Tasks and powers of the Dutch DPA
The Dutch DPA supervises processing of personal data in order to ensure compliance with laws that regulate the use of personal data. The most important laws are the Dutch Data Protection Act (Wet bescherming persoonsgegevens), the Police Data Act (Wet politiegegevens) and the Basic Registration of Persons Act (Wet basisregistratie personen).
The tasks and powers of the Dutch DPA can be roughly divided into four sections:
- providing advice;
- providing information, education and accountability;
- international assignments.
Specific tasks and powers of the Dutch DPA include:
- Undertaking investigations assessing compliance with the law. In case of a violation of the law or of the regulations based on the law, the Dutch DPA can use its (administrative) enforcement powers, for example by issuing an order to cooperate or by issuing a conditional fine.
- Conducting preliminary examinations to assess the legitimacy of certain processing operations that involve specific risks.
- Assessing codes of conduct for specific sectors relating to the processing of personal data.
- Mediating in disputes regarding the exercise of rights and undertaking investigations to assess compliance with the law or of regulations based on the law, at the request of an interested party. Please note that each time a request for mediation or a complaint is received, the Dutch DPA checks whether the request or complaint fulfils the statutory requirements and whether there is sufficient reason to take it up.
- Keeping a public register of notifications of processing operations. Pursuant to the Dutch Data Protection Act, organisations must notify the Dutch DPA of the processing of personal data, unless the processing operations have been exempted from the notification obligation. The notifications ensure openness with regard to the processing of personal data by controllers.
- Assessing requests for granting exemptions from the prohibition to process sensitive data.
- Providing advice on legislative proposals and draft texts of general administrative regulations that wholly or significantly deal with the processing of personal data. The government has a legal obligation to request advice from the Dutch DPA when they draft legislative proposals or general administrative regulations that wholly or significantly deal with the processing of personal data.
- Advising the Minister of Security and Justice on permits for the transfer of personal data to a third country that does not offer an adequate level of protection.
Providing information, education and accountability
- Providing information on how to interpret privacy legislation.
- Providing general information regarding the protection of personal data on this website and by telephone.
- Publication of annual reports.
- Supervising the processing of personal data in the Netherlands that takes place in accordance with the laws of another Member State and rendering all necessary assistance to the supervisory authorities of other Member States if this is requested.
- Other international tasks and activities.
Guarantees regarding the proper performance of its tasks
In the execution of its powers, the Dutch DPA is bound by the standards enshrined in the General Administrative Law Act (Algemene wet bestuursrecht).
In view of the enforcement powers, the guarantees regarding the proper fulfilment of the tasks have been specified more specifically in this act:
- Individuals can object to, and appeal against, decisions of the Dutch DPA with the administrative court.
- Individuals can submit a complaint about the Dutch DPA with the National Ombudsman.
- The Freedom of Information Act (Wet openbaarheid van bestuur) applies to the activities of the Dutch DPA.
- As an administrative body, the Dutch DPA is also bound by the general principles of proper administration.
Dutch DPA’s independence
Article 28 of the European Privacy Directive 95/46/EC explicitly provides for the existence of a supervisory authority, who shall act with complete independence in exercising the functions entrusted to it.
These functions sometimes relate to legal obligations, but generally they see more to the (administrative) powers of the DPA. The Dutch DPA is entitled to take decisions on its own regarding the execution of these powers, naturally subject to the law and scrutiny by the court.
Furthermore, the Dutch DPA has considerable discretionary power to decide on how to fulfil its tasks, naturally within the framework of the law, and to set its priorities and make decisions on what issues to focus on.