Enforcement
Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
- Date
- Status
- final
- Body
- Autoriteit Persoonsgegevens
- Reference
- AP kenmerk z2024-010120, Formele waarschuwing CABR (brief 26 november 2024, gepubliceerd 6 december 2024)
What it is about
The Dutch National Archives planned to publish the Central Archive of Special Jurisdiction (CABR), the largest Dutch war archive with about 485,000 files, online for everyone and full-text searchable in stages from 2 January 2025. The DPA issued a formal warning to the Minister of Education, Culture and Science as controller. According to the DPA, this form of publication goes beyond what Article 14 of the Archives Act requires, and is therefore likely to breach Article 6(1)(e) GDPR. The files contain special category and criminal data, also about third parties who are still alive. No statutory exception covers this, and Article 2a of the Archives Act prohibits making such data available. The DPA therefore also finds a likely breach of Articles 9 and 10 GDPR. A DPO opinion and a prior consultation were also missing. No objection can be lodged against the warning.
What this means in practice
A statutory publication duty does not allow you to put data about living people online and make it searchable without limits. The Article 6(1)(e) basis covers only what is necessary. If the aim can also be reached in a less intrusive way, for example through access in the reading room, the broader publication falls outside that basis. Do not only check whether the main subject of a file has died: living third parties in the file are protected too. A date of birth is not needed to make someone identifiable. Ask the DPO for advice on a DPIA and consult the DPA in advance if high risks remain. The formal warning is a tool the DPA uses before a breach takes place.
The GDPR articles concerned
- Article 6: Lawfulness of processing
- Article 9: Processing of special categories of personal data
- Article 10: Processing of personal data relating to criminal convictions and offences
- Article 35: Data protection impact assessment
- Article 36: Prior consultation
- Article 38: Position of the data protection officer
- Article 58: Powers
Source: Autoriteit Persoonsgegevens, Formele waarschuwing Nationaal Archief (met brief z2024-010120 als PDF)checked on 15 September 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Themes where this returns
- Assessing risks in advance: DPIA and FRIA
- Automated decisions and human oversight
- Biometrics and emotion recognition
- Data quality, minimisation and data governance
- Knowledge in the organisation: data protection officer and AI literacy
- Supervision and fines
- Using special categories of personal data to detect bias
The counterpart in the other law
- Article 2 AI Act: Scope
via Using special categories of personal data to detect bias
- Article 3 AI Act: Definitions
- Article 4 AI Act: AI literacy
via Knowledge in the organisation: data protection officer and AI literacy
- Article 5 AI Act: Prohibited AI practices
- Article 6 AI Act: Classification rules for high-risk AI systems
- Article 9 AI Act: Risk management system
- Article 10 AI Act: Data and data governance
- Article 14 AI Act: Human oversight
- Article 26 AI Act: Obligations of deployers of high-risk AI systems
- Article 27 AI Act: Fundamental rights impact assessment for high-risk AI systems
- Article 50 AI Act: Transparency obligations for providers and deployers of certain AI systems
- Article 70 AI Act: Designation of national competent authorities and single points of contact
- Article 74 AI Act: Market surveillance and control of AI systems in the Union market
- Article 86 AI Act: Right to explanation of individual decision-making
- Article 99 AI Act: Penalties
Case law8 of 18
- The Hague District Court cuts DPA fine on police for mobile camera cars without completed DPIA to 30,000 euros
2024-10-08 · status not established, Rechtbank Den Haag
- EU Court of Justice in KNLTB: a purely commercial interest can be a legitimate interest
2024-10-04 · final, Hof van Justitie van de Europese Unie
- Reddit's summary proceedings against the DPA over a penalty order and legal privilege dismissed
2026-03-04 · status not established, Rechtbank Den Haag, voorzieningenrechter
- Noord-Nederland District Court upholds DPA fine for village livestream, reduces it to 375 euros
2025-01-09 · status not established, Rechtbank Noord-Nederland
