The liability of directors of major organisations receives wide coverage in the press. Examples (in the Netherlands) are Imtech, HDI, FC Twente, Vestia, and Meavita. But the subject really concerns directors of all legal entities, large and small. In this issue of Quoted, we refresh your knowledge of directors' liability and address recent developments, such as case law on `corporate directors' (legal entities which are appointed directors of other entities), the Bill for Management and Supervision of Legal Entities and the General Data Protection Regulation (GDPR).
In this issue we only discuss the general principles set forth in Sections 2:9, 2:11, 2:138 and 2:248 (company law) and 6:162 (law of obligations) of the Dutch Civil Code ("DCC").1 Section 2:9 DCC regulates the internal directors' liability for improper management (onbehoorlijk bestuur). This Section governs the legal relationship between the legal entity and its directors. If the legal entity is declared bankrupt, the trustee may hold the directors liable pursuant to Sections 2:138 or 2:248 DCC. Section 6:162 DCC constitutes the principal ground of third-party liability. Third parties such as creditors and in some instances individual shareholders may hold directors liable pursuant to this Section. Under Section 2:11 DCC, a natural person behind the corporate director may be held liable.
(Im)proper management: Section 2:9 DCC
Each director is obliged to fulfil his task towards the legal entity adequately. In the performance of their duties the directors must be guided by the interests of the company and the business associated with it. Directors are expected to be fit for office, and to perform their tasks meticulously.2 Thus directors should verify whether they have the requisite skills to fulfil the management function adequately.
In principle, there is no room for exculpation based on incompetence.
Improper management: collective nature
Pursuant to Section 2:9(2) DCC, the legal entity may hold its directors liable for improper management. In practice, this only occurs in special circumstances. After all, the management board itself represents the company. Usually a change of directors, or of the board as a whole, is required before the legal entity can actually hold the director(s) liable. Alternatively, if the company is declared bankrupt, the trustee may hold the director(s) liable on grounds of improper management.
Management is of a collective nature (principle of collegialiteit). The management board is collectively responsible for the general course of affairs, including strategic and financial policy, and as a rule its members are jointly and severally liable for damages suffered by the legal entity as a result of improper management.
Whether improper management has occurred is for the legal entity (or trustee) to assert and if necessary to prove. More specifically, the criterion is that no prudent director would have acted that way in the same circumstances.3 Making an error as such does not constitute improper management.
This internal liability is not addressed in case law very often. One example is the case from 2017 in which an insurer, HDI, held two of its former directors liable claiming that their actions surrounding a reinsurance structure had caused HDI damages. In its assessment, the court considered that a conflict of interests existed and that the directors had concealed this. The court regarded this as improper management and found that the directors were seriously to blame for it.4
Serious blame: high bar for liability
Such `serious negligence' (ernstig verwijt) is another requirement of Section 2:9 DCC; so this Section not only
1 We will not go into the more specific principles, for instance, of liability of officers of an informal association (Section 2:30(2) DCC), directors' liability for legal acts executed before registration at the Chamber of Commerce (and/or before shares are paid up) (Sections 2:69(2) and 2:180(2) DCC), liability of those who act on behalf of a company in formation (Sections 2:93(2) and (3) and 2:203(2) and (3) DCC), directors' liability for publishing misleading figures/information (Sections 2:139 and 2:249 DCC) and liability for dividend and other distributions (e.g. Section 2:216(3) DCC).
2 Dutch Supreme Court 10 January 1997, ECLI:NL:HR:1997:ZC2243 (Staleman v. Van de Ven). 3 The Dutch Supreme Court clarified this in the context of directors' liability under Section 2:248 DCC in its Panmo Judgment of 8 June 2001
(ECLI:NL:HR:2001:AB2053), which is considered authoritative for assessing improper management in the terms of Section 2:9 DCC; Asser/Maeijer, Van Solinge & Nieuwe Weme 2-II* 2009/445. 4 Court of Appeal. Den Haag 19 February 2019, ECLI:NL:GHDHA:2019:682.
