Dutch DPA Flags Data Specification Gap in Smoking Cessation Programme Regulation

Key Takeaways

• The Dutch Data Protection Authority (DPA) reviewed a draft regulation on the Smoking Cessation Programme Scheme and identified a single but significant deficiency: the draft fails to specify which categories of personal data healthcare providers must exchange when declaring mutually provided services.
• This matters for compliance teams because it reinforces the DPA's consistent expectation that any legal basis permitting data sharing, particularly data touching on health information, must meet strict legal certainty standards under GDPR.

Deep Dive

This legislative review centers on a draft regulation (NR/REG-2723) governing declaration, administration, and transparency requirements for the Dutch smoking cessation program, which covers treatment for all tobacco and nicotine addictions. The draft was revised following the establishment of a new Care Standard for Tobacco and Nicotine Addiction, which also triggered changes to funding arrangements by the Dutch Healthcare Authority (NZa). While the overall framework was found largely acceptable, the DPA raised one substantive objection under its statutory consultation role pursuant to Article 36(4) GDPR.

The core issue concerns a provision requiring healthcare providers involved in "mutual services" arrangements (where one provider performs services on behalf of another) to exchange personal data necessary for claims declaration. The draft merely references "the personal data" without defining the specific categories involved, and the accompanying explanatory notes offer no clarification. The DPA emphasized that under well-established case law and Recital 41 of the GDPR, any legislative measure interfering with data protection rights must be clear, precise, and predictable in its application. Given the inherently broad and undefined scope of the term "personal data," especially in a healthcare context where sensitive health data is likely involved, this lack of specificity fails the legal certainty standard under the DPA's proportionality assessment framework.

No firm implementation deadline is specified in the letter, but the DPA has indicated that its legislative review will be published on its website within two weeks of the letter's date (by approximately September 8, 2026). The regulatory body overseeing the healthcare system is expected to revise the draft, either by explicitly listing the categories of personal data permissible for exchange or by providing a substantiated justification in the explanatory notes as to why further specification is not feasible or appropriate in this case.

For compliance professionals, particularly those in healthcare, health insurance, or health data processing functions operating in or with Dutch counterparties, this review serves as a useful precedent on how regulators expect data-sharing provisions to be drafted with precision. Organizations drafting internal data governance frameworks, intercompany data sharing agreements, or sector-specific regulations involving health information should proactively define data categories rather than relying on generic references to "personal data." Firms should monitor the final published version of NR/REG-2723 for the specific data categories ultimately adopted, as this may inform data minimization practices and data mapping efforts for mutual service arrangements in healthcare declarations.

Source: Netherlands Data Protection Authority