New European PSD2 legislation in force
At the start of 2019, the Payment Service Directive 2 will enter into force in the Netherlands. Under this new European banking law, consumers can share their banking details with parties other than their own bank. This first requires their explicit consent, upon which banks must share all transactional data of the consumer (account holder) with an external party (financial service provider) for a period of 90 days, after which the consumer can renew his consent. The consumer can also withdraw his consent at all times.
PSD2 is a great concern to Privacy First
Privacy First is very worried about PSD2. The law focuses too much on improving competition and innovation while the privacy interest of account holders is overlooked. These are Privacy First’s greatest concerns:
- Consumers are not in a position to limit the amount of banking details. Even in case a financial service provider does not need these details, all data are shared just the same once the account holder has issued his consent.
- The bank details of a consumer include the details of contra accounts. Holders of such accounts are unaware of the fact that their details may be shared and are not in a position to prevent that. As transactional data will be analyzed much more widely with the use of Big Data and data analyses than before the introduction of PSD2, there will be a much greater risk of privacy violations.
- Banking details contain ‘sensitive personal data’ that may only be issued under strict conditions. A subscription payment to a trade union, political party or organization that reveals one’s sexual preferences, should be considered sensitive personal data according to Privacy First. The same applies to transactions with health insurance companies and pharmacists. Currently, there is no way to filter out these data and they are being issued to parties that are not allowed to process them.
During an episode of the Dutch television program Radar that was broadcast on Monday 7 January 2019, Privacy First drew particular attention to these issues.
PSD2 quality label aims for transparency
Privacy First wants consumers to get honest and transparent information on what happens to their data. We advocate not for lengthy privacy statements, but rather for information that fits on a single sheet of paper. This information should not come from the financial industry, but from consumers themselves. After all, they can best decide which information they find valuable when making a choice. During 2018, Privacy First worked on this initiative along with the Volksbank and other partners from the financial sector.
PSD2 opt-out register
Privacy First is surprised that no attention has been paid to the role of ‘sensitive personal details’ in transactional data. Such details may only be shared under strict conditions and therefore have to be filtered out. Equally, consumers who do not want others to share their data with financial service providers should have the opportunity to prevent this. That is why Privacy First would like to see an opt-out register, similar to the do-not-call-me register which has been around in the Netherlands for many years. During the Radar broadcast, Privacy First announced it would bring forward this proposal, hoping to be able to develop it further together with the financial sector and policy makers. The aim is to have a compulsory opt-out register. This will, however, require amending the European PSD2 directive.
 Additional information: it concerns all transactional data. The extent to which these data go back in time varies per bank. See the overview (in Dutch) of the Dutch consumer association: The majority of account holders saves their bank statements for at least five years https://www.consumentenbond.nl/betaalrekening/meerderheid-bewaart-rekeningafschriften-ten-minste-5-jaar.
 Additional information: this is included in Article 9 of the GDPR and in Article 22 of the Dutch GDPR implementation Act. In short, processing sensitive personal data is unlawful, with a few exceptions. See (in Dutch) https://wetten.overheid.nl/BWBR0040940/2018-05-25.
A train passenger has submitted an enforcement request to the Dutch Data Protection Authority, because he argues that Dutch Railways (NS) violates the privacy of train passengers.
In response to three new attempts by Dutch Railways (NS) to violate the privacy of train passengers, NS customer Michiel Jonker has submitted a request for enforcement to the Dutch Data Protection Authority (DPA). It concerns:
- Rejecting the reimbursement of the remaining balance on anonymous public transport chip cards if the holder does not provide his or her name and address data to NS;
- Refusing international train tickets by NS employees at station desks if buyers do not provide their name and address data to NS;
- Charging, since 2 July 2018, additional "service costs" when holders of anonymous public transport chip cards pay in cash for topping up the balance on these cards.
Since July 2014, NS has already launched attacks on the privacy of Dutch train passengers in various ways. It then concerned:
- Discriminating holders of anonymous public transport chip cards in discount hours;
- Requiring de-anonymization of the anonymous public transport chip cards when NS is asked to provide services (for example, reimbursing money in the event of delays);
- Applying two unique card numbers on each anonymous OV chip card, as a result of which the anonymity of these cards is affected.
