In both public and private organizations, there is a need to exchange personal data. For example, to tackle fraud and undermining. Based on privacy regulations (AVG), this is not allowed just like that. The Data Processing by Collaborative Organizations Act (Wgs) will in certain cases provide a basis for the processing of personal data by collaborative organizations that aim to combat fraud, crime and/or undermining.
In the previous part of the blog series, we discussed what the Wgs regulates and the safeguards the Wgs regulates. In this blog series, we discuss the regulation in the Wgs for Regional Information and Expertise Centers (RIECs) and Care and Safety Homes.
Wgs regulation for the RIEC
The Wgs contains a legal basis for three types of cooperative arrangements (section 2.3 Wgs). One of these are the RIECs (section 2.16 Wgs). The Wgs already regulates a number of aspects for the RIECs:
Section 2.17 Wgs defines the purpose of processing by the RIEC: personal data may only be processed to the extent necessary for the performance of the participants' statutory duties and powers in the field of criminal, administrative and tax law enforcement in the interests of combating organized crime.
Article 2.18 of the Wgs describes the activities of the RIEC (identifying and analyzing enforcement bottlenecks, conducting case consultations and performing area scans). In principle, therefore, the Wgs only provides an opening for processing in the context of the aforementioned activities.
Participants of the RIEC include the police, mayor and provincial government (Article 2.19 of the Wgs).
Additional safeguards in Bgs
Because the Wgs is a framework law, the draft Bgs elaborates on a number of issues, including with respect to the RIECs. The draft Bgs is now up for internet consultation. The aspects relating to the RIECs can be found in section 2.3 of the draft Bgs:
For example, Article 2.13 stipulates that RIECs ensure that their territorial area of operation is publicized by posting on the Internet. This is in order to inform those involved as well as possible about the presence of a RIEC.
Article 2.15 draft Bgs concretizes what personal data may be provided within a RIEC. This includes, for example, data to identify a person, data on residence status and living situation, as well as vehicle data such as financial data. Article 2.15 draft Bgs sets the requirement that the provision must be adequate, relevant and not excessive. This corresponds to a number of principles from the AVG: purpose limitation, necessity and data minimization.
Also, article 2.16 of the draft Bgs sets further criteria that a signal must meet in order to be processed by a RIEC. For example, a joint approach with several participants of the RIEC must be necessary. Furthermore, one of the criteria is that the signal must be related to the manifestations of organized crime listed there. These include human trafficking, organized drug crime and fraud. Thus, signals may not be shared for other purposes based on the Wgs.
In addition, in certain cases the RIEC may share signals with another cooperative. This sharing must be necessary and the participants must have no objection. Article 1.10 of the draft Bgs elaborates on four situations in which data sharing between two collaborative organizations can take place. One of these situations is when the data subject is known to two collaborative organizations. A RIEC and a Care and Safety House may also exchange data with each other that are necessary to coordinate interventions by the participants in both collaborative organizations.
Wgs regulation for Care and Security Houses.
The Wgs also contains a legal basis for Care and Security Houses (article 2.24 Wgs). In its supplementary advice advised that, due to the purpose limitation requirement, the position of Care and Safety Houses should be reconsidered. The government has no reason to remove the Care and Safety Homes from the Wgs. The Wgs already regulates a number of aspects for the "Care and Safety Houses.
Article 2.25 Wgs regulates the purpose of processing personal data by Care and Security Houses. When handling complex casuistry, the Care and Safety Houses may only process personal data with respect to a data subject to the extent that this is necessary for the performance, alignment and coordination of the deployment of the legal duties and powers with which the participants are charged. Processing may also take place for necessary activities in the field of criminal and administrative law enforcement as well as guidance and care and assistance in the interest of preventing, reducing and combating crime and serious nuisance and preventing and reducing unsafe situations for individuals or within an area.
Article 2.26 Wgs outlines the activities of the Care and Safety Houses. These include conducting case meetings and establishing lists of prioritized cases.
Article 2.27 Wgs defines the participants of the Care and Safety Houses. These include the Child Protection Council, police and mayor of the relevant municipality.
Additional regulation Bgs
Section 2.4 of the draft Bgs sets forth specific requirements for the partnership of Care and Security Houses.
As for the RIEC, article 2.18 of the draft Bgs stipulates that the territorial operating area of a Care and Security House be posted on the Internet.
Article 2.19 of the draft Bgs states that within a Care and Security House, personal data may only be shared about individuals who are a family member or other direct social contact of an individual reported within the Care and Security House.
Article 2.20 draft Bgs sets criteria for the handling of a case by the Care and Safety House.
Article 2.21 draft Bgs sets out criteria for incidental participation in a Care and Safety House case conference by third parties. This is only allowed on an incidental basis and insofar as they have the expertise required for the specific case and they can play a role in fulfilling or drawing up, implementing or evaluating a plan of approach in view of their respective legal or public duties and powers. Such a plan of action means a plan that gives substance to the joint strategy, referred to in Article 2.26 of the Wgs, for the performance of the statutory duties and powers with which the participants are charged as well as related necessary work carried out by the participants. A third party participating in a consultation must first sign a confidentiality agreement for this purpose. The third party may not have direct access to the systems of the collaborative, but under conditions personal data may be provided incidentally to this third party. Thus, the Wgs may only be invoked for standard participants within a Care and Safety House. This cannot be extended without question.
Mutual agreements
In all cases, with respect to both the RIEC and the Care and Safety House, it is advisable to make clear mutual agreements about the processing and therefore the exchange of personal data. Despite the fact that the Wgs provides frameworks for the exchange of personal data within these partnerships, this does not mean that in cases that do not fall within the frameworks of the Wgs, no exchange may take place. Other cases must be assessed under the "regular" privacy regime: the AVG. This should also be part of the agreements between parties.
Where do we stand now?
The goal is for the Wgs to come into effect by January 1, 2025. In other parts of the blog series, you can read about exactly what the bill entails (part 1) and what the safeguards are that the Wgs regulates (part 2).
