The GDPR has a long history. The first warnings to companies date back to 2016. However, the real introduction of the largest and most comprehensive European privacy law took place on 25 May 2018, exactly two years ago today. Since then, European companies have had to adhere to strict data collection rules and citizens have more insight into what data is collected about them. This all happens under the watchful eye of mainly one party, the Dutch Data Protection Authority (AP). Now that the privacy law is celebrating its second birthday today, it is a good time to take stock.
2019 was the year when the AP first began to issue fines for violations of the Privacy Act. According to the chairman of the watchdog, Aleid Wolfsen, the total amount of the fine is ‘about three to four million euros’, and that will only increase. Those who count on the back of a beer mat do not immediately arrive at that amount. To date, three fines have been issued, the amounts of which are known, amounting to a total of around 1.7 million. But those aren’t the only violations that the privacy watchdog fined, Wolfsen says. More fines have already been issued to companies, but for various reasons these amounts may not, or not yet, be known.
Maintain and educate
Aleid Wolfsen immediately answers positively to the open question how he feels about the GDPR. “It is going in the right direction. I think we have now found a good balance. ” He mentions the word ‘balance’ several times. He is referring to the twofold objective of the Dutch Data Protection Authority, an organization that must be an adviser on the one hand and enforcer on the other. In recent years, the AP has received much criticism about the interpretation of that double role. In the first year of the GDPR it was mainly a watchdog that barked but did not bite a lot, the first fines charged the organization with judging too quickly and too harshly. Damn if you fined, damn if you don’t.
Still, the cautious approach in that first year was considered policy, Wolfsen says. “We deliberately chose to focus on providing information, information and adjustment during the first twelve months. In the past year, we gave more substance to enforcement. ”
Ticket on the mat
The first AVG fines were issued in the past year
The latter is certainly correct. Last September, the first AVG fine fell on the mat, at the Haga Hospital in The Hague. Later the Dutch tennis association and a company that collected fingerprints of employees followed. In addition, penalties were imposed: conditional fines, some of which were actually collected, including from health insurers. Naturally, more fines will follow, says Wolfsen. In fact, they have already been distributed. To whom he does not want to say, because there are still objection proceedings in court. In any case, they fall within the sectors that the AP has said have priority.
Wolfsen says it as “we-of-toilet duck”, but he is not the only one who can look back on the past period with satisfaction. Critical parties such as Bits Of Freedom are not immediately negative about the approach of the AP – except for the fact that the AP is, according to everyone, including the watchdog itself, significantly understaffed.
–
