other legal provisions relating to the processing of personal data. If a code of conduct provides for the settlement of disputes over its compliance, the College may issue the certificate only if it is provided for in respect of independence.
2 The first paragraph shall apply mutatis mutandis to amendments or renewals of existing codes of conduct.
3 The College shall take the request only if, in its opinion, the applicant or applicants are sufficiently representative and the sector or sectors in the Code have been described in sufficient detail.
4 A decision on a request as referred to in paragraph 1 shall be deemed to be a decision in the sense of the General administrative law . To prepare for it is Section 3.4 of that Act applicable.
5 The declaration shall not apply to the period for which the Code of Conduct shall apply, but not exceeding five years from the date on which the declaration was made known. If the declaration is requested for a modification of a code of conduct for which a statement has been previously issued, it shall apply for the duration of the previously issued declaration.
6 The statement shall be placed in the Official Gazette by the Board of Conduct together with the Code of Conduct to which it relates.
1 In the case of a general measure of management, detailed rules for a particular sector may be laid down for the Articles 6 to 11 and 13 regular subjects.
2 In its annual report, the College shall indicate to what extent the application of the first paragraph is desirable.
1 A fully or partially automated processing of personal data intended for the execution of a purpose or for several related purposes shall be reported.
2 A non-automated processing of personal data intended for the execution of a purpose or for several related purposes shall be notified if it is subject to prior examination.
3 The controller shall report the processing before commendation with it at the College or by the staff member.
1 The notification shall contain an indication of:
a. The name and address of the person responsible;
b. the purpose or purposes of the processing;
c. a description of the categories of data subjects and of the data or categories of data relating to them;
d. recipients or categories of recipients to whom the data may be provided;
e. the intended transfers of data to countries outside the European Union;
f. a general description to give a preliminary opinion on the appropriateness of the proposed measures in order to apply Article 13 and 14 , ensure the security of the processing.
2 The notification shall contain the purpose or purposes for which the data or categories of data are or are to be collected.
3 A change in the name or address of the person responsible is reported within a week. Any amendment to the declaration relating to parts b to f of paragraph 1 shall be notified within one year of the prior notification to the extent that they appear to be more than incidental.
4 Any processing which deviates from what has been reported in accordance with paragraph 1 (b) to (f) shall be recorded and retained for at least three years.
5 In the case of, or under general management, detailed rules may be laid down on the manner in which notification is to be made.
1 In the case of a general measure of management, it may be stipulated that the processing operations which are unlikely to be subject to the breach of the fundamental rights and freedoms of the person concerned shall be exempt from the notification provided for in this Article. Article 27 .
2 The following shall be established:
a. the purposes of the processing,
b. the processed data or categories of data processed;
c. the categories of data subjects;
d. the recipients or categories of recipients to whom the data is provided; and
e. the period of time during which the data is kept.
3 In the case of a general measure of administration, where this is necessary for the purpose of the detection of criminal offences, in a particular case, the processing of data by persons responsible under the law, may be determined, Detection shall be exempted from the notification. In doing so, compensatory safeguards for the protection of personal data can be established. The data processed may be used only for the purposes expressly referred to in that general measure of management.
4 The obligation to notify is not applicable to public records established by law and to benefits in kind provided to a management body under a legal obligation.
1 Both the College and the staff member shall keep a record of the data processing operations notified to them. The register shall contain at least the information given under the register. Article 28, first paragraph, points (a) to (e) .
2 The register may be consulted free of charge.
3 The person responsible shall forward to each person who requests the information as referred to in the Article 28, first paragraph, points (a) to (e) , in relation to the data exempted from the notification.
4 The third paragraph shall not apply to:
a. Data processing which is exempt under Article 29, third paragraph ;
b. Public records established by law.
1 The College shall examine, prior to processing, if the responsible person:
a. A number identifying persons intends to process for a purpose other than for which the number is specifically intended to be used for the purpose of data relating to data processed by another person; Responsible, unless the use of the number is done for the cases described in Article 24 ;
(b) intends to record data on the basis of the targeted collection of information by way of its own investigation without informing the data subject; or
c. intends to process criminal data or data on unlawful or nuisance behaviour for the benefit of third parties, other than in the cases mentioned in Article 22, fourth paragraph, parts a and b .
