Sint Maarten - Landsverordening-Bescherming-Persoonsgengevenes (Nederlands)
TRANSLATION OF THE OFFICIAL PUBLICATION OF SINT MAARTEN (AB 2010, GT no. 2)
National ordinance personal data protection1 CHAPTER 1. GENERAL PROVISIONS
Article 1
The following definitions apply for the purposes of this national ordinance and the provisions based on it:
a. personal data: all data concerning an identified or identifiable natural person;
b. processing of personal data: every action or set of actions concerning personal data, at least including the gathering, recording, organising, saving, updating, altering, retrieving, consulting, use, provision through forward transmission, circulation or any other form of provision, compiling, relating, as well as the protection, deletion or destruction of data;
c. file: every structured set of personal data, regardless of whether that set of data is centralised or spread in a particular functional or geographical manner, which is accessible according to certain criteria and relates to differentpersons;
d. responsible party: the natural or legal entity or any other person or administrative authority who or that, alone or in cooperation with others, determines the purpose of and the resources for the processing of personal data;
e. processor: the person who processes personal data on behalf of the responsible party, without being subject to the direct authority of the latter;
f. person concerned: the person to whom personal data relate;
g. third party: every person, not being the person concerned, the responsible party, the processor, or any person under the direct authority of the responsible party or the processor, who is authorised to process personal data;
h. recipient: the person to whom the personal data is provided;
i. consent of the person concerned: every free, specific expression of will based on information, with which the person concerned accepts that personal data relating to him is processed;
j. the minister: the Minister of Justice;
k. provision of personal data: the disclosure or supply of personal data;
l. gathering of personal data: the acquisition of personal data;
m. court: the court of first instance of Sint Maarten;
n. committee: the Personal Data Protection Supervisory Committee, referred to in Article 42 of this nationalordinance.
o. country: the country of Sint Maarten.
Article 2
1. This national ordinance applies to the full or partial automated processing of personal data and to the non-automatedprocessing of personal data recorded in a file or that is intended for recording in a file.
2. This national ordinance does not apply to processing of personal data:
a. for the purpose of activities purely for personal or domestic purposes;
b. by or on behalf of the investigation and security services, referred to in the National Ordinance on the intelligence and security services;
c. for the purpose of the performance of the police tasks, referred to in Articles 5 and 11 of the Kingdom Act on thepolice of Curaҫao, of Sint Maarten and of Bonaire, Sint Eustatius and Saba;
d. for the purpose of the execution of the National Ordinance concerning the national population records database
e. for the purpose of the execution of the National Ordinance on legal documents and the certificates of good conduct;and
f. for the purpose of the execution of the National Ordinance on elections.
3. This national ordinance does not apply to the processing of personal data by the armed forces if the Minister of Defence so decides with a view to the deployment or provision of the armed forces to enforce or facilitate the international rule of law.
Article 3
1 This issuance takes place on the basis of the additional Article II of the Constitution.
This is an English translation of the Dutch source text.
In the event of any discrepancy between the Dutch language version and the translation, and in case of any disputes, the Dutch version prevails. No rights can be derived from the English translation.
October 2013
1
1. This national ordinance does not apply to the processing of personal data solely for journalistic, artistic or literarypurposes, subject to the other provisions of this section, and of Articles 6 up to and including 11, 13 up to and including15, and 39.
2. The prohibition on processing personal data as referred to in Article 16, does not apply to the extent that this is necessary for the purposes as referred to in the first paragraph.
Article 4
1. This national ordinance applies to the processing of personal data in relation to the activities of an establishment of a responsible party in the country.
2. This national ordinance applies to the processing of personal data by or for a responsible party who has no establishment in the country, making use of means located in the country, automated or otherwise, unless suchmeans are used solely for the through transmission of personal data.
3. A responsible party as referred to in the second paragraph, is not permitted to process personal data, unless he designates a person or institution in the country to act on his behalf in compliance with the provisions of this national ordinance. For the application of this national ordinance and the provisions based on it, he is designated as theresponsible party.
Article 5
1. If the person concerned is a minor and has not yet reached the age of sixteen, or is under tutelage, or if a mentorship has been instituted for the person concerned, the consent of that person’s legal representative is required, rather than that of the person concerned.
2. Consent may be withdrawn at any time by the person concerned or his legal representative.
CHAPTER 2. CONDITIONS FOR THE LEGITIMACY OF PROCESSING OF PERSONAL DATA
Section 1. Processing of personal data in general Article 6
Personal data shall be processed in compliance with the national ordinance, in a proper manner and with
due care.
Article 7
Personal data shall be gathered for carefully considered, explicitly described and justified purposes.
