Dutch DPA Raises No Objections to Draft Act Implementing EU Judicial Cooperation Digitalization Rule

Key Takeaways

• The Dutch Data Protection Authority (AP) reviewed the draft bill implementing Regulation (EU) 2023/2844 and Directive (EU) 2023/2843 on the digitalization of judicial cooperation and had no comments on it.
• The clean opinion signals low data protection friction for the bill's passage.
• Compliance teams should still track the legislative process, since the bill affects how personal data is exchanged electronically in cross-border judicial matters.

Deep Dive

The Dutch Data Protection Authority (AP) reviewed the draft bill implementing Regulation (EU) 2023/2844 and Directive (EU) 2023/2843 on the digitalization of judicial cooperation and had no comments on it. The clean opinion signals low data protection friction for the bill's passage. Compliance teams should still track the legislative process, since the bill affects how personal data is exchanged electronically in cross-border judicial matters.

The draft bill implements two EU instruments: Regulation (EU) 2023/2844, which is directly applicable and requires digital channels for judicial and cross-border communication, and Directive (EU) 2023/2843, which requires national transposition. The letter does not describe the bill's substantive provisions or set any implementation dates. No new obligations arise from the AP letter itself. The appendix restates the AP's standard assessment framework: suitability, subsidiarity, proportionality, legal certainty, substantive and procedural safeguards, and binding force under national law. It also restates the GDPR Article 5 principles (lawfulness, fairness, transparency, purpose limitation, and data minimization) and the corresponding Article 4 principles of the Police and Justice Directive (2016/680).

For financial institutions, the direct impact is limited. The bill concerns judicial and competent-authority communication, not private-sector processing. However, institutions that regularly respond to court orders, freezing or production requests, or mutual legal assistance and cross-border enforcement matters in the Netherlands may see changes in how those requests are received and answered. This could include secure electronic channels, authentication of requests, and record-keeping. Because the AP found no issues, the bill is less likely to be materially amended on data protection grounds, though Parliament may still change it.

Recommended actions:

(1) add the bill to the regulatory horizon-scanning log and monitor its parliamentary progress and any entry-into-force dates;

(2) obtain the published AP letter and the explanatory notes to confirm the scope;

(3) have Legal and Data Protection teams assess whether processes for handling judicial requests will need to support new electronic channels;

(4) confirm that data handling for such requests aligns with GDPR Article 5 principles, including minimization and purpose limitation; and

(5) note the AP's assessment framework as a benchmark for how it reviews future legislation. Overall risk is low, with the main exposure being operational readiness once the digital channels become mandatory.

Source: Netherlands Data Protection Authority