Processes personal data, in the Netherlands

Regulation (EU) 2016/679, Arts. 12-21; UAVG, Arts. 41, 43 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in the Netherlands within one month of receipt.
• You may set aside a person's rights in the Netherlands under GDPR Articles 12 to 21, so far as necessary and proportionate, to protect them or the rights and freedoms of others, or to enforce a civil-law claim, under UAVG Article 41(1)(i) and (j).

Regulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42 · Read the law's page

• Notify the AP without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in the Netherlands, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, subject to UAVG Article 42's national exception.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in the Netherlands outside the EEA.

Regulation (EU) 2016/679, Arts. 82-83; UAVG, Arts. 16-18; Wet Afwikkeling Massaschade in Collectieve Actie (WAMCA) · Read the law's page

• Compensate any person in the Netherlands who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

UAVG, Arts. 30-33, 46 · Read the law's page

• Obtain a GDPR Article 9(2) basis before processing health, genetic, racial or ethnic origin, political opinion, or religious-belief data of a person in the Netherlands, following UAVG's Chapter 3 exceptions where one applies to your processing purpose.
• Do not treat the citizen service number (BSN) as a general-purpose identifier; UAVG Article 46 restricts its processing.

Wet van 16 mei 2018, houdende regels ter uitvoering van de Algemene verordening gegevensbescherming (BWBR0040940) · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in the Netherlands, following the UAVG's institutional and procedural rules and Chapter 3-4 national derogations.

Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg, Arts. 15d and 15e · Read the law's page

• If you are a care provider, give a client who asks for access to or a copy of the client's file, or of the client's data that you make available through an electronic exchange system, that access or copy electronically and at reasonable intervals (Wabvpz Article 15d, paragraph 1).
• If you are a pharmacist, give a client who asks direct electronic access to the client's medication data when dispensing medicines (Article 15d, paragraph 2).
• Provide the electronic access and the electronic copies free of charge (Article 15d, paragraph 3).
• On the client's request, include in a copy under Article 15d, paragraph 1 who made certain information available through the exchange system and on what date, and who viewed or requested certain information and on what date (Article 15e).

Burgerlijk Wetboek Boek 7, Art. 457 · Read the law's page

• If you are a care provider treating a patient, give no one other than the patient information about the patient, or access to or a copy of the data in the patient's file, without the patient's consent, unless a rule of or under the law makes the provision obligatory (Burgerlijk Wetboek Boek 7 Article 457, paragraph 1).
• Where you do provide information, provide it only so far as that does not harm the privacy of another person (Article 457, paragraph 1).

Burgerlijk Wetboek Boek 7, Art. 458 · Read the law's page

• If you are a care provider, give information about a patient or access to the patient's file to another person for statistics or scientific research in the field of public health without the patient's consent only where asking consent is reasonably impossible and the research provides safeguards against disproportionate harm to the patient's privacy, or where consent cannot reasonably be demanded and you have seen to it that the data are provided in a form that reasonably prevents tracing them to individual natural persons (Burgerlijk Wetboek Boek 7 Article 458, paragraph 1).
• Provide the data only if the research serves a general interest, cannot be carried out without the data, and the patient has not expressly objected to the provision (Article 458, paragraph 2).
• Note each such provision of information in the patient's file (Article 458, paragraph 3).

Burgerlijk Wetboek Boek 7, Arts. 455 and 456 · Read the law's page

• If you are a care provider treating a patient, destroy the data in the patient's file after a written or electronic request from the patient, except for data whose retention is reasonably likely to be of considerable importance to someone other than the patient, or where a rule of or under the law opposes destruction (Burgerlijk Wetboek Boek 7 Article 455).
• Give the patient who asks access to, and a copy of, the data in the patient's file, withholding them only so far as necessary to protect another person's privacy (Article 456).

Implementatiewet richtlijn herziening productaansprakelijkheid, Kamerstuk 36906 · Read the law's page

• The bill excludes free-of-charge and open-source software (gratis en opensourcesoftware) that you develop or supply outside the course of a commercial activity (Art. 6:184a(3)(a)).
• If you develop, manufacture or produce a product, software included, or present yourself as its manufacturer by putting your name or trade mark on it, you answer as its manufacturer for damage a defect in it causes (Arts. 6:184a(1)(b) and (e), 6:187(1)(a)).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is within your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 6:185(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 6:186(1)(f)), and failing a mandatory requirement that protects against the damage suffered presumes it defective (Art. 6:188(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to keep learning or to acquire new features is weighed in deciding whether it is defective (Art. 6:186(1)(e)).
• Be ready to give access to the relevant evidence you hold when a court orders it under Articles 194 and 195 of the Code of Civil Procedure; failing to do so presumes the product defective (Art. 6:188(2)(a)).
• If you manufacture outside the Union, the importer, your authorized representative or, where neither is established in the Union, the fulfillment service provider answers for the product alongside you (Art. 6:187(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then place it on the market or put it into service, you are treated as its manufacturer (Art. 6:187(2)).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, name the liable operator established in the Union or your own supplier within one month of the injured person's request, or you answer for the defective product (Art. 6:187(3) and (4)).
• Be able to show when you placed the product on the market or put it into service: you are not liable if you did not, or if it is plausible that the defect did not exist then (Art. 6:185(1)(a) and (c)).

Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg, Arts. 15a and 15f · Read the law's page

• If you are a care provider, make a client's data available through an electronic exchange system only so far as you have established that the client gave express consent (Wabvpz Article 15a, paragraph 1).
• Make a client's data available through an electronic exchange system only so far as another care provider's consultation of the data does not harm the privacy of someone other than the client (Article 15a, paragraph 3).
• If you work as a company doctor, insurance doctor or examining doctor for medical examinations under the Wet op de medische keuringen, do not obtain access to electronic exchange systems and do not process data from them (Article 15f, paragraph 2).