1. It is prohibited to process personal data concerning a person's health.
   The prohibiton on processing personal data concerning a person's health does not apply where the processing is carried out by:
   a. medical professionals, healthcare institutions or facilities or social services, provided that this is necessary for the proper treatment and care of the data subject, or for the administration of the institution or professional practice concerned;
   b. insurance companies as referred to in Article 1(1)(h) of the Insurance Supervision Act 1993 (Wet toezicht verzekeringsbedrijf 1993), insurance companies as referred to in Article 1(c) of the Funeral Insurance Supervision Act (Wet toezicht natura-uitvaartverzekeringsbedrijf), and intermediaries and sub-agents as referred to in Article 1(b) and (c) of the Insurance Mediation Act (Wet assurantiebemiddelingsbedrijf) , provided that this is necessary for:
        1º. assessing the risk to be insured by the insurance company and the data subject has not indicated any objection thereto, or
        2º. the performance of the insurance agreement;
   c. schools, provided that this is necessary with a view to providing special support for pupils or making special arrangements in connection with their state of health.
   The data may only be processed by persons subject to an obligation of confidentiality by virtue of office, profession or legal provision, or under an agreement.
2. The prohibition on processing personal data does not apply where this is necessary to supplement the processing of personal data concerning a person's health with a view to the proper treatment or care of the data subject.
3. Personal data concerning inherited characteristics may only be processed, where this processing takes place with respect to the data subject from whom the data concerned have been obtained, unless:
   a. a serious medical interest prevails, or
   b. the processing is necessary for the purpose of scientific research or statistics.
4. A data subject has the right, freely and at reasonable intervals, to request the responsible party to inform him as to whether personal data relating to him are being processed. The responsible party shall inform the data subject in writing within four weeks as to whether personal data relating to him are being processed.
   In the event that such data are being processed, the information provided shall contain a full and clear summary thereof, a definition of the purpose or purposes of the processing, the data categories to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.
   Prior to the providing of information to which a third party may be expected to object, the responsible party shall give the third party an opportunity to express its views where such information contains data concerning that third party unless this appears to be impossible or would involve a disproportionate effort.
   Upon request, the responsible party shall provide information concerning the underlying logic of the automated processing of data relating to the data subject.
5. A person who has been informed about personal data relating to him, may request the responsible party to correct, supplement, delete or block the said data in the event that it is factually inaccurate, incomplete or irrelevant to the purpose or purposes of the processing, or is being processed in any other way which infringes a legal provision. The request shall contain the modifications to be made.
   The responsible party shall inform the requester in writing within four weeks of receiving the request as to whether and, if so, to what extent, it is complying therewith. A refusal to do so must be accompanied by the reasons.
   The responsible party must make sure that a decision to correct, supplement, delete or block data is implemented as quickly as possible.
   Where personal data have been recorded on a data carrier to which no modifications can be made, the responsible party must take the necessary steps to inform the data user that it is impossible to correct, supplement, delete or block the data, even where there are grounds under this article for modifying the data.

Top