Law note · Netherlands
UAVG Articles 30-33 and 46, Health, Criminal-Conviction, and National-ID-Number Data
UAVG Chapter 3 Section 3.1 (Arts. 22-30) implements General Data Protection Regulation (GDPR) Article 9's special-category regime with article-by-article national exceptions, confirmed by direct fetch: research and statistics, racial or ethnic origin, political opinions, religious or philosophical beliefs, and genetic data (Arts. 24-28), a health-data exception for administrative bodies, pension funds, and employers (Art. 30), and rules on criminal-conviction data (Art. 31).
Article 46 restricts processing of the citizen service number (BSN); this session confirmed the article's existence and heading but not its full text before the fetch truncated. The AP's own scraping guidance (published 1 May 2024, described in secondary commentary since the PDF itself returned HTTP 403 to a direct fetch) states that publicly available information does not become lawfully processable merely because the source was public.
What it asks of an app
- Obtain a General Data Protection Regulation (GDPR) Article 9(2) basis before processing health, genetic, racial or ethnic origin, political opinion, or religious-belief data of a person in the Netherlands, following UAVG's Chapter 3 exceptions where one applies to your processing purpose.
- Do not treat the citizen service number (BSN) as a general-purpose identifier; UAVG Article 46 restricts its processing.
When LexLint raises it
Declared activities: crawls_web, trains_models, high_risk_decisions
Primary source: wetten.overheid.nl, UAVG Arts. 1, 22, 24-31 (direct fetch)
AP scraping guidance, as characterized by secondary commentary (PDF itself unreachable this session)