National legislation supplementing the provisions of the EU General Data Protection Regulation has been eagerly awaited in the Netherlands. A public consultation is currently ongoing on a draft bill for this purpose. The draft bill contains rules regarding the Dutch Personal Data Authority (Autoriteit Persoonsgegevens) and regarding special categories of personal data such as race/ethnicity, health, genetic data, criminal data and – now – biometric data. It is prohibited to process these categories of data unless there is an exception in the Regulation and/or national legislation. Most of the exceptions currently laid down in the Dutch Personal Data Protection Act (Wet bescherming persoonsgegevens) have been included in the draft bill. With respect to criminal data, however, there is no reference to the general exceptions currently laid down in the Personal Data Protection Act and/or the Regulation (e.g. where explicit consent is given or in the event of necessity in legal proceedings). It is likely that this will be amended.

The Regulation will apply from 25 May 2018. The consultation on the draft bill closes on 20 January 2017.