APPENDIX I - DEFINITIONS: PROPOSED RECASTING
1. 'Personal data' means any information relating to a
data subject.
2. 'Data subject' means an identified natural person or a
natural person who can be identified directly or indirectly, in particular by reference to
an identification number or to one or more factors specific to his physical,
physiological, mental, economic, cultural or social identity.
3. 'Processing' means any operation or set of operations
which is performed upon personal data, whether or not by automatic means, such as
collection, recording, organisation, storage, adaptation, or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination, or otherwise making
available, alignment or combination, blocking, erasure or destruction.
4. 'Personal data filing system': a personal data filing
system means any set of personal data whether centralised, decentralised, or dispersed on
a functional or geographical basis which are structured and accessible according to any of
the criteria set out within schedule [ ] to the Act.
5. 'Controller' shall, except where otherwise determined
by law, mean the person who alone or jointly with others determines the purposes and means
of the processing of personal data.
6. 'Processor' shall mean a person who processes personal
data on behalf of the controller.
7. 'Third party' shall mean any person other than the data
subject, the controller, the processor and the persons who, under the direct authority of
the controller or the processor, are authorised to process the data.
8. 'Recipient' shall mean a person to whom data are
disclosed whether a third party or not.
9. 'The data subject's consent' shall mean any freely
given specific and informed indication by which the data subject signifies his agreement
to the processing of personal data relating to him.
APPENDIX II - SENSITIVE DATA
DECREE
Decree of 05 Maart 1993
Laying down rules concerning the inclusion in a personal data
file of personal data as defined in section 7, subsection 1 of the Data Protection Act
(Sensitive Data Decree).
We, Beatrix, by the Grace of God Queen of the Netherlands,
Princess of Orange-Nassau, etc, etc, etc.
At the recommendation of Our Minister of Justice of 16 April
1992, Public Law Legislation Division no. 202935/92/6;
Having regard to section 7, subsection 1 of the Data Protection
Act (bulletin of Acts, Orders and Decrees 1988, 665);
Having heard the Registration Chamber (advisory report of 14
January 1991, no. WGAG/1991/1);
Having heard the Council of State (advisory report of 1 December
1992, no. W03.92.0168);
Having seen the additional report of Our Minister of Justice of 9
February 1993, Public Law Legislation Division no. 304981/93/6;
HAVE APPROVED AND DECREED:
Article 1
Personal data on any individual's religious beliefs or philosophy of life, race, political persuasion, sexuality or intimate private life and personal data of a medical, psychological, criminal or disciplinary nature may not be included in a personal data file in any circumstances other than those determined by law or permissible pursuant to this Decree.
Article 2
1. Personal data concerning an individual's religious beliefs or philosophy of life may be included in the following:
a) personal data files administered by the authorities of
religious denominations or independent sections thereof or other groups based on spiritual
principles, in relation to their members;
b) personal data files administered by, or for the benefit of,
institutions based on religious or philosophical foundations, inasmuch as this is
necessary, having regard to the purpose of the institution and the fulfilment of its aims,
or
c) other personal data files, inasmuch as this is necessary with
a view to the spiritual care of the registered individual concerned.
2. Personal data files as referred to in paragraph 1a may also
include personal data concerning the religious beliefs or philosophy of life of the
members of the family of the individual registered.
3. Personal data on an individual's religious beliefs or
philosophy of life may not be included in the personal data files referred to in paragraph
1c or, where family members are concerned, in paragraph 1a, if the person concerned has
submitted a written objection to such inclusion.
Article 3
1. Personal data concerning an individual's race, for the
purposes of identification, may only be included in a personal data file if it is
essential to this purpose.
2. Personal data concerning an individual's race may not be
included in personal data files with the object of assigning a privileged position to
persons from a particular ethnic or cultural minority group with a view to eliminating or
reducing existing inequalities, unless this is necessary for this purpose and the
provisions of paragraph 3 to 5 inclusive are adhered to.
3. The data referred to in paragraph 2 may only refer to the
country of birth of the person concerned, that of his parents or that of his grandparents.
4. The data referred to in paragraph 3 may not be included if the
person concerned has submitted a written objection to such inclusion.
