KTDi
KTDI Pilot Data Protection
Impact
Assessment
(NLD)

$9

/
ƒ

e

—h

\

I
i

të

1

s=e -

\

gssem

a

«--=A-s

ua
“g

¥ /

4

#

x5*üë
Gan,
$
* *

KD

-

*

_s

-

-

o

z *

N

DPIA Introduction
•

"A Data Protection Impact Assessment (DPIA) is required under the GDPR any time you begin a new project that is likely to involve ‘a
high risk’ to other people’s personal information."

•

•

KDTI

KTDi

Sou ree: gdpr.eu

This DPIA is based on the template as provided by the Dutch government.

DPIA - Introduction (cont’d)
•

TerritoriaI scope (GDPR, art. 3):

•

The processing of personal data within the Netherlands is in scope of this DPIA.
•

•

The processing of personal data within Canada is not in scope of this DPIA.
•

KDTI

Disregarding whether the Data Subject is a Canadian or Dutch Citizen.

Disregarding the fact that personal data of Dutch citizens may be processed in Canada.

KTDi

DPIA Introduction (cont’d)

KTDi

Definitions (GDPR, art, 4):

•

Data Subject: an identified or identifiable natural person.

•

Within the context of the KTDI Pilot: a Canadian or Dutch Traveller who makes use of one or more KTDI Services within the territorial
scope of the GDPR.

Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and
means of the processing of personal data.

•

Within the context of the KTDI Pilot and as far as within the territorial scope of the GDPR:

•

Air Canada.

•

KLM.

•

National Office for Identity Data (NOID).

•

National Coördinator for Security and Counterterrorism (NCSC).

•

Royal Marechaussee (KMar).

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

•

Within the context of the KTDI Pilot:

•

Amsterdam Airport Schiphol (AAS; on behalf of KLM and Royal Marechaussee).

Accenture (on behalf of KLM,

NOID, CBSA, Air Canada).

Idemia (on behalf of NOID).

VisionBox (sub-processor on behalf of Amsterdam Airport Schiphol).
KDTI

DPIA Introduction (cont’d)

KTDi

Definitions: in this DPIA the following terms will be used:

•

KTDI Service:
Service Provider: a Canadian or Dutch private or public organization which offers a KTDI Service to Travellers.

•

Air Canada;

•

KLM;

•

KMar;

•

NCSC

•

NOID; and

•

Schiphol Airport.

•

Also: Controller.

Traveller: a Holder of a Canadian or Dutch e-passport who is eligible to make use of KTDI Services.

•

Also: Data Subject.

(More definitions may be added during the DPIA process.)
KDTI

KTDI

DPIA Scope

6

DPIA Scope: KTDI Pilot Process - Departure
NLD

O

Book
flight

Oo
Invite
traveller

AT
nTn
177

KTDI

KTDi

o

H
O

Create
KTDI profile

Create
Digital ID

Check-in

Prepare
the trip

In scope of DPIA
KTDI.

Drop-off
bag

p

riority access
. security

Border
control

KLM
Lounge

Boarding
Access

Departure

Out of Scope of DPIA KTDI.
In scope of DPIA Seamless Flow.

66

Completely in scope of this DPIA.

Partially in scope of this DPIA.
Not in scope of this DPIA.

In scope of pilot process
KDTI

Out of

of pi

See: 'KTDI NLD Operational Concept Description’
for a detailed description of each process step.

DPIA Scope - KTDI Pilot Process - Arrival NLD

Oo

0

Invite
passenger

Prepare
the
the trip
trip

l

Arrival
flight

RTP
NL

r

RTP_NL
Registration

Border
control

Out of scope of DPIA KTDI.
In scope of DPIA Seamless Flow.
In scope of DPIA KTDI: applying using the KTDI App.
Out of scope of DPIA KTDI but in scope of DPIA RTP-NL:
processing the application.

In of scope of DPIA KTDI: data processing in
the Netherlands (territorial scope GDPR).
In scope of pilot process
KDTI

Out of scope of pilot process

In scope of DPIA KTDI.

KTDi

KTDI

A.
Characteristics of
Data Processing

KDTI

9

Characteristics of Data Processing

KTDi

Describe the proposed data processing, the goals of the data processing and the importance of the data processing to the stake holders:

•

Global overview of the relevant processes.

•

See slides xx and xx.

•

•

Also see document 'KTDI NLD Operational Concept Description' for a detailed description of each process step.

•

See slides xx to xx for a high-level description of the evolution of relevant processes from manual processing up to KTDI
enabled processes.

•

See slides xx to xx for an overview of the technological support of the processes.

Personal data which are processed ) see slides xx to xx.

•

Also see document'KTDI Pilot - data processing (appendix to DPIA)'.

Data flows.

•

KDTI

See document 'KTDI pilot - NLD Data Flows'.

KTDI

A.1
Characteristics of
Data Processing

Processes
KDTI

11

Characteristics of Data Processing
(cont’d)

KTDi

•

The KTDI concept is a new way of enabling the execution of existing business processes of Service Providers.

•

Some KTDI specific processes will be introduced.

Process
Invite Traveller

specific process.

Create KTDI Profile

specific process.

Create Digital ID

specific process.

Check-in

Prepare the Trip

KDTI

New/existing process

Existing process.

