The management and monitoring model around the standard processor agreement have been established. The agreement was also reviewed by the Landsadvocaat and discussed with the privacy regulator, the Autoriteit Persoonsgegevens.
Pass-or-leg-out in 2019, mandatory from 2020
As of December 2018, municipalities and suppliers can use the standard processing agreement municipalities. In 2019, the agreement applies according to the pass-or-leg-out principle for new processing operations and in situations where no processor agreement has yet been concluded. The obligation as of 1/1/2020 will be determined by the VNG board in mid 2019 and the obligation will be ratified in the VNG membership meeting.
Landsadvocaat
The agreement has been reviewed by the Landsadvocaat. He made some suggestions for clarification and/or improvement. These suggestions will be included in the management cycle.
Autoriteit Persoonsgegevens
The standard has been submitted to the Autoriteit Persoonsgegevens. Although the regulator does not judge agreements in terms of content, it indicates that it is in favor of sectoral and collective agreements to promote the protection of personal data. The authority has emphasized to the VNG that not having agreements is against the law and indicates that a collective agreement can offer a solution in such cases. It is now known that the Authority has started checking on processor agreements.
Management model based on experiences of municipalities and suppliers
The use of a standard processor agreement is new for municipalities. The concept is not new, it is already applied in the education sector. Municipalities and suppliers can share their experiences via privacy@vng.nl-This experience is valuable in the further development of the standard. A management model has been set up for this purpose. This management model is as follows:
Municipalities and vendors can submit questions, suggestions and improvement proposals for the standard processor agreement to one central point: privacy@vng.nl;
At VNG Realization, the proposals are stored;
The proposals and suggestions will be submitted to the VWO Management Group.
The members of the Management Group are currently 13 municipal representatives (FGs, CISOs and buyers) and (at most) 8 vendors;
Membership in the Management Group will change regularly beginning in 2020 to give as many municipalities and vendors as possible the opportunity to participate in this.
We aim for a good reflection of small, medium and large municipalities. In principle, the G5 and large suppliers will have a permanent place in the VWO Management Group;
At the VWO Management Group meeting, members will determine whether they agree with the proposed changes. Adopted changes of a major nature are submitted to the Board of Service Affairs.
The members of the VWO Management Group have indicated their desire to meet four times a year. The first meeting is thus scheduled for the end of March 2019.
VNG monitors usage among municipalities in the following way:
The intention is for all municipalities to use the standard processor agreement for new processing operations (for example, a new tender or contract) and for ongoing processing operations in which there is no processor agreement as of today. The adoption of the standard processor agreement should be tracked, this is done in the following way:
At municipalities:
Visits and registration by account management of VNG Realization;
Signals coming in to the IBD help desk and
Periodic survey of municipalities
At suppliers:
Registration by suppliers of usage in the VNG Realization software catalog
Signs coming in to the IBD help desk
Signs coming in to the GIBIT help desk