2 The first paragraph, point (b), shall not apply to public records established by the Act.
3 The first paragraph, section c, does not apply to data processing operations already submitted by another responsible prior examination and in respect of which the College is a statement as intended. Article 32 (5) Has been issued.
4 By law or general measure of governance, other data processing operations that pose a particular risk to the personal rights and freedoms of the person concerned to which the first member applies may be designated. The College shall indicate in its annual report to what extent such designation is desirable in its opinion.
5 The College shall report to the European Commission a processing referred to in point (c) of the first paragraph.
1 A data processing on which Article 31, first paragraph , applies, as such, shall be reported by the person responsible at the College.
2 The notification of such data processing shall require the person responsible to suspend the processing which it intends to carry out until the examination of the College has been completed or has received a notice not until further notice. Investigations are carried out.
3 In the case of a notification of a data processing Article 31, first paragraph , the College shall decide, in writing, within four weeks of the date of its notification, whether it is going to examine it.
(4) In the decision to proceed with further examination, the College shall indicate the period within which it intends to carry out such an investigation. That period shall not exceed 20 weeks.
5 The further investigation, referred to in paragraph 4, shall lead to a statement of the lawfulness of the data processing.
6 The statement of the College applies as a decision in the sense of the General administrative law . To prepare for it is Section 3.4 of that Act applicable.
1 If personal data are obtained from the person concerned, the person responsible shall inform the person concerned before the date of the acquisition, as provided for in the second and third paragraphs, unless the person concerned is already aware of it.
2 The person responsible shall inform the person concerned of his identity and the purposes of the processing for which the data are intended.
3 The controller shall provide further information to the extent that, having regard to the nature of the data, the circumstances under which they are obtained or the use made of it, is necessary to ensure that the person concerned has a proper and thorough knowledge of the facts. to ensure processing.
1 If personal data is obtained in a manner other than that of the Article 33 , the person responsible shall inform the person concerned of the information referred to in the second and third paragraphs, unless it is already informed of the following:
a. at the time of recording of data relating to him; or
b. When the data is intended to be provided to a third party, at the latest at the time of the first provision.
2 The person responsible shall inform the person concerned of his identity and the purposes of the processing.
3 The controller shall provide further information to the extent that, having regard to the nature of the data, the circumstances under which they are obtained or the use made of it, is necessary to ensure that the person concerned has a proper and thorough knowledge of the facts. to ensure processing.
4 The first paragraph shall not apply where communication of the information to the person concerned proves impossible or a disproportionate effort is made. In that case, the person responsible shall record the origin of the data.
5 The first paragraph shall not apply either where the recording or delivery to or under the law is prescribed. In such a case, the person responsible shall, at his request, inform the person concerned of the legal requirement that has led to the recording or provision of the data relating to him.
1 The person responsible shall immediately inform the College of any security breach, as referred to in Article 4 (2). Article 13 , which leads to the significant risk of serious adverse effects or has serious adverse effects on the protection of personal data.
2 The person responsible, referred to in paragraph 1, shall immediately inform the person concerned of the infringement referred to in the first paragraph if the infringement is likely to have adverse effects on his/her private life.
3 The notification to the College and the person concerned shall include in any event the nature of the infringement, the authorities where more information about the infringement may be obtained and the recommended measures to mitigate the negative effects of the infringement.
4 The notification to the College shall also include a description of the identified and probable consequences of the breach of the processing of personal data and the measures taken or proposed by the person responsible for the purpose of to remedy the effects.
5 The notification to the data subject is made in such a way that, taking into account the nature of the infringement, the recorded and actual consequences thereof for the processing of personal data, the circle of persons involved and the cost of implementation, a proper and careful provision of information is ensured.
6 The second paragraph shall not apply where the responsible technical protection measures have taken the necessary steps to ensure that the personal data relating to it are incomprehensible or inaccessible to any person who has no right of access to the personal data of the person concerned. Knowledge of the data.
7 If the person responsible does not make a notification to the person concerned, the College may, if it considers that an infringement is likely to have adverse effects on the personal life of the person concerned, of the person responsible Require him to give a notification.