If existing process is adapted to KTDI: what is different?

• After check-in: Boarding Pass will be sent to Travellers'

Wallet.

specific process.

Priority Access Security

Existing process.

• Traveller requests to make use of this KTDI-adapted process in advance
• Biometric recognition of Traveller.

Border Control

Existing process.

• Traveller requests to make use of this KTDI-adapted process in advance
• Biometric recognition of Traveller.

Boarding Access

Existing process.

• Traveller requests to make use of this KTDI-adapted process in advance
• Biometric recognition of Traveller.

Characteristics of Data Processing cont’d
Global overview of the relevant processes.

First time Dutch Traveller; flight NLD^CAN.

•

0

-92-ED- ë - i :

o

Book
flight

Invite
traveller

Create
Digital ID

Check-in

o

Prepare
the trip

Drop-offPriority access Border
bag
security
control

KLM
Lounge

Boarding Departure
Access

Second time Dutch Traveller; flight NLD-CAN.

•

o

Oo

Book
flight

Invite
traveller

| In scope
KDTI

Create
KTDI
profile

7

D

Out of scope

0

7

Ö

8 :
o

Check-in

Prepare
the trip

Drop-offPriority access Border
bag
security
control

KLM
Lounge

Boarding Departure
Access

KTDi

Characteristics of Data Processing cont’d
Global overview of the relevant processes.

First time CAN Traveller; flight CAN-)NLD.

•

Oo

o

Invite
passenger

Prepare
the trip

RTP
NL
Arrival
flight

RTP_NL
Registration

Border
control

•

Second time or more CAN Traveller; flight CAN-)NLD.

•

Dutch Traveller; flight CAN-)NLD.

Oo
Invite
passenger

| In scope
KDTI

o

Prepare
the trip
Out of scope

Arrival
flight

Border
control

KTDi

Characteristics of Data Processing

KTDi

Global overview of the (technological) development of KTDI related processes - border control
Manual checks: since a long time the Royal Marechaussee (KMar) manually checks travellers and their travel documents upon arrival and departure at
Schiphol airport. This includes a visual inspection of the travel document as well as a check whether the traveller who presents the travel document is the
rightful holder of it (by comparing the face of the traveller with the photo in the Visual Inspection Zone of the passport.)

•

From 2012 to 2015, authenticity of passports wasd a manual process; checks of the enforcement databases were semi-automatic (manual input
of relevant data; automated search for hits).

•

Since 2015, authenticity checks of the passports and the checks of the enforcement databases are fully automated.

In 2014, Self-Service Passport Control is introduced at Schiphol Airport. The traveller presents their e-passport to a scanner in an e-gate, which scans the
holder page (including the optical MRZ) as well as the digital MRZ (RFID chip, Data Group 1). The digitalized data of the optical/digital MRZ is used to
check enforcement databases. A live facial image of the traveller is taken and compared to the photo stored in the RFID chip (Data Group 2) in order to
determine whether the traveller in the e-gate is the rightful holder of the e-passport.

•

These checks are fully automated.

•

In case of hits/errors or other unclear situations, a border guard will intervene/assist the traveller.

KTDI is a next step in which a traveller shares rheir personal data with the KMar before he arrivés at a border Crossing point. This can be done off-airport
at a time and location that suits the traveller. KTDI enables the KMar to process the personal data in advance, which pertain to the concept of
information-based acting (goede vertaling van informatiegebaseerd optreden?).

KDTI

KTDI

A.2
Characteristics of
Data Processing
Data
KDTI

16

Characteristics of Data Processing
(cont’d)

KTDi

Personal
ersonal data which are
a processed - enrollment.

KDTI

Data element*

Special Category of Personal data?**

Data
Subject ***

Given Names

No

Travel er

Surnamer (including prefix)

No

Travel er

Date of Birth

No

Travel er

Place of Birth
Personal Number

Sensitive data
National Identification Number

Travel er
Travel er

Identification Feature (portrait of the holder)

Sensitive data - biometric data

Travel er

Sex

No

Travel er

Live Facial Image
Nationality

Sensitive data - biometric data
Sensitive data

Travel er
Travel er

Passport Number

Sensitive data

Travel er

Document Code

No

Travel er

Date of Issue
Date of Expiry

No
No

Travel er
Travel er

Issuing State or Organization

Sensitive data

Travel er

Flagged in national stolen/lost travel document
database

Sensitive data

Travel er

Source

Holderpage,
RFIDChip DG1
Holderpage,
RFIDChip DG1
Holderpage,
RFIDChip DG1
Holderpage
Holderpage,
RFIDChip DG1
Holderpage,
RFIDChip DG2
Holderpage,
RFIDChip DG1
Traveller
Holderpage,
RFIDChip DG1
Holderpage,
RFIDChip DG1
Holderpage,
RFIDChip DG1
Holderpage
Holderpage,
RFIDChip DG1
Holderpage,
RFIDChip DG1
Verificatieregiste
r

Recipiënt** Controller** Processor**

*

*

NOID

NOID

NOID

NOID

NOID

NOID

NOID
NOID

NOID
NOID

NOID

NOID

NOID

NOID

NOID
NOID

NOID
NOID

NOID

NOID

NOID

NOID

NOID
NOID

NOID
NOID

NOID

NOID

NOID

NOID

*

Characteristics of Data Processing
(cont’d)

KTDi

Personal
ersonal data which are
a processed - check-in.
Data element*

Special Category of Personal Data? **

Data
Subject ***

Source Recipiënt*** Controller*** Processor***

Airport of Departure
Flight Number
Date of Departure
Passenger Sequence Number

No
No
No
Sensitive data

Traveller
Traveller
Traveller
Traveller

Airline Airline
Airline Airline
Airline Airline
Airline Airline

KDTI

Airline
Airline
Airline
Airline

Characteristics of Data Processing
(cont’d)
Personal data which are processed - border control.
.*

Data element'

Given Names

Special Category of Personal Data?

