The Data Protection Omnibus Act: what does this mean for healthcare and youth care?

Children between the ages of 12 and 16 will, alongside their legal representative, be able to exercise their privacy rights independently. In addition, 16-year-olds will be able to initiate legal proceedings themselves in the event of a violation of their privacy rights, without assistance from their parents or guardian.

Furthermore, where a healthcare or youth care provider offers an information society service, a child aged 12 or older will be able to withdraw consent independently if that consent was previously given by their legal representative.

Please note: the rights of access, rectification and erasure under the Dutch Youth Act (Jeugdwet) remain unchanged.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) will be required to publish enforcement decisions and decisions on objections. As a rule, publication will take place no earlier than ten working days after the decision has been notified to the organisation concerned.

If the organisation concerned applies for interim relief, publication may only take place after the interim relief judge has issued a ruling or the application has been withdrawn. This increases the potential reputational impact of an enforcement decision.

The permitted use of biometric data, such as fingerprints, facial recognition or iris scans, for security purposes will be restricted. Such use will only be permitted where it is necessary due to a compelling public interest relating to lawful access to, for example, buildings, services, information systems or work processes.

For organisations using biometric access controls, this means that they will need to assess more carefully whether such use remains lawful.

Under the new rules, medical records may be provided to another healthcare professional, institution or facility that takes over the management and retention of those records, for example where a healthcare provider ceases to operate. The data subject's consent is not required for this transfer.

The receiving healthcare professional, institution or facility may subsequently retain and manage the records, even if there is no treatment agreement with the data subject. Data subjects must, however, be informed of the transfer and made aware of their rights. In certain circumstances, this may be done through a timely general notice, namely where informing the individuals is impossible, would require disproportionate effort, or where the personal data must remain confidential due to a professional duty of confidentiality.

The Data Protection Omnibus Act introduces several important changes for healthcare and youth care providers. In particular, it is important to:

1. Take the amended age thresholds into account when dealing with children's privacy rights;
2. Promptly consider whether to initiate legal proceedings against an AP decision, as doing so may temporarily delay its publication;
3. Reassess whether the use of biometric data for access security remains permissible under the stricter rules; and
4. Take into account the more flexible options for transferring medical records for the purpose of managing and retaining them.

If you have any questions, please feel free to contact one of our specialists in the IT, Privacy & Cybersecurity team.

Would you like to receive a monthly overview of our latest legal updates and blog articles? Subscribe to our newsletter.