Knowledge base
Articles on the GDPR, enforcement by regulators, privacy in healthcare and education, cookies, cyber security and the Wwft. Each article shows its publication date. Laws and regulations may have changed since then.
GDPR and privacy
Consent as a legal basis for data processing
Consent as a legal basis for data processing. Consent must be freely given, specific, informed and unambiguous.
Read more: Consent as a legal basis for data processingWhat are special categories of personal data?
What are special categories of personal data under the GDPR and when may I process them? How do they differ from ordinary personal data?
Read more: What are special categories of personal data?Measuring temperature is not simply allowed under the GDPR
What are the rules for measuring the body temperature of employees, visitors or customers? The GDPR does not simply allow it!
Read more: Measuring temperature is not simply allowed under the GDPRGerman BfDI recommends evaluation of the GDPR
The German BfDI announced that the European Data Protection Board recommends simple improvements in its contribution to the GDPR evaluation.
Read more: German BfDI recommends evaluation of the GDPRVAT identification number for sole traders from 1 January
Since 1 January 2020, the new VAT identification number applies to all sole traders in the Netherlands. It was introduced with privacy in mind.
Read more: VAT identification number for sole traders from 1 JanuaryPrivacy concerns about TikTok
The hugely popular Chinese app TikTok is under fire because of concerns about the privacy of its users.
Read more: Privacy concerns about TikTokThese are the AP's focus areas for the coming years
In the coming years, the Dutch Data Protection Authority (AP) will focus on three areas: data trading, digital government, and AI and algorithms.
Read more: These are the AP's focus areas for the coming yearsEnergy sellers acting in breach of the GDPR
Various media, including the Algemeen Dagblad and Trouw, revealed that energy sellers are using illegally obtained personal data.
Read more: Energy sellers acting in breach of the GDPRWhat must a privacy statement contain under the GDPR?
As an organisation, you are obliged to inform your employees, customers and (website) visitors about the privacy-sensitive personal data you process.
Read more: What must a privacy statement contain under the GDPR?What is personal data?
What is personal data under the General Data Protection Regulation? How do I know whether something is personal data? Examples of personal data
Read more: What is personal data?Social media and job applicants: how to comply with the GDPR
How should I as an employer handle the data of job applicants? Am I allowed to screen a candidate's social media accounts under the GDPR?
Read more: Social media and job applicants: how to comply with the GDPRWhat is the GDPR?
What is the General Data Protection Regulation (GDPR)? What does this regulation entail? What are the changes for companies and organisations?
Read more: What is the GDPR?Fines and enforcement
600,000 euro fine for the municipality of Enschede
The Dutch Data Protection Authority fines the municipality of Enschede 600,000 euros for wifi tracking without a sound legal basis.
Read more: 600,000 euro fine for the municipality of EnschedeGoogle loses appeal against French GDPR fine of 50 million euros
Google loses its appeal against the French GDPR fine of 50 million euros. The fine imposed by the French privacy regulator CNIL is now final.
Read more: Google loses appeal against French GDPR fine of 50 million eurosAP fines company for processing employee fingerprints
A company processed its employees' fingerprints without a legal basis for doing so. The privacy regulator has fined the company.
Read more: AP fines company for processing employee fingerprintsKNLTB fined for selling personal data
The Dutch privacy regulator, the Dutch Data Protection Authority (AP), has imposed a fine of 525,000 euros on the tennis association KNLTB.
Read more: KNLTB fined for selling personal dataGerman privacy regulator imposes fines
We start the week with the news that the German privacy regulator has imposed two fines.
Read more: German privacy regulator imposes finesHaga fined for insufficient internal security of patient records
The AP has fined the Haga Hospital for insufficient security of patient records. This follows an investigation by the regulator.
Read more: Haga fined for insufficient internal security of patient recordsBritish Airways fined for data breach
A major data breach at British Airways, in which a large amount of personal data was stolen.