Article 8
Personal data may be processed only if:
a. the person concerned has granted his unambiguous consent for the processing;
b. the data processing is necessary for the execution of an agreement to which the person concerned is party, or to take pre-contractual measures that are necessary for the contracting of an agreement, in response to a request by the person concerned;
c. the data processing is necessary for compliance with a statutory obligation to which the responsible party is subject;
d. the data processing is necessary for the protection of a vital interest of the person concerned;
e. the data processing is necessary for the correct performance of a duty of public-law task for the relevant administrative authority or the administrative authority to which the data will be provided; or
f. the data processing is necessary for the representation of the warranted interest of the responsible party or of a third party to which the data will be provided, unless the interest or the fundamental rights and freedoms of the person concerned, in particular the right to protection of privacy, take precedence.
Article 9
1. Personal data shall not be processed further in a manner that is inconsistent with the purposes for which they were obtained.
2. In the assessment of whether processing is inconsistent as referred to in the first paragraph, the responsible party shall in any event take account of:
a. the relationship between the purpose of the planned processing and the purpose for which the data wereobtained;
b. the nature of the relevant data;
c. the consequences of the planned processing for the person concerned;
d. the way in which the data were obtained; and
e. the extent to which provision is made for appropriate assurances in respect of the person
concerned.
3. Further processing of the data for historical, statistical or scientific purposes is not regarded as inconsistent if theresponsible party has made the necessary provisions to ensure that the further processing takes place solely for those specific purposes.
4. Processing of personal data shall not take place to the extent that this is prohibited by a confidentiality obligation on official, professional or statutory grounds.
Article 10
1. Personal data shall not be kept in a form that enables identification of the person concerned for any longer than is necessary for the realisation of the purposes for which they were gathered or were then processed.
2. Personal data may be kept for longer than is provided for in the first paragraph, to the extent that they are kept forhistorical, statistical or scientific purposes and the responsible party has made the necessary provisions to ensure that the relevant data are used solely for those specific purposes.
Article 11
1. Personal data shall be processed only to the extent that, in view of the purposes for which they were gathered or were then processed, they are adequate, serve the relevant purpose and are not excessive.
2. The responsible party shall take the necessary measures to ensure that personal data, in view of the purposes for which they were gathered or were then processed, are correct and accurate.
Article 12
1. Any person acting under the authority of the responsible party or of the processor, as well as the processor himself, tothe extent that they have access to personal data, shall process these only on the instructions of the responsible party, subject to any differing statutory obligations.
2. The persons, referred to in the first paragraph, who are not already subject to confidentiality obligations pursuant to their office, profession or any statutory requirement are required to protect the confidentiality of the personal data of which they become aware, subject to any statutory obligation to report these or the need to report arising from their task. Article 285 of the Criminal Code does not apply.
Article 13
The responsible party shall execute appropriate technical and organisational measures to secure personal data against loss or any form of unlawful processing. These measures shall guarantee an appropriate level of security, taking account of the technical state of the art and the costs of execution, in view of the risks associated with that processing and the nature of the data to be protected. The measures shall be aimed partly at preventing unnecessary gathering and further processing of personal data.
Article 14
1. If the person provides for personal data to be processed for it by a processor, that person shall ensure that the processor provides adequate assurances regarding the technical and organisational security measures concerning the processes to be performed. The responsible party shall ensure compliance with those measures.
2. The execution of processes by a processor shall be regulated in a contract or pursuant to another legal act giving rise to an undertaking between the processor and the responsible party.
3. The responsible party shall ensure that the processor:
a. processes the personal data in compliance with article 12(1); and
b. complies with the obligations of the responsible party pursuant to Article 13.
4. If the processor is not registered in the country, the responsible party shall ensure that the processor complieswith the law of that other country, by way of departure from paragraph 3(b).
5. With a view to saving evidence, the parts of the contract or legal act relating to the protection of personal data and the security measures referred to in Article 13 shall be recorded in writing or in another equivalent form.
Article 15
The responsible party shall ensure compliance with the obligations, referred to in Articles 6 up to and including 12 and 14(2) and 14(5) of this chapter.
Section 2. Processing of special personal data Article 16
The processing of personal data concerning a person’s religion or belief, race, political views, health, sexual life as well aspersonal data concerning membership of a trade union is prohibited, subject to the provisions of this paragraph. The same applies for criminal personal data and personal data regarding unlawful or obstructive conduct in connection with a prohibitionimposed in response to that conduct.
Article 17
1. The prohibition on processing personal data concerning a person’s religion or belief, referred to in Article 16, does not apply if the processing takes place by:
a. religious associations, independent parts thereof or other associations with a spiritual basis, to the extent that this concerns data on persons who are members of these;
b. institutions with a religious or ideological basis, to the extent that this is necessary in view of the objective of the institution and for the realisation of its fundamental goals; or
c. other institutions to the extent that this is necessary in view of the mental care of the person concerned, unless that person has objected to this in writing.
