Privacy First input to House debate on privacy

On the occasion of the privacy debate on 15 September next. Privacy First sent the following letter to the House of Representatives today (PDF):

Honourable MPs,

Before you lies an interesting task: how can the Netherlands start developing from European middle man to international leader in the field of privacy? This requires the best possible privacy legislation combined with the most privacy-friendly technology. By investing in this, the Netherlands also develops enormous export opportunities, especially in technological terms. Privacy First's guiding motto here is "own choices in a free environment." In other words: freedom of choice for citizens in a society where privacy is optimally guaranteed both legally and technically. This applies in both an individual and collective sense. After all: without privacy, no free individual development and no free democratic dynamics.

Earlier Senate AO and Franken motion

The importance of good privacy protection for a democratic constitutional state can hardly be overestimated. In light of this, it is all the more painful to note that the level of privacy protection (and perception) in the Netherlands has fallen sharply over the past 10 years. At the same time, Privacy First notes that there now seems to be a positive turnaround, both at European and national level. At the European level, this is evident from, among other things, the plans to revise the European Privacy Directive. Also at the national level, privacy awareness among policymakers seems higher than a few years ago. This trend offers perspective. Nevertheless, on the occasion of the upcoming General Consultation (AO) on Dutch privacy policy, Privacy First is happy to introduce a number of points of interest. These points of interest serve to complement the general concerns which Privacy First sent to the Senate for the purpose of a similar AO earlier this year. Also in this regard, Privacy First would like to refer to the Franken motion which the Senate subsequently passed. Privacy First hopes that the Lower House will adopt this motion in its entirety and unanimously. Privacy First also advises the Lower House, in preparation for the AO, to take inspiration from the Recommendations made by the Scientific Council for Government Policy (WRR) earlier this year in the report iGovernment.

Collection interest actions in privacy law

According to the letter dated 29 April 2011 the government is "not dismissive of the introduction of collection interest actions in privacy law". Outside of the European Commission's intended introduction of privacy law class actions However, Dutch capabilities in this regard have long existed, as evidenced by Art. 3:305a BW and Art. 1:2(3) Awb. In this regard, Privacy First also refers to the legislative history of these articles, the Personal Data Protection Act (Wbp) and Art. 10 of the former Personal Records Act (Wpr). During the Parliamentary debate on whether or not to grant litigation powers to the Human Rights Board (end of March 2011), Minister Donner seemed to distance himself from the collective action right - and thus from the above-mentioned articles of law - in a human rights (including privacy) sense. In doing so, the minister explicitly referred to ongoing court cases against the new Passport Act. Subsequently, the government announced its intention to increase court fees. The existing right of access to justice for both idealistic organisations and individual citizens is seriously compromised by this. Moreover, the question arises to what extent the existing legislation on collecting interest actions is still recognised by this cabinet at all. In Privacy First's view, these developments indicate an imminent crisis in the rule of law that will extend far beyond the Wbp.

Fingerprints in identity cards

End of April 2011 Minister Donner made a commitment to amend the new Passport Act so that citizens would no longer have to provide fingerprints for applying for a new identity card. However, this amendment to the law will not be submitted to the Council of State until mid-2012 and will therefore not enter into force until late 2012/early 2013. It is hard to see why this cannot be expedited by the House of Representatives. Given the privacy objections to the use of fingerprints and the huge error rates in current biometric technology, the Dutch government could also make a case for repealing or amending the Passport Regulation at the European level at the insistence of the House of Representatives.

Special categories of personal data

In the letter from the State Secretary for Foreign Affairs dated 21 December 2010 a few paragraphs are devoted to the concept of '(sensitive) personal data'. In Privacy First's view, the current scope (and thus protection) of this concept also includes 'pseudonymised personal data'. Examples include medical data stored pseudonymised in the Dutch central database DIS (Diagnose-behandelcombinatie Informatie Systeem) and other (e.g. biometric) data that can be encrypted through encryption techniques. A revised Privacy Directive (or regulation) should explicitly recognise and protect biometric and genetic data as 'sensitive personal data'. Any pseudonymisation of such data does not alter this. An interesting fact in this context is that ICT companies are currently increasingly researching personalised and managed storage of medical and other privacy-sensitive data.

Camera surveillance and ANPR

Finally, a few comments on this government's plans to make wider use of public camera surveillance and automatic number plate recognition (ANPR). Through Privacy Impact Assessments (PIA), such plans should be tested as thoroughly and independently as possible against international, European and national law and against requirements of social necessity, effectiveness and proportionality (including public cost-benefit analyses). In combination with ongoing developments in the field of automatic facial recognition and digital facial scanning, an Orwellian future unprecedented in history looms large. Privacy First therefore urges the House of Representatives not to let it come to this and to block the government's plans for more camera surveillance and ANPR. This will benefit both the freedom of Dutch citizens and the spending of scarce government resources, also as there are privacy-friendly alternatives available both legislatively and technologically. Privacy First is very willing to educate the Chamber on this, so that clear and balanced choices can be made. While preserving the principles of our rule of law, from the premise that these principles are non-negotiable, as those who trade freedom for security deserve neither!

Sincerely,

Drs L.T.C. (Bas) Filippini
chairman Privacy First Foundation