Franchisees beware of data breaches (at the franchisor)
In franchise relationships, the processing of, for example, customer data of the franchisee is often reserved for the franchisor. It is not inconceivable that a franchisee is nevertheless responsible for data breaches of such personal data at the franchisor.
The obligation to report data breaches has recently entered into force, as part of the expansion of the Personal Data Protection Act. Violation of the rules is subject to a fine regime. A fine may also follow if data leaks are properly reported.
According to the law, there is an obligation to report to the Dutch Data Protection Authority if there is a security incident. This could include the loss of a USB stick, theft of hardware or a hacker breaking into the automation system. There must also be a loss of personal data or a (suspected) unlawful processing thereof. Unlawful processing includes, among other things, adjusting and/or changing personal data and unauthorized access to, or disclosure thereof. This concerns, for example, usernames and passwords, work performance and financial data that could lead to damage to honor and good name, (identity) fraud, discrimination or, for example, financial damage.
Franchisees have often stored personal data of their employees, customers or prospects on the franchisor’s network. A franchisee may also be required to do so under the franchise agreement. For example, customer data can be an important resource for the franchisor to, for example, align their marketing strategy. In that context, a franchisor can be qualified as a so-called processor.
Despite the engagement of a processor, such as a franchisor, the franchisee remains responsible for proper compliance with the Personal Data Protection Act and therefore also the data breach notification obligation.
The franchisor is obliged to follow the instructions of the franchisee and to comply with the principles regarding the processing of personal data. This is, for example, the obligation of careful and proportionate processing and having a specific purpose and legal basis for the processing.
It is important to be aware of this issue when drafting and concluding franchise agreements. A careful provision about the method of processing, processing and storage of personal data is advisable. For example, it could be agreed that the franchisor indemnifies the franchisee against fines for any form of data breach that occurs at the franchisor.
mr. AW Dolphijn – Franchise lawyer
Ludwig & Van Dam Franchise attorneys, franchise legal advice.
Do you want to respond? Go to dolphijn@ludwigvandam.nl
Other messages
Bankrupt because the franchisor refused to sell the franchise company – dated January 28, 2020 – mr. AW Dolphin
The District Court of The Hague has dealt with a request from a franchisor to declare a franchisee bankrupt.
Prescribed shop fitting – dated January 28, 2020 – mr. AW Dolphin
The Midden-Nederland District Court has ruled on whether a franchisee is obliged to carry the shop fittings prescribed by the franchisor.
Ludwig & Van Dam attorneys summon Sandd and PostNL on behalf of the Sandd franchisees – dated 9 January 2020 – mr. AW Dolphin
The Association of Franchisees of Sandd (VFS) has today summoned Sandd and PostNL before the court in Arnhem. The VFS believes that Sandd and PostNL are letting the franchisees down hard.
Article The National Franchise Guide: “Why joint and several liability, for example, next to private?” – dated 7 January 2020 – mr. AW Dolphin
Franchisees are often asked to co-sign the franchise agreement in addition to their franchise, for example. Sometimes franchisees refuse to do so and the franchise agreement is not signed.
Ludwig & Van Dam Advocaten assists Sandd franchisees: Franchisees Sandd challenge postal monopoly in court – dated 12 November 2019 – mr. AW Dolphin
The Association of Franchisees of Sandd (VFS) is challenging the decision of State Secretary Mona Keijzer to approve the postal merger between PostNL and Sandd before the court in Rotterdam.
Franchisee trapped by non-compete clause? – dated October 21, 2019 – mr. AW Dolphin
The District Court of East Brabant has ruled that a franchisee was still bound by the non-competition clause in the event of premature termination of the franchise agreement.