Letter from Privacy First chairman against 4-week license plate storage (ANPR)

This month, the House of Representatives will consider a bill by minister Opstelten on automatic number plate recognition (ANPR). Under Opstelten's bill, the license plates of all motorists will now be stored for four weeks for investigation and prosecution purposes. In Privacy First's view, this constitutes a blatant violation of privacy. A parliamentary debate on the bill was postponed until further notice yesterday afternoon deferred. Should parliament pass the bill soon, Privacy First Foundation will sue the Dutch state for collective privacy violation. Privacy First already made that commitment when the bill in February 2013 dear Opstelten was submitted to the House of Representatives. Below is the full text of the letter sent to the Lower House by the chairman of Privacy First on Tuesday 8 April: (click HERE for the original in pdf and HERE for a media overview)

Honourable members of the House of Representatives,

You are being asked to approve a bill to give the government the right to store all vehicle registration (or travel) data of motorists for a period of four weeks for investigation and prosecution. This will make every citizen a potential suspect. Mind you, the travel data of 16 million people over a 4-week period to mainly collect outstanding fines. This will be done through expansion of automatic vehicle registration (ANPR). Under the current ANPR practice, only reasoned suspicious license plates (so-called "hits") are retained and traced, incidentally without a specific legal basis already in place, backed by privacy safeguards. However, instead of still providing the current practice with a sound legal basis, minister Opstelten's bill immediately goes 10 steps further by storing everyone's license plate in a police database from now on. This is his umpteenth central database ICT project, starting with EUR 4 mln in costs, in reality heading towards EUR 50-100 mln. Privacy First recognises the following pattern in this:

- Technology-driven "solutions" to a so-called societal problem, lobbied by ICT vendors;
- Then locally test the implementation and temporarily test it outside the law (Rotterdam);
- Amend legislation without looking at rule of law principles;
- Using Lower House as voting cattle to rush bill through fast;
- If Senate does not agree, then proposal to abolish "burdensome" Senate.

Privacy First urges you NOT to approve this draconian law, which is diametrically opposed to all basic principles of our rule of law, for the following reasons:

- What is the need to check all 16 million citizens for a small "by-catch" in addition to the already existing database for "hits"?
- This law is completely disproportionate and leads to a social "chilling effect" and self-censorship among citizens due to the fact that the government is constantly looking over the shoulder of innocent citizens.
- This law will lead to function creep (goal shifting) with new objectives such as additional taxation, expansion of route controls, kilometre charges, environmental taxation and unauthorised and unrestrained analyses of the travel behaviour of individual citizens and groups (profiling).
- The AIVD can request all ANPR data. However, Privacy First's enquiries with the AIVD lead to the conclusion that current legislation already gives them enough room to do their job.
- If the NSA affair and Snowden have taught us anything, it is that ANPR data will be used directly by intelligence agencies, exchanged and thus become completely unverifiable.
- If this law is passed, the fence is drawn, then with just as much reason, a new bill will be created in which all private movements of all 16 million citizens in public spaces will be monitored and stored, first for 4 weeks and later indefinitely, to perhaps find a "suspicion" somewhere.
- Given past experience, such databases offer no guarantee that they will not be hacked, that access and protocols in them will be guaranteed, that a monthly copy will not be made by intelligence agencies, etc.
- The implementation and safeguarding of this law is in no way regulated, see also Privacy First's questions to the minister below. The House is even being asked to approve the law without the corresponding Order in Council already in place.
- Already there are some 500 ANPR cameras, this number will soon grow further and lead to a legally regulated electronic concentration camp where every motorist can be tracked from the front door to all destinations all day long.
- Even in current practice, there are still gaps in the right for citizens to know whether they are registered in a database of "hits", and if so, how to get out of it and with what safeguards. In practice, one internal phone call often proves sufficient, without any search warrant, to briefly follow a "number" on the highway....

Honourable members of parliament, this bill belongs in only two places: in a dictatorship or, in our open democratic society, in the bin. A minister who earlier in Rotterdam proved to not take our laws very seriously and knowingly allowed all ANPR data to be stored for 4 months cannot be trusted, in my view. As the innkeeper trusts his guests, logical right? My advice to the minister is to make his position vacant and apply to the NSA where another nice position has become available after Snowden's departure. If this bill is passed, Privacy First will take immediate legal action to safeguard the cornerstone of our legal system and save innocent citizens from the clutches of the government that has degenerated into a control frenzy.

Below are a number of questions which we have previously put to the minister and to which we believe no (adequate) answer has been given. After one conversation with some privacy organisations, the minister claims that there has been a consultation on this bill and that a "Privacy Impact Analysis" (PIA) has been carried out. However, nothing could be further from the truth. Also, a non-independent PIA is of no use for a bill that in any case does not comply with the basic principles of our rule of law. We have pointed this out as well. And these principles are non-negotiable unless a democratic rule of law is abandoned.

Privacy First's questionnaire to the minister:

1) To what extent is 4 weeks of ANPR data storage strictly necessary (as opposed to "perhaps useful" or "perhaps convenient") in a democratic society based on freedom and trust (Art. 8 ECHR)?

2) In what way does this bill comply with the general human rights duty of the Dutch state to continuously protect the right to privacy promote instead of eroding this right?

3) How does this bill strengthen the relationship of trust between the Dutch people and the Dutch government?

4) Who prepared the Privacy Impact Assessment accompanying the bill? Why was it not done by an external, independent party?

5) How does this bill safeguard the principle of data minimisation?

6) How does this bill safeguard the principle of privacy by design?

7) How are the presumption of innocence and the prohibition of self-incrimination (nemo tenetur) guaranteed in this bill?

8) How does this bill guarantee the right to travel freely and anonymously in one's own country?

9) How does this bill guarantee press freedom and journalistic source protection?

10) How does this bill guarantee freedom of association and freedom of demonstration?

11) In what way does this bill regulate international exchange of ANPR data with foreign governments and (further) exchange with third parties?

12) In what way does this bill function creep and misuse of ANPR data in the short, medium and long term? In what ways, for example, are ANPRdata mining and profiling excluded?

13) How does this bill guarantee that stored ANPR data will not be misused by officials, hackers, criminal organisations, foreign governments, etc?

14) For what purposes, in what manner and with what retention periods does the AIVD intend to use the stored ANPR data?

15) When will the promised Order in Council accompanying this bill be ready? Why is the House of Representatives being bypassed in its preparation?

16) What increase in fake number plates and related identity fraud is this bill expected to cause? What countermeasures are envisaged in this regard?

17) The European Commission was previously critical of the Dutch camera system @MIGO-BORAS. Has the European Commission already been informed about the expansion of @MIGO-BORAS with 4 weeks of ANPR storage? If so, what was the Commission's response?

18) How does this bill contribute to reclaiming the Netherlands' former international position as a human rights guide country? How does the Dutch government guarantee that this bill and associated technology will not be adopted and abused by less democratic regimes abroad? Has there been coordination with the Ministry of Foreign Affairs on this?

19) What are the financial costs and benefits of this bill (including associated side effects) in the short and long term?

20) Do the ANPR reference lists consist of black and white lists? If so, what are the criteria for inclusion in the white lists?

For further information or questions regarding the above points, Privacy First can be reached at any time on telephone number 020-8100279 or by email: info@privacyfirst.nl.

Sincerely,

Drs L.T.C. (Bas) Filippini,
chairman Privacy First Foundation

Update 13 May 2014: the House debate on the bill was again postponed until further notice today. The House of Representatives is first waiting for further advice from the Council of State and the Personal Data Protection Board (CBP).