Part 3.1 and 3.2 of the Dutch Implementation Act extensively regulate the processing of special categories of personal data and personal data relating to criminal law matters.
Processing of special categories of personal data
Article 23 and 24 UAVG specify the that processing of special categories of personal data is allowed, if it is necessary for
- fulfillment of an international law obligation,
- performance of tasks by the Dutch DPA (Autoriteit persoonsgegevens) or an ombudsman (see Section 9:17 of the Algemene wet bestuursrecht, the General Administrative Law Act),
- criminal law matters or
- scientific or historical research that serves a public interest, or for statistical purposes (for more information, see Section 23 “Archiving, scientific and historical research”).
Racial or ethnic origin
Article 25 UAVG permits the processing of data revealing racial or ethnic origin if it is unavoidable for the purpose of identification of the data subject or the aim of the processing is to ensure equal treatment of ethnic or cultural minorities.
Political opinions
In accordance with Article 26 UAVG, it is allowed to process such data for the performance of public duties.
Religious or philosophical beliefs
Data revealing religious or philosophical beliefs can be processed for the purpose of providing spiritual solitude, unless the data subject has a written objection (Article 27 UAVG). Such data may not be transmitted to third parties without consent.
Genetic data
Article 28 UAVG states that genetic data may be processed if it has been collected directly from the data subject. It is also allowed to process genetic data when a substantial medical interest exists or the processing is necessary for scientific research or statistical purposes (see Section 23 Archiving, scientific and historical research) if the data subject has given their explicit consent and safeguards are provided to ensure that the encroachment on their privacy is not disproportionate. Consent is not required if obtaining consent proves impossible or requires disproportionate effort.
Biometric data
In accordance with Article 29 UAVG, biometric data may be processed if such processing is necessary for the purpose of identification of identity or for security reasons.
Health data
Article 30 UAVG specifies who is allowed to process personal health data and under what circumstances. Accordingly, such processing may be carried out:
- by administrative bodies, pension funds and employers for fulfilling their legal obligations, or for the reintegration or support of employees or recipients of welfare benefits in connection with illness or disability,
- by schools for making special arrangements connected to pupils’ health status,
- by certain institutions, such as rehabilitation institutions, for performance of their statutory duties,
- by health care providers for proper treatment, care or management,
- by insurers or financial service providers for performance of a contract.
Further, health data may be processed only by persons who are obliged to observe confidentiality, unless the law provides otherwise.
Processing of personal data relating to criminal convictions and offences
According to Article 32 and 33 UAVG, personal data relating to criminal conviction may be processed if a data subject has given explicit consent to it or in the following cases:
- protection of the vital interests of the data subject or of another person who is physically or legally incapable of giving consent
- establishment, exercise or defense of legal claims, or whenever courts are acting in their judicial capacity
- substantial public interest, fulfillment of an international law obligation or processing by the Dutch DPA (Autoriteit persoonsgegevens) or an ombudsman (see Section 9:17 of the Algemene wet bestuursrecht, the Dutch General Administrative Law Act) for the performance of their statutory duties
- scientific or historical research that serves a public interest, or statistical purpose (For more information, see Section 23 “Archiving, scientific and historical research”.)
Further, personal data relating to criminal convictions and offences may be processed if carried out
- by competent bodies or controllers under criminal law,
- by public-law partnerships of controllers (or groups of controllers) to perform their tasks, if adequate privacy safeguards are ensured,
- for necessary proper health treatment or care of the data subject,
- to make a decision about a data subject upon its request, or to provide it with requested services;
- for the protection of data subjects’ interests, insofar as it concerns criminal offenses that are or are expected to be committed on the basis of facts and circumstances against them or against persons who are in its service; or
- on behalf of third parties by controllers, acting pursuant to a specific license (Article 33(4) UAVG).
Moreover, under Art. 33(3) UAVG, personal data relating to criminal convictions and offences about employees may only be processed if this is done in accordance with the Works Councils Act (Wet op de ondernemingsraden).