**

No

Data Subject*** Source

Travel er

Holderpage,

KTDi

• * * Processor** Data necessaryfor
*
executing

Recipiënt** Controller'

*

*

Data necesary for background

check

Border Control Process

SIS2

E&S

SLTD

n.a.

MoD

Schiphol

Yes

Yes

Yes

No

n.a.

MoD

Schiphol

Yes

Yes

Yes

No

n.a.

MoD

Schiphol

Yes

Yes

Yes

No

n.a.

MoD

Schiphol

Yes

Nee

Nee

No

n.a.

MoD

Schiphol

Yes

Yes

Yes

No

n.a.

MoD

Schiphol

Yes

Nee

Nee

No

n.a.

MoD

Schiphol

Yes

Yes

Yes

No?

n.a.

MoD

Schiphol

Yes

Yes?

No?

Yes

n.a.

MoD

Schiphol

Yes

Yes?

No?

Yes?

n.a.

MoD

Schiphol

Yes

Yes?

No?

?

n.a.

MoD

Schiphol

Yes

Yes

No?

Yes?

RFID Chip DG1

Surname (including prefix)

No

Travel er

Holderpage,

RFID Chip DG1

Date of Birth

No

Travel er

Holderpage,

RFID Chip DG1

Identification Feature (portrait of the holder)

Sensitive data - biometric data

Travel er

Holderpage,

RFID Chip DG2

Sex

No

Travel er

Holderpage,

RFID Chip DG1

Live Facial Image

Sensitive data - biometric data

Travel er

Holderpage,

RFID Chip DG1
Nationality

Sensitive data

Travel er

Holderpage,

RFID Chip DG1

Passport Number

Sensitive data

Travel er

Holderpage,

RFID Chip DG1

Document Code

No

Travel er

Holderpage,

RFID Chip DG1

Date of Expiry

No

Travel er

Holderpage,

RFID Chip DG1

Issuing State or Organization

Sensitive data

Travel er

Holderpage,

RFID Chip DG1

Video Footage (CCTV)

Sensitive data - biometric data

Travel er

CCTV

n.a.

MoD

Schiphol

Yes

No

No

No

Flagged in Law Enforcement Database

Personal data relatingto criminal convictions and offences (only in

Reiziger

SISII, E&S,

n.a.

MoD

Schiphol

Yes

No

No

No

n.a.

MoD

Schiphol

Yes

No

No

No

n.a.

MoD

Schiphol

Yes

No

No

No

n.a.

MoD

Schiphol

Yes

No

No

No

n.a.

MoD

Schiphol

Yes

No

No

No

n.a.

MoD

Schiphol

Yes

No

No

No

case of ’hit’)

HitNoHitCode

Personal data relatingto criminal convictions and offences (only in

SLTD

Reiziger

case of ’hit’)
Match on Data Element

Personal data relatingto criminal convictions and offences (only in

SLTD

Reiziger

case of ’hit’)

Required Action

Personal data relatingto criminal convictions and offences (only in
Personal data relatingto criminal convictions and offences (only in

Reiziger

Personal data relatingto criminal convictions and offences (only in
case of ’hit’)

KDTI

SISII, E&S,

SLTD

Reiziger

case of ’hit’)

Description

SISII, E&S,

SLTD

case of ’hit’)

Gevarenklasse

SISII, E&S,

SISII, E&S,

SLTD

Reiziger

SISII, E&S,

SLTD

Characteristics of Data Processing
(cont’d) are processed Personal data which
Data element*

TBD

KDTI

KTDi

boarding.

Special Category of Personal Data? **

Data Subject*** Sou ree

Recipiënt*** Controller*** Processor***

Characteristics of Data Processing

KTDi

(cont’d)
KTDI Pilot - 'Data Architecture'.
Legend [StorageTypes)

Send: Notifications

Off-Chain Data permanent j
Read / Write:

■ Mobile App Application Da

- Public DID DOC

■Public DID

Mobile Keychain - Secured

- Credential Definition

■ Public DID DOC

Read:

Send: Device ID

* Credential Schema

■ Credential Schema

Device Token

- Revocation Registries

- Credential Definition

Vault - Secured Backend Se

m Auditing and Logging Data

■ Revocation Registries

KTDI Mobile App

ProvC
Vault
5.1.2.E
-NW
Identity Credentials
- Off-Chain Storage Credentials
- Directory Manager Credentialls
- Logging Credentials

Keychain
- Decryption Key | App. Data]
- Decryption Key (Wallet)

Off-Chain Data

Read:

