LEGISLATION
AVG legislation: what the AVG asks of you
The AVG, in full the General Data Protection Regulation, determines what you can and cannot do with personal data. Do you process data without a valid basis or do you keep them longer than necessary? The Dutch Data Protection Authority can then impose fines up to €20 million or 4% of global annual turnover. Anyone who verifies identities processes sensitive data by definition.
DEFINITION
Where does it say AVG for?
The abbreviation AVG stands for General Data Protection Regulation. This European regulation sets out how organizations must handle personal data: when you can process them, how long you can keep them and what rights people have over their own data.
Internationally, the same regulation is called the General Data Protection Regulation, abbreviated GDPR. This is exactly the same piece of legislation, just in a different language. The AVG applies since 25 May 2018 (source: National government).
For organizations that verify identities, the AVG not a precondition but the core of the process. A passport scan and a facial comparison are personal data, and biometric data are considered special personal data for which a processing ban applies, unless you can rely on a legal exception.
The AVG does not determine whether you may process data, but under what conditions. Anyone who cannot demonstrate these conditions has a weak position during an audit.
48 hours
retention period DataChecker
After processing, we do not store customer data for longer than 48 hours as standard. Data minimization is a starting point of the AVG, no extra.
€20 million
maximum AVG-fine: 20 million euros or 4% of global annual turnover (source: Dutch Data Protection Authority)
72 hours
to report a data breach with a risk to the Dutch Data Protection Authority
27 countries
EU member states where the AVG applies directly since May 25, 2018
Also applicable in Norway, Iceland and Liechtenstein via the EEA (source: AP)
ISO 27001
certified information security, tested annually
TWO CONCEPTS
Is the AVG a law?
People often talk about the AVG-law. Strictly speaking, that is not correct: enter the v AVG stands for regulation. The difference is not a word game, because it determines which rules take precedence.
EUROPEAN LEVEL
The regulation (AVG)
A European regulation has a direct effect on all Member States. No transposition into national law is required for the rules to apply. The basis is therefore identical for everyone in the EU.
If a national rule conflicts with the regulation, the regulation wins. That's exactly why the AVG has so much weight.
DUTCH LEVEL
The Implementation Act AVG
The Netherlands has elaborated the regulation in the Implementation Act of the General Data Protection Regulation. This states how to act against violations and which supervisor may intervene.
Someone says AVGlaw, then he usually means this implementing law. Not wrong, but good to know that the regulation itself already applies directly.
The AVG replaced the Personal Data Protection Act in 2018. What mainly changed: stronger rights for people, more responsibility for organizations, and fines that have been equalized throughout the EU.
What regulates the AVG?
Processing personal data is only allowed if you have a valid basis for doing so. The AVG knows six. If you don't have any, you are not allowed to process the data, no matter how useful it would be.
BASIS 1
Consent
The data subject gives active and unambiguous consent. That consent must be freely given and just as easy to withdraw as it is to give.
BASIS 2
Legal obligation
Another law obliges you to process the data. The identification requirement upon entering employment is the best-known example of this.
BASIS 3
Agreement
The processing is necessary to perform a contract. Without an address you cannot deliver anything, and without a bank account you cannot pay out anything.
BASIS 4
Vital importance
The processing is necessary to protect someone's life or health. In practice this is an exception, not a daily work basis.
BASIS 5
General interest
The processing serves a task of public interest or public authority. Especially relevant for governments and public institutions.
BASIS 6
Legitimate interest
You have a compelling interest of your own, such as fraud prevention. This does require a trade-off against the privacy of the data subject, and you must be able to demonstrate that trade-off.
In your privacy statement you record which data you collect, on what basis, for what purpose and for how long you keep it. That document is not a formality, it is your responsibility.
The six principles are stated in Article 6 of the AVG. You decide which basis applies and must be able to substantiate that choice: that is accountability (source: Dutch Data Protection Authority).
Identity checking with data minimization as a starting point
VERIFICATION WITHOUT STORAGE
ID Verification
Document checking, facial comparison and liveness detection determine that someone is who they say they are. The processing takes place within the EU, and after the check we do not store the data for longer than 48 hours as standard.
This means: you get the security you need, without a growing archive of passport scans that you have to secure and account for yourself.
SHARE LESS DATA
Digital ID
Digital ID turns a one-time verification into a reusable digital identity in the user's wallet. During a subsequent check, you only share the outcome, not the entire document again.
