This bill introduces a duty to notify the Dutch Data Protection
Authority (College Bescherming Persoonsgegevens, the
"CBP") and the relevant data subject(s)
in the event of a breach of security measures for the protection of
personal data. The duty will apply to businesses, governmental
bodies and others, provided in all cases that they constitute a
"data controller" within the meaning of the Personal Data
Protection Act (Wet bescherming persoonsgegevens, the
"PDPA"). The rule imposing the duty will
be set out in a new provision of the PDPA (Article 34a).
The penalty for non-compliance with this duty will be a fine of
up to EUR 450,000. A similar fine can be imposed for failure to
co-operate in an investigation by the CBP into a breach/possible
breach (of the above duty to notify) pursuant to article 5:20 of
the General Administrative Law Act (Algemene wet bestuursrecht).
This article lays down a general duty to co-operate and therefore
such a fine can also be