Private Permissioned 5.1.2.E
NetWork

- Public DID DDCs
- Credential 5chermas
- Credential Definitions
- Revocation Lists

Wallet

- Pending Notifications
-Public DID DOC

PIC/P5Y5

m

KTDI Data

-

- Off-Chain Storage Credential
5.1.2.E
-•NWIdentity
Credentials
- Decryption Key (Wallet)
- Logging Credentials

- Pairwise Channels
■ Attestations Revocation References
(revocable Attestations)

- Pairwise Channels
- Issued Attestations

Existing F Updated Data

• Credential Definition

- Credential Schema

Off-Chain Data

- Attestations
-Traveller Data
-Trips
- Channels

-Temp, storage of Notification
data (no PU)

- Auditing and Legging Data

Application Data

- Revocation Lists

Off-Chain Data [Cache]

Send: Pairwise Channels, Attestations

■

- Pairwise Channels
-Tamp; storage of Attestation Data
- Temp, storage of Trip Data
- Temp, storage of Messages

- Revocation tal Is files
Send: Pairwise Channels, Proofs

T
Send: Notifications

- Auditing and Legging Data

±

t

AW55N5

Send: Attestation Data
Send: Push Notifications

Trip Data
Trip Service Status Updates,

Apple Cloud

Trip Service Messages

Send: Chann

Google Cloud

Attestations (NOID),
Revocati
Proofed Data

KDTI

5.1.2.E

- Attestation Revocation 5.1.2.Ei/Status
- issued Attestations (NOID)

Wallet

- Push Notification Content

5.1.2.E
-_ceIDs
■ Device Tokens
- Notification Endpoints

PAC
Vaalt

A.3
Characteristics of
Data Processing

KTDI

Goal of Data
Procesing
KDTI

22

Characteristics of Data Processing
(cont’d)
•

Goal(s) of the data processing.

•

The main goal of the data processing is to enable a seamless travellers journey where the Traveller (the Data Subject) will be
identified using biometrics. This will be possible because the Traveller requests to make use of specific KTDI Services by
sending the required data to the Service Provider. While at the airport, the Traveller will not need to show their Travel
Document* or Boarding Pass at selected touch points since they wil be recognized using biometrics.

•

Another goal of the data processing is to enable the Service Providers to process service requests of Travellers even before the
Traveller’s journey has begun, thereby expediting their processes at the airport.

*) Due to the Schengen Borders Code, Canadian Travellers do need to collect and entry/exit stamp at the Dutch Border upon
arrival/departure.

KDTI

KTDi

A.4
Characteristics of
Data Processing

KTDI

Controllers,
Processors &
Locations
KDTI

24

Characteristics of Data Processing

KTDi

(cont’d)

Parties involved in the data processing and the locations of the data processing.

•

Process

Location

Controller

Processor & Sub-processor

Invite Traveller

the Netherlands (?)

KLM

?

Air Canada

Create KTDI Profile

? (theoretically: everywhere)

?

?
Accenture

Create Digital ID

the Netherlands

KMar

NOID (Idemia)

Prepare the Trip

? (theoretically: everywhere)

KLM

?

Air Canada

?

NOID

Idemia
Accenture

NCSC

AAS (Vision-Box)

KMar

AAS (Vision-Box)

Priority Access to security

the Netherlands

NCSC

AAS (Vision-Box)

Border Control NLD (ARR/DEP)

the Netherlands

KMar

AAS (Vision-Box)

Boarding Access

the Netherlands (?)

KLM/Air Canada

?

AAS (Vision-Box)
KDTI

Characteristics of Data Processing

(cont’d)

Parties involved in the data processing and their interest in the data processing.

•

Party

Role

Air Canada

Controller

KLM

Controller

KMar

Controller

NOID

Controller

NCSC

Controller

Accenture

Processor

Idemia

Processor

AAS

Processor

Vision-Box

Processor

KDTI

Interest in the data processing

KTDi

A.5 Characteristics
of Data Processing

KTDI

Processes &
Supporting
Technology
KDTI

27

KTDI Pilot Process & Supporting Technologies AR
- Departure NLD
>>
E
S
uu
Oo
8
H.
Only once

□ na
□ hn

ATN
nTn
*77

E-mail

Invite
traveller

€

dm

Create
Digital ID

Telephone

Gov. system Scan e-passport

r

----- L

Gov. system Generate QR Code

"i

J------

Partner Agent
Gov. system Component
Generate Attestation

Mobile Device - Gov. system Scan QR Code
Facial recognition

Each trip

KTDI Blockchain

Each trip

r

B

E

:

$

Priority access
security

Boarding Pass

E SF Platform Priority Access Security

Only once

Each trip

N

Prepare
the trip

Create
KTDI profile

KDTI

E

n

uu

J

Central Information
System Schiphol

SF Platform Partner Agen
Component

Border
control

KMar

KTDI Blockchain

o

J

Mobile Device Download/install
KTDI Mobile App

r

E2 SF Platform Border Control NLD

KTDI

(1

Each trip

J

Airline DCS -um
Check-in

Platform

<

EIII

Mobile Device Create User Account (local) +
biometric authentication

©
Provider System Mobile Device Register KTDI Account
Register KTDI Account
with KTDI Provider

