Data Protection Authority's tolerance policy around waste pass under fire

Judge considers privacy violation municipal waste passes

On Friday 7 July at 12:00, the Gelderland District Court will hear a case that sets a precedent for all Dutch municipalities when it comes to the duty to respect the privacy of their citizens when collecting household waste and other public tasks. Arnhem resident Michiel Jonker, who previously won a court case on this matter at the Council of State, is requesting the preliminary relief judge to order the Personal Data Authority to stop tolerating and now start enforcing without further delay a privacy-infringing system of the municipality of Arnhem with address-based waste passes. Such waste passes are being introduced in more and more Dutch municipalities.

The preliminary relief judge of the Gelderland District Court (Arnhem) will consider the question of whether the Personal Data Authority (AP) may refuse to take enforcement action if a year-long, already established privacy violation may, but may not, end in about a year's time. A case with a lot of precedent.

Three years ago, the municipality of Arnhem introduced a registration system that processes personal data of all Arnhem households depositing residual waste in underground waste containers by means of address-specific waste passes. Arnhem resident Michiel Jonker objected to this and submitted enforcement requests to the AP. However, although the AP itself has since acknowledged that there is a violation, it still refuses to take enforcement action as regulator.

As of July 2014, the municipality of Arnhem processes personal data of more than 150,000 Arnhemmers when they correctly deposit their residual waste (rubbish bags) in the designated underground waste containers. The containers can only be opened by means of address-specific waste passes. This registers WHERE (in which container), WHEN, HOW MUCH (number of rubbish bags) and WHO (which multi-person or single-person household) deposits residual waste.

Jonker objected to this immediately after it was announced in June 2014 and also filed an enforcement request with the AP (then called College Bescherming Persoonsgegevens). On 26 April 2016, the Administrative Law Division of the Council of State ruled in Jonker's favour that the system had been introduced without a legal decision. However, the municipality ignored this ruling. Jonker then renewed its enforcement request to the AP.

Following Jonker's insistence, the AP acknowledged on 20 April 2017 that the municipality was in breach of the Personal Data Protection Act (PDPA). At the same time, however, the AP announced that breach will continue to tolerate, because, according to the supervisor, there are "concrete prospects of legalisation", in connection with a decision in principle taken on 27 March 2017 by the Arnhem city council to grant a conditional mandate to the College of B&W to introduce a so-called Diftar system from 1 January 2018.

According to the municipality and the AP, a Diftar system (levying a differentiated rate in proportion to the amount of waste deposited) justifies the processing of citizens' personal data. Jonker disputes this, because even after the introduction of Diftar, there is no need to collect and store personal data that can be used and misused in various ways. Jonker also believes that retrospectively assigning a new objective to an existing offence cannot justify that offence. Moreover, there are good alternatives, for example an anonymous prepaid waste card that can be charged with balance.

According to Jonker, years of persistence and tolerance of a violation now leads to an urgent interest in credible enforcement. This is partly because privacy violations are attacks on people's personal integrity. The longer it lasts, the more damage it does. It is also at the expense of their freedom. Jonker therefore asks the court to order the AP to impose an order for incremental penalty payments on the municipality without further delay.

Privacy First supports Jonker in this case: Dutch municipalities should offer their citizens a privacy-friendly alternative to a personalised waste card, for example in the form of an anonymous waste card at no extra cost.

Case information: Jonker vs. Personal Data Authority, Gelderland District Court (Arnhem location) 7 July 2017, 12.00pm. Click HERE For directions. Case number: ARN 17 / 2340. Everyone is welcome to attend the court hearing.

Update 7 July 2017: the court hearing this afternoon went relatively well. Click HERE for Mr Jonker's pleading note (pdf). A brief oral ruling by the judge is tentatively scheduled for Thursday afternoon, 13 July next, with the written judgment to follow the day after. Also read the article in De Gelderlander, 7 July 2017: http://www.gelderlander.nl/arnhem-e-o/rechter-beslist-over-illegale-arnhemse-afvalpas~a7a05c80/.

Update 11 July 2017: The introduction of Diftar in Arnhem is likely to be delayed until 1 January 2019, see http://www.arnhem-direct.nl/berichten/gemeenteraad-besluit-niet-tot-uitstel-invoering-diftar/. See also, for example https://arnhem.groenlinks.nl/nieuws/raad-pakt-zelf-verantwoordelijkheid-voor-invoering-diftar-na-geharrewar-coalitie.

Update 13 July 2017: The preliminary relief judge of the Gelderland District Court today granted Jonker's request and therefore granted the decision of the AP suspended. The judge ruled that a (continuing) privacy violation involves urgency in enforcement, and that in the case of the Arnhem address-based waste pass, there is no concrete prospect of legalisation. Given that the AP is likely to reconsider its rejection decision in response to Jonker's objection within four weeks, and no later than 24 August next, the judge did not consider it appropriate to require the AP to impose an order for incremental penalty payments at this point. The judge did express an expectation that the AP will enforce. For the text of the court ruling, see ECLI:NL:RBGEL:2017:3665.
See also the following media coverage:
http://www.arnhem-direct.nl/berichten/arnhemse-afvalpas-opnieuw-onder-vuur/
http://www.telegraaf.nl/binnenland/28634796/__Arnhemse_afvalpas_onder_vuur__.html
http://www.binnenlandsbestuur.nl/ruimte-en-milieu/nieuws/arnhemse-afvalpas-houdt-illegaal-gegevens-bij.9567672.lynkx
http://www.gelderlander.nl/arnhem/rechter-autoriteit-had-moeten-optreden-tegen-afvalpas-arnhem~ac57f1b6/
http://www.nu.nl/alphen-aan-den-rijn/4841094/alphen-wellicht-in-overtreding-met-gebruik-afvalpas.html
https://radar.avrotros.nl/nieuws/detail/rechter-verwijst-arnhemse-afvalpas-voorlopig-naar-de-prullenbak/
https://www.privacybarometer.nl/nieuws/3909/Rechter_geeft_Autoriteit_Persoonsgegevens_er_van_langs.

Update 24 July 2017: today, the municipality of Arnhem decided to 'open' all underground waste containers. So to deposit waste, Arnhemmers no longer need a waste pass for the time being. See the coverage in The Gelderlander, at Omroep Gelderland and Arnhem Direct. Privacy First hopes that other municipalities in a similar situation to Arnhem will follow suit and abolish the use of privacy-invading waste passes.