4
entails a standard of conduct proper management but also a standard of liability. When determining whether the director(s) are seriously to blame, the court considers all circumstances of the case, including: the nature of the company's activities; the risks generally following from these activities; the allocation of duties within the management board; any regulations applicable to the management board; the information that the director (ought to have) had at
the time of the decision or conduct he is blamed for; and the expertise and diligence that may be expected of a director who is fit for office and meticulously discharging his duties.5
It is for the legal entity (or trustee) to assert and if necessary to prove that serious negligence exists. The court will consider any act in breach of provisions of the company's articles of association that serve to protect the legal entity as a serious circumstance that in principle establishes the liability of the director(s).6 The same applies to statutory provisions aimed at protecting the legal entity, e.g. rules on conflicts of interests. It is advisable to pay careful attention to situations in your organisation in which a conflict of interests may arise, also in view of recent case law of the Dutch enterprise court (Ondernemingskamer) which sheds new light on the issue of conflicts of interests.7
Once improper management and serious negligence are established, the failure is attributed, in view of the collective nature of management, to all directors. Each director is jointly and severally liable for the full damages, unless an individual director is able to exonerate himself.
Exoneration is not that simple
A director's duty includes all duties that are not allocated to other directors. Each director is in any event responsible for the general course of affairs, e.g. the strategic and financial policy, overseeing fellow directors, ensuring compliance with essential legislation and any matters that may be material for the risk policy or identity of the
organisation. An allocation of duties does not detract from the stating point of joint and several liability.
Nevertheless, an allocation of duties may be material to individual exoneration. A director may be exonerated if he can prove that he is not seriously negligent because the improper management was not related to his duties and that he did not neglect to take measures to avoid the consequences of the improper management. A director, however, cannot exonerate himself by invoking the allocation of duties if the matter concerns the general course of affairs.
Thus, if he wants to be able to exonerate himself later on, a director is required to act when improper management impends because a fellow director is not properly performing his duties, even if the duty concerned is allocated to that fellow director.8 A director may normally rely on the accuracy of information given by a fellow director.9 Possibly a director was, in all fairness, not aware of the improper management. If that is the case, he will have to prove this in order to exonerate himself. Note that in certain circumstances wrongful act liability towards a third-party under Section 6:162 DCC may arise because of insufficient oversight over a fellow director (more about this below).10
Supervisory directors: improper supervision
The collective responsibility and joint and several liability of Section 2:9 DCC apply pursuant to Section 2:149 in conjunction with 2:259 DCC to the supervisory directors of both public (NV) and private limited (BV) companies. The standard may substantively be somewhat different, since the duties of supervisory directors differ from those of managing directors. The duty of the supervisory board is to supervise the general course of affairs and the policy of the management board and to advise the management board. Supervisory directors should also be guided by the interests of the company and its business in the performance of their duties (Sections 2:140(2) and 2:250(2) DCC).
5 Dutch Supreme Court 10 January 1997, ECLI:NL:HR:1997:ZC2243 (Staleman v. Van de Ven). 6 Dutch Supreme Court 29 November 2002, ECLI:NL:PHR:2002:AE7011 (Schwandt v. Berghuizer Papierfabriek). 7 Court of Appeal (Enterprise Court). Amsterdam 31 August 2017, ECLI:NL:GHAMS:2017:3532, JOR 2018/41 (Staphorst Ontwikkeling); Court of Appeal
(Enterprise Court). Amsterdam 22 December 2017, ECLI:NL:GHAMS:2017:5354, JOR 2018/21 (Intergamma) and Court of Appeal (Enterprise Court). Amsterdam 30 April 2018, ECLI:NL:GHAMS:2018:1465, JOR 2018/211 (De Seizoenen). 8 Kamerstukken (parliamentary papers) II 2008/09, 31 763, No. 3, p. 8. 9 Kamerstukken II 2008/09, 31 763, No. 3, p. 9. 10 Dutch Supreme Court 30 March 2018, ECLI:NL:HR:2018:470 (TMF).
