Government organizations had better not use Facebook if it is unclear what happens to the personal data of visitors to their Facebook page. This is because the government must be able to guarantee that the processing of these data complies with the law. This is what the Personal Data Authority (AP) advises the Ministry of the Interior (BZK).
In 2021, the Ministry of the Interior and Kingdom Relations itself investigated the possible privacy risks of the government's use of Facebook. The ministry concluded then that it did not have a good picture of what Facebook does with the personal data of people who visit pages of the Dutch government. Therefore, in late 2023, BZK asked the AP whether the government should be allowed to use Facebook. The AP's advice to BZK (1) is now not to do so if there is uncertainty about privacy.
Aleid Wolfsen, chairman AP: "The state secretary for Digital Affairs is concerned about people's privacy. She wonders whether the government is complying with the law by using Facebook pages. That concern is understandable. Not only because the AP can take enforcement action for violations of the law. But mostly because people who visit a government page trust that their personal and sensitive information is in safe hands. The fact that this can include information about children and young people makes this even more important. They are vulnerable online and need extra protection."
Wolfsen continued: "Because people rely on the government for many things, they will be quick to use a platform like Facebook for communication with the government. But government organizations should not use such platforms as a communication channel if they conclude that they are not sure what happens to people's data. It should be crystal clear what happens to your data. That's the norm."
Which regulator can act if an organization violates the law depends on where it is located. The AP supervises the Dutch government and can take enforcement action if personal data processing there does not comply with the Privacy Act. With Facebook, that authority lies primarily with the Irish regulator because Facebook's European headquarters is in Ireland.
In addition to this advice to the Interior Ministry, another position on large online platforms (2) was made public. The AP and the other privacy regulators in Europe, united in the EDPB, argue that large online platforms, such as social media, should not force their users to pay or be tracked online in order to use the platform. There should be an option where users are not tracked and an option where users do not have to pay and where they are tracked only to a limited extent.
Wolfsen: "If a platform threatens to blacklist your online account once you do not agree to be tracked online, that is not a free choice. Tech companies may not force you to agree to have your behavior tracked on the Internet. For example, to sell your data to advertising companies. People sometimes depend on information on certain online platforms. Especially when it comes to government information, people have a right to access this information. Without having to pay for it and without sacrificing their privacy."
https://www.autoriteitpersoonsgegevens.nl/documenten/advies-aan-bzk-over-gebruik-facebook
https://www.autoriteitpersoonsgegevens.nl/actueel/edpb-platforms-mogen-gebruikers-niet-dwingen-zich-te-laten-volgen
