Articles

Dutch Data Protection Authority increases maximum fine for data breaches committed by telecom providers

Dutch Data Protection Authority increases maximum fine for data breaches committed by telecom providers

Dutch Data Protection Authority increases maximum fine for data breaches committed by telecom providers

13.10.2016

The Dutch Data Protection Authority (“DPA”) has amended its Penalty Policy Rules under an amendment of the Dutch Telecommunication Act. The new rules apply as from 1 July 2016.

Previously, the DPA could impose an administrative fine up to a maximum of EUR 450,000 if a telecom provider did not (immediately) notify the DPA of a data breach in accordance with Article 11.3(a) of the Dutch Telecommunication Act. This fine’s maximum has now been increased to EUR 900,000 in both the DPA’s Penalty Policy Rules and the Dutch Telecommunication Act.

The starting point of the DPA in determining the amount of the fine is that fines must be proportional to the violation committed. Fines that can be imposed by the DPA can vary from a maximum of EUR 20,250 for relatively minor violations to a maximum of EUR 900,000 (previously: EUR 820,000) for deliberate or repeated violations of the Dutch Data Protection Act. For legal entities that have violated this Act, the fine is flexible: if the amount of fine set for the highest penalty category is not sufficiently punitive, the violation can be sanctioned additionally with a fine equivalent to up to 10% of the company’s annual net turnover.

Fines may only be imposed on a company following a binding instruction given from the DPA. Through this instruction, the DPA can inform the company what steps it should take to avoid paying the fine. But if the violation concerned was either intentional or a matter of serious culpable negligence, the DPA is not obliged to issue an instruction and can impose a fine directly.

We will of course inform you if the DPA imposes significant fines with respect to violations of the Dutch Data Protection Act.

 

This document can be found here (only available in Dutch). 

Team

Related news

28.07.2022 NL law
Purely commercial interest also a legitimate interest? Council of State leaves the question unanswered.

Short Reads - On 27 July 2022, the Council of State confirmed that the Dutch Data Protection Authority wrongly imposed a €575,000 fine on VoetbalTV. But the Council did not answer the question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest within the meaning of the General Data Protection Regulation.

Read more

28.07.2022 NL law
Zuiver commercieel belang ook gerechtvaardigd belang: Raad van State laat zich er niet over uit

Short Reads - Op 27 juli 2022 heeft de Raad van State bevestigd dat de Autoriteit Persoonsgegevens onterecht een boete van € 575.000 aan VoetbalTV heeft opgelegd. De hoop bestond dat de Afdeling antwoord zou geven op de vraag of de AP terecht of onterecht meent dat een zuiver commercieel belang géén gerechtvaardigd belang kan zijn in de zin van de Algemene Verordening Gegevensbescherming. Het antwoord op deze vraag blijft echter uit.  

Read more

01.06.2022 BE law
Digital Law Up(to)date: The confidentiality of letters would become the confidentiality of private communications

Articles - The Belgian Parliament published a proposal to amend article 29 of the Belgian Constitution (see here). The provision now states that the “confidentiality of letters is inviolable”. If the proposal is adopted, article 29 should read as follows: “The confidentiality of private communications is inviolable, except in the cases and conditions established by law”.

Read more