Each trip

Airline DCS E• Boarding Access

Partner Agent
Component

Eomm CBSA System -

r

"i

L

J

Of SF Platform

EF Border Control CAN
KTDI Blockchain

Boarding
Access

Airline DCS Boarding Access

KTDI Pilot Process & Supporting Technologies

TD)

Arrival NLD
Each trip

E
KM

C•
1

o

SF Platform Partner Agent,
Component I
- Border Control
Initial RTP-NL application

Prepare
the trip

Only once
A

KTDI Blockchain

RTP-NL
Registration

<(® .
i /

$ '

C
i

E SF Platform DM Border Control NLD

Partner Agent,
Component

KTDI Blockchain

\

\

Each trip

\

•-»

Arrival
flight
DM

Partner Agent
Component

KDTI

SF Platform\- Finalize RTP-NL
application
\

\

Each trip

DM

Provider System

E

os

DM

1
i
i
i
i
1

AH NLD Travellers
> 2nd time CAN Travellen

N

RTP
NL

q
Border
control

r

1

L

J

DM

EI

DM

E

SF Platform Partner Agent
Component

KTDI Blockchain

A.5 Characteristics of
Data Processing

KTDI

Processes &
Supporting
Technology Blockchain
KDTI

30

Characteristics of Data Processing (cont’d) some remarks about blockchain

KTDi

"Indeed, almost one year after the GDPR became binding and although the legal regime is largely based on the previous 1995 Data Protection Directive, it
is evident that many pivotal concepts remain unclear.”

"It will be seen that the regulation is an expression of principles-based regulation that was designed to be technologically-neutral and stand the test of
time in a fast-moving data-economy."

"there is an ongoing debate surrounding whether data typically stored on a distributed ledger, such as public keys and transactional data qualify as
personal data for the purposes of the GDPR. Specifically, the question is whether personal data that has been encrypted or hashed still qualifies as
personal data. Whereas it is often assumed that this is not the case, such data likely does qualify as personal data for GDPR purposes..."

Source: Blockchain and the General Data Protection Regulation. Can distributed ledgers be squared with European data protection law? (Secretariat of the European Parliament;
Brussels 2019), pages i-iv.
KDTI

Characteristics of Data Processing (cont’d) some remarks about blockchain

KTDi

"Whereas the GDPR requires that personal data that is processed be kept to a minimum and only processed for purposes that have been specified in
advance, these principles can be hard to apply to blockchain technologies. Distributed ledgers are append-only databases that continuously grow as new
data is added. In addition, such data is replicated on many different computers. Both aspects are problematic from the perspective of the data
minimisation principle. It is moreover unclear how the 'purpose' of personal data processing ought to be applied in the blockchain context, specifically
whether this only includes the initial transaction or whether it also encompasses the continued processing of personal data (such as its storage and its
usage for consensus) once it has been put on-chain."

"It is the tension between the right to erasure (the 'right to be forgotten') and blockchains that has probably been discussed most in recent years."

"This analysis leads to two overarching conclusions. First, that the very technical specificities and governance design of blockchain use cases can be hard
to reconcile with the GDPR. Therefore, blockchain architects need to be aware of this from the outset and make sure that they design their respective use
cases in a manner that allows compliance with European data protection law. Second, it will however also be stressed that the current lack of legal
certainty asto how blockchains can be designed in a manner that is compliant with the regulation is not just duetothe specific features of this
technology. Rather, examiningthistechnology through the lens of the GDPR also highlights significant conceptual uncertainties in relation tothe
regulation that are of a relevance that significantly exceeds the specific blockchain context. Indeed, the analysis below will show that the lack of legal
certainty pertaining to numerous concepts of the GDPR makes it hard to determine how the latter should apply both to this technology and to others."

Source: Blockchain and the General Data Protection Regulation. Can distributed ledgers be squared with European data protection law? (Secretariat of the European Parliament;
Brussels 2019), pages i-iv.
KDTI

KTDI

A.6
Characteristics of
Data Processing

Miscellaneous
KDTI

33

Characteristics of Data Processing
(cont’d)
•

•

•

Legal and policy
policv framework:
fra

•

Security: Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the
implementation of the common basic standards on aviation security, paragraph 1.2.2.1 - 1.2.2.4

•

Border Control: Schengen Borders Code.

The KTDI mobile application does not support any back-up functionality.
•

Attestations will only be stored in the wallet of the KTDI mobile application and in databases of Service Providers which have
requested them from the Travellen

•

Data of non-core Building Blocks will only be stored in the wallet of the KTDI mobile application and in databases of Service
Providers which have requested them from the Travellen

Retention periods:
•

These are not specific for or adapted to the KTDI concept.

•

During the pilot, statistical data will be collected as well as data on user experience/(dis-)satisfaction. This will be input for an
evaluation of the KTDI concept.
•

•

KDTI

KTDi

Next steps are still to be defined.

The KTDI pilot will last six months and can be prolonged for another six months. After that period, the pilot will be terminated and
travellers can no longer make use of any KTDI related service.

KTDI

Data Processing

KDTI

35

Lawfulness of Data Processing
•

Legal basis for data processing (GDPR, art. 6).