Quoted 5
Supervision is of a collective nature as well. Supervisory directors are collectively responsible and jointly and severally liable for improper supervision in case of serious negligence. If the (collective) supervision is improper, an individual supervisory director may exonerate himself by asserting and if necessary proving that the improper supervision cannot be blamed on him, i.e. that he is not seriously negligent, and that he did not neglect to take measures to avoid the consequences of the improper supervision.
Liability in bankruptcy: Sections 2:138 (NV) and 2:248 (BV) DCC
In bankruptcy, Sections 2:138 and 2:248 DCC offer the trustee specific grounds for liability of directors of public and private limited companies (respectively NV and BV), and of foundations, and associations subject to corporate income tax.11
These grounds were introduced in the 1980s in response to an increased abuse of legal entities: the number of bankruptcies and unpaid debts sharply rose at the time. The objective was twofold: prevention, and remedying the effects of manifest improper performance on creditors.
This liability requires that the management board has performed its duties manifestly improperly and that this is an important cause of the bankruptcy. If these requirements are met, each director will be jointly and severally liable for the entire bankruptcy deficit. So the amount to be reimbursed is not directly linked to the damages actually resulting from the director's or his fellow directors' conduct.
Manifest improper performance
The manifest improper performance (kennelijk onbehoorlijke taakvervulling) must have occurred in the three years before bankruptcy. The directors do not have to be individually to blame. Nor does the trustee need to show which directors contributed to the manifest improper performance.
The court will assess the manifest improper performance on the basis of the circumstances of the case. The test is
whether, in the same circumstances, a prudent director would have acted in the same way.12
Important cause of bankruptcy
The manifest improper performance does not need to be the sole cause of the bankruptcy, but should have contributed to it significantly.
As a rule, it is the trustee who must assert and if necessary prove that the requirements for joint and several liability for the bankruptcy deficit are met.
Far-reaching presumptions of evidence give the trustee a helping hand
We regularly see trustees invoking these grounds of directors' liability. For this we could blame (or thank, depending on where you stand) the evidentiary presumptions that subsection 2 connects to two important statutory obligations of the management board: the obligation to keep proper records (Section 2:10 DCC), and the obligation to timely publish the annual accounts (Section 2:394 DCC). If the management board fails to comply with one (or both) obligations, there is: i.an irrefutable presumption that the management
board has performed its duties manifestly improperly; and ii.a refutable presumption that the improper performance was an important cause of the bankruptcy.
As a starting point, it is the trustee who has to prove that the management board has not complied with these obligations. However, if the trustee does not find any records or timely deposited annual accounts, the director who is held liable will normally be required to prove that these do exist.
Publication of annual accounts
The period within which the annual accounts have to be prepared and published was amended a few years ago. The maximum period within which the management board of a public or private limited company must prepare, adopt and publish the annual accounts is now twelve months; the annual accounts should normally be prepared within five months of the end of the financial year. The general meeting may extend this period by five months in some circumstances (Sections 2:201(1) and 2:210(1) DCC).
11 Sections 2:50a and 2:300a DCC. 12 Dutch Supreme Court 8 June 2001, ECLI:NL:HR:2001:AB2053 (Panmo).
6
The annual accounts have to be adopted by the general meeting within two months thereafter (Section 2:394(1) and (2) DCC).13 Finally, the management board needs to deposit the annual accounts with the Chamber of Commerce. Late publication of the annual accounts will not only lead to the aforementioned evidentiary presumption, but is also a criminal offence (under the Economic Offences Act).
Unimportant breach
In some instances the director may be able to show that the breach is unimportant and does not constitute improper performance in the circumstances, for instance if there is a valid explanation for the breach. This could come into play if the period within which to deposit the annual accounts is only exceeded by a few days.14 The obligation to assert and prove this rests with the director.15
Recent clarification of administration obligation?
