Lawsuit over privacy discrimination OV-chipkaart at Council of State

NS makes travellers pay extra for privacy. Personal Data Authority refuses to enforce. Council of State will review case.

On Monday 4 September next, the Administrative Law Division of the Council of State will consider two legal questions: may the Personal Data Authority (AP) refuse to enforce when train passengers with a benefit-hours season ticket are forced by NS to pay extra if they want to maintain their privacy? Or may the AP perhaps even refuse to investigate the matter at all, despite its supervisory duty?

Three years ago, NS abolished paper train tickets and required all travellers to use an OV-chip card from now on. It turned out that travellers who opted for an anonymous OV-chip card for reasons of privacy did not receive a benefit-hours discount from NS - even if they had held a benefit-hours season ticket for many years. Arnhem resident Michiel Jonker asked the AP to take enforcement action, which the AP refused. On 16 August 2016 The Gelderland District Court partially vindicated Jonker and ordered that the AP should still seriously investigate the case, but did not yet oblige the AP to take enforcement action. The AP and Jonker both appealed to the Council of State.

With effect from 9 July 2014, NS Reizigers BV has made it impossible for season ticket holders to buy a paper ticket that is checked in the train together with their season ticket. NS only allows those who want to travel at discounted rates in the advantage hours to do so if they check in and out with a personal public transport chip card that also shows their identity. As a result, travellers will only receive benefit-hour discounts if they have all their individual travel movements registered by NS via the personal OV-chip card. If they wish to maintain their privacy, they will lose their benefit-hour discount.

Jonker perceives the fact that a traveller with privacy in benefit hours has to pay more than a traveller without privacy as a form of discrimination. "I want to be able to use public transport like I used to without a company or the government being able to track exactly where I have been at any given time. That is also what the anonymous OV-chipkaart is for. But it is discouraged in this way. An unjustified distinction is made between people with privacy and people without privacy. People who want to keep their privacy have to pay more. That is discrimination. NS is thus trying to force me to make my private travel data available for commercial purposes. Dutch laws and European treaties prohibit that."

Jonker also objected to the way NS transferred his personal data to Trans Link Systems (TLS). "NS says I have a contract with TLS, but that's nonsense. I never entered into such a contract, and no train passenger has. NS has changed its general terms and conditions. But NS cannot legitimately include in its general terms and conditions that I would suddenly have entered into a contract about my personal data with a third party. You see here how the so-called privatisation of a public service, public transport, leads to unlawful practices."

- The AP has appealed against the court's order that the case now be seriously investigated.

- Jonker appealed against the lack of an order for the AP to even signal an intention to enforce, after all these years of tolerance.

- NS will also participate in the lawsuit in court.

Jonker is supported in the case by the Privacy First Foundation and Society for Better Public Transport. The court hearing is public: everyone is welcome to attend.

Case information: M. Jonker vs. Personal Data Authority, case no. 201607123/1/A3.
Timing: Monday, September 4, 2017, 10.30am.
Location: Council of State, Kneuterdijk 22, The Hague. Click HERE for directions.

Update 4 September 2017: the court hearing today went relatively well, the judges were well into the matter. Click HERE for Mr Jonker's pleading note (pdf). In six weeks (or later), the Council of State will rule.

Media:
https://www.computable.nl/artikel/nieuws/security/6191053/250449/conflict-ap-en-privacy-first-om-ov-chipkaart-ns.html
https://www.ad.nl/economie/privacy-wordt-geschonden-door-ov-chipkaart-met-abonnement~a4405fa0/
http://www.gelderlander.nl/economie/privacy-wordt-geschonden-door-ov-chipkaart-met-abonnement~a4405fa0/
http://www.hartvannederland.nl/nieuws/2017/ns-beperkt-korting-onterecht-tot-abonnees/
https://www.bnr.nl/nieuws/mobiliteit/10328758/dalurenkorting-ns-discriminatie-of-niet
http://www.treinreiziger.nl/reiziger-eist-anoniem-reizen-ook-abonnement/
http://www.dvhn.nl/binnenland/NS-beperkt-korting-onterecht-tot-abonnees-22465090.html
https://www.security.nl/posting/529824/Raad+van+State+onderzoekt+of+AP+moet+optreden+tegen+NS

Update 22 September 2017: the Council of State ruled on the case on 20 September last, see ECLI:NL:RVS:2017:2555. In an initial reaction, Jonker said: "A ruling two weeks after the hearing is remarkably quick, even considering the six-week or longer deadline the Council of State had announced at the hearing. It is possible that the Council of State ruled quickly in order not to have to say anything yet about the outcome of the AP's investigation commissioned by the court last year, on which the AP will decide soon. Or perhaps the Council wants to give the AP an opportunity to align such a new decision with the ruling."

Summary on key points of the ruling:

(1) The Council of State, like the court, found in favour of Jonker on substance: the AP should not have rejected Jonker's enforcement request without conducting sufficient investigation in this particular case.

(2) According to the Council of State, the earlier studies to which the AP had referred do not show "whether the processing of personal data by means of a personal OV-chipkaart is necessary for the conclusion and performance of the agreement concerning the benefit-hours season ticket", nor "whether, as a result of making the personal OV-chipkaart for a season ticket compulsory, such processing of personal data is adequate, relevant and not excessive."

(3) Furthermore, the Council of State notes that "the circumstance that the OV-chipkaart generally complies with the Wbp does not mean that the circumstance that it is impossible to combine a personal product with an anonymous card also complies with the Wbp."

