On Oct. 9, the Personal Data Authority (AP) published a the Government Sector Assessment. The report maps a number of developments and trends in privacy. The report covers all governments: ministries, water boards, as well as a number of observations about municipalities. In this second blog, Nico Mookhoek discusses the observations the AP makes about municipalities.
The AP sees a specific development in this area in the increasing use of (mobile) camera surveillance. The (temporary) filming of public areas can have a huge impact on the privacy of citizens. The AP therefore notes that camera surveillance always meets the requirements of "subsidiarity" and "proportionality.
Subsidiarity is the question of whether camera deployment is actually necessary or whether a problem can be addressed without the deployment of cameras. The consideration for proportionality involves weighing whether the invasion of privacy is proportionate to the purpose of the camera surveillance.
The AP finds that municipalities do not always communicate clearly about new processes, exactly how they process personal data in certain processes, how they safeguard citizens' privacy, etc. More transparency also forces organizations to think more carefully about how they intend to (start) complying with the AVG and whether new processing operations are really necessary.
A complete and up-to-date processing register and algorithm register help increase transparency. The AP calls on municipalities to publish these registers for all to see.
The AP sees, as noted above with respect to the security domain, that municipalities seek the limits of the AVG and seem to go over them more often. As a cause, the AP identifies a lack of knowledge about the AVG within an organization or among the board. However, it also notes that municipalities sometimes deliberately push the AVG aside because they see it as an obstacle to the task at hand.
Willful sidelining can also stem from a lack of knowledge or insufficient awareness of the importance of privacy. But (missing) legislation can also be a barrier.
The opposite of administrators trying to stretch the boundaries, the AP also encounters: administrators who are reluctant to act. Privacy laws and regulations are seen as standing in the way, without being the case.
The AP also makes a number of comments in its report that relate to the role of the FG.
First, it notes that the independence of FGs is a hard condition for ensuring that FGs can do their job properly. For example, if the FG wears different hats, this can get in the way of the FG's independent advisory role. As an example, the AP cites the FG who is also a privacy officer at the same time.
Indeed, the FG would then have to monitor, as an independent regulator, the privacy policy that the FG helps shape as privacy officer.
Furthermore, the AP observes that especially in smaller municipalities the independent position of the FG is not always very strong. As possible solutions, it suggests hiring an external FG or appointing one FG for several municipalities.
Further, the AP notes although an FG's advice is not binding, the FG's opinion is weighty. An organization that wants to deviate from an FG's advice must give sound reasons for doing so. However, the latter does not always happen.
In the previous blog, I addressed, among other things, the AP's observations about linking data across domains, the AVG as an established fact and the AP's concerns about privacy culture.
The AP's opinions can be summarized in 4 bullets.
Properly organize data sharing between external parties and within different domains in the municipality.
Ensure timely and proper DPIAs.
In the security domain, balance interests between privacy and security.
Strengthen the position of the FG.