Section 2:10 DCC requires the management board to keep records of the assets and liabilities of the legal entity and of everything regarding the legal entity's activities, in accordance with the standards arising from these activities, and to retain the books, records and other data carriers in such a way that the rights and obligations of the legal entity can be known at all times.
As you may have noticed, this is a rather open-ended and not particularly clear standard.
A few years ago16 the Dutch Supreme Court elaborated on earlier case law on this standard. The test is not only `whether it is possible to gain a quick understanding of the accounts payable and accounts receivable at any time and whether these items, together with the liquid assets, provide a fair picture of the financial position of the legal entity given its nature and size', which was the criterion
regularly derived from the earlier case law.17 According to the Dutch Supreme Court, Section 2:10 DCC remains the cornerstone, and aspects other than the accounts payable and receivable and the liquid assets may be material as well, in determining whether the accounts are compliant. How the rights and obligations of the legal entity may be known at all times ultimately also depends on the nature and size of its business.
How the evidentiary presumptions play out
The legislator considers keeping proper records and timely publishing of the annual accounts to be among the essential aspects of a proper performance of duties.18 A lack of proper records and timely published accounts implies that the business is not run very reliably or prudently, and as such already constitutes neglect on the part of the management board, in our legislator's view.19
As mentioned earlier, the second presumption i.e. that the improper performance was an important cause of the bankruptcy may be refuted. The director could disprove this presumption by showing that circumstances other than improper performance are an important cause of bankruptcy. If the director succeeds in doing this, it is for the trustee to show that the manifest improper performance was an important contributory cause of the bankruptcy.20 The trustee could blame the director of having neglected to prevent the other causes, in response to which the director will have to show that this neglect does not constitute improper performance of his duty.21 You might read the commentary to the Dutch Supreme Court's `The Law' ruling from 2016 for more details on how exactly this second evidentiary presumption works.22
Extension and limitation of liability under Sections 2:138 and 2:248 DCC
These grounds for liability not only apply to formally appointed directors, but may extend to other persons (who
13 If all shareholders are also directors, the annual accounts are considered to be adopted immediately following their signing and the two-month period does not apply, unless the articles of association provide otherwise.
14 Dutch Supreme Court 1 November 2013, ECLI:NL:HR:2013:1079 (Verify). 15 Dutch Supreme Court 20 October 2006, ECLI:NL:HR:2006:AY7916. 16 Dutch Supreme Court 10 October 2014, ECLI:NL:HR:2014:2932 (FSM Europe). 17 Dutch Supreme Court 11 June 1993, ECLI:NL:HR:1993:ZC0994 (Brens q.q. v. Sarper). 18 Kamerstukken II 1983/84, 16 631, No. 6, p. 18. 19 Kamerstukken II 1980/81, 16 631, No. 3, p. 4. 20 As ruled by the Dutch Supreme Court in Blue Tomato (30 November 2007, ECLI:NL:HR:2007:BA6773), see e.g. Court of Appeal of Den Bosch
29 September 2015, ECLI:NL:GHSHE:2015:3752 and District Court of Midden-Nederland 20 April 2016 ECLI:NL:RBMNE:2016:2080, in which this is reiterated. 21 Dutch Supreme Court 30 November 2007, ECLI:NL:HR:2007:BA6773 (Blue Tomato). 22 Y. Borrius, annotation to Dutch Supreme Court 12 February 2016, ECLI:NL:HR:2016:233, JOR 2016/223 (The Law).
Quoted 7
contributed to) determining the policy of the legal entity as if they were directors (subsection 7). These are referred to as de facto (or shadow) directors.
