The Dutch Data Protection Authority has issued a statement (source document in Dutch) that organizations that do not update their software and retract any issued security certificates that may have been affected by the heartbleed bug in OpenSSL may be in breach of article 13 of the Dutch Data Protection Act. The Dutch Data Protection Authority recommends that parties that have been affected notify their customers/users as soon as these measures have been taken and to recommend that they change their passwords. The Dutch Data Protection Authority has announced that it will continue to observe the situation and will, for example, monitor the number of affected security certificates that are retracted.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
