ⒾMachine translations by Deepl
Active disclosure of processing registers: from paper duty to public value
Call on cabinet: make active disclosure of register of processing operations a legal requirement.
The right to know what happens to your data is enshrined in the General Data Protection Regulation (GDPR). Yet it is proving difficult to find out how and where your data is processed in government. Open State Foundation and Privacy First are calling on the new cabinet to initiate a legal obligation to actively make the register of processing public.
Government organisations and companies process personal data on a large scale without citizens being actively aware of it. For instance, many citizens have never heard of a processing register at all. These registers require governments and companies to include crucial information on the purpose and conditions of all processing operations. Data processing operations are often far-reaching; for instance, they affect access to financial services, social benefits, insurance, employment and mobility. Citizens therefore have the right to know where and how their data is processed.
For governments, the duty to be public weighs extra heavily. Citizens have no influence on data processing based on statutory duties. Transparency about this is not a luxury, but a precondition of our democratic constitutional state. The information must also be easily accessible: without application or login, in understandable language and digitally accessible.
Transparency as a basis
If you don't know what information the government stores about you, you also have no visibility into lawful processing and incorrect processing cannot be detected.
Often, the information only surfaces in journalistic investigations or with individual requests - explicitly invoking the Open Government Act (Woo) and data protection rights (AVG) or privacy rights (Constitution, ECHR).
Examples of processing operations with very far-reaching consequences:
- credit checks (credit scoring by trade information agencies)
- blacklists (financial institutions, Municipal Incidents Register, FSV registration Tax Office)
- systematic profiling (without meaningful human intervention).
The consequences of these processing operations directly affect citizens in their daily lives, now regularly without them knowing how or why.
Reluctance to disclose information about processing operations is regularly prompted by fears of reputational damage, of liability or (ironically) loss of trust. As a result, precisely when wrongdoing comes to light, trust in government is further damaged. It is therefore time for a legal obligation to actively disclose the register of processing operations. We see this as a logical and necessary next step in the development of a transparent digital rule of law.
From passive to active public
The AVG does not have transparency as an afterthought, but as a fundamental principle. Article 5(1)(a) states that personal data must be processed in a way that is “lawful, proper and transparent”. Article 12 requires clear and accessible communication. Recital 39 emphasises that information should be “easily accessible and understandable”.
The “register of processing operations” of Article 30 AVG contains exactly the information needed to understand and verify data processing operations.
This also fits within the Open Government Act (Woo): transparency is a supporting principle there, with a clear obligation of effort for governments. In the report ‘Getting started with the effort commitment’, the processing register is already mentioned as an example of information whose active disclosure can make a lot of impact.
Public value
Structurally publishing processing registers brings several benefits. It lowers the threshold for citizens to exercise their rights, avoiding extra work and the urgency that comes from individual requests. At the same time, it strengthens internal quality: information becomes more findable and up-to-date. If policy remains unchanged, this administrative burden - and cost item - will continue to exist, in government and in business.
On the other hand, disclosure requires a quality improvement. Registers must be made suitable for public consultation. That requires investment, but also offers an opportunity to make existing administrative burdens more effective. Without an incentive to improve, registers now often lag behind in quality and timeliness.
It is time to trust citizens with the information about how their data is processed.
This article was also published at iBoard.