Supervisory directors may too be liable on these grounds for manifest improper performance in the three years prior to bankruptcy, if it can be presumed that the improper performance was an important cause of bankruptcy (Section 2:149 and 2:259 DCC). The supervisory board is not suddenly, with an eye to presumptions of evidence, made responsible itself for keeping records or publishing the annual accounts,23 even if the management board breaches these obligations. The supervisory board is tasked with supervising the management board in the fulfilment of its obligations.
A director may be able to exonerate himself, and avoid liability accordingly. For that purpose, he has to prove that the manifest improper performance cannot be blamed on him and that he has not neglected to take measures to avoid its consequences (Subsection 3). This is the exception to the rule of joint and several liability of all directors.
The court may, for different reasons, limit the liability of one or more directors, for instance in view of the nature and extent of the improper performance, other causes of the bankruptcy, or the (brief) period during which the director(s) were in office (Subsection 4).
Third-party liability: Section 6:162 DCC (wrongful act)
Under certain circumstances, a third party, for example a contracting party, may have a claim directly against a director. In those instances the director cannot `hide' behind the veil of the legal entity.
The basis for this claim is wrongful act (Section 6:162 DCC). In general, a director who acted in his capacity as director only acts wrongfully towards a third party if he is seriously negligent.24 Some confusion might arise if a
creditor does not hold a director liable in his capacity as director, but for instance as a professional adviser; the criterion of serious negligence does not apply then, and in that case `only' the normal rules for wrongful act are applied when determining liability.25
Serious negligence: high bar for liability
The requirement of serious negligence aims to set a high bar for liability in respect of wrongful act as well. This is to avoid directors' actions being guided by defensive considerations. The justification is that it is primarily the legal entity that acts in relation to the third party and enters into contracts with it.26
More specifically, the director needs to have acted so carelessly towards a creditor that he is to be seriously blamed for it personally. This would normally be the case if the director knows or should reasonably know that the act of the legal entity that he is effecting or permitting will result in the legal entity no longer being able to meet its obligations and without offering recourse for the consequential damages. The court will consider the nature and extent of the breach of this standard and all other circumstances of the case.27
The following three situations serve as typical examples. 1. A director may act wrongfully by taking on an obligation
on behalf of the legal entity while he knew or should reasonably have known that the legal entity would be unable to meet that obligation and would not offer recourse for the other party's consequential damages.28 2. A director may act wrongfully in respect of previously accepted obligations by procuring or permitting that the legal entity does not meet those obligations while he knew or should reasonably have known that this would result in the legal entity being unable to meet its obligations and would not offer recourse for the other party's consequential damages.29 3. A director may act wrongfully by paying creditors selectively. In many instances a director is free to decide, based on his own assessment, which creditor the legal entity will pay in the given circumstances. However, if non-payment is the result of the director's
23 Dutch Supreme Court 28 June 1996, ECLI:NL:HR:1996:ZC2114 (Bodam Jachtservice). 24 Also in view of his obligation to properly perform his duties as referred to in Section 2:9 DCC. 25 Dutch Supreme Court 23 November 2012, ECLI:NL:HR:2012:BX5881 (Spaanse Villa). 26 Dutch Supreme Court 20 June 2008, ECLI:NL:HR:2008:BC4959 (Willemsen v. NOM). 27 Dutch Supreme Court 6 October 1989, ECLI:NL:HR:1989:AB9521 (Beklamel). 28 Dutch Supreme Court 8 December 2006, ECLI:NL:HR:2006:AZ0758 (Ontvanger v. Roelofsen). 29 Dutch Supreme Court 8 December 2006, ECLI:NL:HR:2006:AZ0758 (Ontvanger v. Roelofsen).
