Personal data authority moves to crack down on local waste pass

The Personal Data Authority (AP) is yet to take enforcement action against the waste pass system introduced by the municipality of Arnhem in mid-2014. Through this system of address-specific "waste passes" that have to be compulsorily scanned when disposing of residual waste, the municipality collects personal data from Arnhem residents without necessity. Similar waste pass systems have been introduced in numerous Dutch municipalities in recent years. This case thus sets an important precedent.

The trigger for the AP's decision is an enforcement request from Arnhem resident Michiel Jonker in May 2016. In June, the AP temporarily suspended enforcement. But now that the municipality continues to stubbornly collect personal data unnecessarily, and Jonker again urged enforcement on 4 September, the AP is taking action after all.

From 1 July 2014, the municipality of Arnhem installed a scanner system on every underground container for residual waste, which means that these containers can only be opened with an electronic pass containing the address details of the pass holder. The personal data thus collected are processed in a central data system of the municipality. According to the municipality, processing the personal data when taking out rubbish bags is "necessary" to prevent residents from other municipalities or companies from using the Arnhem containers.

Arnhem resident disputes this. He points out that the need has not been demonstrated and that other systems are also possible, for example with anonymous passes without a unique number.

Back in June 2014, Jonker made a request for help to the AP. At the time, however, the AP indicated that it understood this request only as a "signal" that was registered, but with which nothing further was done. This forced Jonker to object, appeal and appeal against the municipality's action.

Finally, on April 26, 2016 (ECLI:NL:RVS:2016:1114) that the municipality had never taken a formal decision to collect the personal data in question. In doing so, this highest administrative court indicated that the municipality of Arnhem had been illegally invading the privacy of all Arnhemmers since July 2014, through a de facto but not legalised measure. However, the Council of State was silent on how Arnhemmers could then defend themselves against this de facto encroachment on their right to privacy.

Immediately after the ruling by the Council of State, Jonker informed the Arnhem College of Mayor and Aldermen that from now on he would no longer put his rubbish in, but next to the waste containers, as long as his privacy was not respected. The opposition party Party for the Animals then asked twenty-five council questions on the issue.

When the municipality appeared to fail to act on the State Council's ruling, Jonker went to the AP on 31 May 2016 and filed a formal enforcement request there.

On 19 July 2016, the College of B&W answered the questions of the Party for the Animals. From the responses by B&W revealed that the municipality still wants to continue collecting personal data without necessity, with the excuse that they would be re-anonymised afterwards via a minor adjustment in the data system. This is characterised by the Privacy First Foundation as a "quick fix" and by Jonker as a "stopgap measure". Jonker: "Presumably they want to remove this anonymisation as soon as Diftar (differentiated waste tariffs) is introduced. But collecting personal data is not necessary for Diftar either. Moreover, privacy is a fundamental right that should take priority over local waste collection policy."

The AP has now informed that it will announce an intention to enforce in week 40. That is just after the Arnhem city council's scheduled consideration of the waste policy. Jonker: "It is likely that the AP will still hope to refrain from enforcement if the city council instructs B&W to immediately stop the current collection of personal data."

Jonker is happy that now, after more than two years, there finally seems to be movement in the case, but also indicates that the course of events raises many questions about privacy protection in the Netherlands. "It is essentially a simple case. Yet the municipality, the judges and the Personal Data Authority have each, in their own way, dug in their heels first. For an ordinary citizen, it is impractical to stand up to that. Thanks to my legal background knowledge and certain experiential expertise, and thanks to support from Privacy First in approaching the media, I was able to do something. As citizens, we pay taxes to be protected by the government. But in this case, it seems like government agencies are mostly concerned with protecting themselves and each other from a citizen's inconvenient request to simply apply the law."

Read HERE more background information and recent media on the case.