Short Reads

General Data Protection Regulation comes into effect

General Data Protection Regulation comes into effect

General Data Protection Regulation comes into effect

07.08.2018 NL law

On 25 May 2018, the European Union's General Data Protection Regulation (GDPR) came into effect. The GDPR replaces the EU's prior directive governing the processing and transfer of personal data, which was in place since 1995. As a regulation, the GDPR is directly applicable in all 28 EU member states and thus removes the need for national implementing legislation. However, the GDPR allows member states discretion in certain areas, as a result of which national legislation may still be implemented. In the Netherlands, the GDPR Implementation Act came into effect on 25 May 2018.

The GDPR intends to harmonise rules regarding the protection of personal data and the promotion of free movement of such personal data within the EU. It provides a set of standardised data protection laws across all EU member states. The GDPR affects both natural persons and companies. As regards natural persons, their existing privacy rights have been strengthened and new and improved rights have been introduced. In addition, natural persons have been given greater control over their own personal data.

As regards companies, the GDPR applies to both EU companies and non-EU companies that (i) process personal data in relation to the offering of goods or services to EU data subjects or (ii) monitor the behaviour of data subjects occurring within the EU. Even if a company only processes data on behalf of somebody else, it is still subject to the GDPR. The GDPR expressly addresses the role and responsibility of data processors, in other words those entities that process personal data on behalf of another entity that controls the data and the purpose for which the data are being processed (i.e. data controllers). For example, a hosting provider is a data processor for the company owning the website and a payroll service provider is a data processor for the employer outsourcing payroll services.

For companies, new and stricter requirements have been introduced. The GDPR places a number of onerous obligations on companies to have them demonstrate compliance with the GDPR. Companies need to, among other things, put procedures and systems in place so there is a structure for certain topics like risk assessment and decision-making. They are also required to keep a register of all processing activities and, in some cases, designate a data protection officer.

Failing to comply with the GDPR could have a huge impact on companies as the maximum fines for non-compliance are significantly higher than before. For example, companies could now face fines of (i) 4% of total annual worldwide turnover or (ii) EUR 20 million, whichever is higher, depending on the type and severity of the non-compliance in the individual case. In addition, the supervising authorities can issue a warning or impose a temporary or definitive ban on processing personal data.

For more information, please visit the GDPR page on our MyStibbe portal.

Team

Related news

07.08.2018 NL law
Legislative proposal to protect trade secrets: update

Short Reads - On 5 July 2016, the EU Trade Secrets Directive came into effect (Directive 2016/943/EU). The directive intends to harmonise rules regarding the protection of undisclosed know-how and business information (trade secrets) across all EU member states. As the directive is not directly applicable in the member states, each member state must enact national implementing legislation.

Read more

31.07.2018 NL law
Can an SPV be misled before it exists?

Articles - Transactions are regularly structured through special purpose vehicles (SPVs). An SPV is often established at the end of the negotiations, just before signing the agreement. The other party to the agreement provides information and raises certain expectations during the negotiations. The individuals negotiating for the SPV do not necessarily become officers of the SPV once it is established.

Read more

07.08.2018 NL law
Protection of listed companies against unsolicited takeovers, prevention of unwanted influences in the telecoms sector and protection of other vital sectors: latest developments

Short Reads - Following a recent series of (attempted) unsolicited takeovers by foreign bidders of Dutch listed companies, such as PostNL, Unilever and AkzoNobel, the protection of companies against unsolicited takeovers and the protection of vital sectors have received more attention in both the Netherlands and Europe.

Read more

07.08.2018 NL law
Boskalis v. Fugro: scope of a shareholder's right to put items on the agenda

Short Reads - Under Dutch law (section 114a of book 2 of the Dutch Civil Code), shareholders have the right to put items on the agenda of the general meeting. The question arises as to whether shareholders also have the right to force an (informal) vote in the general meeting on subjects which are not within their powers. A judgment of the Dutch Supreme Court of 20 April 2018 between Boskalis and Fugro focused on this question.

Read more

Our website uses cookies: third party analytics cookies to best adapt our website to your needs & cookies to enable social media functionalities. For more information on the use of cookies, please check our Privacy and Cookie Policy. Please note that you can change your cookie opt-ins at any time via your browser settings.

Privacy – en cookieverklaring