In line with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, DPA) previously entering into cooperation protocols with the Dutch National Bank (De Nederlandsche Bank), the Dutch Healthcare Authority (Nederlandse Zorgautoriteit) and the Netherlands Authority for Consumers and Markets (Autoriteit Consument en Markt), on 23 April 2019 the DPA announced that it has also entered into a cooperation protocol with the Dutch Media Authority (het Commissariaat voor de Media, CvdM) in order to improve the cooperation and exchange of information between the two supervisory authorities (the Cooperation Protocol).

What is the purpose of the Cooperation Protocol?

First, the Cooperation Protocol aims to contribute to efficient and goal-oriented task fulfillment of both the DPA and the CvdM. Furthermore, the purpose of the Cooperation Protocol is to establish and improve the mutual relationship between the two supervisors in the exercise of supervision and enforcement of legislation for the media, such as for media institutions.

The content of this Cooperation Protocol does not differ much from the other cooperation protocols that the DPA closed earlier. An interesting aspect of this Cooperation Protocol, however, is that it stipulates that the CvdM will monitor compliance with legislation for which - in all other cases - the DPA is the competent supervisory authority.

The fact is that the DPA supervises compliance with the General Data Protection Regulation (Algemene Verordening Gegevensbescherming, GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG) while the CvdM supervises compliance with the Dutch Media Act (de Mediawet) and the Law on the fixed book price (Wet op de vaste boekenprijs). The tasks of the DPA and the CvdM meet when the processing of personal data is concerned by, for example, media institutions. Media institutions are service providers that deliver programs for the general public, such as radio broadcasters, event channels, (commercial) TV channels, etc.

Processing for journalistic purposes

If the processing of personal data takes place exclusively for journalistic purposes (also called the journalistic exception) the DPA has no supervisory authority. Instead the CvdM is the competent supervisory authority in case of such processing of personal data by or in the media. This is striking because the processing of personal data for journalistic purposes is exempt from a number of requirements deriving from the GDPR and the UAVG, but not from all.

Due to these exemptions, in the Netherlands the processing of personal data for journalistic purposes for instance does not require the data subjects to be informed of such processing (in advance) nor does it require that the data subjects can exercise their right of access or have the right to give or withdraw their consent to the processing of their personal data. However, the requirements that the processing must be based on a legitimate basis, that it may only take place for a clearly defined purpose and that it must be in accordance with the principles of proportionality, subsidiarity and data minimization, continue to apply. Also, the requirement of substitute consent of a legal representative for the processing of personal data of children under the age of 16 continues to apply.

In a letter from the Dutch House of Representatives of 1 April this year, the scope of the journalistic exception and the Cabinet's investigation – in response to Koopmans’ motion - were discussed. In that letter the Cabinet concludes that the GDPR and UAVG in their current forms ensure a proper and necessary balance between the journalistic exception on the one hand and the protection of personal data on the other hand. It therefore appears that the scope of the journalistic exception will not change (substantially) for the time being.

What is the importance of this Cooperation Protocol?

This brings us to the following: despite the fact that the processing of personal data for journalistic purposes is not completely excluded from the obligations arising from the GDPR and the UAVG, the DPA is not authorized to monitor or perform supervisory tasks in relation to such processing activities.

This is notable, since the DPA is the competent supervisory authority with regards to monitoring compliance and enforcement of the GDPR and UAVG and therefore has the required knowledge and expertise in that context. Insofar as the processing of personal data for journalistic purposes is carried out by or in the media, such as through media institutions, the CvdM is therefore the only competent supervisor. In that view, the Cooperation Protocol appears to provide a useful and necessary basis, so the CvdM and the AP can bring together their respective supervisory role, knowledge and expertise in the context of the processing of personal data in order for the CvdM to effectively perform its supervisory tasks in the context of the journalistic exception for the processing of personal data by media institutions.

The full Cooperation Protocol can be consulted via: https://autoriteitpersoonsgegevens.nl/nl/nieuws/cvdm-en-ap-intensiveren-samenwerking.