Aug 232018

Dutch Supervisory Authority Investigates GDPR Compliance in the Healthcare Sector

Wim Nauwelaerts
, , , ,

On 21 August 2018, the Dutch Supervisor Authority announced that it had conducted an investigation into the designation of a Data Protection Officer (DPO) under the General Data Protection Regulation (GDPR) by 91 hospitals and 33 healthcare insurers in the Netherlands. Two hospitals had not yet communicated the contact details of their DPO to the Dutch Supervisor Authority, and were given four weeks to designate a DPO. In addition, the Supervisor Authority found that 25% of the hospitals and healthcare insurers whose practices were reviewed did not properly publish their DPO’s contact details on their website. They will also be expected to implement the necessary compliance measures.

The GDPR, which applies since 25 May 2018, requires organizations like hospitals and healthcare insurers to appoint a DPO, whose main task consists in monitoring compliance with the GDPR.  DPOs should also be in a positon to provide independent advice on how to implement the requirements of the GDPR within the organization, and are an important point of contact for the Supervisor Authority on all issues relating to data processing. The Dutch Supervisor Authority emphasizes that it should be easy for anyone to contact DPOs directly, and therefore the DPO’s telephone number or email address should be made public, for instance, on the controller’s or processor’s website. It is not necessary, according to the Dutch Supervisor Authority, to mention the name of the DPO.

Since the GDPR came into effect, the Dutch Supervisor Authority has investigated different compliance aspects of the GDPR, with a focus on the GDPR’s new accountability requirements. The Supervisor Authority recently assessed whether a selection of large companies is maintaining records of their data processing activities, as required by Article 30 GDPR. This latest flurry of activity in the Netherlands demonstrates that, now that three months have passed since the effective date, GDPR enforcement indeed may be starting to build.

Wim Nauwelaerts

wnauwelaerts@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

How the China Personal Information Protection Law Applies to Foreign Asset Managers

Since China’s Personal Information Protection Law (PIPL) came into effect in November 2021, there has been widespread uncertainty amongst offshore fund managers and investors with entities outside Mainland China as to how and whether the regime applies to them. Given the potential for foreign asset managers to overlook or misinterpret PIPL, this brief update outlines some guidance as to how PIPL can apply, and to whom, in a practical context.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.