Short Reads

General Data Protection Regulation comes into effect

General Data Protection Regulation comes into effect

General Data Protection Regulation comes into effect

07.08.2018 NL law

On 25 May 2018, the European Union's General Data Protection Regulation (GDPR) came into effect. The GDPR replaces the EU's prior directive governing the processing and transfer of personal data, which was in place since 1995. As a regulation, the GDPR is directly applicable in all 28 EU member states and thus removes the need for national implementing legislation. However, the GDPR allows member states discretion in certain areas, as a result of which national legislation may still be implemented. In the Netherlands, the GDPR Implementation Act came into effect on 25 May 2018.

The GDPR intends to harmonise rules regarding the protection of personal data and the promotion of free movement of such personal data within the EU. It provides a set of standardised data protection laws across all EU member states. The GDPR affects both natural persons and companies. As regards natural persons, their existing privacy rights have been strengthened and new and improved rights have been introduced. In addition, natural persons have been given greater control over their own personal data.

As regards companies, the GDPR applies to both EU companies and non-EU companies that (i) process personal data in relation to the offering of goods or services to EU data subjects or (ii) monitor the behaviour of data subjects occurring within the EU. Even if a company only processes data on behalf of somebody else, it is still subject to the GDPR. The GDPR expressly addresses the role and responsibility of data processors, in other words those entities that process personal data on behalf of another entity that controls the data and the purpose for which the data are being processed (i.e. data controllers). For example, a hosting provider is a data processor for the company owning the website and a payroll service provider is a data processor for the employer outsourcing payroll services.

For companies, new and stricter requirements have been introduced. The GDPR places a number of onerous obligations on companies to have them demonstrate compliance with the GDPR. Companies need to, among other things, put procedures and systems in place so there is a structure for certain topics like risk assessment and decision-making. They are also required to keep a register of all processing activities and, in some cases, designate a data protection officer.

Failing to comply with the GDPR could have a huge impact on companies as the maximum fines for non-compliance are significantly higher than before. For example, companies could now face fines of (i) 4% of total annual worldwide turnover or (ii) EUR 20 million, whichever is higher, depending on the type and severity of the non-compliance in the individual case. In addition, the supervising authorities can issue a warning or impose a temporary or definitive ban on processing personal data.

For more information, please visit the GDPR page on our MyStibbe portal.

Team

Related news

20.09.2022 EU law
Launch of Metaverse blog series

Articles - Stibbe launches a new blog series focusing on the legal challenges of the Metaverse. In our upcoming blog posts, we will discuss the legal challenges of NFTs, crypto-assets, Metaverse platforms, crypto exchanges, DAO, and many more.

Read more

28.07.2022 NL law
Zuiver commercieel belang ook gerechtvaardigd belang: Raad van State laat zich er niet over uit

Short Reads - Op 27 juli 2022 heeft de Raad van State bevestigd dat de Autoriteit Persoonsgegevens onterecht een boete van € 575.000 aan VoetbalTV heeft opgelegd. De hoop bestond dat de Afdeling antwoord zou geven op de vraag of de AP terecht of onterecht meent dat een zuiver commercieel belang géén gerechtvaardigd belang kan zijn in de zin van de Algemene Verordening Gegevensbescherming. Het antwoord op deze vraag blijft echter uit.  

Read more

27.07.2022 NL law
Voortgang consultatie Corporate Governance Code

Short Reads - In februari van dit jaar heeft de Monitoring Commissie Corporate Governance Code (de "Commissie") een voorstel voor een gewijzigde Nederlandse Corporate Governance Code (de "Code") in consultatie gebracht (klik hier voor het consultatiedocument). Stibbe heeft op deze voorstellen gereageerd. In een eerdere Corporate Alert zijn wij ingegaan op de hoofdlijnen van het voorstel. Daartoe behoren de sterkere aanzet van duurzaamheid en ESG, de rol van aandeelhouders, diversiteit en inclusie, en versterkte aandacht voor gedrag en cultuur. 

Read more

28.07.2022 NL law
Purely commercial interest also a legitimate interest? Council of State leaves the question unanswered.

Short Reads - On 27 July 2022, the Council of State confirmed that the Dutch Data Protection Authority wrongly imposed a €575,000 fine on VoetbalTV. But the Council did not answer the question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest within the meaning of the General Data Protection Regulation.

Read more

27.07.2022 NL law
Actualiteiten Internationaal Maatschappelijk Verantwoord Ondernemen (IMVO) 

Short Reads - De aandacht voor (Internationaal) Maatschappelijk Verantwoord Ondernemen (“(I)MVO”) en Environmental, Social and Governance factoren (“ESG”) en verantwoording daarover blijft onverminderd groot. Wij zien op nationaal en Europees niveau tal van ontwikkelingen, zoals de publicatie van het voorstel voor een Europese Corporate Sustainability Due Diligence richtlijn. Wij stippen enkele Europese en nationale initiatieven aan. 

Read more