After a long discussion (since 2012), the Open Government Act ("Woo") was recently passed Oct. 5 in the Senate. With its publication in the Official Gazette (Official Gazette 499 and 500 for the amending law) in October, it is clear that the Woo will replace the Open Government Act ("Wob") as of May 1, 2022. This major change also has implications for everyday privacy practice. In this post, we zoom in on an important change to the Woo, which should lead to more active disclosure. The phenomenon of the government disclosing information on its own accord, i.e., without a request to do so.
A notable change in the Woo compared to the Wob is that the emphasis is to be placed on disclosure of information by the government itself. Although the Wob already gave this option under article 8, it was rarely used. Because that possibility did exist under the Wob - and sometimes special laws also compel active disclosure - the Dutch Data Protection Authority (College bescherming persoonsgegevens, "Cbp"), the predecessor of the Autoriteit Persoonsgegevens, saw reason in 2009 to publish guidelines on the privacy aspects that must be taken into account in active disclosure.(1) According to the Cbp, this was necessary because there were no unambiguous rules for the "voluntary disclosure of government information".
The Woo introduces a provision similar to article 8 of the Wob, which anchors the active disclosure obligation in law as an obligation of effort. In addition, the Woo clarifies that even active disclosure quickly becomes a decision with possibilities for objection and appeal. This means that interested parties must be asked for their views on whether they think disclosure is a good idea. To that extent, the person concerned can thus put forward his interests (including those related to privacy) and have a judge check whether those interests do not stand in the way of disclosure.
What is new about the Woo is that the law then also designates specific categories of documents that must be actively disclosed. In the long article 3.3, we see documents where disclosure - within a certain period of time after adoption or receipt of a document - is paramount. Examples of the documents listed in this article are meeting documents, agendas, decision lists, investigations, Woo decisions, other decisions and various opinions.
Disclosure with the documents mentioned in paragraph two is the principle unless interests prevent it. Those interests are listed in Article 5.1 and Article 5.2. They state, among other things, that protection of special personal data or (more generally) protection of privacy sometimes precludes disclosure. This means that an administrative body must assess for each document whether it must (or can) be disclosed. This requires both effort and alertness on the part of the administrative body. For although it concerns 'all information held by the administrative body', exceptions to the obligation to disclose do apply.
The Woo includes three privacy-related exceptions that limit the obligation to disclose. First, for special and criminal personal data (par. 3.1 and 3.2 of the UAVG), disclosure is omitted unless consent has been obtained or the personal data have already been disclosed by the data subject. Secondly, for the bsn (Article 46 UAVG), there is no disclosure. These first two exceptions apply as absolute exceptions. If it concerns such personal data, then this information may not be disclosed.
A relative exception is respect for privacy. This concerns all other information that can be traced back to individuals. The relative nature of this type of information means that in each case a balance must be struck between the interest in disclosure and respect for privacy. If the latter weighs more heavily, there is no disclosure. These three exceptions must therefore always be considered when deciding whether or not to proceed with (full or partial) active disclosure. Even when it comes to the mandatory disclosure of documents as mentioned in article 3.3 Woo.
In addition to the aforementioned exceptions, it is important that the Woo leaves room for the administrative body to disclose personal data. Although instinctively at odds with the AVG, it is clear that the AVG also provides some room for this. Article 86 AVG allows access to official documents and the processing of personal data in that context. If respect for privacy does not prevent disclosure under the Woo, such processing of personal data is possible under Article 6(1)(c) of the AVG (according to the legislator in the consolidated explanatory note(2)). Such processing may be necessary to fulfill the obligation of the Woo.
However, this does not alter the fact that as still under the AVG, it must be assessed whether disclosure is actually necessary to comply with that legal basis. If the AP follows its line (and that of the Cbp) from 2009 and 2017(3) regarding disclosure of personal data, then a strict necessity test should be performed. For example, in 2017 the AP stated that for the active disclosure of decision lists(4) and to comply with the Wob, it is usually not necessary to also disclose personal data. Thus, only if the processing of personal data is necessary to comply with the legal disclosure obligation is processing of personal data based on this legal obligation possible as a lawful basis.
Thus, the more concrete obligation to actively disclose large amounts of data will lead more to having to assess whether and to what extent personal data are involved and whether the processing is necessary for this (by publication). That this is a precarious matter became clear earlier this year. The municipality of Utrecht thought it was publishing anonymous Wob decisions. Due to the naming of files, however, this turned out not to have been done correctly, resulting in a data leak.(5) This shows that the Woo requires continuous alertness, also when it comes to information that can be traced back to individuals. Fortunately, the legislator will soon allow practice to get used to active disclosure. The obligations of article 3.3 will be phased in (via article 10.2). For the rest, the Woo will enter into force immediately on May 1, 2022, and thus the Wob will no longer exist!
CBP Guidelines 'Active disclosure and respect for privacy', Aug. 13, 2009
Annex 2 to Parliamentary Papers II 2019/20, 35 112, no. 9.
As reflected in letter from AP to VNG on active publication of personal data by municipalities, Oct. 13, 2017
This concerned the basis in article 60 of the Municipal Law, which contains a similar obligation to the disclosure obligation in the Woo
Security incident at Utrecht municipality; names of submitters of Wob requests published
