{"id":44504,"date":"2018-06-12T11:05:48","date_gmt":"2018-06-12T09:05:48","guid":{"rendered":"https:\/\/fhi.nl\/nieuws\/nieuwe-meldingsplicht-datalek-persoonsgegevens\/"},"modified":"2024-07-10T14:51:37","modified_gmt":"2024-07-10T12:51:37","slug":"nieuwe-meldingsplicht-datalek-persoonsgegevens","status":"publish","type":"news","link":"https:\/\/fhi.nl\/en\/news\/nieuwe-meldingsplicht-datalek-persoonsgegevens\/","title":{"rendered":"New reporting obligation for data breach of personal data"},"content":{"rendered":"
\n\n\t\n\t\t\t
<\/div>\n\t\n\t
\n\t\t
\n\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t

\n\t\t\t\t\tNew reporting obligation for data breach of personal data\t\t\t\t<\/h1>\n\n\t\t\t\t
\n\t\t\t\t\t<\/svg>\t\t\t\t<\/div>\n\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\n\t\t<\/div>\n\t<\/div>\n<\/header>\n\n\n\n
\n\t
\n\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\tCompanies that store personal data are subject to the Personal Data Protection Act. Compliance with this law has been enforced by the AP, or Dutch Data Protection Authority, since January 1, 2016. Fines for violations can amount to a maximum of \u20ac820,000. With this, the legislator hopes to ensure that companies better protect personal data. Because data leaks must be reported, companies also have a greater incentive not to receive negative press.\r\n\r\nWhat is it about?<\/strong>\r\nAdministrators of personal data must carefully manage and process them. Personal data may not be lost, mutilated, fall into the wrong hands or end up on the street and no unintended operations may be carried out on it. If this does happen, there is a data breach. If there is a data breach, this must be reported to the AP.\r\n\r\nWhat are personal data?<\/strong>\r\nThese are data that say something about an identifiable natural person. Examples are medical data, payment data or personnel files. This also includes the emerging time\/location data that can be collected with tracking\/tracing equipment.\r\n\r\nWhat does processing personal data entail?<\/strong>\r\nProcessing is: all actions that an organization can perform with personal data such as collecting, recording, organizing, storing, updating, modifying, retrieving, consulting, using, forwarding, distributing, making available, bringing together, linking, blocking, erasing and destruction of data.\r\n\r\nWhich companies are affected by this?<\/strong>\r\nAll companies that store personal data that can be traced back to the person in question. The need to act carefully increases with the degree of confidentiality. For example, loss, mutilation, etc. is less harmful when it concerns telephone numbers than when it concerns medical data or financial data. Companies working in the medical sector, for example, will have to deal with this more than companies in the industrial automation sector.\r\n\r\nWhen must a report be made?<\/strong>\r\nWhen there is a (sufficiently serious) data breach as a result of a security breach. This is the case, for example, when security is circumvented, such as a hack, often due to inadequate security such as loss of passwords, loss of a data carrier, or other human errors.\r\n\r\nAdvice<\/strong>\r\n