In my previous blog I described when further processing of personal data is possible. In this blog, I elaborate on the legislation that gives further processing a legal basis.
The AVG concept of further processing is usually referred to in practice as data exchange or sharing. To further process data, you must meet a number of conditions. The most important of these is that the new processing must be compatible with the old processing, the so-called compatibility test. As I stated in my previous blog, the open wording in the AVG and that compatibility test makes further processing legally risky. That compatibility test is not necessary if there is a legal basis to exchange the data. Legislation has therefore been made in a number of areas to enable data sharing.
To enable data sharing, three laws are awaiting completion.
The Data Protection by Partnerships Act (Wgs).
First of all, the Data Processing by Collaborative Organizations Act mentioned in my previous blog (1) and the associated Data Processing by Collaborative Organizations Decree that is an elaboration of the Act. This legislation aims to provide a legal basis for exchange in cooperative ventures. Collaborative arrangements refer to cooperation between administrative bodies and private parties that process data to combat fraud and organized crime, for example. Examples of such cooperative ventures are the Regional Information and Expertise Centers (RIEC) and the Care and Safety Houses (ZVHs). Plenary consideration of this law in the Senate is scheduled for June 11. Incidentally, the AP has called on the Senate (2) not to adopt the bill in its current form. Among other things, the AP advocates a judicial review for data processing analogous to heavy investigative tools such as searches and wiretaps.
The Addressing Multiple Problems Social Domain Act (WAMS).
The second law (3) that gives data exchange a legal basis applies to the Social Domain. Municipalities have been given the task of working integrally and broadly in helping citizens under the Youth Act, Participation Act and Social Support Act, among others. The sharing of data, with an appeal to the AVG, is considered difficult. The professionals who have to implement these laws often struggle with sharing data of families with multiple problems. This law provides a basis for sharing data between different social workers when necessary. The Act regulates the sharing of data, which does not mean, as is sometimes thought in practice, that an integral file can be created.
With the fall of the Cabinet, this Act was declared controversial. The Council of State gave a critical opinion. It believes that regulating how data can be exchanged is at odds with previous legislation aimed at decentralization. So it is still some time to wait for treatment but in practice municipalities are already anticipating the new law.
Promote Cooperation and Lawful Care Act (ICZ Act).
Since I did not come across an abbreviation of this law in practice, I abbreviated it myself to IKZ law.
This law (4) regulates data exchange for combating fraud in healthcare. The law provides a legal basis for data exchange between the various healthcare agencies such as municipalities and health insurers. The Care Fraud Information Exchange (IKZ) is also regulated in this law. The law provides for a central reporting point, on this blacklist healthcare fraudsters are included so that other agencies are warned. The Healthcare Information Exchange (IKZ) manages the reports. After much criticism of an earlier version, the law now explicitly states that health data covered by professional secrecy may not be provided.
The law was approved by the Senate last July and now awaits enactment.
In short, in order to give the further processing of personal data a legal basis, a considerable amount of legislation has been drafted. The AP's advice on the Wgs indicates that the exchange of personal data can also involve risks for those involved. For us as privacy professionals, this is also a task. In addition to the basis, the other principles of the AVG must also be complied with in this type of processing.
https://www.eerstekamer.nl/wetsvoorstel/35447_wet_gegevensverwerking_door
https://www.eerstekamer.nl/wetsvoorstel/35447_wet_gegevensverwerking_door
https://www.tweedekamer.nl/kamerstukken/wetsvoorstellen/detail?cfg=wetsvoorsteldetails&qry=wetsvoorstel%3A36295
https://www.eerstekamer.nl/wetsvoorstel/35515_wet_bevorderen_samenwerking
