The government wants to use information on the Internet about citizens to conduct surveillance and enforcement. This involves collecting personal data through so-called open source intelligence research (OSINT). This is evident from various legislative proposals. The Autoriteit Persoonsgegevens (AP) sees major risks for people.
Therefore, the AP urges the Minister of Justice and Security to provide a general policy framework for OSINT. This should strike the right balance between what the government needs for its tasks and respect for the fundamental rights of citizens. Thereafter, the AP will review whether that balance has been struck.
The bills involve collecting information from public Internet sources. For example, forums, social media, advertising sites, or registries such as the Trade Register. But possibly also data on the darkweb, which may have been obtained and published illegally. The government wants to systematically use AI, special tools or software and fake accounts to collect information about people online.
Aleid Wolfsen, chairman AP: "The government wants to automatically scan the Internet and combine a lot of data about people. This allows the government to get a complete picture of aspects of the private lives of many citizens. This can be very invasive and a major invasion of privacy. The question is when and under what conditions such a thing is justified. The answer to this is currently lacking because there is no legal framework for it yet. Without legal restrictions and guarantees, OSINT research by the government can acquire traits of a surveillance society in which citizens can be constantly watched.'
The AP emphasizes that the surveillance and enforcement bills are not about criminal detection or national security. Rather, it is about citizens against whom there is no suspicion of crimes. Clear criteria and guarantees to protect people's rights are omitted. This concerns, for example, the bill on Internet surveillance by Customs.
The AP believes there needs to be a legal framework that answers the question of when the government may use what forms of OSINT. And what safeguards should then be in the law. The AP says there should be a clear reason for and delineation of the research. The starting point should be to collect as little information about people as possible. Once such a framework is in place, the AP can test whether it fits within the boundaries of privacy laws.
