The Dutch Ministry of Finance is about to oblige companies to export personal data on a large scale. The measure is hidden in a subordinate clause of a letter from the Minister of Finance, although it has major consequences. The measure obliges companies that trade in 'virtual assets' (such as bitcoins, real estate, but also purchases in computer games) to include personal data of customers in the transaction records and messages. The information from all parties involved needs to remain visible and available to everyone in the value chain.
Consumers, companies and citizens cannot object to this mandatory addition of their personal data. The topic is not receiving the proper amount of political attention because it is presented as a technical measure. In his letter to Dutch Parliament of 21 March 2019, the Minister fails to point out the large scope and impact. It is, however, suggested that a consultation round will take the market responses to the envisaged rules onboard.
Privacy First and VBNL (United Bitcoin Companies Netherlands) have meanwhile understood that the worldwide objections to the proposed measure are being ignored. That is why they are today sending an urgent letter to the Dutch Minister of Finance. They ask him to study the issue better, with all relevant Ministries and in particular: to better inform Parliament. In doing so, they point to the conflicts of law that may arise as the measure may well violate international agreements and treaties that protect privacy.
Where it is known that consumers are very reluctant to make their own data available to private and commercial institutions, the government must be similarly reluctant on their behalf. Privacy First finds it extremely unfortunate that the Ministry of Finance seems to intend to give this all-in permission for unbridled export of personal data without giving it proper attention and without applying due process.
There is no merit to the claim that the measure is required for counter-terrorism purposes. Experts at Europol (!) indicate that the international proposal is "overkill" and not necessary for investigative purposes. The rule adds nothing to the existing European framework against money laundering and terrorist financing and only increases the risk of unwanted data breaches.
Privacy First and VBNL hope that their letter will make Dutch Parliament aware that this is a proposal that goes far beyond the much-debated access-regime of the recent second European Payment Services Directive (PSD2). With PSD2, consumers can decide to share data themselves. With this proposal, they will become deprived of that fundamental right for all kinds of economic acts. Privacy First and VBNL are calling on parliamentarians to protect consumers and businesses against this unnecessary planned measure.
The letter can be downloaded here (pdf).
PSD2 opt-out register
Is it possible to have innovation in the field of payment data while preserving privacy? Under the new European banking law PSD2, payment data can be shared with non banking parties. The legislator has, however, failed to implement privacy by design. Therefore, the Privacy First Foundation has taken the initiative to launch a PSD2 opt-out register in the Netherlands. We are happy to report that the SIDN Fund is supporting us in this. With this opt-out register bank account numbers can be filtered. This can be useful in case bank account numbers are linked to sensitive personal data, such as a payment to a trade union, a healthcare insurer, a political party or an organization that reveals one’s sexual preference. It can also be useful when consumers wish to filter their contra accounts. The Dutch PSD2 opt-out register could become trendsetting at a European level.
Source: https://www.sidnfonds.nl/nieuws/de-eerste-pioniers-van-2019, 22 May 2019 (in Dutch).
Follow https://psd2meniet.nl for updates and become a member of our PSD2 Privacy Panel! (in Dutch)
For all its projects and affiliated activities, Privacy First is largely dependent on donations. The more financial support and donations we receive, the sooner Privacy First will be able to launch the PSD2 opt-out register.
In the context of the National Privacy Conference organized by Privacy First and ECP today the Dutch Privacy Awards have been handed out. These Awards offer a podium to organisations that consider privacy as an opportunity to positively distinguish themselves and want privacy-friendly entrepreneurship and innovation to become a benchmark. The winners of the 2019 Dutch Privacy Awards are Startpage.com as well as Privacy Company & SURF. PublicSpaces received the incentive prize.
