Law and regulation
Since the introduction of the Algemene Verordening Gegevensverwerking (AVG/GDPR) on May 25, 2018, you would be wise to familiarize yourself with the rules when using data. Processing personal data is allowed, as long as you respect these rules. But what are personal data and what exactly is processing? And how does the AVG law work?
We would like to inform you about the current state of affairs. Of course, we are not legal experts and are happy to give you our interpretation. The responsibility for the correct handling of personal data lies of course with each organization that is ultimately responsible for the processing. So keep an eye on the developments in the field of privacy yourself.
Curious about how Ad Hoc Data deals with privacy? Then read our privacy statement. Any questions? Feel free to contact us, we are happy to think along with you!
General
The General Data Protection Regulation (GDPR) or Algemene Verordening Persoonsgegevens (AVG) is a privacy law that applies throughout the European Union and replaces the Dutch Personal Data Protection Act (Wbp). Thanks to the GDPR, personal data protection is regulated in the same way in all EU countries and the same rules apply in every member state. Among other things, the GDPR ensures: strengthening and expanding privacy rights of data subjects thereby increasing responsibilities for organizations.Personal data refers to any information about an identified or identifiable natural person. This means that information is either directly about someone or can be traced back to that person. Examples include: names and addresses, direct telephone numbers, personal e-mail addresses, IP addresses, photos, etc. There are also ‘special categories of personal data’ defined. These include political affiliation, religion, health, and race, which are afforded extra protection; processing them is prohibited.‘Processing’ is a broad term and includes all actions an organization can perform with personal data. Examples are: collecting, recording, organizing, structuring, storing, updating or modifying, retrieving, consulting, using, transferring, distributing, making available, combining, linking, blocking, erasing, and destroying data.If you process personal data, you must comply with the GDPR. In fact, this applies to virtually every organization — whether it concerns data from customers, prospects, employees, or applicants, you’re soon storing and processing personal data.You are a data controller if you determine the purpose and means of processing personal data. An organization can do this alone or together with a ‘processor’. Whether it’s about customers, prospects, employees or applicants, as soon as you process data, you are the controller.You are a processor when the data controller outsources the processing activities to you. Think of administration offices, software providers, call centers, cloud providers, etc. The controller is required to have a data processing agreement in place with the processor(s).The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is the supervisory body designated by law to monitor personal data processing in the Netherlands. The AP's responsibilities include supervision, advice, education, public information, accountability, and international cooperation.The GDPR defines 6 legal bases for processing personal data: - consent of the data subject; - performance of a contract; - legal obligation; - protection of vital interests; - task carried out in the public interest or official authority; - legitimate interest.The GDPR grants the following rights to data subjects: 1. Information: the right to know how their data is used; 2. Access: which data is processed; 3. Rectification: to have incorrect data corrected; 4. Erasure: right to be forgotten; 5. Restriction: of data processing; 6. Objection: to processing activities; 7. Data portability: right to transfer data; 8. No profiling: right to object to automated profiling.The GDPR does not prescribe a fixed retention period for personal data. You must determine how long data is stored yourself. However, you must not keep it longer than necessary for the purpose for which it was collected. It's advisable to document your retention decisions in your processing register.Measures to take
There are both technical and organizational measurements that you can take to comply with privacy regulations:- Establishing privacy policies: where you pay attention to e.g. data minimization, transparency, procedures for safeguarding in international data traffic.
- Appointing an FG/DPO: designating/appointing internal responsible officer when processing large-scale, or special personal data;
- Compile a data processing register: registration of all processing of personal data, including information about which processing takes place and how, supplemented with the retention periods and how you guarantee the rights of data subjects in this;
- Data breach policy: determine the procedures for data breaches and maintain a report of all (suspected) data breaches, including the actions taken in this regard;
- DPIA (if applicable).: Conducting a data protection impact assessment for new processing activities with increased privacy risk.
- Establishing dataprocess agreements: with all processors agreeing on responsibilities and procedures on both sides;
- Privacy by design & default: Implement data protection through design and default settings of (Web) applications;
- Technical security measures: among other things, for creating passwords, sending files safely, secure website (you can possibly have a hack performed as a test);
- Internal handbook: raising internal awareness about privacy and implementing a practice according to the handbook.
