Privacy still a paper tiger for VWS

Privacy organisations are not welcome at the Healthcare Information Council, a ministry discussion table that cuts important knots on security and privacy in digital healthcare communications. How it really works was demonstrated very recently by the 'Corona opt-in', in which privacy and medical professional secrecy were unceremoniously offside were put in place. No one from the privacy community was asked for advice.

In 2018 requested the House of Representatives in a motion to actively involve privacy and civil rights parties in the Healthcare Information Council (IBZ). In the IBZ, parties from the healthcare sector make important plans and agreements with the Ministry of Health on the development of digital healthcare communication. Privacy First has been lobbying and campaigning on this issue for years, including through our campaign Specific Consent.

In response to the register of Privacy First for participation in the IBZ, however, Minister Bruins left know That the IBZ sees no place for the privacy organisation at its discussion table. "Indeed, the council is an administrative collaboration of participants from the healthcare field. The core group of the Healthcare Information Council consists of participants from the members of this council. As a result, the Foundation can also not participate in the Core Group as a gateway to the Information Council.", the minister said. According to the ministry, Privacy First can provide its input on privacy and security in the national Information Security and Privacy Expert Group (IV&P), of which Privacy First is already a member and "where our input is very welcome." Last week, however, there was a deafening silence in this corner.

Review and correction by privacy experts

Privacy First writes in a comment today to the ministry that the role of the expert group IV&P is not heavy enough to make a difference in the decision-making of the core group IBZ, which in the current hierarchy has the last word in privacy and security decision-making.

The advisory role of this Expert Group should therefore be replaced by a reviewing and, if necessary, corrective role. Once this is the case, we believe that sufficient justice is done to the intention of the aforementioned Parliamentary motion, and participation in the Expert Community IV&P offers sufficient perspective.

Citizen's perspective underexposed

According to Privacy First, it is of great importance that, in addition to the interests of healthcare parties, the interests of citizens are also given formal representation in the Information Council. Currently, civil rights organisations and independent privacy and security experts do not have an obvious place in the IBZ, even though these parties are needed to appreciate the societal implications of proposals and, if necessary, propose alternatives. NGOs such as Privacy First can represent citizens broadly and offer perspectives that might otherwise remain underexposed.

Privacy by design as a starting point

Among other things, Privacy First aims to help achieve privacy by design in the architecture of healthcare ICT, a requirement that many healthcare communication applications do not meet. This is despite several motions passed in parliament over the past decade calling for this, and also being a requirement under the General Data Protection Regulation. To enable a critical review of privacy implications of proposals, parties from outside healthcare should be given a sufficiently strong role in the IBZ's governance structure.

The IBZ, according to Privacy First, should include procedures that independently test whether the architecture of current and future healthcare communications meets the requirement of privacy by design. Cross-fertilisation between privacy and civil rights organisations and the healthcare parties that are now tying the knots in the IBZ is crucial in this regard. After all, the interests of healthcare umbrella organisations and other stakeholders are not necessarily the same as those of citizens (sometimes non-patients) at large. Civil rights organisations such as Privacy First are ideally placed to represent these interests.

Read the entire letter here (pdf) which Privacy First sent to the Ministry of Health, Welfare and Sport today.