NetherlandsUAVG Articles 30-33 and 46, Health, Criminal-Conviction, and National-ID-Number Data
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Obtain a General Data Protection Regulation (GDPR) Article 9(2) basis before processing health, genetic, racial or ethnic origin, political opinion, or religious-belief data of a person in the Netherlands, following UAVG's Chapter 3 exceptions where one applies to your processing purpose.
- Do not treat the citizen service number (BSN) as a general-purpose identifier; UAVG Article 46 restricts its processing.
These lines are LexLint's reading of the law's text. Also read by: Autoriteit Persoonsgegevens (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.autoriteitpersoonsgegevens.nl/en/themes/employment-and-benefits/sick-employees/rules-for-employers-regarding-sick-employees
- Guidance body
- Autoriteit Persoonsgegevens
- Open questions
- Does Article 30(1)(b) of the UAVG, which lifts the ban on health data for employers so far as processing is necessary for 'reïntegratie of begeleiding' (reintegration or guidance), reach the nature or cause of an illness, which the AP says is not necessary information?
- Which statute counts as a law that prescribes a number 'ter identificatie van een persoon' (for the identification of a person), so that a controller may use the citizen service number under Article 46 of the UAVG?
What it makes you log
Logging duty
Articles 30 to 33 and 46 set exceptions and limits for health data, criminal-conviction data and the citizen service number. They state no duty to create, keep or produce a log or record. Article 30a refers to the retention duty of the Civil Code for patient files, which is a duty of that Code and not of the UAVG.
- Kind
- None
- As of
What this law does
UAVG Chapter 3 Section 3.1 (Arts. 22-30b) implements General Data Protection Regulation (GDPR) Article 9's special-category regime with article-by-article national exceptions: research and statistics, racial or ethnic origin, political opinions, religious or philosophical beliefs, and genetic data (Arts. 24-28), a health-data exception for administrative bodies, pension funds, and employers (Art. 30), and rules on criminal-conviction data (Art. 33). Article 46 restricts processing of the citizen service number (BSN) to statutory or law-designated purposes.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .