The Dutch Data Protection Authority has imposed a fine of €750,000 (US$883,000) on a social media company for not providing their privacy notice in Dutch. The Dutch Regulator considered having the privacy notice only in English was not understandable to the audience. As many social media users in The Netherlands are children, who are given additional protections under law, it was decided that it cannot be expected that they will understand a notice in English. This decision is consistent with the transparency principle of the GDPR that requires businesses to provide information to data subjects in a concise, intelligible, easily accessible, and understandable form.
Article 12(1) of the GDPR is relevant here that states:
“The controller shall take appropriate measures to provide any information referred to in Articles 13 (...) relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. (...)”
Three major principles can be derived from Article 12 of the GDPR, read with Articles 13 and 14:
- All privacy notices must be in clear and plain language.
- All privacy notices must be given in a concise, transparent, intelligible and easily accessible form.
- In particular, information intended for children must be in language for children to understand.
Securiti recommends that you review your websites and apps and your target audience. If you offer services in different countries or web content in different languages, we recommend that your privacy notice is available in all languages you use and the official language of the countries of your audience.
More information on the fine and the PDF of the full decision are available here.
To review your responsibility country by country – read Securiti’s regularly updated “State of Global Consent Requirements” paper and heatmap.