(4) Furthermore, the Council agrees with the court that the AP was not entitled to infer the existence of a necessity for processing personal data from the general terms and conditions drawn up by NS itself and the terms and conditions of the benefit-hours season ticket.

(5) On the other hand, the Council does not agree with Jonker that the AP should have already concluded on the basis of the already known facts that there were grounds for an intention to enforce. According to the Council, the AP only needs to take a position on this after a more extensive investigation.

(6) Procedurally, the Council agrees with the AP that the court should not have ordered the AP to conduct a more extensive investigation under Section 60 of the PDPA. According to the Council, the court should only have set aside the AP's rejection decision, without ordering such an investigation, because the court thereby "usurped the AP's policy space". The AP included in its policy a "phasing" of investigations, with the investigation ordered by the court falling only in phase III.

Jonker: "I am pleased that the Council of State, like the court, has ruled in my substantive favour that my enforcement request should not have been so easily rejected by the AP. The Council punctured a number of fallacies put forward by the AP."

Still, Jonker is not completely satisfied: "The decision of the Council of State also leads to the fact that the AP now has the opportunity in a new round to come up with new arguments to start rejecting my enforcement request after all. It feels a bit like a knockout tournament with two participants and half a dozen rounds, in which the home team, i.e. the AP, is immediately assured of a final place, while the other party, i.e. me, has to win the match in all those rounds to even get into the final. And if I make even one real mistake, I'm out. That is actually the opposite of effective legal protection. What also strikes me is that the Council of State did not mention the European Convention on Human Rights (ECHR) at all, even though the ECHR offers more fundamental protection than the European Privacy Directive it did mention. I have always referred to the ECHR."

Asked what any new arguments from the AP might then be, Jonker replied: "Just last week, I received a so-called findings report from the AP on the investigation that the AP was ordered to do by the court. But because the AP has asked me to keep that confidential until the AP has made a new decision on my enforcement request, I don't want to say anything further about it at the moment. Of course, the AP should have sent that report to me well in advance of the Council of State's court hearing, but unfortunately chose to wait to do so until after the court hearing - even though NS was essentially informed. That does not contribute to a fair trial. Next week, the AP will hold a hearing. And after that, it will probably be several weeks before the AP makes a new decision. That decision I can then possibly appeal and appeal again. It does keep me off the streets..."

To be continued, then.

Media:
http://www.omroepgelderland.nl/nieuws/2143524/Treinreiziger-uit-Arnhem-krijgt-weer-gelijk-meer-onderzoek-naar-privacy-discriminatie-ov-chipkaart
https://www.security.nl/posting/532206/Autoriteit+Persoonsgegevens+hoeft+NS+niet+uitgebreid+te+onderzoeken (with comments by Michiel Jonker below article).
https://www.ovmagazine.nl/2017/09/opnieuw-onderzocht-tegen-privacydiscriminatie-ov-chipkaart-1527/ 

Update 7 May 2018: On 8 September 2017 (a few days after the court hearing in the Council of State), the AP sent Mr Jonker a findings report on the results of the extensive investigation ordered by the Gelderland District Court on 16 August 2016. On 25 September and 28 November 2017, Mr Jonker sent to the AP a response to the findings report, in which he severely criticised the findings. In his view, the report seemed to serve mainly as a tool for covering up, rather than reflecting an impartially conducted investigation by an independent regulator.

Despite Jonker's criticisms, the AP decided on 22 December 2017 that the investigation carried out did not provide a reason to declare Jonker's original objection still valid. The AP still found that nothing was wrong. Jonker appealed this second decision on objection to the District Court of Gelderland on 29 January 2018 (second appeal in the case, case number 18/546). Because the AP has since investigated, this second appeal is no longer about whether the AP should investigate, but about the substantive outcome of that investigation.

Meanwhile, a second legal track is ongoing in the same case. On 24 November 2016, Jonker had asked the AP to include, in the comprehensive investigation ordered by the court, the fact that two unique pass numbers are affixed to every so-called "anonymous" NS public transport chip card, making those cards effectively no longer anonymous. The unique pass numbers should be considered personal data.

The AP refused to include this fact in its comprehensive investigation, and instead decided to conceive of it as a new, separate enforcement request, where, as the first time, the AP tried to do no more than an "exploratory" or "global desk investigation". After this "global" investigation, the AP concluded on 28 September 2017 that nothing was wrong. Jonker filed objections to this on 16 October and 28 November 2017, in which Jonker also expressed its disagreement with the carve-out of this aspect into a so-called separate enforcement request that, according to the AP, did not need to be investigated comprehensively.

On 26 February 2018, the AP also rejected this objection by Jonker, after which Jonker also appealed this objection decision to the District Court of Gelderland on 19 March 2018 (third appeal in the case, case number 18/1487).

Jonker: "I hope the court will merge the two proceedings, as the content largely overlaps. And I hope the court comes to the conclusion that the AP indeed wrongly refused to include the unique pass numbers in the investigation previously ordered by the court. I find it bizarre that the AP ignored the court's earlier ruling on an important point. The court had clearly stated that NS is the data controller with the OV-chipkaart, because as a customer I perform transactions with NS, while TLS is only a contractor of NS, performing a task for NS. Now the AP is again trying to pretend that TLS would be the primary responsible party. Clearly, in this case, the AP is doing everything it can to NOT properly perform its supervisory and enforcement role. I look forward to the court case(s) with confidence."