Minister Blok answers questions about the report that the Central Bureau of Statistics (CBS) gained access to privacy-sensitive location data of T-Mobile customers.
1
Are you familiar with the article "How CBS and T-Mobile violated privacy"?
Reply
Yes.
2
What is your reaction to this reporting, which indicates that the Central Bureau of Statistics (CBS) had access to sensitive location data of T-Mobile customers for years?
Reply
The Telecom Agency and the Autoriteit Persoonsgegevens , as regulators, are currently conducting a joint investigation in response to the NRC article. This investigation is looking into what exactly happened and whether privacy rules were violated in the process. The results of this investigation will have to be awaited before a response can be given.
3
Is it true that CBS employees had access to traffic data for billing purposes for T-Mobile customers, which can be used to find out who was at what location when and with whom they were in contact?
Reply
It is up to regulators the Telecom Agency and the Autoriteit Persoonsgegevens to assess this. According to CBS, it has not had access to individual individuals' customer data. CBS and T-Mobile have indicated that CBS has had insight into data that cannot be traced back to customers and that the data in question does not indicate exact location. Nevertheless, questions have arisen about T-Mobile's provision of data to CBS. An investigation has therefore been launched by the Netherlands Radiocommunications Agency assisted by the Autoriteit Persoonsgegevens.
4
To what extent can such traffic and billing data be considered anonymous datasets?
Reply
Traffic and billing data are considered personal data and therefore not anonymous.
5
What is your definition of pseudonymized personal data in this context? Are telecommunications traffic data from which only the unique IMSI numbers have been removed still personal data, or not?
Reply
The definition used is taken from Article 4.5 of the AVG: processing personal data in such a way that the personal data can no longer be linked to a specific data subject without the use of additional data, provided that this additional data is kept separately and technical and organizational measures are taken to ensure that the personal data are not linked to an identified or identifiable natural person.
Whether telecommunications traffic data can still be considered personal data after the removal of IMSI numbers depends on the content of the remaining data (do they still allow traceability to individuals) and thus cannot be answered without further investigation.
6
Is it true that CBS employees even had access to directly traceable personal data, including IMSI numbers?
Reply
CBS indicated that CBS employees did not see IMSI numbers nor did they have access to individually traceable personal data. It is up to the regulators to judge this.
7
How does the cooperation between CBS and T-Mobile relate to the proposal for the Temporary Act on the Provision of Information by RIVM in connection with COVID-19? Is the provision of data, as has taken place between CBS and T-Mobile, somewhat similar to the proposal to pass information through CBS to the National Institute of Public Health and the Environment (RIVM)?
Reply
The Telecommunications Act allows telecommunications service providers to process location data without users' consent under the condition that this data is anonymized. After anonymization, the data may also be shared with third parties if the telecommunications service providers would like to do so. CBS indicates that the pilot involved anonymized data provided voluntarily by the provider. As for the use of telecommunications data for Covid-19, several providers have stated that they are willing to cooperate in this only if they are required to do so by law. Such an obligation for providers is included in the Temporary Act on the Provision of Information by RIVM in connection with the fight against Covid-19. In addition, the bill includes rules on how telecommunications providers should provide the data to CBS.
8
How do you now view the answer in the response to the report, in which you wrote that CBS employees were working at the T-Mobile office as part of a pilot to observe and consult, and that during the pilot only anonymous results (counts) were provided to CBS? Do you share the opinion that this answer was incorrect? If so, how do you explain this?
Reply
No. In the memorandum in response to the report, the government noted that the Telecommunications Act permits the processing of traffic data if it is anonymized. Furthermore, it was mentioned that CBS has indicated that the cooperation with T-Mobile involved the processing of anonymous data. Nevertheless, questions have arisen about the provision of telecommunications data from T-Mobile to CBS. An investigation has therefore been launched by the Netherlands Radiocommunications Agency assisted by the Autoriteit Persoonsgegevens.
9
Is it true that CBS, in regular consultations with regulators, concealed that it had access to non-anonymized location data of T-Mobile customers? If so, what do you think about this?
Reply
CBS says it has not had access to non-anonymized location data of T-Mobile customers. The Radiocommunications Agency and the Autoriteit Persoonsgegevens are currently conducting a joint investigation as regulators. This investigation is looking into what exactly happened and whether privacy rules were violated in the process. The results of this investigation will have to wait.
10
Is it true that the Autoriteit Persoonsgegevens had not yet gotten around to reviewing requested CBS documents due to lack of time? Do you share the view that this case demonstrates once again that a substantial intensification of the capacity of the Personal Autoriteit Persoonsgegevens Authority is needed?
Reply
The Autoriteit Persoonsgegevens has decided to ask further questions regarding the situation at CBS in relation to the pilot. CBS has provided the Autoriteit Persoonsgegevens with documentation on the pilot. This supplied documentation from CBS has been dealt with by the Autoriteit Persoonsgegevens . As mentioned above, the Telecom Agency and the Autoriteit Persoonsgegevens are currently conducting joint investigations. No conclusions can be drawn from this course of events regarding the need for a capacity intensification for the Autoriteit Persoonsgegevens.
11
Is it true that the project plan for this collaboration states that CBS employees would have full access to sensitive location data, while the contract is only about aggregated data?
Reply
The agreement between CBS and T-Mobile setting out the terms of cooperation has been made public. CBS has indicated that the project plan states that, in accordance with the agreement, aggregate data will be used.
