The AVG states that personal data "shall be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; further processing for archiving in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1)" (AVG Art. 5(1)(b)). The AVG has brought the tension between the right to know and the right to be forgotten into the spotlight.
The regulation forces archival institutions to develop scenarios that will allow for the timely operationalization of the category "archiving in the public interest, scientific or historical research, or statistical purposes. If not, there is a good chance that many personal data in archival records that fall within this category will be destroyed early.
The information relationship between government and citizens in the Netherlands is regulated through a number of laws. The most important laws in this regard are the WOB, the Archives Act and the AVG. In principle, the WOB and Archives Act are aimed at making information that the government collects and produces in the performance of its duties public as much as possible, while the AVG aims to protect certain information from unnecessary processing - including disclosure. The WOB relates to all information recorded in documents held by administrative bodies, the Archives Act applies to all records formed and received by public bodies, the AVG, on the other hand, relates only to personal data but its scope is not limited to the government.
There is an important distinction between the disclosure regime of the WOB and the Archives Act. When citizens approach an administrative body to obtain information about a particular matter, they do so on the basis of the WOB. The administrative body can then provide information about the requested matter in a variety of ways but there are also quite a few reasons to limit disclosure. The disclosure regime of the Archives Act, on the other hand, relates to the records of government bodies transferred to an archive repository. In the Netherlands, government bodies must transfer their records not eligible for destruction after 20 years (AW art. 12) to a so-called archive depository such as the National Archives or a municipal archive. A legal consequence is attached to this mechanism of transfer: from that moment on, the public access provisions of the Archives Act apply. After transfer, the transferred documents are in principle public (AW art 14) and this means that they are fully available for public inspection. In principle, because when documents are transferred, it is possible that, for three reasons specified in the law , restrictions may still be placed on public access temporarily (AW art. 15).
In outline, the coming into force of the AVG actually did not even change that much in the information relationship between government and citizens. After all, the PDPA had a similar tension with respect to the two other laws mentioned above. Nevertheless, the AVG has caused some nervousness even among archival institutions. The main issue seems to be the question of what archival institutions can and cannot make available online. But also in this respect there is little new under the sun compared to the Wbp. The AVG therefore seems to act as a kind of wake-up call for archival institutions in paying serious attention to personal data protection rather than causing fundamental changes. What is, or should be, a point of concern, however, is the tendency of government bodies to apply data minimization entirely in accordance with the principles of the AVG as soon as the personal data collected are no longer relevant to the purpose for which they were collected. From a tour of a number of government organizations, there seems to be a strong preference for destruction. Awareness regarding "archiving in the public interest, scientific or historical research" generally does not seem to be strongly developed.
Fortunately, in the Netherlands we have a system whereby documents made or received by government agencies cannot simply be destroyed. Destruction takes place on the basis of selection lists(AW art. 5) in which it is determined for each category of archive documents (and to avoid any misunderstanding: archive documents expressly include digitally recorded information) and for each government body how long they should be kept and when they should be destroyed. Selection lists are drawn up and established according to a procedure laid down in the Archives Act and in the Archives Decree. The simplest and, in my opinion, most valid reasoning is that if, when drawing up a selection list, the consideration is to preserve a certain category of records for eternity, this automatically means that "archiving in the public interest, scientific or historical research or statistical purposes" is in play. Data minimization cannot then mean that the personal data contained in these records can be destroyed.
Yet this sounds simpler than what the unruly reality usually holds. Valuing categories of records in a selection list is not the same as selecting specific records for destruction or transfer to a repository. The rather compartmentalized way in which information management is organized within many government agencies (including security officers, data protection officers, documentary information managers, information architects, etc., who do not all work together) does not bode well in this case either. Selection lists are drawn up according to a fixed protocol at least once every 20 years(Archives Decree 1995, articles 2 to 5). The application of those lists in the actual selection of records (which are then either destroyed or transferred to an archive repository) is by no means always done in conjunction with the other aspects of information management. To date, selection of records that are to be preserved for eternity often does not take place until the time when records must be transferred (after 20 years). This lack of integrated information management entails many risks. After all, there is a good chance that data minimization (read: destruction of personal data) has already taken place before the selection of records for transfer to a repository. I expect government bodies, partly because of the stick available to the Autoriteit Persoonsgegevens to impose fines, to apply data minimization by destroying personal data as soon as they are no longer needed for the purpose for which they were collected. This way, after all, all short-term risks are avoided. To prevent historical archives from becoming abstract and "de-personalized" data files in the future, archival institutions, lawyers and information professionals within government agencies will have to work together from an integral information perspective. The AVG provides ample opportunities to protect the various interests. The considerations involved in creating selection lists provide the arguments for archiving 'in the public interest...'. The ingredients are thus present to apply 'know and forget' in a balanced way. What it comes down to is realizing more integrality and proactivity in implementation. And there is still a lot of work to be done in that area. Archiving is not an after-the-fact activity. Archiving means that principles that must be protected must be embedded in information systems and applications by design(archiving by design).
This article can also be found in the AVG file