With Private Search 2.0, Startpage.com allows those who find profiling and targeting on the basis of search queries oppressing, to breathe a little more freely again. The basic promise of Startpage is that its users can question Google Search without having to fear that Google accords a permanent data trail to every single query. Moreover, Startpage.com enables searching through an anonymizing proxy. It therefore meets the needs of anyone who doesn’t want to be confronted with targeted ads on the basis of search queries. Think of people who search for information related to financial, relationship or health problems. And naturally any other person who, by default, wishes to stay clear of foreign companies that trade in personal data (based in Silicon Valley and elsewhere). Startpage.com thus offers people an important and very privacy-friendly opportunity to visit websites without having to worry about unwanted profiling and without being confronted with one’s own search behavior.
Winner: Privacy Designer (Privacy Company and SURF)
Privacy Designer is a Privacy Company and SURF web app which helps SMEs, associations and NGOs to identify privacy risks. The app has been co-financed by the SIDN Fund and can be used free of charge.
The expert panel was deeply impressed by this solution. It’s a practical and innovative app which has a large impact on society because research points out that the target group is often insufficiently aware of the privacy risks to which it is exposed and doesn’t quite know how to deal with such risks appropriately. Another advantage of Privacy Designer is the fact that all data is stored on one’s own device and the use of personal data is kept to a minimum. In short, this entry can potentially improve the privacy of a large group of people in an effective and accessible way.
There is a lot that goes on online that internet users can’t see and are not aware of. Advertising displayed on the basis of search behavior can be a great annoyance. Meanwhile, we become increasingly dependent on online information gathering, navigation and cloud storage. This makes a few dominant commercial companies ever more powerful.
PublicSpaces is a coalition of public broadcasters and cultural organizations that aim to ‘repair’ the internet by restoring it to a community of users. They try to do so by collaborating with a number of relevant parties and by offering alternatives. In particular, the fact that data so easily ends up across different platforms is a thorn in the eye of PublicSpaces. With open source initiatives and the use of IRMA (‘I Reveal my Attributes’, an open source identity platform which won a Dutch Privacy Award last year), the coalition attempts to improve online privacy. The expert panel wholeheartedly encourages PublicSpaces’ mission.
There are four categories in which applicants are awarded:
1. the category of Consumer solutions (business-to-consumer)
2. the category of Business solutions (within a company or business-to-business)
3. the category of Public services (public authority-to-citizen)
4. The incentive prize for a ground breaking technology or person.
From the various entries, the independent expert panel chose the following nominees per category:
|Consumer solutions:||Business solutions:||Public services:|
|Private Search 2.0 (Startpage.com)||
Privacy op Schooltas
Passantentellingen (Municipality of Nijmegen)
|VraagApp||Privacy Designer (Privacy Company and SURF)||Project privacy by design (Dutch Tax Authorities)|
During the Dutch National Privacy Conference the nominees presented their projects to the audience in Award pitches. Thereafter, the Awards were handed out. Click HERE for the entire expert panel report (Dutch pdf), which includes participation criteria and explanatory notes on all the nominees and winners.
National Privacy Conference
The National Privacy Conference is a ECP|Platform for the Information Society and Privacy First initiative. Once a year, this conference brings together Dutch industry, public authorities, the academic community and civil society with the aim to build a privacy-friendly information society. The mission of both the National Privacy Conference and Privacy First is to turn the Netherlands into a guiding nation in the field of privacy and data protection. To this end, privacy by design is key.
These were the speakers during the 2019 National Privacy Conference in successive order:
Aleid Wolfsen (chairman of the Dutch Data Protection Authority)
Sophie in ‘t Veld (Member of the European Parliament)
Tijmen Schep (PrivacyLabel)
Brenno de Winter (IT researcher)
Jeroen Terstegge (Privacy Management Partners).
