**Questions? [[Contact us!]]** The Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), which translates to the Implementation Act of the General Data Protection Regulation, is the Dutch implementation act of the GDPR (as the name suggests). The UAVG outlines specific provisions and details for how the GDPR is applied within the Dutch legal framework. ### Exceptions to the ban of the processing of sensitive data There are national exceptions to the ban on the processing of [[Sensitive data]]. It is important to note that these exceptions are only applicable within the Netherlands and that all principles and obligations of the GDPR still apply. ##### **1. Exception for scientific or historical research or statistical purposes** The prohibition to process sensitive categories of personal data does not apply if: - the processing is necessary for scientific or historical research or statistical purposes; - the research serves a public interest; - obtaining explicit consent proves impossible or involves a disproportionate effort; **and** - such safeguards have been provided in the implementation that the privacy of the data subject is not disproportionately affected. ##### **2. Exception regarding processing personal data revealing racial or ethnic origin** The prohibition on processing personal data revealing racial or ethnic origin does not apply if the processing is done: - for the purpose of identifying the data subject, and only insofar as the processing is unavoidable for that purpose; or - with the purpose of granting a privileged position to persons of a particular ethnic or cultural minority group in order to eliminate or reduce factual disadvantages related to the ground of racial or ethnic origin, and only to the extent that: - the processing is necessary for that purpose; - the data is about where the person was born, their parents or grandparents, or other criteria defined by the law to decide if they belong to a particular ethnic or cultural group; - the data subject has not objected to the processing in writing. ##### 3. Exception regarding processing of personal data revealing political opinions for performance of public functions The prohibition on processing personal data revealing political opinions doesn't apply if it's being used for tasks related to political opinions in administrative bodies and advisory boards, as long as these tasks are reasonable. ##### 4. Exception regarding processing personal data revealing religious or philosophical beliefs for spiritual care The prohibition of processing personal data revealing religious or philosophical convictions does not apply if the processing is carried out by certain institutions and the processing is necessary for the spiritual care of the data subject, unless the data subject has objected to it in writing. However, no personal data shall be provided to third parties without the consent of the data subject. ##### 5. Exception regarding genetic data The prohibition on processing genetic data does not apply if such processing is carried out in relation to the data subject from whom the data in question have been obtained. Or when: - there is a more important substantial medical reason; or - the processing is necessary for scientific research that serves a general interest or for statistics, if: - the data subject has given explicit consent (if not impossible or disproportionate); and - there are such safeguards implemented that the privacy of the data subject is not disproportionately harmed. ##### 6. Exception concerning biometric data The prohibition on processing biometric data for the purpose of uniquely identifying a person does not apply if the processing is necessary for authentication or security purposes. ##### 7. Exception on health data The prohibition on processing data concerning health does not apply if the processing is carried out by administrative bodies, pension funds, employers or institutions acting on their behalf, and the processing is necessary for: - the proper execution of legal regulations, pension schemes or collective bargaining agreements providing for entitlements dependent on the health status of the data subject; or - the reintegration or guidance of employees or benefit recipients in connection with illness or disability. The prohibition to process data on health does not apply if the processing is carried out by: - schools, insofar as the processing is necessary for the purpose of special supervision of pupils or making special arrangements in connection with their state of health; - a probation institution, a special probation officer, the child protection board, a certified institution referred to in the Youth Act, insofar as the processing is necessary for the performance of the statutory duties assigned to them; or - the Minister and the Minister of Justice and Security, as long as that the processing is necessary in connection with the enforcement of custodial orders. The prohibition to process data concerning health does not apply if the processing is carried out by: - care providers, institutions or facilities for health care or social services, to the extent that the processing is necessary for the proper treatment or care of the data subject or the management of the institution or professional practice concerned; or - insurers or financial service providers that mediate in insurance, to the extent that the processing is necessary for: - the assessment of the risk to be insured by the insurer and the data subject has not objected; or - the performance of the insurance agreement or assisting in the management and performance of the insurance. **Confidentiality** The data shall only be processed by persons who are under a duty of **confidentiality** by virtue of office, profession, legal provision or contract. If the data controller processes personal data and is not already subject to a duty of confidentiality, it shall be obliged to maintain the confidentiality of the data, except if the law obliges it to disclose the data or its duty requires it to disclose the data to others who are authorised to process them. **Other special categories in addition to the health data** The prohibition to process other special categories of personal data shall not apply if the processing is necessary in addition to the processing of data concerning health, with a view to the proper treatment or care of the person concerned.