2. In the cases, referred to in paragraph 1(a), the prohibition also does not apply to personal data concerning the religionor belief of the family members of the person concerned, to the extent that:
a. the relevant association maintains regular contact with those family members on the grounds of its objective and
b. those family members have not submitted any objections to this in writing.
3. In the cases, referred to in the first and second paragraphs, no personal data shall be provided to third parties without the consent of the person concerned.
Article 18
The prohibition on processing of personal data concerning a person’s race, referred to in Article 16, does not apply if the processing takes place:
a. with a view to the identification of the person concerned and solely to the extent that this is unavoidable for that purpose;
b. with the objective of assigning a privileged position to members of a certain ethnic or cultural minority group in order to eliminate or reduce actual disadvantages relating to their race and only if:
1°. this is necessary for that purpose;
2°. the data relate solely to the country of birth of the person concerned, his parents or grandparents, or to other criteria enacted by national ordinance, on the basis of which it is possible to determine objectivelywhether a person forms part of a minority group as referred to in the preamble to paragraph b, and
3°. the person concerned has not submitted any written objection to this.
Article 19
1. The prohibition on processing of personal data concerning a person’s political views, referred to in Article 16, does not apply if the processing takes place:
a. by institutions with a political basis in regard to their members or employees or other persons belonging to the institution, to the extent that this is necessary in view of the objective of the institution for the realisation of its fundamental goals, or
b. in view of the requirements relating to political views that can reasonably be imposed in relation to the performance of positions in administrative bodies and advisory boards.
2. In the case, referred to in paragraph 1(a), no personal data shall be provided to third parties without the consent of the person concerned.
Article 20
1. The prohibition on processing of personal data concerning a person’s membership of a trade union, referred to inArticle 16, does not apply if the processing takes place by the relevant trade union or the trade union federation of which that union forms a part, to the extent that this is necessary in view of the objective of that trade union orfederation.
2. In the case, referred to in the first paragraph, no personal data shall be provided to third parties without the consent of the person concerned.
Article 21
1. The prohibition on processing of personal data concerning a person’s health, referred to in Article 16, does not apply if the processing takes place by:
a. care providers, health care or social services institutions or facilities to the extent that this is necessary with a view to good treatment or care of the person concerned, or for the management of the relevant institution or professional practice;
b. insurers as referred to in Article 1 of the national ordinance on supervision of insurers, and
financial service providers that mediate in insurance as referred to in that national ordinance, to the extent that this is necessary for:
1°. the assessment of the risk to be insured by the insurer and the person concerned has not made any objection; or
2°. the execution of the insurance contract;
c. schools to the extent that this is necessary with a view to the special supervision of students or for making special provisions in connection with their health;
d. a probation institution, a special probation officer and the Guardianship Council, a family supervisor, or a legal entity as referred to in Article 302(1) of the Civil Code, to the extent that this is necessary for the execution of their statutory duties;
e. the Minister, to the extent necessary in connection with the execution of penal sentences or custodial measures; or
f. administrative bodies, pension funds, employers or institutions working on their behalf, to the extent necessary for:
1°. proper execution of statutory provisions, pension schemes or collective labour agreements that provide for claims that are dependent on the health of the person concerned or
2°. the reintegration or supervision of employees or benefit claimants in connection with illness or occupational disability.
2. In the cases, referred to in the first paragraph, the data are processed only by persons required to protect confidentiality on official, professional or statutory grounds or pursuant to a confidentiality agreement. If the responsible party processes data personally and is not already required to protect confidentiality on official, professional or statutory grounds, he is required to protect the confidentiality of the data, except to the extent that he is required to report these pursuant to the national ordinance or the need arises through his duties to report the data to other persons authorised to process these pursuant to the first paragraph.
3. The prohibition on processing other personal data as referred to in Article 16, does not apply to the extent that this is necessary in addition to the processing of personal data concerning a person’s health as referred to in paragraph 1(a) with a view to good treatment or care of the person concerned.
4. Personal data concerning hereditary characteristics may only be processed to the extent that such processing takes place with regard to the person concerned from whom the relevant data were obtained, unless:
a. a serious medical interest takes precedence or
b. the processing is necessary for scientific research or statistical purposes.
In the case, referred to in b, Article 23(1a) and Article 23(2) are likewise applicable.
5. In a national decree containing general measures, further rules may be laid down with regard to the application of paragraph 1(b) and 1(f).
