NetherlandsGDPR Articles 12-21 and UAVG Articles 41 and 43, Data Subject Rights in the Netherlands
Regulation (EU) 2016/679, Arts. 12-21; UAVG, Arts. 41, 43
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in the Netherlands within one month of receipt.
- You may set aside a person's rights in the Netherlands under General Data Protection Regulation (GDPR) Articles 12 to 21, so far as necessary and proportionate, to protect them or the rights and freedoms of others, or to enforce a civil-law claim, under UAVG Article 41(1)(i) and (j).
These lines are LexLint's reading of the law's text. Also read by: Autoriteit Persoonsgegevens (guidance, recorded ); Case C-307/22 FT v DW, judgment of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/for-organisations-privacy-rights-in-practice
- Case citation
- Case C-307/22 FT v DW, judgment of (First Chamber)
- Guidance body
- Autoriteit Persoonsgegevens
- Open questions
- May a controller rely on Article 41(1) of the UAVG to set aside a data subject's rights under GDPR Articles 12 to 21, given the AP's statement that it will not honor a controller's reliance on Article 41 in complaint proceedings because the article does not meet the requirements of GDPR Article 23?
- Does processing carried out for journalism and also for a commercial purpose count as processing 'voor uitsluitend journalistieke doeleinden' (for exclusively journalistic purposes) under Article 43 of the UAVG, so that GDPR Chapter III does not apply?
What it makes you log
Logging duty
Articles 12 to 21 set how and when a controller answers a rights request. They state no duty to create, keep or produce a log or record of the request or the answer. UAVG Article 41 lets a controller set the rights aside where necessary and proportionate, and Article 43 disapplies Chapter III of the GDPR for journalism and academic, artistic or literary expression; neither adds a record duty.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in the Netherlands can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
UAVG Article 41(1) lets a controller set these rights aside, so far as necessary and proportionate, on listed grounds; two reach an ordinary private controller: protecting the person or the rights and freedoms of others, and enforcing a civil-law claim.
UAVG Article 43 disapplies Chapter III of the GDPR, which holds the data-subject rights, together with Chapters V to VII and most of Chapter IV, for processing carried out exclusively for journalism or for academic, artistic or literary expression.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .