Types of data processing for which prior investigations are required
The Dutch DPA will conduct a prior investigation in situations where you:
a) are intending to process numbers used to identify individuals (tax and social insurance numbers, for example) for a purpose other than that for which these numbers are specifically intended, in order to link these data to data held by another controller. This will apply except where permitted by law;
b) are planning to record data on the basis of your own observations, without informing the data subject of this fact (hidden camera surveillance, for example);
c) are planning to process criminal data or data on unlawful or objectionable conduct on behalf of third parties, but do not have the permit required under the Wet particuliere beveiligingsorganisaties en recherchebureaus [Private Security Organisations and Detective Agencies Act].
Procedure
If you are intending to process data in situations in which a prior investigation is required, you must explicitly indicate this fact when notifying the Dutch DPA of the data processing intended by you. Subsequently, the Dutch DPA will conduct an initial investigation; this may take a maximum of four weeks. After this period, the Dutch DPA will inform you whether or not a further investigation will be conducted. Please note that you must postpone processing until the investigation has been completed, or until you receive notification that no further investigation will be conducted.
A further investigation will last no longer than twenty weeks. During
this period, the Dutch DPA will assess the lawfulness
of the processing proposed. You will be given the opportunity to respond
in writing to the preliminary outcome of the investigation. If necessary
the Dutch DPA will adapt its preliminary decision in reply to your reaction
and deposit it for public inspection, which will be announced in the
Government Gazette. Then interested parties have six weeks to make known
their views to the preliminary decision; if your reaction to these views
were to be required, you will be given the opportunity to do so. The
Dutch DPA will then come to its final decision, which will also be deposited
for public inspection and will be announced in the Government Gazette.
Where appropriate, you will also be given the opportunity to respond
to comments contributed by third parties.
Declaration of lawfulness
On the basis of the further investigation conducted, the Dutch DPA will generally issue a declaration on the lawfulness of the processing proposed. Where notification is made on behalf of a number of individuals or organisations, you must inform each of these parties of the outcome of the investigation conducted.
Lodging objections
The decision whether or not to conduct a further investigation and the Dutch
DPA’s
declaration on the lawfulness of the processing are decisions in the sense
of the Algemene wet bestuursrecht (Awb) [General Administrative Law Act]. Under
this Act, interested parties have the right to lodge a written, reasoned objection
to a decision with the Dutch DPA within six weeks of the date on which the
decision in question was issued. Where an objection is lodged to a decision
to conduct a further investigation, this will not result in the suspension
of the investigation in question. For more information on this subject, see
the brochure entitled Bezwaar en beroep tegen een beslissing van de overheid
[Review and Appeal Against a Decision of the Government]. This brochure can
be found at the website for
the Ministry of Justice. In many cases, this brochure is also available
from the municipality in which you live, or can be ordered directly from the
Ministry of Justice.