Expert panel of the Dutch Privacy Awards
The independent expert Award panel consists of privacy experts from different fields:
- Bart van der Sloot, senior researcher at Tilburg University (panel chairman)
- Bas Filippini, founder and chairman of Privacy First
- Paul Korremans, data protection & security professional at Comfort Information Architects (and Privacy First board member)
- Marie-José Bonthuis, IT’s Privacy owner
- Esther Janssen, attorney specialized in information law and fundamental rights, Brandeis Attorneys
- Esther Keymolen, philosopher of technology, TILT, Tilburg University
- Matthijs Koot, senior security specialist, Secura BV
- Marc van Lieshout, senior researcher at TNO and managing director at PI.lab
- Wendeline Sjouwerman, privacy specialist who focuses on local governments and health care.
In order to make sure that the Award process is run objectively, the panel may not judge on any entry of his or her own organization.
Privacy First organizes the Dutch Privacy Awards with the support of the Democracy & Media Foundation and in collaboration with ECP. Would you like to become a partner or sponsor of the Dutch Privacy Awards? Then please contact Privacy First!
IRMA and ‘referendum students’ win Dutch Privacy Awards
In the context of the National Privacy Conference organized by Privacy First and ECP, today the very first Dutch Privacy Awards have been awarded. These Awards offer a podium to companies and governments that consider privacy as an opportunity to positively distinguish themselves and want privacy-friendly entrepreneurship and innovation to become a benchmark. The great winner of the 2018 Dutch Privacy Awards is IRMA (I Reveal My Attributes). The students who organized the Dutch referendum about the controversial Tapping law received the incentive prize.
Winner: IRMA (I Reveal my Attributes)
IRMA (I Reveal my Attributes) is a state of the art, open source identity platform which allows users to authenticate themselves by using an app on the basis of one or several attributes related to their different roles (contextual authentication). This form of authentication does not reveal one’s identity: a one-to-one relation between the user and the service provider makes brokers redundant and allows the former to use services anonymously, without a password and with minimal attributes.
The system has been developed by the Digital Security Research Group of the Radboud University Nijmegen. Since the end of 2016, IRMA is part of the independent Dutch Privacy by Design foundation.
The Awards panel praises the academic community for developing IRMA as a general purpose privacy-by-design application intended for both the private as well as the public sector. As a means of privacy-friendly authentication, the panel regards the innovative capacity of the open source technology used, the instant deployability and the potential impact on society of IRMA as great assets. That is why the panel unanimously chose IRMA as the winner of the 2018 Dutch Privacy Awards.
Winners: ‘Tapping law students’
On the initiative of five University of Amsterdam students, a national referendum about the new and controversial Dutch Intelligence and Security Services Act (‘Tapping law’) will be held on 21 March 2018. Regardless of the outcome of the referendum, one of its results will be a heightened awareness of and a more critical stand towards privacy issues among the Dutch. This fact alone was sufficient ground for the panel to unanimously reward the students with a Dutch Privacy Award (incentive prize).
There are four categories in which applicants are awarded:
1. the category of Consumer solutions (from companies for consumers)
2. the category of Business solutions (within a company or business-to-business)
3. the category of Public services (public authorities to citizens)
4. The incentive prize for a ground breaking technology or person.
Out of the various entries, the independent expert panel chose the following nominees per category:
|Consumer solutions:||Business solutions:||Public services:|
|IRMA (I Reveal My Attributes)||TrustTester||Youth Privacy Implementation Plan (municipality of Amsterdam)|
|Schluss||Personal Health Train|
During the National Privacy Conference the nominees have presented their projects to the audience in Award pitches. Thereafter, the Awards were handed out. Click HERE for the entire Award panel report (pdf in Dutch), which includes participation criteria and explanatory notes on all the nominees and winners.
From left to right: Paul Korremans (panel member), Luca van der Kamp (‘referendum student’), Esther Bloemen (Personal Health Train), Nina Boelsums (‘referendum student’), Bas Filippini (panel chairman), Bart Jacobs (IRMA), Arjan van Diemen (TrustTester), Marie-José Hoefmans (Schluss) and Wilmar Hendriks (Youth Privacy Implementation Plan (municipality of Amsterdam). Photo: Maarten Tromp.