- Schrems v Meta: no unlimited retention and aggregation of data for targeted advertising
2024-10-04 · final, Hof van Justitie van de EU (Vierde kamer), Maximilian Schrems tegen Meta Platforms Ireland Limited
- Council of State: 600,000 euro fine for wifi tracking in Enschede stays annulled
2026-07-29 · final, Raad van State, Afdeling bestuursrechtspraak
- Mousse: asking for Mr or Ms when selling a train ticket is not necessary
2025-01-09 · final, Hof van Justitie van de EU (Eerste kamer), Mousse tegen Commission nationale de l'informatique et des libertés (CNIL) en SNCF Connect
- Interim judge suspends DPA penalty order against Northwave: exhaust powers against the hosting provider first
2024-03-26 · final, Rechtbank Midden-Nederland, voorzieningenrechter (zittingsplaats Utrecht)
Guidelines8 of 15
- EDPB Template for Data Protection Impact Assessment
2026-04-14 · under consultation, European Data Protection Board (EDPB)
- Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is likely to result in a high risk
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
- Guidelines 03/2026 on web scraping in the context of generative AI
2026-07-07 · under consultation, European Data Protection Board (EDPB)
- Guidelines 05/2020 on consent under Regulation 2016/679
2020-05-04 · final, European Data Protection Board (EDPB)
- Consultation on the draft list of processing operations for which no DPIA is required (Dutch DPA)
2026-06-24 · under consultation, Autoriteit Persoonsgegevens (AP)
- Consultation on the Dutch DPA's enforcement policy (April 2026)
2026-04-13 · under consultation, Autoriteit Persoonsgegevens
- Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus
2026-01-13 · final, Autoriteit Persoonsgegevens
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
2024-12-17 · final, European Data Protection Board (EDPB)
Enforcement and fines8 of 9
- Ten municipalities fined a total of 250,000 euros for unlawful files on Muslim residents
2026-02-03 · final, Autoriteit Persoonsgegevens
- 150,000 euro fine for ICS for missing DPIA on digital identity checks
2023-12-18 · final, Autoriteit Persoonsgegevens
- Dutch DPA and tennis federation KNLTB end litigation: fine cut from 525,000 to at most 250,000 euros
2025-10-18 · status not established, Autoriteit Persoonsgegevens
- 600,000 euro fine for AS Watson (Kruidvat) over tracking cookies without consent
2024-05-02 · annulled, Autoriteit Persoonsgegevens
- 500 euro fine and penalty order for Stichting Oud Lemmer over webcam livestream
2021-07-09 · status not established, Autoriteit Persoonsgegevens
- DPA cuts Kruidvat fine to 50,000 euros on objection
2025-05-27 · status not established, Autoriteit Persoonsgegevens
- Experian Netherlands fined 2.7 million euros for credit scoring without legal basis or information
2025-10-16 · final, Autoriteit Persoonsgegevens
- Coolblue fined 40,000 euros on objection for cookies without consent
2024-12-23 · status not established, Autoriteit Persoonsgegevens
Legislation in motion6 of 10
- Proposal: exception for biometric verification under the data subject's sole control (Article 9(2)(l) GDPR)
2025-11-19 · proposal, Europese Commissie
- Council: Irish Presidency continues with a revised compromise, Antici Group 11 September 2026
2026-09-11 · under negotiation, Raad van de Europese Unie, Iers voorzitterschap
- Proposal: exception for incidental special category data in AI development (Article 9(2)(k) and 9(5) GDPR)
2025-11-19 · proposal, Europese Commissie
- Amendment to the Dutch GDPR Implementation Act: DPA must publish GDPR sanctions from 1 September 2026
2026-09-01 · in force, Wetgever (Tweede Kamer) en Autoriteit Persoonsgegevens
- Proposal: legitimate interest for development and operation of AI (new Article 88c GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: cookie rules move from ePrivacy to the GDPR, with new exceptions and a six-month rule (new Article 88a GDPR and Article 5(3) ePrivacy)
2025-11-19 · under negotiation, Europese Commissie
Analysis6 of 7
- AI DPIA: when it's required + free template (2026)
2026-03-23
- EU AI Act Article 26: deployer obligations explained
2026-03-21
- DPIA vs FRIA: 5 key differences, when you need both, plus a free FRIA template (2026)
2025-08-05
- AI Act regulator inspection: which documents must your organisation be able to show?
2026-07-07
- What is FRIA? Fundamental rights impact assessment explained (EU AI Act)
2026-02-28
- EU AI Act in the public sector: 2025 government guide
2025-06-16