Data protection in the Netherlands rests on two instruments. The General Data Protection Regulation (GDPR) applies directly across the European Union and sets the substantive rules: the principles, the lawful bases, the rights of data subjects and the obligations of controllers and processors. Alongside it, the Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG) fills in the choices the Regulation left to member states and designates the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) as supervisory authority.
규정이 직접 적용되기 때문에 조직이 준수해야 하는 것은 GDPR 자체입니다. 시행법은 국가별 선택이 이루어진 경우에 중요하며, 여러 회원국에서 사업을 운영하는 조직들이 간과하기 쉬운 부분이 바로 이 점입니다.
What does the Implementation Act add?
The UAVG fills in a limited number of national choices. Under article 5 UAVG, a child under sixteen needs a parent’s or guardian’s consent before information society services may rely on consent as the lawful basis; from sixteen the child can consent alone.
The Act also provides for processing of special category data in defined situations. Article 29 UAVG allows biometric data to be processed for unique identification where this is necessary for authentication or security purposes, an exception organisations use for access control and login systems. The UAVG further contains provisions on processing criminal data and regulates exemptions in areas such as journalism, research and archiving, and it sets out the powers of the Data Protection Authority and the procedures around them.
이는 규제를 완화하는 것이 아닙니다. 규정과 법률을 함께 읽어보면, 규정은 기준을 설정하고 법률은 제한된 수의 국가적 문제에 대한 답변 방식을 규정합니다.
Which obligations matter in practice?
Four things account for most of the work. A record of processing activities under article 30 GDPR, which is the document a supervisory authority asks for first and which forces an organisation to know what it actually holds. A lawful basis for each processing operation, chosen deliberately rather than defaulting to consent, which is frequently the weakest basis available because it must be freely given and can be withdrawn at any time.
Data processing agreements with every processor under article 28 GDPR, and adequate safeguards where personal data leave the European Economic Area. And a working procedure for data subject rights and for breach notification, which has to be capable of operating within the seventy-two-hour notification period of article 33 GDPR.
How is the GDPR enforced?
The Dutch Data Protection Authority can investigate, order measures, impose processing bans and fine organisations. Under article 83 GDPR, fines run up to €10 million or 2% of total worldwide annual turnover for breaches of administrative obligations, and up to €20 million or 4% of turnover, whichever is higher, for breaches of the core principles, data subject rights or international transfer rules.
Alongside regulatory enforcement, individuals can claim compensation, and collective actions in this field have become a real exposure in the Netherlands since the introduction of the collective damages regime (WAMCA) in 2020.
결론
- The GDPR sets the substantive rules directly; the UAVG only fills in the national choices the Regulation leaves open.
- Under article 5 UAVG, a child needs parental consent for information society services until the age of sixteen.
- Article 29 UAVG allows biometric data to be used for authentication or security purposes as an exception to the general prohibition.
- A record of processing activities, a lawful basis per processing operation, processor agreements and a breach procedure covering the seventy-two-hour notification period account for most compliance work.
- Fines under article 83 GDPR run up to €20 million or 4% of worldwide turnover, and individuals and groups can claim compensation separately.
자주하는 질문
데이터 보호 책임자가 필요한가요?
규정에서 요구하는 경우에만, 즉 공공기관이나 대규모 정기 모니터링 또는 대규모 특수 범주 데이터 처리를 핵심 활동으로 하는 기관에만 지정됩니다. 많은 기관들이 자발적으로 지정하고 있으며, 이를 통해 법적 지위와 보호를 받게 됩니다.
동의가 가장 안전한 근거일까요?
대개는 정반대입니다. 동의는 자유롭게 주어져야 하며 언제든지 철회할 수 있어야 하고, 동의 철회 후에는 정보 처리가 즉시 중단되어야 합니다. 정당한 이익이나 계약 이행은 평가 과정이 문서화되어 있다면 더욱 강력한 근거가 될 수 있습니다.
우리가 EU 외부에 있는 경우에도 GDPR이 적용되나요?
가능합니다. 해당 규정은 조직의 설립 위치와 관계없이 유럽 연합 내 사람들에게 상품이나 서비스를 제공하거나 그들의 행동을 감시하는 경우에 적용됩니다.
데이터 보호에 대한 조언
Compliance work is most effective when it starts from what an organisation actually does with data rather than from a template. We advise on processing records, lawful bases, processor agreements, international transfers, impact assessments and breach response.
현재 상황이 어떤지 잘 모르시겠나요? 상황을 알려주시면 영업일 기준 하루 이내에 가능한 해결책을 안내해 드리겠습니다.
방법 Law & More 이에 대해 저희가 어떻게 도움을 드릴 수 있는지 자세히 설명드리겠습니다. IT 변호사 페이지를 확인하시기 바랍니다.