Article 22
1. The prohibition on processing of criminal personal data, referred to in Article 16, does not apply if the processing is performed by bodies charged pursuant to a national ordinance with the application of criminal law, or by the responsible party who obtained this data by or pursuant to the Kingdom Act on the Police of Curacao, of Sint Maarten and of Bonaire, Sint Eustatius and Saba or the national ordinance on judicial documentation and the certificates of good conduct.
2. The prohibition does not apply to the responsible party who processes this data on his own behalf, in order to:
a. assess a request from the person concerned to take a decision on him or to provide him with a performance or
b. protect his interests to the extent that this concerns criminal offences that have been committed against him or against persons in his service, or are expected to be committed on the grounds of facts and circumstances.
3. The prohibition on processing of other personal data as referred to in Article 16 does not apply to the extent that this is necessary in addition to the processing of criminal data for the purposes for which those data wereprocessed.
4. Paragraphs 2 and 3 are likewise applicable to personal data concerning a prohibition imposed by a court in response to unlawful or obstructive conduct.
Article 23
1. Without prejudice to Articles 17 up to and including 22, the prohibition on processing personal data as referred to in Article 16 does not apply to the extent that:
a. this takes place with the explicit consent of the person concerned;
b. the data have clearly been disclosed by the person concerned;
c. this is necessary for the establishment, exercise or defence of a right in court;
d. this is necessary in order to comply with an obligation under international law; or
e. this is necessary in view of a serious general interest, appropriate assurances for the protection of privacy are provided and this is laid down by national ordinance or the committee has granted dispensation. In granting dispensation, the committee may impose restrictions and requirements.
2. The prohibition on processing personal data for the purpose of scientific research or statistics as referred to in Article 16 does not apply to the extent that:
a. the research serves a general interest,
b. the processing is necessary for the relevant research or the relevant statistics,
c. requesting explicit consent proves to be impossible or to cost a disproportionate effort and
d. provision is made in the execution for assurances such that the privacy of the person concerned is not disproportionately breached.
Article 24
1. A number prescribed by national ordinance for the identification of a person, shall be used in the processing of personal data only to execute the relevant national ordinance or for purposes laid down by the national ordinance.
2. In a national decree containing general measures, cases may be designated in which a number to be assigned as referred to in the first paragraph other than the cases referred to in the first paragraph, may be used. Further rulesmay be laid down regarding the use of such a number.
CHAPTER 3. PROVISION OF INFORMATION TO THE PERSON CONCERNED
Article 25
1. If personal data are obtained from the person concerned, the responsible party shall notify the person concerned of the information, referred to in paragraphs 2 and 3, before the time at which the data are obtained, unless the person concerned is already aware of this.
2. The responsible party informs the person concerned of his identity and the purposes of the processing for which the data are intended.
3. The responsible party provides further information, to the extent necessary, in view of the nature of the data, the circumstances in which they are obtained or the use to which they are put, in order to ensure proper processing with due care in respect of the person concerned.
Article 26
1. If personal data are obtained in a manner other than that referred to in Article 25, the responsible party shall notifythe person concerned of the information, referred to in paragraphs 2 and 3, unless the latter is already aware of this:
a. at the time when the data concerning him are recorded, or
b. at the time when the data are intended for provision to a third party, no later than the time of the earliestprovision.
2. The responsible party informs the person concerned of his identity and the purposes of the processing.
3. The responsible party provides further information, to the extent necessary, in view of the nature of the data, the circumstances in which they are obtained or the use to which they are put, to ensure proper processing with due care in respect of the person concerned.
4. The first paragraph does not apply if notification of the information to the person concerned proves to be impossible or to require disproportionate efforts. In that case, the responsible party shall record the origin of the data.
5. The first paragraph is likewise not applicable if recording or provision is required by or pursuant to a national ordinance. In that case, the responsible party must inform the person concerned, on request, of the statutory regulation that led him to record or provide the data concerning that person.
CHAPTER 4. RIGHTS OF THE PERSON CONCERNED
Article 27
1. The person concerned has the right, freely and at reasonable intervals, to address requests to the responsible party for information regarding whether personal data concerning him are processed. The responsible party shall notify the person concerned in writing, within four weeks, as to whether personal data concerning him are processed.
2. If such data are processed, the notice shall provide a full review of this in a comprehensible form, a description of thepurpose or purposes of the processing, the categories of data to which the
processing relates and the recipients or categories of recipients, as well as the available information on the origin of the data.
3. Before a responsible party issues a notice as referred to in the first paragraph, concerning which a third party can be expected to have reservations, he shall give that third party an opportunity to present its view if the notice contains data that concern that party, unless this proves to be impossible or costs a disproportionate effort.
4. On request, the responsible party shall issue notices concerning the underlying rationale for the automated processing of the data concerning him.
