Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)

The Dutch act implementing the GDPR: national choices, the Autoriteit Persoonsgegevens as supervisor and limits on using the BSN.

The Dutch act that implements the GDPR. A regulation applies directly, so the UAVG deliberately does not repeat it: it fills in the choices the GDPR leaves to national law and it repealed the older Wet bescherming persoonsgegevens. It applies from 25 May 2018, the day the GDPR became applicable.

What it settles for the Netherlands, among other things:

• the Autoriteit Persoonsgegevens is the supervisory authority, with the investigation and fining powers that go with it;
• children can consent to information society services themselves from the age of 16;
• the narrow grounds on which special categories of personal data may still be processed, and the exemptions for journalistic, academic and artistic purposes;
• Article 46 governs the use of a national identification number such as the BSN: it may be used to carry out the law that prescribes it, or for purposes laid down by law.

That last point is the one a private provider runs into first. A QTSP doing identity verification reads a person's data from an identity document or a register, but it cannot simply take the BSN along because it is convenient: there has to be a legal provision that allows it. The Wet digitale overheid is where such provisions live for the Dutch public means of identification.