8
unwillingness to pay, personal liability may arise.30 This could also be different if a director favours creditors in his own group; those payments will typically require reasons for preference as recognised by law.31
The criterion of serious negligence also applies when determining whether a trust director has improperly performed his duties and whether that trust director for instance knew or should have known that the consequence of this improper performance would disadvantage a creditor.32
No joint and several liability
Liability for wrongful act via Section 6:162 DCC does not result in joint and several liability of different directors. The third party must assert and if necessary prove that the requirements of Section 6:162 DCC are met for each director individually. In 2018 the Dutch Supreme Court made absolutely clear that, even if the legal entity does not fulfil a statutory requirement (in this case requirements under securities law concerning a licence and a prospectus), one needs to establish a wrongful act towards the third party by each director individually.33
Increasing clarity on piercing the veil of a corporate director: Section 2:11 DCC
Thus, a natural person cannot hide behind the veil of the corporate director.
In the past twenty years, the Dutch Supreme Court has ruled on liability under Section 2:11 DCC in five different rulings. Although this Section cannot be applied to the de facto director of the corporate director34, it can be applied to the corporate director that is held liable by the trustee as de facto director (as set out above in respect of liability in case of bankruptcy).35 This Section does not apply to the directors of a corporate director that is not incorporated in the Netherlands. If, for instance, a Belgian public limited company is the director of a Dutch legal entity, the corporate veil of the Belgian company cannot be pierced under Section 2:11 DCC to (also) get to its directors.36
Applicability of Section 2:11 DCC on liability for wrongful act
The fifth and most recent ruling from 2017 concerns this veil piercing article in conjunction with the grounds for wrongful act (Section 6:162 DCC). The ruling addresses three questions: (i) does Section 2:11 DCC apply if Section 6:162 DCC is invoked against the corporate director?; if so: (ii) must the creditor demonstrate serious negligence on the part of the director of the corporate director?; and if the answer to the second question is `no,' (iii) how might the director of the corporate director still avoid liability?
In the Netherlands, a legal entity can be a director of another legal entity. This is not a given. Many states or countries do not allow it, for instance Delaware and Canada, and closer to home Denmark, Estonia, Finland, Ireland, Austria, Poland and Sweden. This has to do with the duties, responsibilities and liabilities of the management board.
This is why the Dutch legislator introduced Section 2:11 DCC: the liability of a corporate director also rests jointly and severally on each of its directors. The director of a liable legal entity may be a legal entity itself, and so on; there is no limit on piercing the veil of (Dutch) legal entities.
In brief, the Dutch Supreme Court answered these questions as follows: (i) yes; (ii) no; and (iii) the relevant director of the corporate director should assert and if necessary prove that he cannot seriously be blamed for the acts of the corporate director.37
Those are clear answers, of pretty good use in practice. The desirability of these answers is a different matter. They might put the creditor in a better position in terms of evidence (i) if his claims are against members of a management board (with a plurality of members) of a corporate director than (ii) if his claims are against directly appointed members of a management board (with a
30 Dutch Supreme Court 26 March 2010, ECLI:NL:HR:2010:BK9654 (Zandvliet v. ING). 31 Dutch Supreme Court 12 June 1998, ECLI:NL:HR:1998:ZC2669 (Coral v. Stalt). 32 Dutch Supreme Court 8 July 2011, ECLI:NL:HR:2011:BP8686 (Ontvanger v. Intertrust). 33 Dutch Supreme Court 30 March 2018, ECLI:NL:HR:2018:470 (TMF). 34 Dutch Supreme Court 28 April 2000, ECLI:NL:HR:2000:AA5658 (Montedison). 35 Dutch Supreme Court 14 March 2008, ECLI:NL:HR:2008:BC1231 (Lammers v. Aerts q.q.). 36 Dutch Supreme Court 18 March 2011, ECLI:NL:HR:2011:BP1408 (D Group Europe); Dutch Supreme Court 21 June 2013, ECLI:NL:HR:2013:CA3958
(My Guide). 37 Dutch Supreme Court 17 February 2017, ECLI:NL:HR:2017:275 (Kampscher v. Le Roux).
Quoted 9
plurality of members) without a corporate director in place. In situation (i) it is sufficient for the creditor to show that the corporate director is seriously negligent, whereas in situation (ii) he will have to show serious negligence for each separate director. As mentioned earlier, the collective nature does not apply to liability for wrongful act.