Article 28
1. A person who is notified of personal data concerning him, in accordance with Article 26, may request the responsible party to improve, supplement, delete or shield these data if they are factually incorrect, are incomplete or irrelevant for the purpose or purposes of the processing or are processed in contravention of any statutory provision. The request shall contain the changes to be made.
2. The responsible party shall notify the applicant in writing of whether, or the extent to which he shall comply with the request, within four weeks of its receipt. A rejection of the request shall state the reasons for this.
3. The responsible party shall ensure that a decision on improvement, supplementation, deletion or shielding is executed at the earliest opportunity.
4. If the personal data are recorded on a data carrier in which no changes can be made, he shall make the provisions necessary to inform the user of the data that improvement, supplementation, removal or shielding are not possible despite the fact that there are grounds to adjust the data on the basis of this article.
5. The first to fourth paragraphs do not apply to the public registers instituted by national ordinance if that national ordinance includes a special procedure for the improvement, supplementation, deletion or shielding of data.
Article 29
1. If required by a serious interest of the applicant, the responsible party shall comply with a request as referred to inArticles 27 and 28, in a form other than written, which is adapted to that interest.
2. The responsible party shall provide for proper verification of the identity of the applicant.
3. With regard to minors who have not yet reached the age of 16 and with regard to persons placed under tutelage, the requests referred to in Articles 27 and 28 shall be made by their legal representatives. The relevant notice shall also be issued to the legal representatives.
Article 30
1. A responsible party who has improved, supplemented, deleted or shielded personal data in response to a request on the grounds of Article 28 is required to notify third parties to which the data were previously issued of the improvement, supplement, deletion or shielding at the earliest opportunity, unless this proves to be impossible or requires a disproportionate effort.
2. On request, the responsible party shall notify the applicant, as referred to in Article 28, of the persons to whom he issued such notice.
Article 31
1. For a notice as referred to in Article 27 the responsible party may require compensation of costs amounting to amaximum of ANG 10, to be fixed by or pursuant to a national decree, containing general measures.
2. The compensation shall be refunded if the responsible party has improved, supplemented, deleted or shielded data at the request of the person concerned, on the order of a court.
Article 32
1. If data are the subject of processing on the grounds of Article 8(e) and 8(f), the person concerned may lodge an appeal against this with the responsible party at any time, in connection with his exceptional personalcircumstances.
2. The responsible party shall assess within four weeks of the receipt of the appeal whether the appeal is justified. If the appeal is justified, he shall immediately discontinue the processing.
3. The responsible party may require compensation for costs for handling an appeal, which may not exceed an amountto be fixed by or pursuant to a national decree, containing general measures. The compensation will be refunded if theappeal is found to be justified.
4. This Article does not apply to public registers formed by national ordinance.
Article 33
1. If data are processed in connection with the realisation and maintenance of a direct relationship between the responsible party or a third party and the person concerned, with a view to recruitment for commercial or charitable purposes, the person concerned may appeal against this at any time to the responsible party, free of charge.
2. In the event of an appeal, the responsible party shall take measures to discontinue this form of processingimmediately.
3. The responsible party who intends to provide personal data to third parties or to use this, at the expense of third parties, for the purpose, referred to in paragraph 1, shall take appropriate measures to notify the person concerned of the possibilities of lodging an appeal. The notification shall take place via one or more daily newspapers, newspapers or free newspapers or in another suitable manner. With regular provision to third parties or use at the expense of thirdparties, notification shall take place at least once a year.
4. The responsible party who processes personal data for the purpose, referred to in paragraph 1 shall ensure that if a message is sent directly to the person concerned for that purpose, this shall always refer to the possibility of lodging an appeal.
Article 34
1. No-one may be subjected to an order carrying legal consequences for him, or affecting him to a significant degree, if that order is taken solely on the grounds of automated processing of personal data intended to obtain a picture of certain aspects of his personality.
2. The first paragraph does not apply if the order referred to there:
a. is taken as part of the contracting or execution of an agreement and 1°. the request of the person concerned has been met or
2°. appropriate measures have been taken to protect his justified interests, or
b. is based on a national ordinance in which measures are laid down that serve to protect the justified interest of the person concerned.
3. An appropriate measure as referred to in paragraph 2(a), is taken if the person concerned has been given an opportunity to express his views concerning the order as referred to in paragraph 1.
4. In the case, referred to in paragraph 2, the responsible party shall notify the person concerned of the underlying logic of the automated processing of the data concerning him.
CHAPTER 5. EXEMPTIONS AND RESTRICTIONS
Article 35
The responsible party may omit the application of Articles 9(1), 25, 26 and 27 to the extent that this is necessary in the interests of:
a. the security of the country or the state;
b. the prevention, detection and prosecution of criminal offences;
c. serious economic and financial interests of the country or the state;
d. supervision of compliance with statutory provisions imposed for the interests, referred to in b and c, or
e. the protection of the person concerned or of the rights and freedoms of others.