12
How is it possible that CBS, as an independent administrative body, has entered into this collaboration? How does the organization test whether project plans comply with privacy legislation? How is it possible that no one has sounded the alarm about this? Are you prepared to launch an external investigation into the way CBS handles privacy issues?
Reply
CBS has a statutory duty to produce and publish government statistics. New social and technological developments have led to an increased demand for data. Collaboration by CBS with science and private parties provides opportunities for CBS to gain more insight into unique data or methods for developing statistics.
According to CBS and T-Mobile, they satisfied themselves that this research was permitted within the frameworks of the Telecommunications Act and the AVG. Moreover, external auditors conduct annual audits of CBS' job performance, including in the area of privacy. CBS recently again received the privacy certificate "Privacy Audit Proof," which is based on the Privacy Control Framework. As indicated earlier, this does not eliminate the fact that questions have arisen regarding the provision of telecommunications data from T-Mobile to CBS. An investigation has therefore been launched by the Radiocommunications Agency assisted by the Autoriteit Persoonsgegevens.
13
How do you assess the fact that the CBS, an independent administrative body, funded from the state budget, operates on the basis of a business plan that bets on combining datasets, with which tens of millions of euros per year can be earned? Do you think this is desirable?
Reply
CBS has the legal task of producing and publishing government statistics. In order to do this efficiently and safely, research is also carried out into the possibilities of using new data sources. The goal is always to generate information that meets societal needs. All results and methods are made public.
The CBS receives a lump-sum contribution each year from the Ministry of Economic Affairs and Climate for carrying out the work program, from which, among other things, the mandatory European statistics are paid for. In addition, governments may, from their own budgets, request additional statistical services from the CBS. For this, the CBS charges the full cost price in accordance with article 5 of the Policy Rule on the performance of duties by the CBS. Although the CBS has no profit motive, it is required to pass on the costs of services not covered by the Ministry of Economic Affairs and Climate to its clients in the form of a full cost price in order to prevent unfair competition with private statistical service providers. It is important that CBS's actions do not lead to market-distorting behavior. To clarify the division of roles between private statistical service providers and the CBS, the Policy Rule on the performance of tasks by the CBS and the Regulation on the activities of third parties by the CBS came into force on July 1, 2020.
14
Do you consider it desirable for the CBS to enter into contracts with private companies where access to sensitive data is exchanged, as it were, against the provision of algorithms from which those private companies can in turn benefit? To what extent is this compatible with the public mission of the CBS?
Reply
The possibility of cooperation with private companies is desirable to enable CBS to fulfill its statutory task of producing and publishing government statistics for the benefit of practice, policy and science. The algorithms and other knowledge resulting from such collaborations are always made publicly available so that others, such as companies, governments or research institutions, can also make use of them. An overview of innovative projects can be found on the CBS website.
15
To what extent are national statistics offices in other European countries set up in a similar way, entering the market as algorithm developers?
Reply
CBS does not enter the market for algorithms. CBS develops algorithms it needs for its statutory task and then makes them publicly available.
16
Do you agree with the thrust of the article that CBS explicitly presents itself in the market as a reliable party, due to its ties to the government, in order to gain market advantage over competitors?
Reply
Government parties can turn to CBS for statistical information they need in carrying out their public duties. CBS charges the full cost price for such work. The CBS also occasionally performs work for third parties (private parties). Against this background, the Ministry of Economic Affairs and Climate Change has received signals that market parties and the CBS increasingly encounter each other in the market for statistical services. Uncertainty has arisen as to whether CBS is the appropriate party to provide a statistical assignment, or whether this should be left to a market party. To this end, since July 1, 2020, the Policy Rule on the performance of tasks by CBS and the Regulation on the work of third parties by CBS have come into force. These regulations aim to create more clarity about the division of roles between private statistical service providers and the CBS. To this end, CBS focuses more visibly on its core tasks and pays permanent attention to the interests of market parties when providing additional services or carrying out innovative projects. In 2022, the effects of the Policy Rule on the performance of tasks by CBS and the Regulation on the activities of third parties by CBS will be evaluated.
17
Do you share the thrust of the article that both T-Mobile and CBS were misleading in their external communications about this collaborative project by emphasizing that only anonymous aggregated data would be involved, even when it was already known that raw location data had also been worked with?
Reply
18
Do you recognize the picture being painted of companies and researchers attempting to use the corona crisis to gain access to data in ways not previously possible? If so, what do you think of this trend?
Reply
No such signals have reached the Cabinet. If this were the case, it is of course worrying. The corona crisis should not be misused to improperly gain access to previously inaccessible data.
19
Can you provide an overview of all similar contracts CBS has with private companies around access to customer data and algorithm development and delivery?
Reply
As Minister of Economic Affairs and Climate, I am politically responsible for the legislation concerning the CBS and its budget. The CBS is an independent administrative body and therefore not hierarchically subordinate to the Minister. This means that I cannot give instructions to CBS at the dossier level, nor am I informed of all individual contracts concluded by CBS. An overview of innovative projects and their results, which sometimes translate into publicly accessible algorithms, is available on the CBS website.
Footnotes:
(1) https://www.t-mobile.nl/company/media/pdf/Overeenkomst%20pilot%20CBS%20T-Mobile.pdf
(2) https://www.cbs.nl/nl-nl/over-ons/organisatie/privacy/iso-en-privacycertificering
(3) www.cbs.nl/nl-nl/over-ons/innovatie
(4) www.cbs.nl/nl-nl/over-ons/innovatie