8 The person responsible shall keep an overview of any infringement leading to the significant risk of serious adverse effects or serious adverse effects on the protection of personal data. In any case, the summary shall contain facts and information concerning the nature of the infringement referred to in the third paragraph and the text of the notification to the person concerned.
9 This Article shall not apply if the person in charge in his capacity as the provider of a public electronic communications service has issued a notification as intended 11.3a, 1st and 2nd member, of the Telecommunication Act .
10 The second and seventh members shall not apply to financial undertakings as referred to in the Law on financial supervision .
11 In the case of a general measure of management, detailed rules may be laid down regarding the notification.
1 The person concerned shall have the right freely and at reasonable intervals to contact the person responsible with the request to inform him of any processing of personal data concerning him or her. The person responsible shall inform the person concerned whether he or she will be processed in writing for personal data within four weeks.
2 Where such information is processed, the communication shall contain a full list of them in intelligible form, a description of the purpose or purpose of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the information available on the origin of the data.
3 Before a person responsible makes a communication as referred to in the first paragraph, against which a third party is expected to have reservations, he shall give the third opportunity to present his views if the communication contains data which relate to it, unless this proves impossible or a disproportionate effort is required.
4 The information on the logic underlying the automated processing of data relating to data is submitted by the responsible communications.
1 The person to whom, according to Article 35 has been notified of any personal data relating to him, the requests responsible may improve it, supplement it, remove it, or display it if it is factually inaccurate, for the purpose or purposes of the processing be incomplete or not on the subject of business or otherwise in contrasting with a legal requirement. The request shall contain the amendments to be made.
2 The person responsible shall notify the applicant in writing within four weeks of the receipt of the request, or of the extent to which it is satisfied. A refusal shall state the reasons for it.
3 The person in charge shall ensure that a decision to improve, supplement, remove or foreclosure is carried out as soon as possible.
4 If the personal data is recorded on a data carrier in which no changes can be made, he shall find the facilities necessary to inform the user of the impossibility of improvement, supplement, removal or foreclosure despite the fact that there is ground for the adjustment of the data under this Article.
5 The provisions of paragraphs 1 to 4 of this Article shall not apply to public registers established by law where a special procedure for the improvement, completion, disposal or blocking of data is provided in that law.
1 If a weighty interest of the applicant demands this, the person in charge shall comply with a request as referred to in the Articles 35 and 36 , in a form other than written, which has been adapted to that interest.
2 The person responsible shall ensure that the identity of the applicant is properly identified.
3 The applications referred to in the Articles 35 and 36 , in respect of minors who have not reached the age of sixteen years, and are done by their legal representatives in the case of receipted persons. The communication in question shall also be made to the legal representatives.
1 The person responsible for a request based on the Article 36 has improved, supplemented, removed or shielded personal data, is required to notify third parties to whom the data prior to it has been provided as soon as possible of the improvement, replenishment, removal or shielding, unless it proves impossible or costs a disproportionate effort.
2 The person responsible shall do so to the applicant, Article 36 , if requested, indicate those to whom he has made the communication.
1 The person responsible may for a communication as referred to in Article 35 require a fee of a maximum of € 5 to be determined by or pursuant to a general measure of management.
2 The allowance shall be returned in the case where the person responsible, at the request of the person concerned, on a recommendation from the College or on the order of the judge ' s order to improve, supplement, remove or shield the person concerned.
3 The amount referred to in paragraph 1 may be amended in special cases by a general measure of management.
1 If data is the object of processing on the basis of Article 8 (e) and (f) , the person concerned may, at any time, be resisting the person responsible in connection with his particular personal circumstances.
2 The responsible assessment shall be made within four weeks of receipt of the opposition or justified by the opposition. If the resistance is justified, it shall cease to be processed immediately.
3 The person responsible may, for the consideration of a resistance, require reimbursement of costs, which shall not exceed an amount to be fixed by or on the basis of a general measure of management. The fee shall be returned in case the resistance is found to be well founded.
4 This Article shall not apply to public records established by the Act.
1 If data is processed in connection with the establishment or maintenance of a direct relationship between the person responsible or a third party and the person concerned with a view to recruitment for commercial or charitable purposes, the person concerned may oppose, free of charge, at any time by the person responsible.