Article 36
1. If processing is performed by institutions or services for scientific research or statistics, and the necessary provisions have been made to ensure that the personal data can be used solely for statistical and scientific purposes, the responsible party may omit a notice as referred to in Article 26 and refuse to meet a request as referred to in Article 27.
2. If processing takes place of personal data forming part of archive documents transferred to an archive storage location pursuant to Articles 12 or 13 of the Archives national ordinance, the responsible party may omit a notice as referred to in Article 26.
CHAPTER 6. LEGAL PROTECTION
Article 37
A decision on a request as referred to in Articles 27, 28 and 30(2), as well as a decision in response to the filing of an appeal as referred to in Articles 32 and 33, is deemed to be an administrative decision as referred to in Article 3 national ordinance on administrative justice, to the extent that this decision has been taken by an administrative authority.
Article 38
1. If a decision as referred to in Article 37 has been taken by a party other than an administrative
authority, the interested party may address a written petition to the Court of first instance of Sint Maarten to order the responsible party to grant or reject a request as referred to in Articles 27, 28 or 30(2) or to honour or not to honour an appeal as referred to in Articles 32 or 31.
2. The petition must be submitted within six weeks of the receipt of the response of the responsible party. If the responsible party has not responded within the set term, the petition must be submitted within six weeks of the expiration of that term.
3. The court shall grant the petition, to the extent that it judges this to be well-founded. Before making its decision, the court shall give the interested parties an opportunity to present their views, if necessary.
4. A petition need not be submitted by an attorney of record.
5. Section 3 of Title 5 of Book 2 of the Code of Civil Procedure is likewise applicable.
6. The court may ask the parties and others to submit written explanations within a term that it sets and to submitdocuments they possess. The responsible party and interested parties are required to comply with this request.
Article 39
1. If a person suffers damages because action is taken in relation to him in contravention of the provisions of or pursuant to this national ordinance, the following paragraphs apply, without prejudice to rights pursuant to other statutory rules.
2. For damages that do not comprise financial damages, the injured party has the right to fair compensation fordamages.
3. The responsible party is liable for the damages arising from non-compliance with the provisions referred to in the firstparagraph. The processor is liable for the damages or losses to the extent that they arise through the processor’swork.
4. The responsible party or the processor may be relieved of such liability, partially or in full, if he proved that the da
mages are not attributable to him.
Article 40
1. If the responsible party or the processor acts in contravention of the provisions of or pursuant to this national ordinance and another party suffers, or threatens to suffer damages as a result, the court may prohibit such conduct at the request of that other party and order him to take measures to reverse the consequences of that conduct.
2. A legal entity that represents general or collective interests, or a legal entity as referred to in Article 305(a), Book 3 of the Civil Code, may not base a claim on processing, to the extent that the person affected by such processing objects to this.
Article 41
1. The responsible party who acts in contravention of the provisions of or pursuant to Article 4(3) may be penalised with a financial penalty in the second category.
2. The responsible party who deliberately commits an offence as referred to in the first paragraph shall be penalised with a custodial sentence of no more than six months or a financial penalty in the third category.
3. The offences criminalised in the first paragraph are summary offences. The offences criminalised in the second paragraph are criminal offences.
CHAPTER 7. SUPERVISION
Section 1. Institution and task of the Personal Data Protection Supervisory Committee Article 42
1. There shall be a Personal Data Protection Supervisory Committee which is responsible party for
supervising the processing of personal data in compliance with the provisions of and pursuant to this national ordinance.
2. The committee shall further perform the tasks assigned to it by national ordinance and by treaty.
3. The committee shall perform its tasks independently.
Article 43
1. The committee consists of a chairman and two other members.
2. The chairman must comply with the requirements of or pursuant to Article 23 of the Kingdom Act on the Common Court of Justice for eligibility for appointment of a judge in the Common Court of Justice.
3. The chairman and the members shall be appointed for a term of six years by national decree, at the proposal of the Minister.
Article 44
Members of the committee shall be dismissed by national decree, at the proposal of the Minister:
a. at the request of the person concerned;
b. if the person concerned is permanently unable to perform his duties due to illness or disability;
c. on the loss of Dutch citizenship;
d. if the person concerned is convicted of a criminal offence in a final decision of a court or if a measure is imposed in such a decision that leads to a deprivation of liberty;
e. if the person concerned is placed in receivership, is declared bankrupt, is granted a moratorium on payments or is committed due to debt pursuant to a final decision of a court.
Article 45
Further rules on the remuneration and the other rights and obligations relating to the legal status of the committee membersshall be laid down by national decree, containing general measures.
