Policy Observatory

The Dutch Senate passed a new law adding a new provision article 34.a to the Dutch data protection law Wet Bescherming Persoonsgegevens, which introduces an obligation to notify the Dutch DPA ‘without delay’ in case of a data breach and the related data subjects, broadens the powers of the Dutch DPA with significantly higher fines for a wide range of privacy violations, sets out the exemption conditions for data breach duty on taking active measures to make the such data incomprehensible and inaccessible, and changes the name of Dutch DPA to Autoriteit Persoonsgegevens (Personal Data Authority).

A few weeks ago, Access Now received a response from the European Commission regarding the organization's notification in November that Belgium’s plan for a Passenger Name Record (PNR) system breaches EU law. Since then the Belgian Parliament has adopted its proposed PNR law, despite the lack of evidence to show it will help stop crime or terrorism. This has set in motion what is essentially a rights-harming exercise in security theatre.