A Discretionary Practice Becomes a Statutory Duty
On September 1, 2026, the Netherlands' Verzamelwet gegevensbescherming — a technical-sounding "collection law" that bundles amendments to the Uitvoeringswet AVG (UAVG), the Dutch GDPR implementation act — quietly took effect. Published as Staatsblad 2026, 154 and brought into force by Staatsblad 2026, 196, the law passed the Tweede Kamer 144–0 in May 2025 and cleared the Eerste Kamer as an uncontested hamerstuk in June 2026 (Eerste Kamer).
Buried among provisions on curators, youth data rights, and bank transaction monitoring is a change with outsized consequences: it makes public disclosure of Autoriteit Persoonsgegevens (AP) sanctions — fines, penalty orders, processing bans — the legal default rather than a policy choice. The Tweede Kamer's own bill file describes it as "een verplichting tot openbaarmaking van een door de Autoriteit Persoonsgegevens opgelegde bestuurlijke sanctie" — an obligation, not an option (Tweede Kamer).
The mechanics matter. The AP must wait at least ten working days after notifying a violator before publishing, unless the organization has already disclosed the sanction itself or raises no objection to earlier release. If the violator seeks emergency relief from a voorzieningenrechter, publication is suspended until the court rules. Information exempt under the Wet open overheid (Woo) — the Dutch freedom-of-information law — can still be withheld (Binnenlandsbestuur).
The Steelman: Why This Isn't an Overreach
It's worth stating the case for this plainly, because it's a good one. The AP already published most of its fines under internal policy — this law mostly formalizes existing practice rather than inventing a new power. The legislative rationale, per the bill's own summary, is to increase the AP's visibility, create a genuine deterrent effect for AVG violations, and let organizations learn from each other's enforcement outcomes. Discretionary disclosure regimes are also inherently fragile: a regulator can quietly stop publishing inconvenient decisions, or apply naming-and-shaming unevenly across politically connected versus obscure violators. Converting the practice into a statutory duty closes that discretion gap and gives regulated companies predictable rules — they know in advance that a fine will become public, on a fixed timeline, with defined exceptions. For a regulator whose central enforcement tool (administrative fines) can take years to bite through appeals, public disclosure is often the only immediate consequence a violation produces.
The Proportionality Problem
The steelman is real, but it elides an asymmetry the safeguards only partly fix. A ten-working-day notice window and a Woo exception are procedural, not substantive — they govern when and whether narrowly a decision is withheld, not whether the underlying finding was correct. Reputational damage from a published fine is front-loaded and often irreversible, while the legal process to contest the fine itself can run for years. Uber's original €290 million fine from the AP in 2024, over unlawful driver-data transfers to the US, is still working through appeal; the reputational hit landed the moment it was announced, well before any court tested the AP's underlying legal theory.
That asymmetry compounds for smaller companies without Uber's legal budget or brand resilience to absorb a headline fine while an appeal plays out. A statutory publication duty removes the AP's own ability to exercise proportionality — for instance, delaying disclosure of a borderline or first-offense case — that discretionary regimes at least theoretically allowed. Converting policy into law is good for predictability, but only if the underlying enforcement judgment being publicized is itself reliably sound, and GDPR fine calculations remain notoriously inconsistent across the EU's national regulators.
The Uber Precedent Shows the Stakes
The timing makes the new rule more than academic. On August 21, 2026 — eleven days before the law took effect — the AP fined Uber nearly €825 million for automatically deactivating driver accounts between 2018 and 2022 without meaningful human review, a decision the regulator says violated GDPR's rules against fully automated decisions with significant consequences. It is the second-largest GDPR fine ever imposed in the EU, trailing only the Irish Data Protection Commission's €1.2 billion Meta fine from 2023 (Computable). Uber is appealing. Under the old discretionary regime, publication of a case this size was never seriously in doubt — but for the next mid-sized fine, the gap between "AP usually publishes" and "AP must publish" is exactly where proportionality arguments used to live.
What Changes for Compliance Teams
- Assume any AP administrative sanction will become public roughly two weeks after notification — build that into breach-response and investor-disclosure timelines now, not after a decision letter arrives.
- The Woo exception and preliminary-relief route are the only levers left to delay disclosure — legal teams should map both before an investigation reaches the sanction stage, not during it.
- Expect more, smaller fines to generate press coverage than under the old policy, simply because non-publication is no longer a quiet option for the AP.
The Netherlands has traded regulatory flexibility for procedural certainty. That is a defensible trade — but proportionate enforcement requires more than a fixed clock on disclosure; it requires confidence that what's being disclosed was correctly decided in the first place.