2 In the case of resistance, the person responsible shall take the necessary steps to terminate this form of processing immediately. The person responsible shall inform the person concerned of the measures taken within four weeks of the request. If the notification cannot be made within a period of four weeks, the person responsible shall, within four weeks of the date of receipt of the request, inform the Commission of the time limit within which the notification may be made.
3 The person responsible for processing personal data for the purpose referred to in paragraph 1 shall take appropriate measures to ensure that the persons concerned are aware of the possibilities for resistance to the action.
4 The person responsible for processing personal data for the purpose referred to in paragraph 1 shall ensure that, where a message is sent directly to the person concerned, the latter shall be made aware of the possibility of the personal data being taken up by the person concerned. Of resistance.
1 No one can be subject to a decision which has legal effect for him or which affects him to a significant extent, if that decision is taken solely on the basis of an automated processing of personal data intended to get an image of certain aspects of his personality.
2 The first paragraph shall not apply if the decision referred to therein:
a. is taken in the context of the conclusion or execution of an agreement and
1 °. the request of the person concerned is fulfilled or
2 °. appropriate measures have been taken to protect its legitimate interest; or
(b) considers its basis in a law laying down measures designed to protect the legitimate interest of the person concerned.
3 An appropriate measure as referred to in point (a) of paragraph 2 shall be taken if the person concerned has been given the opportunity to present his views on the decision referred to in the first paragraph.
4 In the case referred to in paragraph 2, the person responsible shall inform the person concerned of the logic underlying the automated processing of data relating to him.
The person responsible may Article 9, first paragraph , 30, third member , 33 , 34 , 34a, second member , and 35 shall, in so far as is necessary in the interest of:
a. the safety of the State;
b. the prevention, detection and prosecution of criminal offences;
c. weighty economic and financial interests of the State and other public bodies;
d. the supervision of compliance with legal requirements imposed on behalf of the interests referred to in point (b) and (c); or
e. the protection of the person concerned or of the rights and freedoms of others.
1 If a processing takes place by institutions or services for scientific research or statistics, and the necessary facilities are affected to ensure that the personal data is exclusively for statistical and scientific purposes the means to be used, the person responsible may, as referred to in Article 34 refrain and refuse to a request as intended to Article 35 -
2 Where a processing takes place of personal data which is part of archive records which are Articles 12 or 13 of the Archives Act 1995 have been transferred to an archive storage site, the person responsible may, as a result, be responsible for Article 34 Do not use it.
A decision on a request as referred to in the Article 30, third paragraph , 35 , 36 and 38, second paragraph , as well as a decision on the purpose of the notice of resistance to the use of Articles 40 or 41 to the extent that it is taken by a governing body as a decision within the meaning of the General administrative law .
1 If a decision as referred to in Article 45 has been taken by a board other than a governing body, the person concerned may refer the matter to the court in writing with the request in writing, order the person responsible for the application as referred to in the Article 30, third paragraph , 35 , 36 or 38, second paragraph , either to be used or to be indicated or to be opposed as specified in the Articles 40 or 41 Whether or not to honor it.
2 The application must be filed within six weeks of receipt of the answer from the person responsible. If the person responsible has not replied within the time limit set, the application must be lodged within six weeks of the end of that period.
3 The court shall assign the application, in so far as it considers it well founded. Before a decision is taken by the court, it shall, if necessary, inform the interested parties of the opportunity to present their views.
4 The submission of the application may not be made by a lawyer.
5 The third division of the fifth title of the Second Book of the Code of Civil Procedure shall apply mutatis mutandis.
6 The court may request parties and others to provide written information and to transmit written documents to them within a time limit to be determined by the court. The person responsible and the person concerned shall be obliged to comply with this request. The Articles 8:45, 2nd and 3rd member , and 8:29 of the General Law governing law shall be applicable mutatis mutandis.
1 The person concerned may also, within the time limit laid down for the application of the General administrative law , or those, intended to Article 46, second paragraph , turn to the College to mediate or advise against the request in its dispute with the person responsible, or to use a dispute settlement system under a code of conduct in respect of which a certificate has been issued as a result of the application of the Intended in Article 25, first paragraph . In that case, by way of derogation from Article 6: 7 of the General Administrative Law Act the appeal is still being brought, or the proceedings pursuant to Article 46 continue to be brought after the College concerned or under a dispute settlement procedure under a Code of Conduct for which a certificate has been issued as referred to in Article 3 (2) of the EC Treaty. Article 25, first paragraph , a notice was received that the treatment of the case was terminated, but not later than six weeks after that time.