National Privacy Conference
The National Privacy Conference is an initiative of ECP (Dutch Platform for the Information Society) and Privacy First. From now on, the conference will bring together once a year Dutch industry, public authorities, the academic community and civil society with the aim to build a privacy-friendly information society. The mission of both the National Privacy Conference and Privacy First is to turn the Netherlands into a guiding nation in the field of privacy. To this end, privacy-by-design is key.
The speakers during the 2018 National Privacy Conference were, in successive order:
Aleid Wolfsen, chairman of the Dutch Data Protection Authority,
Gerrit-Jan Zwenne, professor of Law and the Information Society (University of Leiden),
Jaap-Henk Hoepman, associate professor Privacy by Design (Radboud University Nijmegen),
Ulco van de Pol, chairman of the Amsterdam Data Protection Commission,
Tim Toornvliet, Netherlands ICT,
Lennart Huizing, Privacy Company.
Aleid Wolfsen, chairman of the Dutch Data Protection Authority. Photo: Maarten Tromp.
Panel of the Dutch Privacy Awards
The independent expert Award panel consists of privacy experts from different fields:
• Bas Filippini, founder and chairman of Privacy First (panel chairman)
• Paul Korremans, data protection & security professional at Comfort Information Architects
• Marie-José Bonthuis, owner of IT’s Privacy
• Bart van der Sloot, senior researcher at Tilburg University
• Marjolein Lanzing, PhD Philosophy & Ethics, Eindhoven University of Technology.
In order to make sure that the award process is run objectively, the panel members may not judge on any entry of his or her own organization.
Privacy First organized this first edition of the Dutch Privacy Awards in collaboration with ECP, with the support of the Democracy & Media Foundation and the Adessium Foundation. Would you like to become a partner of the Dutch Privacy Awards? Then please contact Privacy First!
Since 2013, the Dutch Association of General Practitioners has, in an essential civil case, been litigating against the private successor of the Dutch Electronic Health Record (Elektronisch Patiëntendossier, EPD): the National Switch Point (Landelijk Schakelpunt, LSP). At the end of last week, the Dutch Supreme Court decided that, for the time being, the LSP is not in violation of current privacy law. However, the Supreme Court has laid down in its judgment that the LSP will soon have to comply with the legislative requirement of privacy-by-design. This constitutes an important precedent and raises the bar with a view to the future.
Private relaunch of EPD: National Switch Point
In April 2011, the Dutch Senate unanimously rejected the EPD, primarily on account of privacy objections. However, almost directly afterwards, various market participants (among which health insurance companies) made sure there was a relaunch of the same EPD in private form: the LSP, intended for the large-scale, central exchange of medical data. Since then, the LSP has been introduced nationally and many practitioners have aligned themselves with it, oftentimes under pressure of health insurers. Millions of people in the Netherlands have given their ‘consent’ to the exchange of their medical records via the LSP. However, this ‘consent’ is so broad and general, it’s virtually impossible to deem it lawful. This was one of the main objections the court case of the Association of General Practitioners against the LSP revolved around. Other objections against the LSP are related to the fact that its architecture is inherently insecure and in breach of privacy. Through the LSP, every connected medical record is accessible for thousands of health care providers. This is in violation of the right to privacy of patients and the medical confidentiality of treating physicians. What’s more, there is no privacy-by-design, for example through end-to-end encryption. The LSP is basically as leaky as a sieve, which means that it’s ideal for function creep and possible abuse by malicious actors.