In view of these developments it may be advisable, if your group's structure includes one or more corporate directors, to have another careful look at your structure and decisionmaking processes.
Other developments
Which legal developments are relevant for your organisation depends, among other things, on the industry that you operate in. We have noted two developments that may impact many different types of organisations, and which may accordingly be relevant for their directors.
Anticipated introduction of the Bill for Management and Supervision of Legal Entities
This Bill intends to clarify the rules for the management and supervision of clubs and associations, cooperatives, friendly societies and foundations.38 It is still under discussion in parliament. After it had been shelved for two years, supplementary parliamentary documents were published as of the end of 2018.
Main outlines of the current Bill
In its present form the Bill provides a statutory basis for a supervisory board for associations and foundations and for a one-tier management board model for all legal entities. With the enactment of the Management and Supervision Act (Wet bestuur en toezicht) in 2013, this statutory basis was only introduced for public and private limited companies. The present Bill also provides clarity for associations, cooperatives, mutual benefit associations and foundations regarding: the principles that apply to (supervisory) directors (the
Bill aims to specifically lay down by law that they must be guided by the interests of the legal entity and its organisation when performing their duties); the position of (supervisory) directors with a conflict of interests (the Bill contains a regulation for all legal entities comparable to the public/private limited
company rules, and in respect of a foundation a requirement to record any decision-making in writing if a conflict of interests exists); the rules governing (supervisory) directors' liability (the Bill provides a wider scope of applicability of directors' liability in bankruptcy, not only if the legal entity is subject to corporate income tax).
Entry into force of GDPR: the General Data Protection Regulation
The entry into force as of 25 May 2018 of the GDPR created quite a sensation. We reported on the GDPR in the March 2018 issue of Quoted on `Privacy Compliance' (No. 118). The GDPR applies to all organisations that process personal data of citizens of the European Union. Organisations from outside the European Union may fall under the scope of the GDPR as well. Availing itself of the possibility to draft an additional national regulation, the Netherlands introduced the General Data Protection Regulation Implementation Act.39
Liability of the legal entity and its directors
By virtue of Section 82 of the GDPR any person who incurs monetary or emotional damages as a result of a GDPR breach is entitled to compensation by the data controller or the processor. A data controller or processor is exculpated from liability if he proves not to be responsible for the conduct. Multiple data controllers or processors can be liable jointly and severally.
Accordingly, liability of the legal entity towards a third party requires a breach of the GDPR. Non-compliance with the GDPR constitutes a breach of a statutory obligation and is consequently, pursuant to Section 6:162 DCC, a wrongful act of the legal entity. Directors' liability, however, requires a wrongful act committed by the director himself, and in most instances the criterion of `serious negligence' will apply.
A much-discussed obligation in respect of data protection is the duty to report data breaches. This reporting obligation has existed in the Netherlands since 2016 and was tightened with the introduction of the GDPR, by setting stricter demands for recording data breaches. Organisations are required to record all data breaches. These records enable the Dutch Data Protection Authority to verify whether organisations comply with the duty to
38 Kamerstukken II 2015-2015, 34 491, No. 2. 39 Kamerstukken II 2017/18, 34 851, No. 3, p. 87.
10
report data breaches. In certain cases the organisation is required to notify the Dutch Data Protection Authority, and sometimes also the people whose data was compromised, of the data breach. Such notification allows them to take steps themselves to minimise the damage.
Power of the Dutch Data Protection Authority to impose fines
One of the powers of the Dutch Data Protection Authority is that it may enforce compliance with the GDPR by imposing a fine. The Authority may impose this fine on the organisation/legal entity, or directly on the director(s).40 The legal entity may seek recourse for a fine imposed upon it against its director(s) on the ground of improper management (Section 2:9 DCC), for instance if despite being aware of a data breach the director(s) did not act in compliance with the GDPR, where a prudent director would have done so.