2 During the examination of the appeal and the procedure referred to in paragraph 1, the bodies responsible for dealing with the dispute may seek the opinion of the College.
The authorities responsible for dealing with the dispute shall send copies of their proceedings to the College.
1 If a person suffers injury by being acted contrary to the rules provided by or under this law, the following paragraphs shall apply, without prejudice to claims under other legal rules.
2 For a disadvantage which does not exist in capital damage, the injured party shall be entitled to a compensation to be determined in fairness.
3 The person responsible shall be liable for the damage or disadvantage resulting from the failure to comply with the rules referred to in paragraph 1. The editor shall be liable for such damage or disadvantage to the extent resulting from its efficacy.
4 The person responsible or the editor may be relieved, in whole or in part, from this liability if he proves that the damage is not attributable to him.
1 If the person responsible or the editor acts in contraa with or by virtue of this Law that there is or is likely to suffer harm or harm, the judge may, on the action of that other, prohibit him from taking action and order him to take action to recover the effects of that behaviour.
2 A processing may not be based on a claim by a legal person as intended in Article 1:2, third paragraph, of the General Law governing the administrative law or Article 3:305a of the Civil Code , to the extent that the person affected by this processing is opposed to it.
1 There is a College Protection Personal Data that has the task of seeing on the processing of personal data in accordance with it and under the law determined. The College also monitors the processing of personal data in the Netherlands, when processing is carried out in accordance with the law of another country of the European Union.
2 The College is asked for advice on proposals of law and draft general measures of management which relate wholly or to an important part to the processing of personal data.
3 The Framework Law shall apply to the College, subject to the exceptions provided for in this Act.
4 The College is referred to in social traffic as: Personal Data Authority.
1 The College shall have the power to conclude, in the interests of efficient and effective supervision of the processing of personal data, agreements with other supervisors and to that end establish cooperation protocols with those supervisors. A cooperation protocol shall be published in the Official Gazette.
2 The College and the supervisors referred to in paragraph 1 shall be empowered to supply each other with data relating to the processing of personal data which are necessary for the execution of their own personal data, and to the competent authorities of the Member States. task.
1 The College, by the way, performs the duties, mandated him by law and under the terms of the Treaty.
2 The College fulfils its tasks in independence.
1 The College shall consist of a chairman and no more than two other members. Extraordinary members may also be appointed to the College. The appointment of exceptional members shall be the subject of a distribution across the various sectors of society.
2 The chairman must comply with the at or under Article 5 of the Law on the legal position of judicial officers Required requirements for need to judge in court.
The President, the other members and the special members shall be appointed by royal decree, upon the proposal of Our Minister, for a period of five years. The members may be reappointed once for a period of five years. On their own request, they will be dismissed by our Minister. Article 12 of the Framework Law does not apply.
4 There is a Board of Opinion advising the College on general aspects of the protection of personal data. The members are drawn from the various sectors of society and are appointed by our Minister on a proposal from the College. Members shall be appointed for a maximum period of four years. Reappointment may take place twice and each time for a maximum of four years. In the case of, or under general management, the reimbursement of expenses shall be determined to the members.
The Articles 46c , 46d, second member , 46f , 46g , 46i, with the exception of the first paragraph, , 46j , 46l, first and third members , 46m , 46n , 46o and 46p of the Law on Civil Law shall be applicable mutatis mutandis, subject to the following conditions:
a. the disciplinary measure referred to in Article 46c, first paragraph , as regards the members of the College by the President of the College of the College of the European Union;
b. In Article 46c, first paragraph, part b The Members of the College shall not be subject to the said prohibition in a maintenance or conversation with the parties or its lawyers or agents, or any particular information or written part of them.
Article 12, second paragraph, of the Framework Law does not apply.
The legal position of the President, the other members and the special members shall be governed by ministerial rules.
1 The College shall have a secretariat, the officials of which shall be appointed by our Minister, on a proposal from the President, suspended and dismissed.