Specific Consent Campaign
Over the last couple of years, Privacy First has repeatedly raised the alarm about this in the media. We have brought the issue to the attention even of the United Nations Human Rights Council. In April 2014, a large scale Internet campaign was launched on the initiative of Privacy First and the Dutch Platform for the Protection of Civil Rights (Platform Bescherming Burgerrechten) in order to retain and enhance the right to medical confidentiality: www.SpecifiekeToestemming.nl. Ever since, this campaign is being supported by numerous civil organizations, healthcare providers and scholars. The essence of the campaign is that specific consent should (again) become the leading principle when it comes to the exchange of medical data. In case of specific consent, prior to sharing medical data, clients have to be able to decide whether or not, and if so, which data to share with which healthcare providers and for which purposes. This minimizes risks and enables patients to control the exchange of their medical data. This is in contrast to the generic consent that applies to the LSP. In the case of generic consent, it is unforeseeable who can access, use and exchange someone’s medical data. In this respect, generic consent is in contravention of two classic privacy principles: the purpose limitation principle and the right to free, prior and fully informed consent for the processing of personal data.
Privacy by design
Courtesy also of the pressure exerted by our campaign SpecifiekeToestemming.nl, the Dutch legislative proposal Clients’ Rights in relation to the processing of data in healthcare (legislative proposal 33509), was strenghtened by the House of Representatives in 2014 and was adopted by the Senate in 2016 as a result of two crucial motions: 1) the motion Bredenoord (D66) about the further elaboration of data-protection-by-design as the starting point for the electronic processing of medical data and 2) the motion Teunissen (Party for the Animals) related to keeping medical records accessible on a decentral (instead of a central) level. Under the new law, specific (‘specified’) consent is obligatory. This should now be implemented in all existing and future systems for the exchange of medical data, including the LSP. Moreover, privacy-by-design will become an inexorable legal duty under the new European General Protection Data Regulation (GDPR), that is to say, privacy and data protection should be incorporated in all relevant hardware and software from the very first design. In this context, there have been several developments on the Dutch market in recent years, all of which indicate that both specific consent as well as privacy-by-design are indeed becoming standards in new systems. A prime example of this in a medical context is Whitebox Systems, which won a Dutch National Privacy Innovation Award in 2015 already.
Court case of Association of General Practitioners
Since March 2013, the Dutch Association of General Practitioners (Vereniging Praktijkhoudende Huisartsen, VPH) has been litigating in a large-scale civil case against the private administrator of the LSP: the Association of Healthcare Providers for Healthcare Communication (Vereniging van zorgaanbieders voor zorgcommunicatie, VZVZ). Following unsatisfactory rulings by the district court of Utrecht and the Arnhem Court of Appeal, VPH appealed before the Dutch Supreme Court at the end of 2016. Since then, this case has, on the recommendation of Privacy First, received pro bono support from law firm Houthoff Buruma. As amicus curiae, Privacy First and the Platform for the Protection of Civil Rights filed a letter (PDF) with the Supreme Court in support of the general practitioners and in line with our joint campaign SpecifiekeToestemming.nl. In her conclusion, the Advocate general of the Supreme Court referred extensively to the amicus curiae letter. On 1 December 2016, the Supreme Court finally came up with its ruling. Regrettably, the Supreme Court by and large agreed with the line of reasoning of the Arnhem Court of Appeal. Privacy First cannot help thinking that the LSP (even before the Supreme Court) is apparently too big too fail: by now this faulty system has grown to the extend that no one dares to declare it unlawful. There is, however, an important positive note, which can be found in the final consideration of the Supreme Court:
‘‘[The Court has] acknowledged that the healthcare infrastructure can be designed in such a way that a clearer distinction can be made between (sorts of) data and (categories of) healthcare providers and, particularly, in such a way that the exchange of data on the basis of consent can beforehand be limited to cases of urgency. The Court takes the view that such infrastructure would be better in line with the principles of the Privacy Directive and the Personal Data Protection Act, but that it could not have been demanded from VZVZ at the time of the contested ruling. According to the Court, VZVZ can be expected, however, to alter its system offering greater freedom of choice, as soon as this is technically possible and feasible.