If a complaint is filed about your organization, the Personal Data Authority will investigate you. And if this investigation determines that you are not sufficiently privacy compliant, your fine could be up to 4% of your worldwide annual turnover with a maximum of 20 million euros.A Functionaris Gegevensbescherming (FG) or Data ProtectionOfficer (DPO) is the person within an organization responsible for compliance and application of the AVG. Often this is an external person, usually with a legal background. For certain organizations, the appointment of an FG is mandatory, given the large amounts of personal data being processed or when these are special personal data. It is also always mandatory for governments and public organizations. Not sure whether you are obliged to appoint such an officer, but do you process personal data on a reasonable scale? Then it is better to play it safe and appoint someone for this purpose. Always report your DPO to the Autoriteit Persoonsgegevens (AP).When personal data falls into the hands of third parties who should not have access to that data, it is a data breach. This is an incident in which personal data is lost or unauthorizedly handed over, seen or changed as a result of a security problem. Examples are: leaked computer files, an e-mail sent to the wrong e-mail addresses, a stolen laptop or lost USB stick, cyber attacks, etc. insofar as personal data are involved. You are obliged to report all data leaks to the AP and your DPO, and if necessary you must inform the data subject (mandatory notification).Organizations are required to demonstrate with documentation that they have taken appropriate and effective organizational and technical measures to comply with the principles and obligations of the AVG. Among other things, this requires you to document how you carry out which processing operations, on what basis and for how long you store personal data. This is a crucial document and is called a processing register.The GDPR states that you must properly inform data subjects about what personal data are processed, for what purposes and on what grounds. You can do this, for example, in a privacy statement. But you can also inform data subjects at other times, for example in an online order module.A DPIA, Data Protection Impact Assessment, is an examination of the risks of a processing operation before it takes place. This examination may be a mandatory tool in some cases, such as when personal data are processed systematically and on a large scale.B2B market
In the corporate world all data is primarily business data. This business data falls outside the GDPR as far as the data cannot be traced back to a person. Keep in mind that there's always the risk of processing of personal data. This includes personal data of customers, potential and former customers. This includes data that you store in your CRM system: personal e-mail addresses, direct telephone numbers, bank details, etc. Make sure that you include only those data which are necessary for the performance of the agreement, or else you ask permission or have a legitimate interest for the processing. For example, it is (most likely) not necessary to include your business customer's hobbies, preferences or date of birth. So in that case, you should omit this data.If you use e-mail marketing in The Netherlands you first have to deal with the Telecommunications Act (in the future the e-Privacy Act) regarding the use of this channel. This law stipulates, among other things, that you must ask the recipient's permission in advance to be able to send e-mails if there is no customer relationship with the recipient and if the recipient has not opted out. In addition, you usually make use of personal data, such as personal e-mail addresses, direct telephone numbers and other data that may be personally related. For this you do have to deal with the GDPR.Marketing campaigns on social media can be affected by the GDPR, insofar as you want to match lists of e-mail addresses with your social media campaign, for example. Remarketing (showing targeted ads to people who have previously visited your website) is also covered.As with e-mail marketing, in the case of telemarketing you have to deal in the first instance with the Telecommunications Act (in the future the e-Privacy Act) with regard to the use of this channel. In the case of B2B telemarketing this only concerns organizations with the legal forms: sole traders, general partnerships, partnerships. But in addition, you also have to deal with the GDPR here, insofar as you use direct telephone numbers, contacts and other information in your call list that can be considered personal data.When there is a transfer of personal data from one controller to another, there is ‘chain responsibility’. Thus, the scope of your responsibility goes beyond your own activities. In fact, you must also make efforts to ensure data protection when there is data transfer within the chain.The GDPR applies to all countries within the EU. If your products or services are purchased outside the EU, chances are that the privacy rules there are not as tightly regulated. These so-called ‘third countries’ are all countries outside the EU, with the exception of countries in the European Economic Area (EEA: Norway, Liechtenstein and Iceland). You may only sell to countries with an adequate level of protection.