2 The President shall direct the work of the College and the Secretariat.
3 The College shall adopt rules of management. This includes, in any case, rules on financial management and administrative organisation, as well as on procedures and procedures for the proper and careful exercise of the various tasks. It shall provide for safeguards against the mixing of the supervisory, advisory and sanctioning task of the College. It may also lay down detailed rules for the Council's opinion, as provided for in Article 53, fourth paragraph .
1 The College shall be represented by the President and other Members, or by one of them.
2 The members shall establish a division of tasks and involve as much as possible the extraordinary members.
The annual report referred to in Article 18 of the Framework Law , shall be sent to the Data Protection Officers of the Article 62 , and generally available.
Article 20 of the Framework Law does not apply if the College has obtained the information from third parties under the condition that its secret nature is maintained.
1 The Articles 21 and 22 of the Framework Law shall not apply to the College.
2 Article 23 of the Framework Law shall apply only to the financial management and administrative organisation carried out by the College.
1 The College may, of its own motion or at the request of any interested party, investigate the manner in which data processing is applied to the specific case of, or under, the law.
2 The College shall notify its preliminary findings to the person responsible or to the group of those responsible for the investigation and shall give them the opportunity to comment on them. If the provisional findings are related to the implementation of any law, the College shall also notify it to our Minister for the purpose of doing so.
3 In the case of an investigation established at the request of an interested party, the College shall submit its findings, unless such disclosure is incompatible with the purpose of data processing or the nature of the personal data, any important interests of others than the applicant, including the person in charge, would be adversely affected by it. If the disclosure of the findings is omitted, it shall send notice to the person concerned if it has been recommended.
1 With the verification of compliance as referred to in Article 51, first paragraph be responsible for the members and extraordinary members of the College, the officials of the College Secretariat, and the persons designated by decision of the College.
2 Persons referred to in paragraph 1 shall be entitled to enter a dwelling without the permission of the occupant.
3 The persons referred to in paragraph 1 shall, for the exercise of the power defined in the second paragraph, have the express and special powers of the College, without prejudice to the provisions of the Article 2 of the General Act on entering .
4 The College is responsible for the imposition of a charge under administrative constraints in the enforcement of Article 5:20, 1st paragraph, of the General Law governing the administrative law , in so far as it concerns the obligation to cooperate with an official designated by or under the first paragraph.
5 An obligation of professional secrecy may not be invoked, to the extent that information or cooperation is required in connection with its own involvement in the processing of personal data.
6 The College is required, on request, to give all cooperation to the supervisory authorities of the other Member States of the European Union to the extent necessary for the performance of their tasks.
A person responsible or an organisation in which persons responsible may appoint a personal data protection officer shall, without prejudice to the powers of the College, be appointed by Chapter 9 and 10 of this law.
1 shall be appointed as a staff member only if a natural person has sufficient knowledge for the performance of his task and who can be regarded as sufficiently reliable.
2 The officer may not receive any instructions from the person in charge or from the organisation which appointed him, as far as the performance of his duties is concerned. He is not adversely affected by the exercise of his duties. The person responsible shall give the staff member the opportunity to perform his duties properly. The staff member may request the cantonal court to provide that the person responsible must comply with the conditions laid down in the second sentence of the sentence.
3 The staff member shall perform his duties first after the person responsible or the organisation which appointed him has notified him to the College. The College shall keep a list of notified staff members.
4 The staff member shall be required to keep the information known to him on the basis of a complaint or to a request made by the person concerned, unless the person concerned agrees to his publication.
1 The staff member shall monitor the processing of personal data in accordance with the rules laid down by and pursuant to the law. The supervision shall extend to the processing of personal data by the person who has appointed him or by those responsible to the organisation who appointed him.
2 If the processing is a Article 25 The provisions of the Code of Conduct shall be designed to ensure compliance with this Code.
3 The person responsible or the organisation referred to in the first paragraph shall ensure that the officer has powers equivalent to the powers laid down in the Member State in order to carry out his duties. Title 5.2 of the General Law on administrative law .
4 The staff member may make recommendations to the person responsible for improving the protection of the data that is being processed. In cases of doubt, he's transferring to the College.
The College shall have the power to impose a charge under administrative constraints in order to maintain the obligations imposed by or under this Law.