These considerations are not incomprehensible. It is worthwhile noting that, considering (...) the regulatory changes and VZVZ’s ambitions in relation to the system (...), privacy by design and privacy by default as explicit points of departure (art. 25, paragraphs 1 and 2 General Data Protection Regulation), is what the Court can reasonably expect from VZVZ.’' (5.4.4)
Just like the Arnhem Court of Appeal, the Supreme Court clearly homes in on the implementation of specific consent and privacy-by-design when it comes to the LSP. The Supreme Court thereby creates a positive precedent which will set the scene for the future, also in a broader sense. Privacy First will continue to actively follow the developments in this case and, if necessary, will not hesitate to bring certain aspects to the attention of the courts once more.
HERE you find the amicus curiae letter written by Privacy First and the Dutch Platform for the Protection of Civil Rights (pdf in Dutch).
Comments from the Dutch Association of General Practitioners: http://www.vphuisartsen.nl/nieuws/cassatieberoep-vphuisartsen-verloren-toch-winst/
Comments from SpecifiekeToestemming.nl: http://specifieketoestemming.nl/werk-aan-de-winkel-na-teleurstellend-vonnis-over-lsp/.
Christmas column by Bas Filippini,
Chairman of the Privacy First Foundation
Principles of our democratic constitutional State are still very relevant
‘‘Your choice in a free society’’ is the slogan of the Privacy First Foundation. Privacy First has defined its principles on the basis of universal human rights and our Dutch Constitution and is reputed for professional and, if necessary, legal action in line with our free constitutional State. The mere fact that Privacy First exists, means that in recent years the aforementioned principles have come under increasing pressure. We base our (legal) actions and judgements on thorough fact-finding, to the extent possible in our working area.
‘The Netherlands as a secure global pioneer in the field of privacy’, that’s our motto. This country should also serve as an example of how to use technology whilst maintaining the principles of our open and free society. This can be achieved through legislative, executive and IT infrastructures, starting from privacy by design and making use of privacy enhanced technology.
Whereas the industrial revolution has environmental pollution as a negative side effect, the information revolution has the ‘pollution of privacy and freedom’ as an unwanted side effect.
Therefore, the question is how to preserve the basic principles of our democratic constitutional State and how to support new structures and services towards the future. As far as we’re concerned, these basic principles are neither negotiable nor exchangeable. Yet time and again we see the same incident-driven politics based on the misconceptions of the day strike at times when the constitutional State is at its most vulnerable and cannot defend itself against the emotional tide of the moment.
Paris as yet another excuse to pull through ‘new’ laws
Various politicians feed on the attacks in Paris and tumble over one another to express Orwellian macho talk, taking things further and further in legislative proposals or in emotional speeches characterized by belligerence and rhetoric. And it’s always so predictable: further restraining existing freedoms of all citizens instead of focusing further on the group of adolescents (on average, terrorist attackers are between 18 and 30 years old) that intelligence agencies already have in sight. Instead of having a discussion about how intelligence agencies can more effectively tackle the already defined group that needs to be monitored and take preventive measures in the communication with and education of this target group, the focus too easily shifts to familiar affairs whereby necessity, proportionality and subsidiarity are hard to find.
So in the meanwhile we’ve witnessed the prolonged state of emergency in France, the far reaching extension of powers of the police, the judiciary and intelligence services (also to the detriment of innocent citizens), extra controls in public space, the retention of passenger data, etc., etc. All this apparently for legitimate reasons in the heat of the moment, but it will be disastrous for our freedom both in the short as well as in the long run. In this respect the blurring definition of the term ‘terrorism’ is striking. Privacy First focuses on government powers in relation to the presumption of innocence that citizens have. We’re in favour of applying special powers in dealing with citizens who are under reasonable suspicion of criminal offences and violate the rights of others with their hate and violence. In fact, that’s exactly what the law says. Let’s first implement this properly, instead of introducing legislative proposals that throw out the baby with the bathwater.