Read more: British Airways fined for data breachFrance fines Google 50 million euros
Google receives a fine of 50 million euros from the French privacy watchdog for breaching the General Data Protection Regulation (GDPR).
Read more: France fines Google 50 million eurosHealthcare
The Digital Government Act is coming, also for healthcare institutions
The Digital Government Act enters into force from 1 June 2021. It lays the foundation for digitalising government and healthcare institutions.
Read more: The Digital Government Act is coming, also for healthcare institutionsUBO register for healthcare institutions
UBO register for healthcare institutions. When are you a UBO? What are the sanctions if you do not comply with the obligations?
Read more: UBO register for healthcare institutionsWhat happens to my data when I get tested for coronavirus?
What happens to my data when I get tested for the coronavirus? Which parties are involved? What arrangements do these parties make with each other?
Read more: What happens to my data when I get tested for coronavirus?GGD loses coronavirus tests
GGD Zaanstreek-Waterland has lost 132 coronavirus tests, the GGD writes on its own website. How this could have happened is not yet clear.
Read more: GGD loses coronavirus testsWhen must my healthcare institution comply with NEN 7510?
Healthcare institutions must comply with NEN 7510. NEN 7510 provides a framework for information security in healthcare. NEN 7510 is important.
Read more: When must my healthcare institution comply with NEN 7510?European Medical Device Regulation postponed by a year
Due to the coronavirus crisis, the European regulation on medical devices (Medical Device Regulation) has been postponed until May 2021.
Read more: European Medical Device Regulation postponed by a yearThe rules for processing health data for scientific research in the context of the coronavirus (COVID-19)
The EDPB guidelines on processing health data for scientific research during the COVID-19 outbreak: legal bases, controller duties and storage periods.
Read more: The rules for processing health data for scientific research in the context of the coronavirus (COVID-19)Espria takes Drenthe municipalities to court over GDPR breach
Care organisation Espria, owner of GGZ Drenthe, Icare and De Trans, has taken five Drenthe municipalities to court for breaching care workers' privacy.
Read more: Espria takes Drenthe municipalities to court over GDPR breachAP clarifies the term ‘large-scale’ processing for all healthcare providers
The Dutch Data Protection Authority clarifies the term 'large-scale' for healthcare providers, such as hospitals, GPs, care groups and pharmacies.
Read more: AP clarifies the term ‘large-scale’ processing for all healthcare providersCyber security and data breaches
CJG Rijnmond hit by data breach after phishing email
CJG Rijnmond has been hit by a data breach after a phishing email. CJG Rotterdam has reported the data breach to the Dutch Data Protection Authority.
Read more: CJG Rijnmond hit by data breach after phishing emailUS hospital cancels operations due to ransomware
A US hospital has had to cancel several operations because its systems were infected with ransomware.
Read more: US hospital cancels operations due to ransomwareCookies and ePrivacy
Turkish DPA fines Amazon for cookie violations
The Turkish DPA has fined Amazon Turkey for violations related to its electronic messaging and use of cookies.
Read more: Turkish DPA fines Amazon for cookie violationsCourt: pre-ticked cookie consent invalid
A pre-ticked box for cookies is invalid, according to the court. Active consent is required for placing cookies.
Read more: Court: pre-ticked cookie consent invalidWhat are cookies?
When people visit websites, many companies are looking over the visitor's shoulder.
Read more: What are cookies?Education
Educational institutions reach agreement with Google
Educational institutions reach agreement with Google on mitigating high privacy risks relating to applications
Read more: Educational institutions reach agreement with GoogleUniversities ban Zoom over privacy risks
Several Dutch universities are banning the use of Zoom because of privacy risks.
Read more: Universities ban Zoom over privacy risksCamera surveillance at school
What rules apply to installing cameras at school? The rules are briefly explained on this page.
Read more: Camera surveillance at schoolCan we help you?
Feel free to contact us for a no obligation conversation.