1 The College may impose an administrative penalty of not more than the amount of the fine of the fourth category of Article 23 (4) of the Code of Criminal Law with regard to infringements of the provisions of, or under the conditions of, the Article 4, third paragraph , or 78, second paragraph, introductory wording and point (a) .
2 The College may impose an administrative penalty of not more than the amount of the fine of the sixth category of Article 23 (4) of the Code of Criminal Law with regard to infringements of the provisions of, or under the conditions of, the Articles 6 to 8 , 9, first and fourth members , 10, 1st Member , 11 to 13 , 16 , 24 , 33 , 34, first, second and third members , 34a , 35, first paragraph, second sentence, second, third and fourth members , 36, second, third and fourth members , 38 to 40, second and third members , 41, second and third members , 42, first and fourth members , 76 , 77 or 78, third and fourth members , as well as Article 5:20 of the General Administrative Law . Article 23, seventh paragraph, of the Criminal Code shall apply mutatis mutandis.
3 The College shall not impose administrative penalties for infringement of the provisions of, or in pursuance of, the provisions of Article 66, second paragraph , said articles, than after it has given a binding designation. The College may provide the offender with a period within which the designation must be followed.
4 The third paragraph shall not apply where the offence has been committed intentionally or is the result of serious negligence.
5 The College may impose an administrative penalty of not more than the amount of the fine of the sixth category of Article 23 (4) of the Code of Criminal Law in the event of non-compliance with a binding designation. Article 23, seventh paragraph, of the Penal Code shall apply mutatis mutandis.
The College shall, prior to the adoption of a policy rule on the interpretation of the provisions of, or under the conditions of Article 66, second paragraph , mentioned articles with Our Minister and Our Minister of Internal Affairs and Kingdom Relations.
The action of the decision to impose the administrative fine shall be suspended until the period of objection or notice of appeal has expired or, where an appeal has been lodged, on the objection or appeal, respectively. Definitely.
1 The person responsible shall act in violation of what is at or pursuant to Article 4, third paragraph , or 78, second paragraph , it is determined, shall be penalised with a fine of the third category.
2 The person responsible for the purpose of the offence referred to in paragraph 1 shall be penalised by imprisonment of not more than six months or a fine of the fourth category.
3 The offences referred to in the first paragraph are offences. The offences referred to in the second paragraph shall be criminal offences.
4 With the detection of the facts described in this article are except the at or under Article 141 of the Code of Criminal Procedure Officials designated by our Minister for the purpose of doing so shall be responsible for the Secretariat of the College.
1 Personal data subject to a processing or intended to be processed after their transfer shall only be transferred to a country outside the European Union if, without prejudice to compliance with the law, that country shall be deemed appropriate ensure protection.
2 By way of derogation from the first paragraph, personal data subject to processing or which are intended to be processed after their transfer to a country outside the European Union may be transferred, if that country is a party to the second paragraph of Article 2 of the May 1992 Agreement on the European Economic Area adopted in Oporto 1992, 132), unless a decision of the Commission of the European Communities or the Council of the European Union results in a restriction or prohibition on the transfer of these transfers.
The appropriated nature of the level of protection shall be assessed in the light of the circumstances affecting the transfer of data or a category of data transfers. In particular, account shall be taken of the nature of the data, the purpose or purpose and duration of the intended processing or processing, the country of origin and the country of final destination, the general and the sectoral nature of the products concerned. rules of law applicable in the third country concerned, as well as the rules of professional life and the security measures which are complied with in those countries.
1 By way of derogation from Article 76 a transfer or a category of transfers of personal data to a third country which does not provide safeguards for an adequate level of protection may be carried out if:
(a) has given his unequivocal consent to the person concerned;
b. the transfer is necessary for the execution of an agreement between the person concerned and the person responsible, or for the taking of pre-contractual measures following a request from the person concerned and necessary for the purpose of Conclusion of an agreement;
c. the transfer is necessary for the conclusion or execution of a contract concluded in the interest of the person concerned between the person responsible and a third party to be concluded or to be concluded;
d. the retransmission is necessary because of a serious public interest, or for the adoption, execution or defence in law of any right;
e. the retransmission is necessary to safeguard a vital interest of the data subject; or
f. the transfer is made from a register established by law and can be consulted either by any person or by any person who can rely on a legitimate interest, to the extent that it is in the case in question. comply with the legal conditions for consultation;
Use is made of a model contract as referred to in Article 26 (4) of Directive No 1408/71. 95 /46/EC of the European Parliament and of the Council of the European Union of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (PbEG L 281).
2 By way of derogation from the first paragraph, our Minister, after having heard the College, may authorise a transfer or a category of transfers of personal data to a third country which does not provide safeguards for an adequate level of protection. The authorisation shall be subject to the detailed rules necessary to safeguard the protection of the privacy and fundamental rights and freedoms of persons and the exercise of the rights associated with them.
1 Our Minister shall inform the Commission of the European Communities of:
(a) cases where, in its opinion, a third country does not provide safeguards for an adequate level of protection in the sense of Article 76, first paragraph , and
b. of a licence as referred to in Article 77, second paragraph .
If this is the result of a decision of the Commission of the European Communities or of the Council of the European Union, the Minister of Justice shall, by means of a ministerial order or by decision, determine:
(a) the transfer to a country outside the European Union is prohibited; or
b. On the basis of Article 77, second paragraph , permit granted is revoked or amended.
3 In a third country of which the Commission of the European Communities or the Council of the European Union has established that it is in a position to ensure an adequate level of protection, without prejudice to, moreover, the provisions of this Act, personal data shall be transmitted.
4 By way of derogation from the third paragraph, the transfer of personal data to a third country of which the Commission of the European Communities or the Council of the European Union has established that it provides safeguards for an adequate level of protection may be transferred, suspended by Our Minister of Justice by ministerial arrangement or by decision, heard the College, in order to protect individuals in the processing of personal data in cases where:
(a) a competent authority in the third country has come to the conclusion that the relevant recipient acts in breach of the applicable data protection standards;
b. It is highly likely that data protection standards are not met, there are reasonable grounds to believe that the competent authority in the third country is not taking or will not take appropriate action in a timely way to ensure the relevant problem to be resolved, the continuation of the transfer constitutes an imminent danger of serious harm to the person concerned and the College has made sufficient efforts to inform the responsible person established in the third country of its findings and provided him with an opportunity to comment on those findings.
5 The ministerial arrangement, the decision referred to in paragraph 4, shall remain in force until it is established that the data processing standards are complied with and the College thereof has been informed by the relevant competent authority. authority, in a case referred to in paragraph 4 (a), or the College, in a case referred to in point (b) of the fourth paragraph. The College shall inform our Minister of Justice of its findings.
6 The notifications referred to in paragraph 1 (a) and (b) shall be published in the Official Journal.
1 Within one year of the entry into force of this Act, the data processing operations already in place at that time shall be brought into line with this law and shall be reported as intended in Article 27 at the College of the Official. In the case of a general measure of management, the period referred to in the first sentence may be extended to a maximum of three years in the case of the obligation to notify.
2 For the adaptation of the processing of particular data to: Section 2 of Chapter 2 shall be valid for a period of three years, provided that the processing operations which have already been carried out and which are necessary for the implementation of agreements before the date of entry into force of this Act do not have to be re-authorised. need to be requested as referred to in Article 23, first paragraph, point (a) .
3 Article 32, second paragraph , does not apply to the processing operations referred to in Article 31 , first and third paragraphs, which have already taken place at the time of the entry into force of the law, or of the general measure of administration in which they are appointed.
Within five years of the entry into force of this Act, our Ministers of Justice and of the Interior and Kingdom Relations shall send to the States-General a report on the effectiveness and effects of this law in practice.
The Person Registrations Act is repealed.
This Law shall enter into force on a date to be determined by Royal Decree.
This law is cited as: Personal Data Protection Act.
Burdens and orders that it will be placed in the Official Gazette, and that all ministries, authorities, colleges and officials who so concern will keep their hands on the precise execution.
Given in Gravenhage, 6 July 2000
Beatrix
The Minister of Justice,
A. H. Korthals
The Minister for Major Cities and Integration Policy,
R. H. L. M. van Boxtel
Issued the 20th of July 2000The Minister of Justice,
A. H. Korthals
