Cooperation, almost every organization is talking about it. Both private and public organizations want to tackle fraud and other abuses together and work more effectively. To do this, it is often necessary and desirable for investigative services to provide data. But as soon as the term "data exchange" comes up, people shy away; due to lack of knowledge, experience or a strict privacy advisor. What is the real situation?
In organizations where special investigating officers work, much more is possible than is often thought. Even the information systems in use do not make optimal use of the possibilities offered by the law. Data processed by boas do not fall under the AVG but under the Police Data Act (Wpg). And the Wpg has a very different disclosure regime than the AVG. Whereas the AVG focuses on a compatible purpose, for the Wpg, if the legislator has assessed that there is a compelling public interest, the boa or general investigator may provide.
The Wpg applies to the police, the Marechaussee, the National Criminal Investigation Department, the four Special Investigation Services and boas. The law states in Article 15 that there is a mutual obligation to make data available to other investigating officers. The only condition is that this investigating officer needs this data for his task. This is not always easy to assess, but can be fulfilled in various ways. The police have long had a national information system, which allows any officer to access police data across the country. Oaths or vows, with logging and good leadership, flesh out the test of whether an officer needs the data for his job. Another way of fulfilling the duty to share is by contacting each other or attending a briefing, for example.
At boa organizations such as water boards, environmental services, municipalities and nature management organizations, there is also a desire to cooperate. The Boa Registration System (BRS) (1) fulfills the partial obligation by working with authorizations in a manner similar to the police. A boa from Sportvisserij Nederland thus has access to the mutations and official reports of a boa from a water board. And yes, this requires trust: trust that the system is properly secured, and that the employer of these other organizations trains and manages his people well. Again, instruments such as logging apply as a means of monitoring this. If a boa uses another registration system, then the partial obligation can be fulfilled manually or by other means.
In addition to this duty to share, the Wpg also contains possibilities to provide data to partners who are not investigating officers. These are detailed in Articles 16 to 20. This includes, for example, the possibility for a police officer to provide an official report drawn up during an alcohol inspection to the mayor so that he can revoke an Alcohol Act license. Another example is the provision to an aggrieved person of a criminal offense. If a shipping company damaged a bridge because the vessel was sailing in a place where it was not allowed, the boa can provide these police records to the owner of the bridge. This power of disclosure requires that the proportionality and subsidiarity requirement set by the Wpg be met. If it is possible for the owner to obtain compensation for the damage in a way that is less invasive of the shipowner's privacy, this way is preferred under the Wpg. Often an injured party can join the criminal process, for example, and then that is preferred.
Cooperation can take place in different ways. Here it should be taken into account whether the data are covered by the Wpg and to whom the data are sent. Provision can take place under the Wpg in the following ways.
From a boa to another boa or police: this involves making police data available and Article 15 applies;
From a boa to another type of organization, then it involves providing. Use the national Provisioning Guide Wpg for boas (2) as a tool;
From another organization to a boa or police, then the AVG applies.
So why do people shy away from the term data sharing? Often the above three points are unknown. And there is no such thing as "quid pro quo. It's about providing or making available, and if a non-Wpg partner wants to provide to a boa organization, then the AVG must be involved. So don't talk about exchanging, talk about providing.
Want to know more about this, or training on the Wpg for police officers, their supervisors, privacy advisors? Then look here.
https://www.boaregistratie.nl/public/InfoBRS.aspx
https://www.natuurnetwerk.info/BRSdocumenten/Verstrekkingenwijzer%20Wpg%20voor%20boa%20v1.6.pdf