Less data circulating, fewer parties keeping something. That is data minimization in practice.
For employment agencies: employment agencies process data from many people at the same time. That is why a Data Protection Officer is mandatory in this industry, and processing agreements with hirers, accountants and payroll parties are not an option but a requirement.
When should you report a data breach?
In the event of a data breach, you first assess the risk. You do this based on the possible consequences for those involved and the likelihood that those consequences will occur. The more sensitive the data, the greater the chance of damage.
If you conclude that there is a risk, you must report the leak to the Dutch Data Protection Authority within 72 hours. If the risk is high, you must also inform those involved yourself. The AP publishes a sample list of situations and the associated advice.
SANCTIONS OF THE PERSONAL DATA AUTHORITY
- Fine up to 20 million euros or 4% of global annual turnover
- Order subject to penalty for persistent violation
- Processing ban on specific data flows
- Reprimand
- Warning
How the AVG is related to other legislation
The AVG does not stand alone. Anyone who checks identities has to deal with several laws at the same time.
Compulsory Identification Act (WID)
You are obliged to determine the identity of each employee. By definition, this means processing personal data, ie AVG determines how you can do that.
AML
Mandatory customer due diligence at financial institutions. The Wwft prescribes that you must record data, the AVG determines how long and under what conditions.
Chain Liability Act (WKA)
Makes you partly responsible for who works in your chain. Checking means processing data, even from people who are not on your payroll.
How's it going? DataChecker to deal with the AVG?
Identity verification means processing passport numbers, facial images and work permits. DataChecker is built on data minimization and EU processing.
ISO 27001 certified
Independently tested information security policy. Annual audit on processes, access and risk management.
Processing within the EU
Data is processed and stored within the European Union. Privacy by design and data minimization are the starting point.
48 hours retention period
By default, customer data is not kept for longer than 48 hours after processing. What is not there cannot leak.
Questions about the AVG
Where does it say AVG for?
AVG stands for General Data Protection Regulation. It is European privacy legislation that determines how organizations must handle personal data. In English, the same regulation is called the General Data Protection Regulation (GDPR).
Is the AVG a law or a regulation?
Strictly speaking, the AVG a regulation, not a law. A European regulation has direct effect in all Member States, without the need for transposition into national legislation. The Netherlands has elaborated the regulation in the Implementation Act AVG. Who speaks about the AVGlaw, usually means that implementing law.
To whom does the AVG?
The AVG applies to everyone who processes personal data: large companies, SMEs, self-employed persons and the government. Individuals can also be included, for example someone who hangs a camera at his house. Processing for purely personal use, such as a birthday calendar, is excluded (source: Dutch Data Protection Authority).
Since when does the AVG?
The AVG has been in force since May 25, 2018. The regulation thus replaced the Dutch Personal Data Protection Act (Wbp), which expired at the same time.
What is personal data according to the AVG?
Personal data is any data with which a person can be directly or indirectly identified: name, address, e-mail address, but also a document number. In addition, the AVG special personal data, including data about health, racial or ethnic origin, religious beliefs and biometric data that can be traced back to an individual. A processing ban applies to that category, unless you can rely on a legal exception (source: Dutch Data Protection Authority).
What are the fines for violating the AVG?
The Dutch Data Protection Authority can impose a fine of up to 20 million euros or 4% of the global annual turnover. In addition, the supervisor can impose a penalty, impose a processing ban, issue a reprimand or a warning (source: Dutch Data Protection Authority).
When do I need a privacy statement on my website?
As soon as you collect personal data via your website, and this already happens with a contact form, a newsletter registration or analytics cookies, you need a privacy statement. In it you record which data you collect, on what basis, for what purpose and for how long you keep it.
What is the difference between the AVG and the GDPR?
There is no substantive difference. AVG is the Dutch name, GDPR the English name. This is exactly the same European regulation, just stated in a different language.
How do I combine identity verification with the AVG?
By only processing what is necessary and not storing it longer than necessary. Bee ID Verification processing takes place within the EU and is used DataChecker standard retention period of 48 hours. Or Digital ID during the next check, you only share the outcome instead of the entire document again. Schedule a demo to see how that fits into your process.
Verify identities without building an archive
The AVG does not require less control, but more careful handling of what you collect. DataChecker processed within the EU, is ISO 27001 certified and does not store customer data for longer than 48 hours as standard.
