When implementing the Social Support Act (Wmo) and the Youth Act, municipalities collect more personal data from people than is necessary for their care needs. This violates privacy laws. The Autoriteit Persoonsgegevens investigated the way two municipalities process personal data in a self-reliance matrix (ZRM). Chairman Aleid Wolfsen: "This involves personal data of vulnerable people. It is important that municipalities handle this carefully. Good care and careful handling of personal data are inseparable. All municipalities that use a ZRM must adjust their working methods accordingly."
The ZRM is an instrument used to measure how self-reliant people are. The matrix is used in many municipalities as a guideline in contacts with citizens, such as during the so-called kitchen table talks. With a ZRM, personal data are collected on a large number of domains, such as physical and mental health, finances and justice.
Use self-reliance matrix
The Personal Data Protection Act states that no more personal data may be collected than is necessary for the purpose. The AP's investigation shows that a ZRM also collects personal data that are not relevant to the request for help. In doing so, municipalities are acting in violation of the law.
Duty of care by municipalities
The AP finds that instructions by municipalities on this point are insufficiently concrete and specific. Thus, the municipalities are not fulfilling their duty of care. Municipalities have a duty of care to ensure that professionals are sufficiently capable of assessing which personal data are necessary for guidance to care. This means that they have to take guarantees for this, for example by organizing training and drawing up adequate manuals for professionals.
Earlier AP investigation into social domain
In April 2016, the AP concluded, based on research at the 41 largest municipalities in the Netherlands, that municipalities do not have a clear overview for what purposes, and based on what grounds, what personal data may be processed in the social domain. In response, the AP published an overarching report detailing the legal framework for processing personal data in the social domain. The new investigation into the two municipalities is a follow-up to the 2016 investigation.
