Law note · Netherlands
AP Enforcement, GDPR Article 82 and the WAMCA Collective-Action Regime
The Autoriteit Persoonsgegevens (AP) is the Dutch supervisory authority, with General Data Protection Regulation (GDPR) Article 83 fines plus UAVG's own administrative powers including a fine specific to unlawful processing of criminal-conviction data (Art. 17) and administrative fines against government bodies (Art. 18).
GDPR Article 82 arms an individual with a direct private right of action, and the Netherlands' WAMCA collective-action regime is a live vehicle for privacy mass claims: a Consumentenbond and Stichting Take Back Your Privacy claim against TikTok, over unauthorized collection of children's personal data, is currently paused pending a Hoge Raad ruling in a related Oracle/Salesforce case expected 4 September 2026.
What it asks of an app
- Expect the AP to have General Data Protection Regulation (GDPR) Article 83 fining power, plus UAVG's own administrative powers, over your processing of personal data of a person in the Netherlands.
- Expect any person in the Netherlands who suffered material or non-material damage from an infringement to have a direct GDPR Article 82 right to compensation, potentially pursued as part of a WAMCA collective action.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, processes_biometrics, processes_voice, high_risk_decisions
Primary source: GDPR Arts. 82-83
UAVG Arts. 6-21a, 16-18 (direct fetch, table of contents); Consumentenbond TikTok case page (direct fetch)