ⒾMachine translations by Deepl

Privacy First lawsuit against ANPR mass surveillance

Article
Surveillance
6 March, 2024

Standing policy of Privacy First Foundation is to challenge mass privacy violations in court and have them declared unlawful. In recent years, Privacy First successfully did so against the central storage of everyone's fingerprints under the Passport Act, against the storage of everyone's communication data under the Telecommunications Retention Act and (in coalition) against mass risk profiling by the System Risk Indication (SyRI). An issue that also lends itself ideally to such litigation concerns the Dutch legislation on automatic number plate recognition (Automatic number plate recognition, ANPR) as in force since 2019. Privacy First has filed a lawsuit against the State to invalidate the ANPR law. The court hearing in the case will take place on 12 March at the District Court of The Hague.

Violation of European privacy law

Under the ANPR Act (art. 126jj Sv.), the license plates and locations of millions of cars in the Netherlands (i.e. everyone's travel movements) are continuously stored for four weeks in a central police database for, among other things, investigation and prosecution purposes, regardless of whether one is suspected of anything. This is totally unnecessary, totally disproportionate and also ineffective, several independent studies have shown in recent years. Moreover, supervision is lacking and the system can easily be abused. The current ANPR law thus constitutes a massive privacy violation and simply has no place in a free democratic constitutional state. Privacy First has therefore decided to file a lawsuit against the State to invalidate the ANPR law on the grounds that it violates European privacy law.

The ANPR legislation at the heart of Privacy First's lawsuit is primarily concerned with the mass collection and storage of everyone's "historical" ANPR data, also known as "no hits". This should be distinguished from the long-standing police practice where licence plates of suspects (so-called "hits") can be used for detection.

Ground proceedings

A summary proceedings of Privacy First against the ANPR Act took place. In this case, however, the District Court of The Hague ruled that there would be no sufficiently urgent interest in these summary proceedings. This ruling was incomprehensible, as a daily massive privacy violation by definition involves an urgent interest to have that violation legally tested and stopped. Privacy First subsequently decided to pursue this case as proceedings on the merits in which all relevant points of law could be raised. In early 2023, Privacy First filed a comprehensive subpoena filed. In early 2024, the Hague court declared Privacy First in the case admissible. This interlocutory judgment may set broader precedent for similar cases.

Chance case

Via Pro Bono Connect has Privacy First the law firm CMS engaged to conduct both the summary proceedings and the proceedings on the merits for us. This lawsuit is also supported by the Digital Freedom Fund. If necessary, Privacy First will pursue the case to the highest courts, including the European Court of Justice in Luxembourg. Given the European case law on the matter, Privacy First considers the likelihood of a successful trial to be extremely high.

The court hearing in our ANPR case will take place at The Hague District Court on Tuesday 12 March at 9.30am (Case number C/09/642185 HA ZA 23-116, Stichting Privacy First vs the State). Everyone is welcome to attend; directions can be found at here.

Update 12 March 2024:

The court hearing took place today; click here for our lawyers' pleading note (pdf). The court's ruling is tentatively scheduled for Wednesday 5 June next.

Update 29 May 2024:

It was with great disappointment that Privacy First today learned of the early judgment (pdf) of the District Court of The Hague (also published at jurisprudence.com). The judgment reads largely like a purpose reasoning and is relatively superficial, incorrect and incomprehensible. Particularly telling in this context is the following passage: "The importance of the power of Article 126jj Sv for investigation is not refuted by the circumstance that it could not be established in the evaluations that (i) (more) fugitives were apprehended using that power or (ii) that Article 126jj Sv plays a relevant role in the taking of evidence in criminal cases and thus leads to more convictions." (ro. 4.14) Nevertheless, the court considers the ANPR Act useful, necessary and proportionate even without independent oversight. Privacy First will soon decide on appeal to overturn this verdict.