All organizations employing boas, such as municipalities, provinces, environmental services and social services, are currently adapting their work processes and systems in accordance with the Police Data Act (Wpg). Many of these boas have supervisory duties in addition to their investigative powers. These two hats result in them working under both the AVG and the Wpg: another touch more complicated, in other words.
Since 2019, the legal framework for data processing by a boa has changed. You can read more about this in this article.
Article 20 Wpg describes the possibility of providing data in the context of a cooperation agreement. Since 2008, this article has already applied to the police. Because - like the police - boas also sometimes cooperate with local partners, this article also applies to boas. For a municipal boa domain 1 'Public space', for example, this may involve cooperation with street coaches, housing corporations or healthcare institutions.
An Article 20 partnership usually involves a covenant describing which of the partners has which task. The law describes a number of conditions that must be met, and one of these is that the purpose for which the cooperative is established must be laid down. For the boa, this will always have to be the prevention and detection of criminal offenses. There is sometimes confusion about this since the law describes that there are four possible purposes. However, these are the purposes that apply to a police officer and not to a boa.
Because the fine officer - in his role as a fine officer - processes police data for the purpose of investigative duties, it follows from the purpose limitation that the purpose of the provision is compatible with the prevention or investigation of criminal offenses for which the fine officer is authorized. So the boa does not provide information for the purpose of providing assistance or maintaining public order; that is reserved only for the police. If the boa is involved in that, it can only be in his role as supervisor.
This also means something for the requirement that the decision to provide (the Article 20 decision) must be taken in agreement with the competent authority under the Police Act 2012. Indeed, for the boa, this competent authority is always the public prosecutor, because he is the one under whose authority the boa does his work as a boa. This is therefore different from the police, since there a cooperation can also be entered into for, for example, providing assistance. If the municipal boa cooperates in that context, it will have to involve data that he processes in his other role, often as a supervisor, and so it is not police data (Wpg) but 'ordinary' personal data under the AVG.
Any covenant to be drafted must stipulate:
For the purpose of which important public interest the disclosure is necessary;
for the purpose of which collaborative effort the police data is provided;
the purpose for which the partnership was established: for the boa, this will always have to be the prevention and detection of crimes;
What types of data are provided;
the conditions under which the data is provided;
To which persons and agencies the data will be provided;
With which prosecutor (competent authority) this cooperation and provision has been agreed upon.
Furthermore, as with all other transmissions of police data, each transmission must be recorded, the recipient must be made aware of the duty of confidentiality, and a careful proportionality and subsidiarity test must be carried out.
More information? Register for the Privacy Law in Detection course next Oct. 3.
