Close this search box.
AI-based solution designed to automate personal data discovery and classification
Discover personal data across multiple systems in the cloud or on-premise
Harbor cooperation between DPO, Legal Services, IT and Marketing
Turn data subject request into an automated workflow with a clear insight into data every step of the way
Collaborate with stakeholders and manage DPIA and LIA in real-time with Assessment Automation
Guide your partners trough vendor management process workflow
Identifying the risk from the point of view of Data Subject
Quickly respond, mitigate damage and maintain compliance
Consolidate your data and prioritize your relationship with customers
Privacy portal allows customers to communicate their requests and preferences at any time
Introducing end-to end automation of personal data removal

Latest Blog posts

Learn the terms

General Data Protection Regulation

Here you can find the official content of the Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version. All Articles of the GDPR are linked with suitable recitals.

Latest papers

Dutch DPA issues 830K euro GDPR fine

the dutch DPA issues a records fine to the BKR for asking for a fee to access personal data

On the 6 July 2020, the Dutch DPA (De Autoriteit Persoonsgegevens or AP) issued a decision to impose an 830.000 euro fine (or around 939.000 USD) to the Dutch Credit Registration Bureau (BKR) for violation of data subject rights.

BKR Foundation maintains the Dutch central credit information system, which holds information about all Dutch credit registrations and payment records. As stated on their website; the BKR Foundation maps out the loans of all Dutch people, and when a consumer is about to make an important financial choice, the BKR provides lenders with insight into individuals’ current loans and payment history.

What happened?

The AP received numerous complaints about the BKR’s excessive and unreasonably complicated procedures for accessing personal data and initiated an investigation.

Investigation revealed that from May 2018 till April 2019, the BKR charged a fee to individuals who wanted to access their personal data and only provided free of charge access to their data once a year via post, therefore violating Transparent information, communication, and modalities for the exercise of the rights of the data subject (GDPR Article 12).

The General Data Protection Regulation grants individuals easy access to their personal data in reasonable intervals while providing information and any communication has to be free of charge in a “concise, transparent, intelligible and easily accessible form…”.

However, in this case, individuals were required to send a written request via post with a copy of their passport in order to access their personal data. The BKR access policy stated that it could only be requested once a year free of charge and for every additional request or immediate digital access, individuals were requested to sign with BKR with a minimum annual payment of 4.95 euros, up to 12,50 euros a year.

The BKR justified their practice relying on the GDPR Article 12(5a), that states if the data subject requests are unfounded or excessive, the organization or a company is allowed to charge a reasonable fee, taking into account the administrative costs of providing the information, or can even refuse to act on the request.

However, the BKR did not take into account that the burden of demonstrating the unfounded or excessive requests remains with the data controller, or in this case -them. They did not convince the Dutch DPA that free access to personal data once a year is reasonable or that multiple annual access requests are repetitive since they did not conduct an assessment for each individual case.

This showcased how relying on GDPR exemptions can not be used without proper assessments and documentation in place.

Reasons behind high fine

The AP took into account the seriousness of the violation, the time period of 9 months in which the violations took place, the number of data subjects involved, and following their fining structure for the violation of the GDPR, determined two fines.

The violation of Article 12(2), classified as category III, which resulted in €650,000 fine,  and violation of Article 12(5), classified as category II, for which € 385,000 fine has been determined. 

However, since both fines are regarding the transparency principle, the total fine could not exceed the maximum of €20,000,000 or up to 4% of total global annual revenue in the previous fiscal year, leading to € 830,000 fine in total.

You can read the entire decision in Dutch here!

Request a Data Privacy Manager demo

Let us navigate you through the Data Privacy Manager solution and showcase functionalities that will help you overcome your compliance challenges.

Scroll to Top