Source: https://blog.cyberwar.nl/2013/10/mandatory-privacy-impact-assessments-for-dutch-govt-it-projects/
Timestamp: 2019-03-20 17:07:42
Document Index: 314095364

Matched Legal Cases: ['Art. 1', 'Art. 16', 'Art. 24', 'Art. 8', 'Art. 11', 'Art. 16', 'Art. 7', 'Art. 11', 'Art. 27', 'Art. 30', 'Art. 76']

Mandatory Privacy Impact Assessments for Dutch govt IT projects – Matthijs R. Koot's notebook
Posted on 2013-10-23 2015-03-17 by mrkoot
UPDATE 2015-03-17: US DHS also performs PIAs and has an excellent page on what a comprises a PIA in their context and how they carry it out; including guidance and template documents.
UPDATE 2013-11-03: regarding the EU-proposed PIA, the UK Deputy Information Commissioner David Smith stated: “It might sound scary, but it should help organisations to design systems that respect individuals’ privacy and so command the confidence of customers and the wider public.” That’s exactly right!
In 2011 the Dutch government published the “I-Strategy 2012-2015” document; see Trust, Privacy & Security in Dutch Govt “I-Strategy”. The I-Strategy describes the Rutte-cabinet coalition agreement on information strategy for the period 2012-2015. One of the topics covered in the strategy is that the requirements for the content of project plans (including legislative proposals) for large IT projects (26 643, nr. 135) would be “supplemented with the demand to state whether the project involves privacy-sensitive data and linkage or data enrichment. The project plan will state, with arguments, whether a Privacy Impact Assessment or a similar instrument applies.”
As of September 1st 2013 in the Netherlands, a new rule applies to all `large’ (?) ICT proposals initiated by the national-level government entities (Ministries, etc.): ICT project proposals must now include a Privacy Impact Assessment (PIA). In June 2013, the Dutch administration proposed a PIA model (.pdf, in Dutch).
On July 9th 2013, the Dutch Senate responded (.pdf, in Dutch) to the proposed PIA model and points out that improvements are needed. First, here’s my translation of the Senate’s response:
The proposed model is based primarily on the Dutch Data Protection Act (DPA) anyhow and new elements of the proposed European privacy regulation are not included, such as the requirement to apply principles of “privacy by design” and “privacy by default”. Although the text of the proposed European privacy regulation is not yet final, the expectation is justified that such mandatory application of these principles will also be included in the final text. Why has the government not been able to include such obligations in the PIA, and is the government willing to do so now?
Furthermore, the committee members questioned whether the government sufficiently considered the consequences of answering the questions in the PIA model. It is by no means in all cases clear what impact a particular answer has. For example, the first question of part II.1 reads: “Did you establish the specific purpose(s) for the intended processing of personal data?” This is an important question. However, the meaning of a “no”-answer is left open and no consequences are attached. Does this then mean that a risk is only identified? What are the consequences? The key questions seem to be designed to apply the current Dutch DPA, rather than to the examination of privacy risks of those whose personal data is processed. What is the government’s perspective on this? Is the government willing to make a next revision of the proposed model more in agreement with the intended purpose of a PIA, as well as with the requirements in the expected European privacy regulation?
I will update this post when the government has responded to the Senate’s questions.
Finally, here is my translation of the proposed Dutch official PIA model to which the Senate’s criticism still applies. Hyperlinks and parts in [] are mine. (Note: Google Translate was remarkably accurate in translation of some paragraphs.)
8. If the PIA is performed in the context of developing policies that will result in legislation, the `Guidelines for alignment with Dutch DPA’, included in the IAK, must be used.
9. If the PIA is performed in the context of developing policy that (also) provision the construction of data files or the construction of ICT systems, attention should also be given to the control measures described in the `handbook portfolio for Dutch govt projects with a large ICT component’.
2. When is the processing of personal data by the Dutch national govt, including independent administrative bodies [=Dutch “ZBO’s”], necessary? (and is a PIA relevant at all)?
4. For the development of policy and legislation, the answering of the questions of subsidiarity of personal data processing can be done using the `Guidelines for alignment with Dutch DPA’, included in the IAK, on alignment with (international) (classical) fundamental rights.
5. If the (preliminary) finding is that alternatives to processing of personal data do not exist, it is important to use the PIA model. Thus, all questions related to proportionality of the processing of personal data are clearly mapped and solutions can be formulated that do not go beyond what is necessary to achieve the desired outcome. These may include, for example, differentiating measures (is the processing of same data needed for all aspects of the policy proposal?), or allowing the possibility of an “opt-out” to those involved in certain specific circumstances.
– Expansion of the database within an existing IT system (it suffices to answer the questions in Sections I and IV)
– Using an existing database or ICT system for additional or new goals (it may suffice to answer the questions in section II and IV)
– Linking various existing databases or ICT systems for existing or additional or new new purposes (sufficient answering the questions in sections II-V)
It goes without saying that in the performance of such a “PIA-light”, it is sensible to refer to any previous pieces (previous PIAs, other impact assessments, explanations).
1. The PIA questionnaire must be completed by the staff members or legal drafter of the Minister who, or independent administrative body [=Dutch “ZBO’s”] that is or will be “responsible” for the processing of personal data within the meaning of the Dutch DPA.
2. “Responsibility” exists, in terms of the DPA, if this department of the national government is the entity that determines the purposes and means of the processing of personal data.
3. A PIA does not have to be performed by policy makers and legal drafters of the Ministry or the part of the national government that only acts as “processor” within the meaning of the DPA, i.e., if only at request of a responsible party. In case of uncertainty, please contact the legal department of your Ministry.