As a traveler who wants to maintain his privacy, Jonker repeatedly asked the DPA to investigate these violations and to take enforcement measures. Jonker already won several lawsuits against the DPA, which initially refused to even investigate the reports.
The recently adopted General Data Protection Regulation (GDPR) will play an important role in the assessment of the new violations by NS. Another central issue will be the right to pay by cash, which protects privacy.
Jonker: "In all these matters, the question is whether users of Dutch public transport are entitled to a real, effective protection of their privacy. This question is more relevant than ever, when you see how people are treated in situations where privacy is not adequately protected. We don't only think about China with its Social Credit score, or the United States with their "No Fly" lists, but also about European countries where laws have been adopted in recent years that allow the government to spy on travelers who are not even suspected of any punishable or risky behavior. For example France with its permanent state of emergency and the Netherlands with its new Intelligence and Security Act."
In this new case, Jonker is supported by Privacy First and Maatschappij voor Beter OV.
Source: https://www.liberties.eu/en/news/ns-privacy-fight-passenger-privacy/15444, 25 July 2018.
During a Dutch press meeting about the new Payment Service Directive 2 (PSD2), an initiative to launch a privacy quality label for payment services was announced. This quality label should encourage financial service providers and fintech companies to focus on the privacy of consumers.
If you struggle to make ends meet, sooner or later you will get physical complaints, two Utrecht physicians wrote in Dutch newspaper AD/Utrechts Nieuwsblad of 7 March 2018. Those who want to lead a healthy life, will first have to make sure they’re in a healthy financial position. Being in control of your own finances and all related data is a part of that. De Volksbank offers a helping hand in both these areas.
The new European Payment Service Directive 2 (PSD2) paves the way for payment apps of new parties. Banks no longer have the exclusive right to offer payment services. This appears to be good news for consumers. But there is a downside too. Customers who share their data with any such new service provider, should take into account that part of those data are privacy-sensitive. A bank cannot recover such data once in the hands of other financial service providers, so the consumer cannot resort to anyone but himself if he regrets his decisions.
The Dutch Consumers' Association (Consumentenbond) has recently warned that personal data are already being collected on a large scale for commercial reasons. With the introduction of PSD2, this will only increase. Ninety days of access to personal information is sufficient for service providers to create digital profiles that can be traded. De Volksbank does not want to create profiles and is of the opinion that client information should be secure in the hands of the bank: ‘‘That means that we don’t sell information of clients, neither on an individual nor on an aggregated level. We earn our money as a bank, not by selling the data of our clients.'’
De Volksbank considers it to be its role of helping clients deal with their data in a secure and deliberate way in an environment that has changed. By providing information (free is never really free), but also by encouraging clients to take additional measures:
- When it comes to taking deliberate decisions on sharing data, clients should increase their self-awareness by operating a Main Switch. The default setting of the Main Switch should be ‘off’. Before a client is able to authorize the bank to share his data with third parties, he should first flick the Main Switch. The client should then authorize the sharing of data for each party. In so doing, he can stop sharing his data with any party at any moment. Alternatively, he can flick the Main Switch, blocking the access to his data of all parties in a single instant.
- In cooperation with De Volksbank, several other banks, KPMG and fintech companies, Privacy First is developing a PSD2 quality label. This should answer the call of the Central Bank of the Netherlands (DNB), which ascertained that as of yet there is no such quality label, while there is the need to have one. As far as we know, the Netherlands is the first country to be working on this issue. Thanks to the PSD2 quality label, consumers should at once be able to tell which parties they can or cannot entrust their data to. De Volksbank is working hard on further developing the quality label in order for it to be ready as soon as the Payment Service Directive 2 has been transposed into Dutch legislation.
The Privacy First Foundation supports the PSD2 privacy quality label. Privacy First would like it to become an international label which is recognized and supported by banks, fintech companies, financial service providers, regulators and consumer organizations.
PSD2 offers advantages, but also puts people’s privacy at risk. People are more than just consumers. Privacy First doubts whether the measures laid down in PSD2 to protect the data and therewith the privacy of people, will be sufficient. For the protection of personal data, PSD2 relies heavily on the new General Data Protection Regulation (GDPR). This regulation has not yet come into force and we don’t know which effects PSD2 will have in practice and what the monitoring of it will look like. Many organizations are not yet ready to comply with all of the GDPR requirements. However, they will not hold off providing their services. In turn, regulators are not yet ready to enforce all aspects of the GDPR. Introducing PSD2 is like going out to fly without checking the parachute.
