Dutch DPA Objects to Human Trafficking Directive Decree Over Unregulated Processing Bases

Key Takeaways

• The Dutch Data Protection Authority (AP) has formally objected to the draft decree implementing the revised EU Human Trafficking Directive.
• It found that the GDPR legal bases of public interest task and legal obligation are not properly established in law.
• Without further regulation, processing of victims' personal data, including special category and criminal data, could be unlawful.
• Compliance teams should treat this as a signal of how strictly regulators apply the Article 6(3) requirement.

Deep Dive

The AP issued its legislative review on 26 August 2026 (published 3 September 2026) in response to the Minister of Justice and Security's 6 July 2026 submission under Article 36(4) GDPR. The draft amends the Decree on International Obligations of Extraterritorial Jurisdiction, the Police Data Decree and the Decree on Victims of Criminal Offences. It implements the 2024 amending directive (cited in the AP's letter as both Directive (EU) 2024/1712 and 2023/1712; the 2024 citation is the one in the decree title). It creates a contact point for the cross-border referral of trafficking victims. The explanatory memorandum indicates that the Comensha foundation will act as this contact point "de facto."

The core finding is a legal-basis gap. The draft text only states that a contact point exists. It does not name Comensha or define its tasks and powers, which currently sit in a subsidy decision. Article 6(3) GDPR requires the bases in Article 6(1)(c) and (e) to be established by Union or Member State law. The AP considers a subsidy decision and an explanatory note insufficient. The law must set out the processing purpose, the types of personal data, the recipient authorities, purpose limitation and retention periods. Where relevant, it must also identify the controller, including whether it is a private-law entity.

The practical consequence is that the explanatory memorandum treats consent under Article 9(2)(a) as the primary basis, with public task and legal obligation as fallbacks. If those fallbacks are unavailable, only consent remains. The AP notes that consent must meet the strict requirements of Articles 4(11) and 7, and that it is rarely freely given in the context of a public task (recital 43). This is a particular concern for vulnerable victims. The AP also points to its earlier opinion on the National Rapporteur Act regarding disclosures of victim data to the Rapporteur. No implementation deadline is stated, and the AP expects no additional workload. The next step is for the Ministry to revise the draft.

Recommended actions for compliance professionals: - Review whether processing relying on Article 6(1)(c) or (e) is supported by a specific legal instrument that sets out purposes, data categories, recipients and retention, rather than only by subsidies, guidance or policy. - Reassess the reliance on consent, especially where there is a power imbalance or vulnerable data subjects. - Monitor the revised decree, and the likely effect on any data-sharing with Comensha or similar bodies. - Check that processing of special category and criminal data meets Articles 9 and 10 and that governance documentation reflects this.

Risk impact: the issue is a legislative drafting defect, not an enforcement action. However, it signals a significant risk of unlawful processing, regulatory challenge and data subject claims for organizations involved in cross-border victim referral, and it is relevant to financial institutions that handle trafficking-related reports and data sharing with authorities.

Source: Netherlands Data Protection Authority