Conclusion
The different general grounds for (supervisory) directors' liability aim to set a relatively high bar for personal liability. In an ever-widening regulatory landscape we welcome this. Nevertheless, (supervisory) directors are advised to stay abreast of the responsibilities and risks inherent in their offices. We welcome the opportunity to discuss this issue with you and others within your organisation, as well as the specific regulations that may be relevant in this regard, such as regulations that apply to a specific industry.
Under the former Dutch Personal Data Protection Act the power to impose a fine was reserved to the CBP, the predecessor of the Dutch Data Protection Authority. To date, this power has never been exercised. We do not rule out that this might change in the near future; in respect of competition law, for instance, we note that the Netherlands Authority for Consumers and Markets has already fined several natural persons. These may include both the director who gave the instruction and the actual executive.41 The Authority for Consumers and Markets does not confine itself to formal directors.42
It is not unusual for a legal entity to indemnify a director against any damages he may suffer in the execution of his management duties. Often the legal entity insures the personal risks related to liability of directors and others who run comparable risks. In view of the recent developments concerning fines imposed on directors, you are advised to verify whether the applicable terms and conditions are still current.
40 Kamerstukken I 2014/15, 33 662, No. C, p. 20. 41 Decisions of the Netherlands Authority for Consumers and Markets ACM of 9 June 2016, ref. ACM/DJZ/2016/403307 and 1 July 2015, ref.
ACM/DJZ/2015/203593; Decision of the ACM of 22 May 2017, ref. ACM/DJZ/2017/203847; Decision of the ACM of 22 May 2017, ref. ACM/ DJZ/2017/203854. 42 Decision of the ACM of 26 May 2016, ref. ACM/DJZ/2016/202336.
Quoted 11
About Loyens & Loeff
Quoted
Loyens & Loeff N.V. is an independent full service firm of civil lawyers, tax advisors and notaries, where civil law and tax services are provided on an integrated basis. The civil lawyers and notaries on the one hand and the tax advisors on the other hand have an equal position within the firm. This size and purpose make Loyens & Loeff N.V. unique in the Benelux countries and Switzerland.
The practice is primarily focused on the business sector (national and international) and the public sector. Loyens & Loeff N.V. is seen as a firm with extensive knowledge and experience in the area of, inter alia, tax law, corporate law, mergers and acquisitions, stock exchange listings, privatisations, banking and securities law, commercial real estate, employment law, administrative law, technology, media and procedural law, EU and competition, construction law, energy law, insolvency, environmental law, pensions law and spatial planning.
loyensloeff.com
Quoted is a periodical newsletter for contacts of Loyens & Loeff N.V. Quoted has been published since October 2001.
The author of this issue is Huib Schrama ([email protected]).
Editors
P.G.M. Adriaansen R.P.C. Cornelisse E.H.J. Hendrix A.N. Krol C.W.M. Lieverse P.E. Lucassen W.C.M. Martens W.J. Oostwouder D.F.M.M. Zaman
You can of course also approach your own contact person within Loyens & Loeff N.V.
Although this publication has been compiled with great care, Loyens & Loeff N.V. and all other entities, partnerships, persons and practices trading under the name `Loyens & Loeff', cannot accept any liability for the consequences of making use of this issue without their cooperation. The information provided is intended as general information and cannot be regarded as advice.
LOYENSLOEFF.COM
As a leading firm, Loyens & Loeff is the logical choice as a legal and tax partner if you do business in or from the Netherlands, Belgium, Luxembourg or Switzerland, our home markets. You can count on personal advice from any of our 900 advisers based in one of our offices in the Benelux and Switzerland or in key financial centres around the world. Thanks to our full-service practice, specific sector experience and thorough understanding of the market, our advisers comprehend exactly what you need. Amsterdam, Brussels, Hong Kong, London, Luxembourg, New York, Paris, Rotterdam, Singapore, Tokyo, Zurich
