Participation and privacy rules: how to combine under the Environment Act?

In this blog post, we discuss points of attention for governments and initiators for privacy risks when organizing participation in the new regime of the Ow. Finally, we formulate a number of concerns for governments and initiators for processing personal data for participation purposes.

1. Participation in the Environment Act

The Ow seeks early participation of the environment in the preparation of policy and decision-making. Precisely the initial phase, in the government's opinion, offers the most room to include the input of third parties (Parliamentary Papers II 2013-14, 33 962, no. 3, p. 217). Therefore, the Ow gives more attention to early participation before formal decision-making starts (Stb. 2018, 209, p. 131). As far as we are concerned, this is a good development. For example, there are more and more energy construction projects in the vicinity of people (wind farms, solar parks) and support for them is important.

The Ow's requirements for the participation process are minimal so as not to overly legalize the participation process (Parliamentary Papers II 2019-20, 34986, S, p. 28). We identify four requirements for the participation process:

1. The application of Section 3.4 Aw to the preparation of the core instruments of the Ow under Article 16.22 Ow;

2. An obligation for the competent authority to motivate the participation process. That duty to state reasons applies to all core instruments (16.139(1)(b) OL joins Section 10.7 Ob (environmental vision), 16.139(1)(b) OL joins 10.8 Ob (program), 16.139(1)(b) OL joins 10.2(2) Ob (environmental plan), and Section 5.51 Ob (project decision));

3. the introduction of the participation report for promoters; and

4. the obligation to organize a preliminary process for the environmental plan and the project decision.

We briefly discuss below the participation report (item 3) and the preliminary process (item 4).

1.1 The participation report

The competent authority has a duty to justify the participation process, but the initiator also has a responsibility in this regard. He submits a participation report with the application for an environmental permit. This is not obligatory but is desirable. Sometimes, in the opinion of the legislator, it is simply not possible to ask applicants to involve their neighbors in their application in all cases (Parliamentary Papers I 2019-20, 34986, S, p. 27). By way of exception, however, the municipal council can make participation mandatory for designated cases of out-of-plane deviation pursuant to Article 16.55, paragraph 7 of the Ow. The Ow does not set substantive requirements for the participation report, but this may be further regulated in the municipal participation ordinances that municipal councils will have to adopt under the proposed amendment to Section 150 of the Municipalities Act. We are curious as to whether this will make municipal participation ordinances more part of the preparation of spatial decisions again, as was the case before Section 3.4 Awb came into force. After all, under the current system, the Administrative Law Division of the Raad van State ("Division") has made it clear precisely that municipal participation ordinances cannot impose public participation obligations that affect the legality of the decision-making procedure (e.g. ABRvS 2 July 2014, ECLI:NL:RVS:2014:2439, r.o. 2.1).

1.2 The preliminary process

In the creation procedure of the environmental plan and the project decision, the Ow provides for a broadening of the preliminary process in addition to the obligation to provide reasons. The preliminary procedure is thus back in the limelight. Section 6a WRO (old) already provided for a similar regulation. That article was deleted with the entry into force of Section 3.4 Awb with the aim of deregulation. Now participation is the reason for reintroducing the preliminary stage again. The preliminary process in decision-making on the environmental plan begins with the obligation for the competent authority to publish a notification of the intention to adopt an environmental plan (Article 16.29 OL). In the preparation of the project decision, the preliminary process starts with the publication of the intention to explore (in brief) the options for the solution to a possible existing or future task (Article 5.47 Ow). This procedure is similar to the procedure under Article 2 of the Tracéwet. This notification starts a period in which the competent authority gathers information about the nature of the task, spatial developments and possible solutions (Section 5.48 Ow). Participation is possible by suggesting possible alternative solutions for the project (Article 5.47 (3) Ow) and requesting the competent authority to seek advice on the suggested alternatives (Article 5.48 Ow).

2. What does the Ow regulate privacy and data protection for governments?

Governments have a great deal of information about various parts of the physical environment which they collect as part of their own performance of duties. Now that the performance of those duties is expanding to organizing and facilitating participation, it is obvious that governments will also collect more information about the participants involved. After all, with participation comes new data processing. When using this information, the Ow and the General Data Protection Regulation ("AVG") and the AVG Implementation Act ("UAVG") constitute the main legal framework. Insofar as the Ow does not regulate anything, the AVG and the UAVG apply.