“Given the nature of this proposal, a Privacy Impact Assessment is carried out at the stage of policy development (see also Kamerstuk I 2010/11, 31051, No. D , motion-Franken) . Using this, the necessity of data processing is reviewed, and the implications of the measure(s) are identified in a structured manner. In particular, attention is given to the principles of data minimization and purpose limitation, the requirement of a good security, and to the rights of those involved. <Description of specific aspects and the judgments made in this case>”
Processing of personal data has a strong legal framework. On the other hand, the text of the DPA is often experienced to be abstract and inscrutable. In this light, the questionnaire below contains both practical questions and questions of legal nature. The practical questions are meant to map the entire trajectory of data processing, and the agencies involve. When it comes to legal questions, the wording of the questions is crucial. In that case, it is attempted insofar as possible to explain this, and to add examples. If uncertainty exists about the content of the question, it is sensible to contact the DPO at your Ministry or the legal department.
I. Basic information: type of personal data, type of processing and necessity / data minimization
Notes: Definition of `personal data’: any information relating to an identified or identifiable person (Art. 1 of Dutch DPA) .
Definition of `particular (sensitive) personal data’: data on religion or belief, race, political opinions, health, sexual life, trade union membership, criminal record; Cf . definition in Art. 16 of Dutch DPA: A representative is a natural person, legal person or any other person who or the governing body that alone or jointly with others determines the purposes and means of the processing of personal data.
Note: If your organization only acts as a processor (the one who processes data at request of the responsible party, without being subject to his direct authority), this questionnaire must be completed not by you, but by the responsible party.
Definition of `processing’: any operation or set of operations performed upon personal data, including at least the collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, interrelation, blocking, exchange or destruction of personal data.
Explanation: This type of data is not formally classified as `sensitive data’ in the EU Data Protection Directive 95/46 or in the Dutch DPA, but has become to be treated as such in the national and European legal and practical context. Pending European proposals for adjustment of data protection regulations continue this trend by categorizing the processing of biometric data as a specific risk.
2e. Will the SSN [=”BSN” in Dutch] or another personal number be processed?
Explanation: The Dutch DPA (Art. 24) provides that a law-prescribed number for identification of a person in the course of data processing is only processed for the purpose of implementing the law or the purposes determined by law. If necessary, refer the `Decree on use of SSN and Dutch DPA’ of 15 August 2001.
Explanation: The Dutch DPA provides the so-called `principle of data minimization’. Personal data may only be processed if a necessity exists (Art. 8). Art. 11, paragraph 1 also provides that personal data may only be processed if it is, given the purposes for which they were collected or subsequently processed, adequate, relevant and not excessive (relevance requirement). It is also important that the processing of sensitive personal data is, in principle, prohibited (Art. 16-23), and only permitted under strict(er) conditions.
Explanation: The Dutch DPA (Art. 7) provides that personal data may only be collected for specific, explicit and legitimate purposes. For example, it can be indicated in legislation that personal data are processed for the limited purpose of combating illegal immigration. The processing must be justified based on grounds of the DPA (Art.). If multiple objectives are pursued by the collection of personal data, then those must all be made explicit, and for each objective it must be substantiated why the (entire) set of data is necessary to reach it.
2. Does the project/system involve the use of new data for an existing objective, or existing objectives within existing systems? (scenario of addition of new data).
Explanation: The Dutch DPA provides the so-called `principle of data minimization’. Art. 11, paragraph 1 provides that personal data may be processed only insofar they are, given the purposes for which they were collected or subsequently processed, adequate, relevant and not excessive. This means that if the data to be processed in an existing system is expanded, justification must exist for each of the new personal data to be processed. For a review of the data to be added, also see questions I.1-4 above.
4. If you have answered positively to questions II.2 and II.3, how is such intended use (i.e., addition of new personal data to existing systems or use of existing personal data for new purposes) reported to: (a) the DPO, or (b) the Dutch Data Protection Authority [=”CBP” in Dutch] if there is no DPO?
Explanation: The characteristics of the processing should always be available as a condition for being “in control” as a responsible party, in particular with regard to the notification and information obligations of those whose data is processed (Art. 27, first paragraph, and Art. 30, paragraph 3 of Dutch DPA).
Explanation: The Dutch DPA (Art. 76) provides that personal data may be transferred only to a country outside the EU/EEA if that country ensures an adequate level of data protection. As for the U.S., the European Commission states that organizations that have obliged themselves to comply with the so-called `safe harbor’ principles are also supposed to guarantee adequate protection. A complete list of Commission’s decisions on the adequacy of protection in other third countries (such as Israel, Argentina and Australia) can be found at the following website: http://ec.europa.eu/justice/data-protection/document/international-transfers/adequacy/index_en.htm
Explanation: To determine the appropriate level of risk, see the “Guidelines for Security of Personal Data”, 2013, at: http://www.cbpweb.nl/Pages/pb_20130219_richtsnoeren-beveiliging-persoonsgegevens.aspx
4. If you ask the subject’s consent for processing personal data (opt-in), can the person revoke his/her consent at a later time (opt-out)? In case the subjects refuses or revokes consent, what is the implication for that person?
← Dutch govt response to Parliamentary questions concerning U.S. spying / AMS-IX expansion to U.S.
TorRAT: four Dutch suspects arrested in EUR 1M digital fraud and money laundering case →
2 thoughts on “Mandatory Privacy Impact Assessments for Dutch govt IT projects”
2013-10-24 at 17:17
Thank you very much for this post. It is very helpful to my research.
2013-10-24 at 18:20
I’m grateful for that comment!