ⒾMachine translations by Deepl

Personal data authority tolerates illegal waste pass

Article
Uncategorized
1 May, 2017

Personal Data Authority acknowledges massive Privacy violation, but refuses to intervene

After years of legal battle, the Personal Data Authority (AP) has recently decided not to take enforcement action against the Arnhem municipality's waste card, while at the same time the same AP has acknowledged that the current use of this waste card completely violates the Personal Data Protection Act. Besides Arnhem, the waste pass is also in danger of being introduced in numerous other Dutch municipalities. The Arnhem citizen (Mr Michiel Jonker) who has been taking up this cause for the last few years commended at both the AP and the Council of State, this has forced them to now take this issue back to court to end this blatant privacy violation.

Rejection of enforcement request due to 'special circumstance'

Even before the municipality of Arnhem introduced a system of address-based waste passes almost three years ago, the Personal Data Authority was alerted by Mr Jonker that this violated the privacy of all Arnhem residents, in violation of the Personal Data Protection Act (Wbp).

The AP, as supervisor and enforcer, then did nothing for two years, while Jonker pursued legal proceedings all the way to the Council of State, which ruled in his favour on 26 April 2016. As the municipality of Arnhem subsequently refused to comply with the ruling of the highest administrative court, Jonker submitted an enforcement request (again) to the AP on 31 May 2016.

On 20 April, the AP rejected this enforcement request. While the AP did note that the municipality had been in breach for three years, since the municipality decided at the end of March 2017 to introduce DIFTAR (differentiated waste charge) as of 1 January 2018, the AP considers this to be a "special circumstance" allowing enforcement to be waived as yet.

Municipal "business model"

From 1 July 2014, the municipality of Arnhem installed a scanner system on every underground container for residual waste, which means that these containers can only be opened with an electronic pass linked to the address details of the pass holder. The personal data thus collected are processed in a central data system of the municipality (WHO offers residual waste WHERE and WHEN). According to the municipality, this is "necessary". Jonker disputes this. He points out that the need has not been demonstrated and that other, privacy-friendly systems are also possible, for example with anonymous passes without a unique number.

In its decision rejecting Jonker's enforcement request, the AP confirmed that the municipality had been collecting personal data on all its residents without necessity since July 2014. But since that need will be there from 1 January 2018, when Arnhem introduces the DIFTAR (differentiated waste tariff) system, according to the AP, there is now "concrete prospect of legalisation".

The alternatives put forward by Jonker are rejected by the AP because they would not be in line with the "business model" chosen by the municipality. The AP also argues that the processing of the personal data "fits" with the municipality's public duties. The AP thereby ignores the legal criterion that the processing of personal data must not only fit with, but also be necessary for the performance of a public task.

Personal data authority facilitates privacy breach

Jonker: "DIFTAR also does not require processing of personal data. Here, the AP is not acting as an enforcer, but as an advocate for the infringer. By subordinating the protection of a fundamental right to the "business models" organisations choose, the AP is giving a free pass to both governments and private companies to eliminate the law on this point. In this way, a government can first process personal data illegally, then introduce a new "business model", and then claim that respecting legal requirements would conflict with this new "business model". That, of course, leaves little of the rule of law. It is an example of overblown neoliberalism," Jonker said.

Jonker says he will appeal the rejection to the court. "I will ask the AP if it agrees to appeal directly to the court. After all, sufficient arguments have been exchanged between me and the AP over the past three years. Further delay is not desirable."

Privacy First Foundation is supporting Mr Jonker in this case. Requests for interviews with Jonker can be made through Privacy First.

Update 2 May 2017: see also https://www.security.nl/posting/513015/Toezichthouder+treedt+toch+niet+op+tegen+afvalpasjes+Arnhem
http://www.arnhem-direct.nl/berichten/autoriteit-persoonsgegevens-treedt-niet-op-tegen-afvalpas-gemeente-arnhem/
http://www.binnenlandsbestuur.nl/digitaal/nieuws/juridische-strijd-om-arnhemse-afvalpas-krijgt.9563035.lynkx

Update 3 May 2017: Meanwhile, the AP has published et al, see https://autoriteitpersoonsgegevens.nl/nl/nieuws/ap-gemeente-arnhem-past-afvalsysteem-aan . Click HERE for the full AP decision (pdf).

Very readable article on DIFTAR in De Gelderlander: http://www.gelderlander.nl/arnhem/arnhem-haalt-je-privacy-uit-de-vuilnisbak~aec9ffa1/

Municipality of Arnhem response: https://www.arnhem.nl/actueel/alle_nieuwsberichten:R-hsF1b7T5SC7K5T8o4zOA/Reactie_gemeente_Arnhem_na_uitspraak_Autoriteit_Persoonsgegevens_over_afvalpas

Apt comment on DIFTAR: https://maartenswebblog.wordpress.com/2017/03/04/diftar-het-nieuwe-systeem-van-afvalinzameling-in-arnhem/

To be continued...