The Ow introduces a central digital counter: the Digital System for the Environment Act ("DSO-LV"). In the DSO-LV, all current facilities for the organization of spatial planning (OLO, ruimtelijkeplannen.nl) will be available on one website. These data must be accessible. This has a legal certainty function (knowing which spatial rules apply) and a legal protection function (checking whether participation has taken place sufficiently, see Parliamentary Papers I 2019-20, 34986, S, p. 29).

Article 20.5 Ow is the basis for the processing of personal data in the DSO. Pursuant to section 20.21, second paragraph, of the Ow, the responsible minister must ensure the establishment, maintenance, operation and security of the DSO-LV. It follows from the parliamentary explanation that in the execution of this legal obligation it may be necessary for the Minister to process personal data. This is permissible under the AVG based on Article 6(1)(c) AVG, namely that it is necessary to fulfill a legal obligation.

Besides the legal obligation, the most important basis for processing personal data in the DSO-LV is Article 6, first paragraph, under e, AVG: the data processing must be necessary for the performance of a task in the public interest or the exercise of public authority vested in the controller. This means that this task must be provided for by statutory regulation. That statutory regulation must also determine the purpose of the processing and any additional requirements (Article 6, third paragraph AVG, see also recital 41 AVG). These aspects are not detailed in the Ow. The Ow does offer room to elaborate further in lower legislation such as, for example, municipal participation ordinances. This is permitted under the AVG, which does not require a formal law (recital 41 AVG).

Pursuant to Article 20.25 Ow, Chapter 14 of the Environment Decree specifies which personal data may be processed in the DSO-LV, to whom the data may be provided and how long the data will be retained. It further follows from the Environment Decree that special or criminal data will not be provided through the DSO-LV. Apart from Section 20.5 of the Ow (and Chapter 14 of the Environment Decree) on the processing of personal data in the DSO-LV, the Ow contains no provisions on the processing of personal data other than in the context of enforcement. This means that both competent authority and initiators must otherwise comply with the requirements of the AVG and UAVG when processing personal data in the context of participation.

3. What does the Ow regulate in terms of privacy and data protection for initiators?

The Ow contains no regulation on privacy and data protection for initiators. Initiators who compile a participation report must comply with the AVG and UAVG.

Because in principle it is not a legal obligation to provide participation opportunities, reliance on Article 6(1)(c) AVG will often not be possible. Indeed, this basis requires that the data processing is necessary to fulfill a legal obligation. Instead, consent of participants will often provide the most appropriate basis for initiators to process personal data for participation purposes (Article 6(1)(a) in conjunction with Article 4(11) AVG). This may be different in the event that the municipal council makes participation mandatory under Article 16.55(7), Ow. Then a legal obligation does exist. That legal obligation can be the basis for processing personal data. Because discussions may arise (after the fact) about which data are necessary to meet the legal obligation for the participation report, we can imagine that the consent basis may provide more guidance and certainty for initiators in practice.

4. Considerations for processing personal data for participation purposes

It is up to governments and initiators to take measures to comply with the AVG and UAVG when organizing the participation process and processing personal data for this purpose. We formulate a number of points of attention below:

• Ensure transparency about what personal data is processed and for what purposes. Participants should be informed in accordance with the requirements of the AVG. It is common practice to make a written privacy notice available for this purpose.

• Participants should be able to exercise rights regarding their own personal data, such as access, rectification and deletion of data.

• Personal data must be collected for a specific purpose and then not used for other non-compatible purposes (purpose limitation). For example, data collected for participation purposes may not simply be used for a newsletter or other marketing activities. A developer setting up a participation program, for example, may not use the names he has collected for potential buyers of his development.

• Personal data collected and processed must be necessary (data minimization), not kept in identifying form longer than necessary (storage limitation) and adequately secured.

• Make clear processor agreements in case third parties are engaged: which party/parties is/are responsible for processing and/or does a party act as a processor on behalf of the initiator? In the latter case, a processor agreement should be concluded. Incidentally, this also applies to IT suppliers who make an online space available ('host') for the personal data on behalf of the initiator.

5. Conclusion

In the system of the Ow, an important role has been conceived for participation in the creation of decisions. The Ow itself provides a limited basis for processing personal data in the DSO-LV, which requires further elaboration in lower legislation. Beyond that, the rules of the AVG and UAVG apply in full. Parties operating within this playing field would therefore be wise to think carefully beforehand about whether and how they want to collect personal data in the context of participation, for which a number of points of attention have already been formulated in this blog.

This blog previously appeared on Environment Web