We hope that the quality label will encourage financial service providers and fintech companies to start considering consumers as human beings. We want the requirements of the label to be set higher each year. We also want service providers to consider the ‘information behind the information’:
- The disclosure of behavior and data by others
- Services with the underlying aim of collecting data (improper application)
- Deducting data, such as transaction data from which sensitive personal data can be deduced.
We call on fintech companies to continue to explore ways to limit the amounts of data they collect and store. Think of excluding transaction data that could indicate religion, political preference or health status. Limiting the retention period of transaction data is another measure to take into consideration.
This article has also been published on privacy-web.nl.
IRMA and ‘referendum students’ win Dutch Privacy Awards
In the context of the National Privacy Conference organized by Privacy First and ECP, today the very first Dutch Privacy Awards have been awarded. These Awards offer a podium to companies and governments that consider privacy as an opportunity to positively distinguish themselves and want privacy-friendly entrepreneurship and innovation to become a benchmark. The great winner of the 2018 Dutch Privacy Awards is IRMA (I Reveal My Attributes). The students who organized the Dutch referendum about the controversial Tapping law received the incentive prize.
Winner: IRMA (I Reveal my Attributes)
IRMA (I Reveal my Attributes) is a state of the art, open source identity platform which allows users to authenticate themselves by using an app on the basis of one or several attributes related to their different roles (contextual authentication). This form of authentication does not reveal one’s identity: a one-to-one relation between the user and the service provider makes brokers redundant and allows the former to use services anonymously, without a password and with minimal attributes.
The system has been developed by the Digital Security Research Group of the Radboud University Nijmegen. Since the end of 2016, IRMA is part of the independent Dutch Privacy by Design foundation.
The Awards panel praises the academic community for developing IRMA as a general purpose privacy-by-design application intended for both the private as well as the public sector. As a means of privacy-friendly authentication, the panel regards the innovative capacity of the open source technology used, the instant deployability and the potential impact on society of IRMA as great assets. That is why the panel unanimously chose IRMA as the winner of the 2018 Dutch Privacy Awards.
Winners: ‘Tapping law students’
On the initiative of five University of Amsterdam students, a national referendum about the new and controversial Dutch Intelligence and Security Services Act (‘Tapping law’) will be held on 21 March 2018. Regardless of the outcome of the referendum, one of its results will be a heightened awareness of and a more critical stand towards privacy issues among the Dutch. This fact alone was sufficient ground for the panel to unanimously reward the students with a Dutch Privacy Award (incentive prize).
There are four categories in which applicants are awarded:
1. the category of Consumer solutions (from companies for consumers)
2. the category of Business solutions (within a company or business-to-business)
3. the category of Public services (public authorities to citizens)
4. The incentive prize for a ground breaking technology or person.
Out of the various entries, the independent expert panel chose the following nominees per category:
|Consumer solutions:||Business solutions:||Public services:|
|IRMA (I Reveal My Attributes)||TrustTester||Youth Privacy Implementation Plan (municipality of Amsterdam)|
|Schluss||Personal Health Train|
During the National Privacy Conference the nominees have presented their projects to the audience in Award pitches. Thereafter, the Awards were handed out. Click HERE for the entire Award panel report (pdf in Dutch), which includes participation criteria and explanatory notes on all the nominees and winners.
From left to right: Paul Korremans (panel member), Luca van der Kamp (‘referendum student’), Esther Bloemen (Personal Health Train), Nina Boelsums (‘referendum student’), Bas Filippini (panel chairman), Bart Jacobs (IRMA), Arjan van Diemen (TrustTester), Marie-José Hoefmans (Schluss) and Wilmar Hendriks (Youth Privacy Implementation Plan (municipality of Amsterdam). Photo: Maarten Tromp.
National Privacy Conference
The National Privacy Conference is an initiative of ECP (Dutch Platform for the Information Society) and Privacy First. From now on, the conference will bring together once a year Dutch industry, public authorities, the academic community and civil society with the aim to build a privacy-friendly information society. The mission of both the National Privacy Conference and Privacy First is to turn the Netherlands into a guiding nation in the field of privacy. To this end, privacy-by-design is key.
