EdLaw
Netherlands — Uitvoeringswet AVG (UAVG)
The Dutch GDPR implementation act. Headlines for EdTech: consent age 16, an AP that can fine public bodies, and a narrow biometrics exception that matters for headset hardware.
Statute text is Dutch (the authentic language); this README is curation.
Applicability to EdTech
- Digital-consent age is 16 (artikel 5 lid 1) — no derogation; but note the layered minors regime: children from 12 can withdraw consent themselves (lid 3) and exercise GDPR rights alongside their representative from 12–16 (lid 4).
- Public bodies are fineable (artikel 18): the Autoriteit Persoonsgegevens can impose full Art. 83 GDPR fines on overheidsinstanties — Dutch public schools carry real fine exposure (contrast Austria/Czechia), which is why they lean on the Privacyconvenant.
- Biometrics (artikel 29): the Art. 9 ban on biometric unique identification is lifted only where processing is necessary for authentication or security serving a weighty general interest — relevant to any eye/face/hand-tracking feature that could uniquely identify; recreational or analytic biometric use has no Dutch exception.
- BSN (artikel 46): the national identification number may only be processed as the specific statute prescribes — a vendor platform should never receive or store BSN/PGN outside a legal basis.
Contents
| Document | Covers |
|---|---|
| TOESTEMMING-BOETES-BIOMETRIE.md | artikelen 5, 18, 29, 46 |
Enforcement
Autoriteit Persoonsgegevens (AP, autoriteitpersoonsgegevens.nl).
Related
- EU GDPR — directly applicable
- NL Privacyconvenant Onderwijs — the sector agreement schools actually demand
Sources
Meta
Statute text in TOESTEMMING-BOETES-BIOMETRIE.md is reproduced verbatim in Dutch from the official Basiswettenbestand consolidation by tools/nl/build_nl.py; the served toestand date is pinned and verify fails on a newer consolidation.