The Dutch DPA must now make fines public
Since 1 September 2026, a new rule applies: fines and other sanctions imposed by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) are made public as standard. That used to be different. Until that date, the AP first had to weigh the interests involved before publishing a fine, and organisations could challenge that assessment. Those options are now severely limited.
The change stems from the Data Protection Omnibus Act (Verzamelwet gegevensbescherming), which introduced Article 21b of the Dutch GDPR Implementation Act (UAVG). The principle is now “public, unless“. This means that enforcement decisions such as fines, penalty payments and processing bans are in principle published after two weeks. Only the grounds for refusal under the Dutch Open Government Act (Woo), such as the protection of commercially sensitive information, still form an exception.
This is all the more difficult because, in practice, AP fines often do not stand up. A well-known example is the VoetbalTV fine. VoetbalTV B.V. was fined €575,000 by the AP because, according to the AP, the company had made video recordings of football matches and distributed those images without a valid legal basis under Article 6 GDPR. The data subjects had allegedly not given consent to being filmed. In addition, the AP argued that VoetbalTV had no legitimate interest in processing personal data. According to the district court, and later also the Administrative Jurisdiction Division of the Council of State, the fine had been imposed wrongly. After all, the AP had not taken into account all the interests put forward by VoetbalTV. Had it done so, the AP would have had to conclude that VoetbalTV did not have a purely commercial interest in recording football matches. Furthermore, the AP had not examined whether the processing of personal data was necessary, nor had it weighed the interests of VoetbalTV against those of the data subjects.
As of 1 September 2026, a company can therefore already suffer reputational damage from the publication of an AP fine, while it may later turn out that the fine was imposed wrongly. Any annulment of the fine does not automatically undo that reputational damage.
Anyone who disagrees with publication must also act quickly: within ten working days (!) an application for interim relief must be filed with the administrative court to have the publication suspended. Waiting is therefore not an option.
Has your organisation received a fine or other sanction decision from the AP, or would you like to know how to defend yourself against a premature fine and its publication? Then contact us quickly, because given the ten-working-day deadline, time is a crucial factor here. Do you have other questions about GDPR compliance in general and how to prevent a fine in the first place? We are also happy to think along with you on that.
An overview of data can be sufficient for a subject access request
When responding to a GDPR subject access request, must a company always provide copies of all underlying documents? No, the court ruled in a case against the municipality of Tilburg.[1] A sufficiently specific overview of the personal data processed can suffice.
Two data subjects asked the municipality for access to their personal data, processed in connection with the Social Support Act (Wmo) and an address investigation. The municipality provided overviews instead of all the underlying documents. According to the court, that was sufficient, because the right of access under Article 15 GDPR serves a different purpose than a right to documents: it is about enabling a person to check which data about them has been processed and whether this was done lawfully. For each item of data, the municipality’s overviews stated in which document it appeared, the date, the source and recipient, the retention period and the purpose of processing. That was sufficient to assess the lawfulness.
Internal considerations about the processing also fall outside the right of access: Article 15 GDPR does not give a right to insight into decision-making processes or reasoning.
This ruling offers practical room for manoeuvre: a well-structured overview can be more efficient than collecting and providing all the underlying documents, without this being at the expense of the data subject’s rights. The right of access does not automatically give access to complete emails, personnel files or other business documents. According to a recent ruling, this also applies to a former employee who requests access to his personal data after an employment dispute. That former employee is not automatically entitled to all business documents in which he appears.[2]
As an employer, have you received a subject access request from a (former) employee who, for example, requests the complete personnel file, and would you like to know which parts can be dealt with by means of an overview and which documents and personal data actually need to be provided? Feel free to get in touch, and the corporate lawyers of The Legal Company will look at how you can respond to the request carefully and efficiently. We can be reached at info@thelegalcompany.nl or 020-3450152.
Blog by corporate lawyer Bente Brouwer LL.M.
