Netherlandscookiebepaling (cookie provision)
Officially Telecommunicatiewet (Telecommunications Act), Article 11.7a, Consent Before Storing or Accessing Information on a User's Device
Telecommunicatiewet, art. 11.7a
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Before you store information on a user's terminal equipment, or gain access to information stored there, via an electronic communications network, give the user clear and complete information in accordance with the General Data Protection Regulation, in any case about the purposes for which you use the information, and obtain the user's consent.
- These requirements also apply where storage or access over an electronic communications network is brought about in another way than through such a network.
- You need neither the information nor the consent where the storage or access has the sole purpose of carrying out communication over an electronic communications network, or is strictly necessary to deliver an information society service that the subscriber or user has requested.
- You also need neither where, provided it has no or minor consequences for the personal privacy of the subscriber or user concerned, the storage or access serves to obtain information about the quality or effectiveness of an information society service you have delivered.
- If you provide an information society service by or on behalf of a legal person established under public law, do not make a user's access to it depend on giving consent under Article 11.7a(1).
If you get it wrong
Penalty structure
Article 15.4(2) lets the ACM fine a breach of a provision it supervises under Article 15.1(3) up to EUR 900,000 or, if that is more, 1 % of the undertaking's turnover, and Article 15.4(5) raises that maximum by 100 % where a fine for the same or a similar rule became final within the five years before the report of the breach.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 900,000
- Turnover percentage cap
- 1
Who enforces it
Enforcement body
The Authority for Consumers and Markets (Autoriteit Consument en Markt, ACM), which Article 15.1(3) of the Telecommunicatiewet charges with supervising compliance with the provisions of the Act other than those named in Article 15.1(1) and (2), and which Article 15.4(2) empowers to impose administrative fines.
What this law does
Article 11.7a(1) permits storing information in, or gaining access to information in, the terminal equipment of a user via an electronic communications network only on condition that the user has been given clear and complete information in accordance with the General Data Protection Regulation, in any case about the purposes of use, and has given consent.
Article 11.7a(2) extends those requirements to the case where storage or access over an electronic communications network is brought about in another way than through such a network. Article 11.7a(3) lifts paragraph 1 for storage or access whose sole purpose is to carry out communication over an electronic communications network.
Article 11.7a(3) also lifts paragraph 1 for storage or access that is strictly necessary to deliver an information society service the subscriber or user has requested, or, provided this has no or minor consequences for the personal privacy of the subscriber or user concerned, to obtain information about the quality or effectiveness of a service delivered.
Article 11.7a(4) presumes to be a processing of personal data an act under paragraph 1 that aims to collect, combine or analyze data about a user's or subscriber's use of different information society services so that the user or subscriber can be treated differently. Article 11.7a(5) provides that a user's access to an information society service provided by or on behalf of a legal person established under public law may not be made dependent on giving consent under paragraph 1.
Article 11.7a was rewritten by an Act of that widened the exception to storage or access with no or minor consequences for the personal privacy of the person concerned.
When LexLint raises it
When your app profile says your app tracks devices.