Trouw.nl, 25 March 2015: 'Can we still trust the AIVD?'

“The database of DNA profiles kept by the General Intelligence and Security Service (AIVD) must be destroyed. No guidelines have been set for storing the cellular material and associated profiles, so it is against the law. But the AIVD built a database anyway. Can you still trust the intelligence service?

A report by the Intelligence and Security Services Regulatory Commission (CTIVD) was published today. According to the report, data was kept in a database "on a limited scale". It involved names linked to DNA profiles.

Examination of DNA data is regulated by law, but once identity is established, DNA profiles and any other material, such as fingerprints, must be destroyed. The retention of DNA profiles and cellular material by the AIVD is currently not regulated by law, and is therefore not allowed.

The AIVD would not say how many DNA profiles were stored in the database. The report states that "all DNA profiles prepared so far have been stored in an AIVD DNA database". According to the AIVD, the minister has since ordered the destruction of all DNA-related data that had been stored. That has been done. So has the database.

Can you still trust the AIVD?
"Outrageous that the AIVD kept a DNA database on its own, against the legal rules." Vincent Böhre, a lawyer at the Privacy First foundation, finds the intelligence service's behaviour objectionable. He wonders who else was given access to the DNA data. "Were these data also shared with foreign intelligence agencies? And are there other databases with data that the AIVD should have actually deleted?"

The foundation wants the AIVD to inform and apologise to all those affected. "The Wiv (the Intelligence and Security Services Act of 2002, ed.) prescribes that people whose privacy has been violated should be informed after some time, where possible. The DNA data have been destroyed, so they are apparently no longer relevant, so the AIVD could tell those people what it has done."

"The funny thing is: we have quite a good relationship with the AIVD. The head of the intelligence service, Rob Bertholee, said in January literally that privacy is as sacred to him as it is to Privacy First. And in 2012, during a lecture for us that he is also not in favour of Big Brother. 'There are limits to what you can and cannot do,' he said at the time."

Yet Böhre still trusts the AIVD chief. "Do I think he is a hypocrite? No, absolutely not. He made a sincere and honourable impression on me. Maybe he had no insight into this, crazy as that sounds."

What should happen, according to the CTIVD?
It notes that there is no basis in the Wiv for establishing a DNA database. "This therefore requires its own regulation, recognisable to the public." What will and will not be allowed in that regulation should be decided by the House of Representatives.
According to the Commission, there is also a risk that DNA profiles and bodily material have been kept for too long. It should be more explicitly regulated who is responsible for retaining and destroying these data and how this is done.

How did minister Plasterk respond?
Interior Minister Plasterk has already announced that he will take on board all the report's recommendations. He is also looking at how the CTIVD's conclusions can be taken into account when reforming the Wiv.

Is the Commission satisfied with this?
"Of course, that is always good to see," says Hilde Bos, secretary of the CTIVD.

The investigation was announced in late March 2013 and was completed in early January 2015. Do CTIVD investigations always take so long?
"No," Bos explains. "We usually try to spend a maximum of a year on investigations. But if the minister or the House of Representatives submit other investigation requests to us, for instance about the MH17 or Roel van Duijn, such an investigation can be delayed. In addition, it takes quite a long time before it becomes public, because, for example, it must first be checked whether it still contains state secrets."

Collecting material
The report further reveals that the AIVD collected body material in two operations with the aim of conducting a health investigation, but this is not allowed. This kind of material may only be analysed for the purpose of identifying someone.

The procedures were also not followed entirely properly in a number of cases: for instance, in a number of cases, the reason for examining bodily material was not properly justified, or permission for DNA testing, which is mandatory, had not been granted in advance. In two cases, the AIVD was also already aware of the identity of the person concerned, and therefore the service was not allowed to conduct DNA research - but it did.

Conditions

According to the law, there are two preconditions that must be met when collecting material for forensic biological research.

Firstly, the AIVD may only search objects with bodily material present on them. No material may be taken from on the persons' own bodies, for example by covertly pulling out body hair. The physical integrity of persons may not be infringed.

Second, establishing an identity must be the purpose of the investigation. Thus, the law does not allow for investigations to be conducted if identity has already been established. For example, it is forbidden to store a DNA profile to re-identify a suspect in the future. Nor may an investigation be aimed at establishing a person's ancestry or health."

Source: http://www.trouw.nl/tr/nl/4492/Nederland/article/detail/3926188/2015/03/25/Kunnen-we-de-AIVD-nog-wel-vertrouwen.dhtml, 25 March 2015.