The speakers during the 2018 National Privacy Conference were, in successive order:
Aleid Wolfsen, chairman of the Dutch Data Protection Authority,
Gerrit-Jan Zwenne, professor of Law and the Information Society (University of Leiden),
Jaap-Henk Hoepman, associate professor Privacy by Design (Radboud University Nijmegen),
Ulco van de Pol, chairman of the Amsterdam Data Protection Commission,
Tim Toornvliet, Netherlands ICT,
Lennart Huizing, Privacy Company.
Aleid Wolfsen, chairman of the Dutch Data Protection Authority. Photo: Maarten Tromp.
Panel of the Dutch Privacy Awards
The independent expert Award panel consists of privacy experts from different fields:
• Bas Filippini, founder and chairman of Privacy First (panel chairman)
• Paul Korremans, data protection & security professional at Comfort Information Architects
• Marie-José Bonthuis, owner of IT’s Privacy
• Bart van der Sloot, senior researcher at Tilburg University
• Marjolein Lanzing, PhD Philosophy & Ethics, Eindhoven University of Technology.
In order to make sure that the award process is run objectively, the panel members may not judge on any entry of his or her own organization.
Privacy First organized this first edition of the Dutch Privacy Awards in collaboration with ECP, with the support of the Democracy & Media Foundation and the Adessium Foundation. Would you like to become a partner of the Dutch Privacy Awards? Then please contact Privacy First!
Since 2013, the Dutch Association of General Practitioners has, in an essential civil case, been litigating against the private successor of the Dutch Electronic Health Record (Elektronisch Patiëntendossier, EPD): the National Switch Point (Landelijk Schakelpunt, LSP). At the end of last week, the Dutch Supreme Court decided that, for the time being, the LSP is not in violation of current privacy law. However, the Supreme Court has laid down in its judgment that the LSP will soon have to comply with the legislative requirement of privacy-by-design. This constitutes an important precedent and raises the bar with a view to the future.
Private relaunch of EPD: National Switch Point
In April 2011, the Dutch Senate unanimously rejected the EPD, primarily on account of privacy objections. However, almost directly afterwards, various market participants (among which health insurance companies) made sure there was a relaunch of the same EPD in private form: the LSP, intended for the large-scale, central exchange of medical data. Since then, the LSP has been introduced nationally and many practitioners have aligned themselves with it, oftentimes under pressure of health insurers. Millions of people in the Netherlands have given their ‘consent’ to the exchange of their medical records via the LSP. However, this ‘consent’ is so broad and general, it’s virtually impossible to deem it lawful. This was one of the main objections the court case of the Association of General Practitioners against the LSP revolved around. Other objections against the LSP are related to the fact that its architecture is inherently insecure and in breach of privacy. Through the LSP, every connected medical record is accessible for thousands of health care providers. This is in violation of the right to privacy of patients and the medical confidentiality of treating physicians. What’s more, there is no privacy-by-design, for example through end-to-end encryption. The LSP is basically as leaky as a sieve, which means that it’s ideal for function creep and possible abuse by malicious actors.
Specific Consent Campaign
Over the last couple of years, Privacy First has repeatedly raised the alarm about this in the media. We have brought the issue to the attention even of the United Nations Human Rights Council. In April 2014, a large scale Internet campaign was launched on the initiative of Privacy First and the Dutch Platform for the Protection of Civil Rights (Platform Bescherming Burgerrechten) in order to retain and enhance the right to medical confidentiality: www.SpecifiekeToestemming.nl. Ever since, this campaign is being supported by numerous civil organizations, healthcare providers and scholars. The essence of the campaign is that specific consent should (again) become the leading principle when it comes to the exchange of medical data. In case of specific consent, prior to sharing medical data, clients have to be able to decide whether or not, and if so, which data to share with which healthcare providers and for which purposes. This minimizes risks and enables patients to control the exchange of their medical data. This is in contrast to the generic consent that applies to the LSP. In the case of generic consent, it is unforeseeable who can access, use and exchange someone’s medical data. In this respect, generic consent is in contravention of two classic privacy principles: the purpose limitation principle and the right to free, prior and fully informed consent for the processing of personal data.
