NETHERLANDS Law and Practice Contributed by: Friederike Henke, Ingrid Cools, Philip ter Burg, IJsbrand Uljée, Suzan van de Kam and Epke Spijkerman, BUREN
access to EU data by US intelligence services to what is necessary and proportionate, and establishing a Data Protection Review Court (DPRC), to which EU individuals have access. If the DPRC finds that data was collected in violation of the new safeguards, it will be able to order the deletion of the data. The new safeguards in the area of government access to data will complement the obligations that US companies importing data from EU will have to subscribe to. In order to be able to receive personal data trans - ferred from the EU on the basis of the EU–US Data Privacy Framework, US companies must certify, and then re-certify on an annual basis, with the US Depart - ment of Commerce, its adherence to a detailed set of privacy obligations, for instance, the requirement to delete personal data when it is no longer necessary for the purpose for which it was collected, and to ensure continuity of protection when personal data is shared with third parties. The functioning of the EU–US Data Privacy Frame - work is subject to periodic reviews, to be carried out by the European Commission, together with repre - sentatives of European data protection authorities and competent US authorities. The first review took place in July 2024. Based on the information gathered dur - ing this first review, the European Commission con - cluded that the US authorities have put in place the necessary structures and procedures to ensure that the Data Privacy Framework functions effectively. At the moment of the first review more than 2,800 US Companies were certified under the Data Privacy Framework. The Trump administration, however, has taken an aggressive stance against the EU’s GDPR, viewing it as a restriction on digital trade and a bur - den on US tech companies, with US firms receiving 83% of total GDPR fines. While the US administration supports the EU–US Data Privacy Framework (DPF) as of early 2026, future threats to weaken or roll back the framework could endanger the free flow of data, potentially leading to its invalidation by the EU. On 4 June 2021, the European Commission modern - ised the SCCs for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the
GDPR) to controllers or processors established out - side the EU/EEA (and not subject to the GDPR). These modernised SCCs replace the three sets of SCCs that were adopted under the previous Data Protec - tion Directive 95/46. On 27 December 2022, the grace period for using contracts incorporating these earlier sets of SCCs expired. The European Commission is in the process of developing additional sets of SCCs for data transfers to third countries by EU institutions and bodies, and for data transfers to controllers or processors outside the EU whose processing opera - tions are directly subject to the GDPR. 8.3 Role and Authority of the Data Protection Agency The Dutch Data Protection Authority ( Autoriteit Per- soonsgegevens ) was established by the GDPR Imple - mentation Act as an independent supervisory author - ity, as referred to in Article 51 (1) of the GDPR. The Authority is charged with supervising the processing of personal data in accordance with the provisions of the GDPR and the law. The functions of the Dutch Data Protection Authority include: • providing guidance to individuals and organisations in the form of information and advice; • supporting organisations by offering practical tools; • reviewing requests for prior consultations and licence applications for processing data relating to criminal convictions and offences; and • promoting the creation of codes of conduct. It has the power to investigate violations, to issue orders to stop violations and to impose fines of up to EUR20 million or 4% of the worldwide annual turno - ver, whichever is higher.
9. Looking Forward 9.1 Upcoming Legal Reforms
No information has been provided in this jurisdiction with respect to upcoming legal reforms concerning doing business in the Netherlands.
747 CHAMBERS.COM
Powered by FlippingBook