5. The fourth paragraph does not apply if the personal files have
been compiled purely for research purposes or to compile statistics, the data are
essential for a particular study or particular statistics and the person himself has
provided the data as referred to in paragraph 3.
Article 4
Personal data concerning an individual's political persuasion may
be included in personal data files:
a) where these are administered by, or for the benefit of,
institutions based on political principles in relation to their members or employees, or
to other persons attached to such institutions, inasmuch as this is necessary, having
regard to the purpose of the institution and the fulfilment of its aims, or
b) with a view to the requirements that may reasonably be set
with regard to political persuasion in connection with the fulfilment of functions in
administrative and advisory bodies.
Article 5
1. Personal data concerning an individual's sexuality or intimate
private life and personal data of a medical or psychological nature may be included in
personal data files to which section 5 of the Data Protection Act is applicable, which are
administered by, or for the benefit of, institutions or facilities providing health care
or social services, inasmuch as these data concern patients or clients.
2. Personal data of a medical of psychological nature may be
included in personal data files which are administered by, or for the benefit of, schools
to which the Special Education Interim Act (Bulletin of Acts, Orders and Decrees 1982,
730) is applicable.
Article 6
Personal data of a criminal nature may be included in:
a) personal data files administered by, or for the benefit of,
bodies, services or institutions charged, by or pursuant to the law, with the
investigation of criminal offences or prosecution in connection with criminal offences or
with other judicial tasks, inasmuch as this is necessary to the fulfilment of these tasks;
or
b) other personal data files, inasmuch as the data concerned have
been obtained in accordance with the provisions of or pursuant to the Criminal Records and
Certificates of Good Behaviour Act (Bulletin of Acts, Orders and Decrees 1955, 395) or the
Data Protection (Police Files) Act (Bulletin of Acts, Orders and Decrees 1990, 414) and
the inclusion of these data is necessary to the purpose of these files.
Article 7
Personal data of a disciplinary nature, concerning the
application of a disciplinary code that is regulated by law, may be included in personal
data files that are administered by, or for the benefit of, bodies, services or
institutions charged, by or pursuant to the law, with dealing with the offences concerned.
Article 8
1. Without prejudice to the provisions of Articles 2 to 7
inclusive, personal data as referred to in Article 1 may also be included in personal data
files, inasmuch as:
a) this is necessary to the fulfilment of obligations under
international law or other obligations imposed by law;
b) this is necessary with a view to a lawful decision or action requested by the person concerned;
c) this occurs with the written permission of the person
concerned and is necessary to the purpose of the files;
d) this is necessary with a view to safeguarding an important
interest of the person registered, unless the latter has submitted a written objection to
such inclusion;
e) the personal data files have been compiled purely for research
purposes or to compile statistics, and the data are essential for a particular study or
particular statistics, or
f) this is necessary with a view to safeguarding an important
interest of the administrator of the files and no disproportionate harm is done to the
personal life of the individual in question.
2. In the case referred to in paragraph 1c, permission can only
refer to a particular inclusion or a restricted category of inclusions in a particular
file, which must be accurately defined in the document granting permission. Permission may
at all times be withdrawn in writing.
Article 9
If the individual concerned is a minor who has not yet attained
the age of sixteen, or who has been placed under guardianship, the place of this
individual is taken by his legal representative for the purposes of submitting an
objection, requesting a decision to be made or action taken, or granting permission, as
referred to in article 2, paragraph 3, article 3, paragraph 4 and article 8, paragraphs
1b, 1c and 1d.
Article 10
Personal data that have already been included in personal data
files on the date of the entry into force of this Decree and the inclusion of which is not
permissible pursuant to this Decree must be removed from these files no later than six
months after that date.
Article 11
The title to be used when quoting from this Decree is the
Sensitive Data Decree.
Article 12
This Decree enters into force as from the third calendar month
after the date of publication of the Bulletin of Acts, Orders and Decrees in which it
appears.
We order and command that this Decree with the accompanying
explanatory memorandum shall be published in the Bulletin of Acts, Orders and Decrees and
that a copy shall be sent to the Council of State.
The Minister of Justice