Article 46
The committee shall be supported by a secretariat, the officials of which shall be appointed, suspended or dismissed by the Minister following consultation of the chairman.
Article 47
The Minister may request the advice of the committee on draft national ordinances and draft national decrees, containing general measures, that relate largely or entirely to the processing of personal data.
Article 48
1. The committee may open an inquiry, officially or at the request of an interested party, into the way in which the provisions of or pursuant to this national ordinance are applied in relation to data processing.
2. The committee shall notify the responsible party or the group of responsible parties involved in the inquiry of its provisional findings and shall grant them an opportunity to present their views on this. If the provisional findings relate to the execution of any national ordinance, the committee shall also notify the relevant Minister of this.
3. In the event of an inquiry opened at the request of the interested party, the committee shall notify the interested party of its findings, unless such notification is inconsistent with the objective of the data processing or the nature of the personal data, or if serious interests of parties other than the applicant, including the responsible party, would be disproportionately harmed as a result. If the committee fails to notify its findings, it shall send the interested party a message such as it sees fit.
Article 49
Before 1 September of each year, the committee shall draw up a report on its work, the general policy pursued and the effectiveness and efficiency of its working methods in particular in the past calendar year. The report shall be sent to the Minister and shall be made publicly available.
Article 50
The committee shall provide the Minister with the information required for the performance of his duties, on request. The Minister may require access to business data and documents, to the extent that this is necessary for the performance of his duties.
Section 2. Authorisation
Article 51
The members of the committee and the officials of the secretariat are responsible party for supervision of observance , referred to in Article 42.
Article 52
1. In the performance of their duties, the persons, referred to in Article 51, shall carry proof of identity issued by or under the responsibility of the committee.
2. The persons, referred to in Article 51, must show their proof of identity immediately on request.
3. The proof of identity shall contain a photograph of the supervisor and shall in any event state his name and capacity. The model proof of identity shall be enacted by ministerial regulation.
Article 53
The committee shall avail itself of its powers only to the extent reasonably necessary for the performance of its tasks.
Article 54
1. The persons, referred to in Article 51, are authorised to enter every location, with the necessary equipment, including residential properties, without the consent of the occupant. Articles 155 to 163 of the Code of Criminal Procedure arelikewise applicable, on the understanding that the authorisation, referred to in Article 155, of the Code of Criminal Procedure is granted by the committee.
2. If necessary, they may gain entrance with the aid of the police.
3. They are authorised to arrange to be accompanied by persons that they designate for that purpose.
Article 55
The persons, referred to in Article 51, are authorised to demand information.
Article 56
1. The persons, referred to in Article 51, are authorised to demand access to corporate data and documents.
2. They are authorised to make copies of the data and documents.
3. If copies cannot be made at the location, they are authorised to take the data and documents for that purpose awaywith them for a short period, for the issue of a written receipt.
Article 57
1. All persons are required to provide a supervisor with all cooperation that he may reasonably require in the exercise of his powers, within the reasonable term set by the supervisor.
2. Persons who are required to protect confidentiality on official, professional or statutory grounds may refuse cooperation, to the extent that this arises from their confidentiality obligation.
3. A confidentiality obligation may not be invoked to the extent that information or cooperation is required in connection with a personal involvement in the processing of personal data.
Section 3. Enforcement action and astreinte Article 58
1. The committee is authorised to impose enforcement action on the offender to enforce compliance with
the obligations imposed by or pursuant to this national ordinance. The enforcement action shall describe the recovery measures to be taken and shall be issued with a statement of the reasons.
2. Enforcement action comprises
a. an order for full or partial reversal of the infringement, and
b. the authorisation of the committee to enforce the order through action if it is not executed or is not executed in good time.
3. The enforcement action shall state the term within which it must be executed.
Article 59
1. The application of enforcement action shall take place at the expense of the offender, unless these costs should not reasonably be borne by the offender, in part or in full. The committee may recover the costs, referred to in this Article, from the offender, by an administrative decision.
2. The order shall state the extent to which the offender shall bear the costs of the enforcement action.
3. The costs of the enforcement action include the costs of preparing administrative enforcement, to the extent that these are incurred after the expiration of the term within which the order should have been executed.
4. The costs of the preparation of enforcement action are also payable to the extent that no administrative enforcement hasbeen applied as a result of the fact that the order was executed after all.
5. The committee shall fix the amount of the costs due.
Article 60
1. A duty backed by an astreinte may be imposed on a person regarding whom the committee has observed that he has not complied with obligations imposed by or pursuant to this national ordinance.
2. A duty backed by an astreinte is deemed to be a recovery sanction, comprising:
a. an order for full or partial restoration of the infringement; and
b. the obligation to pay a financial penalty if the order is not executed, or is not executed in good time.