•

•

For Border Control: the Data Subject does not give consent for the data processing, a Data subject is under the legal
obligation to have their passport checked. *
•

GDPR, article 6.1 (c): "processing is necessary for compliance with a legal obligation to which the controller is subject";
and

•

GDPR, article 6.1 (e): "processing is necessary for the performance of a task carried out in the public interest or in the
exercise of official authority vested in the controller".

For Airlines (KLM, Air Canada), a Data Subject will have concluded a contract under which they are obliged to share certain
personal data with the Airlines in order to make use of the KTDI Service ‘Boarding’.
•

GDPR, article 6.1(b): "processing is necessary for the performance of a contract to which the data subject is party ..."

•

However: sharing the facial image is not part of the (current) contract between a Data Subject and the Airline. The Data
Subject will need to give informed consent to the Airlines allowing them to process their facial image during the KTDI
Service ‘Boarding’.
•

*) See: DPIASSPC.
KDTI

KTDi

GDPR, article 6.1 (a): "the data subject has given consent to the processing of his or her personal data for one or
more specific purposes".

Lawfulness of Data Processing (cont’d)
•

Legal basis for data processing (GDPR, art. 6).

•

For the Airport, a Data Subject will have given informed consent to the processing of personal data by the airport so they can
make use of the KTDI Service 'Priority Access to Security'.
•

KDTI

KTDi

GDPR article 6.1(a): "the data subject has given consent to the processing of his or her personal data for one or more
specific purposes".

•

For RTP-NL Application a (Canadian) Data Subject will have given informed consent to the processing of personal data by the
KMar so they can make use of the KTDI Service 'Cross NLD Border - Arrival'.

•

The Data Subject shares their personal data for every journey and within every journey for every KTDI Service they wish to
make use of.
•

A ‘subscription model' (subscribe once, use multiple times) is not envisioned for the KTDI pilot.

•

See document 'KTDI Pilot - Services' (Excel file).

Lawfulness of Data Processing (cont’d)

KTDi

Is the data used for another goal than originally collected for (GDPR, art 6.4)?

•

Personal data is only collected for a specific KTDI Service:

•

'Cross NLD Border (Departure/Arrival)'. Legal basis = the law;

•

'Priority Access to Security '. Legal basis = informed consent;

•

'Boarding' (the execution of the agreement between the airine and the Travellen) Legal basis = the contract; and

•
•

Boarding using biometrics. Legal basis = informed consent.

'RTP-NL Application'. Legal basis = informed consent.

•

The consent refers to giving the personal data via the KTDI mobile application to the relevant controllers in order to be able to make use of the
KTDI services.

•

Concluding: no. The personal data, which is collected in order to enable a Data Subject to make use of a specific KTDI Service, is only used to
provide that KTDI Service to the Data Subject.

Necessity of data processing (GDPR, art, 6):

•

Proportionality of the data processing: data processing is based on the principle of 'Data Minimisation' (GDPR, art. 5.1.c). The data which is
collected for a specific KTDI Service is limited to what is necessary in order to enable the Data Subject to make use of that KTDI Service.

Subsidiarity: participation to the KTDI Pilot is on voluntary basis only. Dutch and Canadian Travellers who are invited to participate, may at all times refuse
or terminate their participation. In that case, 'normal' border control facilities are available: Self-Sevice Passport Control and the manual counter.

KDTI

Lawfulness of Data Processing (cont’d)
•

Rights of the data subject:
•

•

Information to be provided where personal data are collected from the data subject (GDPR, art. 13).

•

This Information will be made available to the Data Subject at the time when the personal data are obtained.

•

The Information will also be published on the web site of KTDI (www.ktdi.org).

Information to be provided where personal data have not been obtained from the data subject (GDPR, art. 14).

•
•
•

A participating Traveller can ask the appropriate Controller access to their personal data.

Right of rectification (GDPR, art. 16).
•

•

As far as applicable, this Information will be published on the web site of KTDI (www.ktdi.org).

Right of access by the data subject (GDPR, art. 15).
•

KDTI

KTDi

A participating Traveller can ask the appropriate Controller to rectify their personal data.

Right of erasure (GDPR, art. 17).
Ifa participating
wishes
does mean that the Dutch Traveller will not

•

NOID persistenly stores the digital identity of all participating
to have their personal data deleted, they can request the NOID
be able anymore to consume Dutch and Canadian KTDI Services.

•

Canadian participants who are member of the RTP-NL programme: see DPIA RTP-NL/3L.

Lawfulness of Data Processing (cont’d)
•

Rights of the data subject:
•

Right to restriction of processing (GDPR, art. 18).
•

•

A participating Dutch or Canadian Travellermay at all times invoke their right to restriction of processing by informing
the appropriate Controller.

Right to data portability (GDPR, art. 20).
•

NOID persistenly stores the digital identity of all participating
Travellers. Ifa participating
wishes
to transfer their personal data from NOID to any other organization, than they can request the NOID to supply them with
the requested pesonal data.

•

The Royal Marechausseee persistently stores RTP-NL membership data of participating
Travellers. If a
participating
wishes to transfer their personal data from the RTP-NL programme to any other
organization, than they can request the Royal Marechaussee to supply them with the requested pesonal data.
Airlines: ?

