Dutch DPA’s 2019 annual report: more focus on enforcement

In 2019 the Dutch Data Protection Authority (Dutch DPA) stepped up its focus on enforcing privacy legislation. Where in 2018 its main priority was to provide information about the new EU General Data Protection Regulation, in 2019 this grace period ended.

The enforcement measures imposed by the Dutch DPA included 4 fines totalling over €2.5 million. The violations concerned access to medical records, the sale of membership data, biometrics (fingerprints) and access rights.

Investigations and interventions

In 2019 the Dutch DPA began 110 investigations, compared with 20 in 2018. These covered a range of areas, including tracking cookies and unwanted advertising targeting self-employed persons without employees. 

The Dutch DPA also intervened in more than 2,000 cases involving a privacy complaint or data leak (twice the number it had dealt with the previous year), discussing the matter with organisations or sending a letter of warning. 

According to Dutch DPA Chairman Aleid Wolfsen, ‘That in itself is often enough to bring a halt to non-compliance. So a great deal is happening behind the scenes that may be not very visible but has a big impact.’

Huge rise in privacy complaints

The Dutch DPA certainly had good reason to take action. The huge number of privacy complaints it received in 2019 (almost 28,000) illustrates the importance people attach to their privacy and how frequently they run into problems with organisations that process their personal data.

As Wolfsen sees it, ‘The time of “I have nothing to hide” is over. Research we commissioned in early 2019 showed that no less than 94% of Dutch people are concerned about protecting their personal data. And they’re right to be concerned, given the number of complaints that we receive.’

Information and advice

In 2019, the Dutch DPA was also as busy as ever providing information about privacy legislation. As well as dealing with daily phone enquiries, the Dutch DPA ran a campaign aimed specifically at small and medium-sized enterprises called ‘What does privacy mean for you and your company?’ It also launched a game for young people (Who’s the Boss? You or your Phone?), which attracted more than 180,000 players.

Another of the Dutch DPA’s key tasks is providing advice on planned legislation. In 2019 it issued no fewer than 105 advisory opinions and reports, dealing with topics such as credit registration, preventive debt counselling and partnerships between public and private organisations.

International activities

Of course, the processing of personal data doesn’t stop at the Dutch border. So the Dutch DPA also works closely with partners in Europe and beyond on matters ranging from complaints and data leaks to research studies. The primary forum for such collaboration is the European Data Protection Board (EDPB). In 2019 Aleid Wolfsen was elected one of the Board’s two deputy-chairs.

Rigorous supervision is key

According to Wolfsen, ‘There’s a lot that people can do to protect their privacy, but ultimately they can’t do it alone. That’s why they need the Dutch DPA to rigorously supervise compliance with the law.

Unfortunately, given budget and staffing limitations, we can’t deal with everything at once. So the waiting time for handling complaints and approving binding corporate rules is on the rise.

That concerns us greatly, because we believe that people should be able to trust that organisations will treat their data with due care. That’s something the Dutch DPA remains committed to every day.

The Dutch DPA and the Ministry of Justice and Security recently commissioned a study on our organisation’s budget, which is now under way. We hope that the outcome of this research will greatly strengthen the position of the Dutch DPA and, by extension, of everyone in the Netherlands.’