3. The order shall be imposed in writing, stating the reasons and the term within which it must be executed; the penalty shall amount to at least ANG 1,000 and no more than ANG 500,000 for each violation of the order.
4. The order subject to penalty is aimed at reversing an offence and preventing any further offence or a repetition of the offence. The order subject to penalty imposed shall be in reasonable proportion to the severity of the interestinfringed.
5. At the written request of the offender, the committee may extend the term of an order if it has been shown to the committee’s satisfaction that it is not possible for the offender to comply with the relevant obligation in good time.
6. The committee shall not impose an order subject to penalty while an administrative enforcement order imposed for the same offence is in effect.
Article 61
At the request of the offender, an administrative authority that has imposed an order subject to penalty may withdraw theorder, suspend its duration for a particular term or reduce the penalty in the event that it is temporarily or permanentlyimpossible for the offender to meet his obligations, partially or in full.
Article 62
1. In the absence of compliance with the order within the term, referred to in Article 60(3), the committee maycollect the amount of the penalty, plus costs relating to its collection, by a writ of execution, unless an objection has been filed against the imposition of the order pursuant to the national ordinance on administrative justice.
2. A writ of execution as referred to in the first paragraph will be served by a bailiff at the offender’s expense andgives rise to an executory title within the meaning of the Code of Civil Procedure.
3. For six weeks after the date on which the writ was served, the order may be appealed by summonsing the Minister. An appeal suspends the enforcement. At the Minister’s request, the court may lift the suspension of the enforcement.
4. The authorisation to collect penalty amounts due is prescribed by the passage of six months following the date on which the penalty amounts fall due. The prescription is suspended by bankruptcy and by any other statutory impediment to collection.
5. Appeals may be filed against the imposition of the administrative enforcement order as referred to in Article 58, an administrative decision to determine the costs of the administrative enforcement order as referred to in Article 59 and against the imposition of an order subject to penalty as referred to in Article 60, pursuant to the national ordinance on administrative justice, in observance of Article 28(2) of that national ordinance.
CHAPTER 8. DATA EXCHANGES WITH OTHER STATES
Article 63
1. Personal data that are subjected to processing or that are intended for processing following their throughtransmission shall be sent to another country only if, without prejudice to compliance with the national ordinance,that country guarantees an appropriate level of protection.
2. The appropriate character of the level of protection is assessed in view of the circumstances that influence thethrough transmission of data or a category of data. In particular, account is taken of the nature of the data, the purpose or purposes and the duration of the intended processing, the country of origin and the final destination country, the general and sectoral rules of law applying in the country concerned, as well as the professional rules and security measures observed in those countries.
Article 64
1. By way of departure from Article 63, a through transmission or a category of through transmissions of personal data to a country that provides no assurances of an appropriate level of protection may take place if:
a. the person concerned has granted unambiguous consent for this;
b. the through transmission is necessary for the execution of an agreement between the person concerned and the responsible party, or in order to take pre-contractual measures in response to a request by the person concerned and that are necessary for the contracting of an agreement;
c. the through transmission is necessary for the contracting or execution of an agreement contracted or to be contracted between the responsible party and a third party, in the interest of
the person concerned;
d. the through transmission is necessary due to a serious general interest or for the establishment, exercise or the defence of any right in court;
e. the through transmission is necessary to protect a vital interest of the person concerned; or
f. the through transmission takes place from a register installed by law and that can be viewed publicly, or by any person that can invoke a justified interest, to the extent that in the case concerned, the statutory requirements for viewing have been met.
2. By way of departure from the first paragraph, the committee may issue a permit for a through transmission or a category of through transmissions of personal data to a country that does not provide assurances of an appropriate level of protection. The further provisions necessary to secure the protection of privacy and the fundamental rights and freedoms of persons, as well as the exercise of the associated rights, shall be attached to the permit.
CHAPTER 9. FINAL PROVISIONS
Article 65
Within five years of this national ordinance taking effect, the Minister shall send Parliament a report on the effectiveness and the effects of this national ordinance in practice.
Article 66
1. Within one year of this national ordinance taking effect, the data processing that has already taken place at that time shall be harmonised with this national ordinance.
2. A term of three years applies for the adjustment of the processing of special data to the provisions of section 2 of Chapter 2, on the understanding that consent as referred to in Article 23(1)(a), need not be requested anew for processing that has already taken place and that was necessary for the execution of agreements contracted prior tothe date on which this national ordinance took effect.
Article 67
This personal data protection national ordinance shall be referred to as the ‘Personal Data Protection National Ordinance’.
Issued on the twentieth of December 2010 The Minister of General Affairs,
S.A. Wescot-Williams