KDTI

KTDi

Lawfulness of Data Processing (cont’d)
•

Rights of the data subject (cont'd):
•

Right to object (GDPR, art. 21).
•

KDTI

KTDi

The right to object is only applicable on data processing based on GDPR article 6.1(e) and 6.1(f):
•

Article 6.1(e): "processing is necessary for the performance of a task carried out in the public interest or in the
exercise of official authority vested in the controller".

•

Article 6.1.(f): "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a
third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the
data subject which require protection of personal data".

•

Making use of the KTDI Service ‘Priority Access to Security' is based on informed consent (GPDR, article 6.1(a). Therefore,
the right to object can not be executed while making use of this service.

•

Making use of the KTDI Service ‘RTP-NL Application' is based on informed consent (GPDR, article 6.1(a). Therefore, the
right to object can not be executed while making use of this service.

•

Making use of the KTDI Service 'Cross NLD Border (Departure and Arrival)' is based on public interest orthe exercise of
official authority vested in the controller (GPDR, article 6.1(a). Therefore, the right to object can be executed while
making use of this service.

•

Making use of the KTDI Service ‘Boarding' is based on a contract (GDPR, article 6.1(b) with the Participating Airline. The
use of biometrics is based on informed consent. Therefore, the right to object can not be executed while making use of
this service.

Lawfulness of Data Processing (cont’d)
•

Rights of the data subject (cont'd):
•

Automated individual decision-making, including profiling (GDPR, art. 22).
•

Not applicable to the KTDI Pilot.

•

SeeDPIAof:

•

KDTI

•

Seamless Flow; and

•

RTP-NL/3L.

Airlines: ?

KTDi

KTDI

C./D. - Risks &
Mitigation

KDTI

43

Risks & Mitigations - Introduction

KTDi

In this chapter, risks are described which a Data Subject may run as they travel the 'KTDI way’, including:

•

The negative consequences which the Data Subject may experience;

•

The source of these consequences;

•

The possibility that these risks may occur; and

•

The impact of the risk on the Data Subject. The impact is assessed taking into account: loss of freedom, are special categories of
personal data processed , can the Data Subject experience financial damage.

For each risk, mitigating measures are identified and described in this chapter as well.

•

A mitigating measure can be of a technological, organizational or legal nature.

•

It may very well be possible that parts of a risk are not covered by the measures. In these cases, it will be explained why those residual
risks are acceptable.

KDTI

Risks with regard to the KTDI Mobile Application

KTDi

Mitigations

GDPR Principle

Privacy Risks

Lawfulness, fairness and transparency Art.5(l)(a)

Unlawful, excessive and incorrect processing (e.g. App providers/developers should make sure that they have a legal basis for the
due to permissions to unauthorised parties to
processing of personal data.
access personal data through the app).
App providers/developers should inform the data subjects properly about their
data processing activities. This may help the users to understand what personal
data is collected by them and why.
App providers/developers should be aware of data subject rights such as rights to
access, rectification, erasure, data portability. They should implement appropriate
processes to support these rights
Excessive collection and sharing of data (e.g. due App providers/developers should use the data for a specific purpose that the data
to multiple sensors of mobile devices that are
subjects have been made aware of and no other, without further consent. If the
activated without need).
personal data is used for purposes other than the initial, they should be
anonymised or the data subjects must be notified and their consent must be reobtained.
Excessive processing (e.g. due to use of third
The minimum amount of data for specific processing should be processed by app
party libraries).
providers/developers. For instance, they should not store the exact location point
when a generic location area is sufficiënt for their app functionalities.
Measures:
• The KTDI Mobile Application must only process data which are absolutely
necessary for a user to make use of a KTDI Service.
• The KTDI Mobile Application must not collect geolocaton data.

Purpose limitation Art.5(l)(b)

Data minimisation Art.5(l)(c)

Accuracy Art.5(l)(d)

Outdated data pose identity theft risks.

Rectification processes into data management should be embedded in the app
design.

Sources: Privacy and data protection in mobile applications (ENISA; november 2017), page 22; Smartphone Secure Development Guidelines (ENISA; december 2016).
KDTI

Risks with regard to the KTDI Mobile Application
cont’d

KTDi

GDPR Principle

Privacy Risks

Mitigations

Storage limitation Art.5(l)(e)

Undue data disclosure (e.g. due to cloud storage
services used by mobile app developers).

Personal data must not be stored longerthan necessary. App
providers/developers should provide the "right to be forgotten" to the data
subjects. This data must be kept only for a certain period of time for non-active
users.
Measures:
• The KTDI Mobile Application & Wallet must not persistenly store Attestations
issued by NOID containing persona data. These Attestations (and other objects
in the cache of the app) must be irrevocably deleted after:
• xx seconds of idle time; or
• The Traveller has terminated the KTDI Mobile Application.