Privacy by design
Courtesy also of the pressure exerted by our campaign SpecifiekeToestemming.nl, the Dutch legislative proposal Clients’ Rights in relation to the processing of data in healthcare (legislative proposal 33509), was strenghtened by the House of Representatives in 2014 and was adopted by the Senate in 2016 as a result of two crucial motions: 1) the motion Bredenoord (D66) about the further elaboration of data-protection-by-design as the starting point for the electronic processing of medical data and 2) the motion Teunissen (Party for the Animals) related to keeping medical records accessible on a decentral (instead of a central) level. Under the new law, specific (‘specified’) consent is obligatory. This should now be implemented in all existing and future systems for the exchange of medical data, including the LSP. Moreover, privacy-by-design will become an inexorable legal duty under the new European General Protection Data Regulation (GDPR), that is to say, privacy and data protection should be incorporated in all relevant hardware and software from the very first design. In this context, there have been several developments on the Dutch market in recent years, all of which indicate that both specific consent as well as privacy-by-design are indeed becoming standards in new systems. A prime example of this in a medical context is Whitebox Systems, which won a Dutch National Privacy Innovation Award in 2015 already.
Court case of Association of General Practitioners
Since March 2013, the Dutch Association of General Practitioners (Vereniging Praktijkhoudende Huisartsen, VPH) has been litigating in a large-scale civil case against the private administrator of the LSP: the Association of Healthcare Providers for Healthcare Communication (Vereniging van zorgaanbieders voor zorgcommunicatie, VZVZ). Following unsatisfactory rulings by the district court of Utrecht and the Arnhem Court of Appeal, VPH appealed before the Dutch Supreme Court at the end of 2016. Since then, this case has, on the recommendation of Privacy First, received pro bono support from law firm Houthoff Buruma. As amicus curiae, Privacy First and the Platform for the Protection of Civil Rights filed a letter (PDF) with the Supreme Court in support of the general practitioners and in line with our joint campaign SpecifiekeToestemming.nl. In her conclusion, the Advocate general of the Supreme Court referred extensively to the amicus curiae letter. On 1 December 2016, the Supreme Court finally came up with its ruling. Regrettably, the Supreme Court by and large agreed with the line of reasoning of the Arnhem Court of Appeal. Privacy First cannot help thinking that the LSP (even before the Supreme Court) is apparently too big too fail: by now this faulty system has grown to the extend that no one dares to declare it unlawful. There is, however, an important positive note, which can be found in the final consideration of the Supreme Court:
‘‘[The Court has] acknowledged that the healthcare infrastructure can be designed in such a way that a clearer distinction can be made between (sorts of) data and (categories of) healthcare providers and, particularly, in such a way that the exchange of data on the basis of consent can beforehand be limited to cases of urgency. The Court takes the view that such infrastructure would be better in line with the principles of the Privacy Directive and the Personal Data Protection Act, but that it could not have been demanded from VZVZ at the time of the contested ruling. According to the Court, VZVZ can be expected, however, to alter its system offering greater freedom of choice, as soon as this is technically possible and feasible.
These considerations are not incomprehensible. It is worthwhile noting that, considering (...) the regulatory changes and VZVZ’s ambitions in relation to the system (...), privacy by design and privacy by default as explicit points of departure (art. 25, paragraphs 1 and 2 General Data Protection Regulation), is what the Court can reasonably expect from VZVZ.’' (5.4.4)
Just like the Arnhem Court of Appeal, the Supreme Court clearly homes in on the implementation of specific consent and privacy-by-design when it comes to the LSP. The Supreme Court thereby creates a positive precedent which will set the scene for the future, also in a broader sense. Privacy First will continue to actively follow the developments in this case and, if necessary, will not hesitate to bring certain aspects to the attention of the courts once more.
HERE you find the amicus curiae letter written by Privacy First and the Dutch Platform for the Protection of Civil Rights (pdf in Dutch).
Comments from the Dutch Association of General Practitioners: http://www.vphuisartsen.nl/nieuws/cassatieberoep-vphuisartsen-verloren-toch-winst/
Comments from SpecifiekeToestemming.nl: http://specifieketoestemming.nl/werk-aan-de-winkel-na-teleurstellend-vonnis-over-lsp/.