From 1 September, the Dutch Data Protection Authority (AP) will be legally required to publish administrative sanctions imposed under the GDPR. These include fines, orders subject to a penalty for non-compliance and bans on processing. Until now, the AP has already published these sanctions on the basis of its own policy.
The obligation is included in an amendment to the Implementation Act of the General Data Protection Regulation (UAVG), following an amendment proposed by the House of Representatives. According to the AP, the legal basis is important for legal certainty and legal protection. The publication should also provide insight into shortcomings and their consequences, enabling other organisations to see what they may need to improve.
The AP will first inform an organisation of the proposed publication decision and give it the opportunity to respond. The sanction will not be published until at least ten working days after the organisation has received the decision on publication. Earlier publication is possible if the organisation has already made the sanction public itself or does not object.
Organisations can object to both the GDPR sanction and its publication. Anyone who objects to the publication can also go to court to try to prevent it. The existing publication policy will be amended for GDPR sanctions. In future, the AP will publish sanctions imposed under the Police Data Act and the Judicial and Criminal Records Data Act in the same way.
