Data subjects’ rights under Dutch data protection law

Restrictions of data subjects’ rights

Article 41(1) UAVG allows controllers to disregard the data subjects’ rights (Art. 12- 21 GDPR) and the obligation of breach communication to the data subject (Art. 34 GDPR) to the extent necessary and proportionate to ensure

  • national security
  • national defense
  • public security
  • the prevention, investigation, detection and prosecution of criminal offenses or the execution of criminal penalties
  • other important public interest objectives of the European Union or the Netherlands (in particular, an important economic or financial interest of the EU or the Netherlands)
  • the protection of judicial independence and legal proceedings
  • the prevention, investigation, detection and prosecution of violations of professional codes for regulated professions
  • supervision, inspection or regulation that is related with the exercise of official authority
  • the protection of the data subject or of the rights and freedoms of others or
  • the collection of civil claims

In deciding to disregard the above-mentioned obligations and rights, the controller shall take into account several factors listed in Article 41 (2) UAVG, such as: the purposes of the processing or categories of processing, the categories of personal data, the risks to the rights and freedoms of those involved, etc.

Processing of personal data for the purposes of scientific research or statistics

Further, the rights to access, rectification and restriction of processing do not apply where processing is carried out solely for the purposes of scientific research or statistics (Article 44 UAVG).

Processing of personal data for the purposes of archiving in the public interest

Where the processing is carried out for the purposes of archiving in the public interest, the right to access, rectification, restriction of processing (when the accuracy of data is contested) and portability may not be granted (Article 45 UAVG).

Exceptions for public registers

Pursuant to Art. 47 UAVG, public registers may further restrict some rights of data subjects, namely the right to access, rectification and restriction of processing. In such cases, also the notification obligation of Art. 19 GDPR, regarding rectification or erasure of data or restriction of processing does not apply. Moreover, there is no right to object to registers established by law.