Sources: Privacy and data protection in mobile applications (ENISA; november 2017), page 22; Smartphone Secure Development Guidelines (ENISA; december 2016).
KDTI

Risks with regard to the KTDI Mobile Application
cont’d

KTDi

GDPR Principle

Privacy Risks

Mitigations

Integrity and confidentiality Art.5(l)(f)

Unlawful data processing,
data loss, data breach,
data destruction or damage

App providers/developers should ensure that the security requirements of the
personal data and the processing systems are met. This encompasses integrity
and confidentiality as well as availability and resilience (Art. 35(l)(b) GDPR). For
instance, the appropriate control access mechanisms should be embedded into
the apps infrastructure in order to detect or monitor unauthorized access to the
data.
Measures:
• Data at rest must be encrypted using a state-of-the-art encryption.
• Data at transport must be encrypted using a state-of-the-art encryption.
• The KTDI Mobile Application may nog have a 'debug mode' or 'developper
mode'.
• The password of the user account must follow a strong password policy.
• The password must be masked while the user enters it in an input field.
• The password of the user account must be securely stored on the mobile
device, making use of encryption and key-store mechanisms provided by the
mobile OS.

Sources: Privacy and data protection in mobile applications (ENISA; november 2017), page 22; Smartphone Secure Development Guidelines (ENISA; december 2016).
KDTI

Risk - Data Subject cannot execute their rights

KTDi

Risk

Data Subject cannot execute their rights

Description

The Data Subject cannot execute their rights. KTDI's data processing is complex because multiple organisations are involved. Some of them are based
within the EU, some outside of the EU. Data processing can happen within the EU, but also outside of the
Data Subject could also choose to make
use of a KTDI Service by accident.
This can be caused by:
• Unclear Information.
• Unclear agreements between controllers and processors.

Possibility

Currently, there are no data processing agreements between Data Controllers and Data Processors. Before the actual pilot will start, these agreements
must be concluded. That may solve the issue of unknown data processing. However, due to the complex nature of the KTDI processes, it may very well be
that Data Subjects do not fuIly understand the KTDI concept, the possible consequences of the concept to their rights and how they execute their rights in
relation with the KTDI concept.
• The possibility that this risk may occur is 'high'.

Impact

KDTI

Risk - Data Subject cannot execute their rights cont’d
Risk

Data Subject cannot execute their rights

Mitigation

• Terms and Conditions will be made available in gthe KTDI mobile application, KTDI web site, web site of Service Providers.
• Including a clear desciption how a Traveller can execute his rights.
• A clear Processing Agreement must be concluded between each Controller and their Processor(s) before the actual pilot starts.

T

5
KDTI

Risk before implementation
of mitigating measures

Impact

Possibility

B

F
F

B

T

B

F

Risk after implementation of
mitigating measures

1

§

F

KTDi

Risk - Stigmatization & Discrimination

KTDi

Risk

Stigmatization & Discrimintion

Description

Personal data (biographic as well as biometric) can fall into the wrong hands and be used in order to discriminate of stigmatize the Data Subject. It is also
possible that a Data Subject who has enrolled into KTDI and wants to make use of KTDI Services cannot be recognized by a touchpoint and will be referred
to manual processing causing negative feelings. Also, it has been proofed that matching algorithms may have difficulties recognizing dark coloured skins
which may also cause negative feelings.
This can be caused by:
• Data leakage.
• System errors.
• Unclear agreements about data processing (access to personal data).
• Function creep which caused personal data to be processed for other purposed than collected for.

Possibility

Service Providers and Information Systems used in the KTDI pilot must comply with security measures according to international standards (ISO, OWASP)
but unfortunately a data leakage or system error cannot be ruled out completely.
Currently, there are no data processing agreements between Data Controllers and Data Processors. Before the actual pilot will start, these agreements
must be concluded. That may solve the issue of unwanted data processing.

• The possibility that this risk may occur is 'medium'.
Impact

A Data Subject could experience discrimination or stigmatization. As a result of a system error the Data Subject may inadvertently be denied border
Crossing or boarding possibly even resulting in the Data Subject missing their flight.
• The impact of this risk is 'high'.

KDTI

Risk - Stigmatization & Discrimintion - cont’d
Risk

Stigmatization & Discrimintion

Mitigation

• Each Controller and Processor must have a procedure in place how to act in case of data leakage or system error.
• Each Controller and Processor must demonstrable comply to international Information Security standards.
• A clear Processing Agreement must be concluded between each Controller and their Processor(s) before the actual pilot starts.
• Each Controller and Processor must only process data for the purpose the data was collected for.
• Audits may be executed in order to verify if a Controller or Processor has implemented the above mentioned measures.

Impact

Possibility

B
KDTI

1
1

B

F
F

Risk before implementation
of mitigating measures

Risk after implementation of
mitigating measures

B

§

T

F

KTDi

Risk - Adverse decision taking due to erroneous data
Risk

Adverse decision taking due to erroneous data

Description

A Service Provider could take a decision based on erroneous data. This has a negative impact on the Data Subject.

KTDi

This can be caused by:
• Erroneous record keeping: data of a Data Subject is combined with data of another Data Subject.

Possibility

• The possibility that this risk may occur is 'medium'.
Impact

A Data Subject could experience negative feelings discrimination or stigmatization. As a result of a system error the Data Subject may inadvertently be
denied border Crossing or boarding possibly even resulting in the Data Subject missing their flight.
• The impact of this risk is 'high'.

KDTI

Risk - Adverse decision taking due to erroneous data

- cont’d
Risk

Adverse decision taking due to erroneous data

Mitigation

• Controllers need to implement measures guaranteeing data integrity.

Possibility

Impact

8
KDTI

Risk before implementation
of mitigating measures

Risk after implementation of
mitigating measures

8

8

AR

KTD