The governments is committed to impossible 100 per cent security solutions
What often strikes me in conversations with civil servants is the idea that the government should provide 100 per cent solutions for citizens and applies a risk exclusion principle. This leads to a great deal of compartmentalization and paralyzation when it comes to possible government solutions in the area of security. Technology-based quick fixes are adhered to by default, without properly analyzing the cause of problems and looking at the implementation of existing legislation.
The government way of thinking is separate from citizens, who are not trusted in having legal capacity and are regarded as a necessary evil, as troublesome and as inconvenient in the performance of the government’s tasks. The idea that the government, serving its citizens, should offer as high a percentage as possible but certainly not a 100 per cent security (the final 10 per cent are very costly on the one hand and suffocating for society on the other) is not commonly shared. No civil servant and no politician is prepared to introduce policies to maintain an open society today (and 50 years from now) that entail any risk factors. However, in reality there will always be risks in an open society and it should be noted that a society is not a matter of course but something we should treat with great care.
Here in the Netherlands we’ve seen other forms of government before: from rule by royal decree to a bourgeoisie society and an actual war dictatorship. Every time we chose not to like these forms of society. What could possibly be a reason to be willing to go back to any of these forms and give up our freedoms instead of increasing them and enforcing them with technology? Especially in a society that has high levels of education and wherein citizens show to be perfectly able to take their own decisions on various issues. We hire the government and politics as our representatives, not the other way around. However, we’re now put up with a government that doesn’t trust us, is only prepared to deliver information on the basis of FOIA requests and requires us to hand over all information and communications about us and our deepest private lives as if we were prima facie suspects. That puts everything back to front and to me it embodies a one way trip to North Korea. You’ll be more than welcome there!
Political lobby of the industry
The industry’s persistence to overload the government and citizens with ICT solutions is unprecedented. Again and again here in the Netherlands and in Silicon Valley the same companies pop up that want to secure their Christmas bonus by marketing their products in exchange for our freedom. We’re talking about various electronic health records like the Child record and the Orwellian and centralized electronic patient record, the all-encompassing System Risk-Indication database, travel and residency records, road pricing, chips in number plates and cars, so-called automated guided vehicles (including illegal data collection by car manufacturers), number plate parking, automatic number plate recognition cameras, facial recognition in public space and counter-hacking by government agencies while voting computers are back on the agenda. Big Data, the Internet of things, the list goes on.
With huge budgets these companies promote these allegedly smart solutions, without caring about their dangers for our freedom. It’s alienating to see that the reversal of legal principles is creeping in and is being supported by various government and industry mantras. It’s as if a parasitic wasp erodes civil liberties: the outside looks intact but the inside is already empty and rotten.
From street terrorism to State terrorism
As indicated above, the information revolution leads to the restriction of freedom. It’s imperative to realize that after 4000 years of struggle, development and evolution we have come to our refined form of society and principles that are (relatively) universal for every free citizen. Just as most of us are born out of love, freedom and trust, to me these are also the best principles with which to build a society. We’re all too familiar with societies founded on hate, fear and government control and we have renounced them not so long ago as disastrous and exceptionally unpleasant. At the expense of many sacrifices and lives these principles have been enshrined in treaties, charters and constitutions and are therefore non-negotiable.
It’s high time to continue to act on the basis of these principles and make policy implementation and technology subordinate to this, taking into account the people’s needs and their own responsibility. In my eyes, a civil servant in the service of the people who places security above everything else, is nothing more than a State terrorist or a white collar terrorist who in the long term causes much more damage to our constitutional State and freedom than a so called street terrorist. The government and industry should have an immediate integrity discussion about this, after which clear codes can be introduced for privacy-sustainable governing and entrepreneurship.
Towards a secure global pioneer in the field of privacy
Privacy First would like to see government and industry take their own responsibility in protecting and promoting the personal freedom of citizens and in so doing use a 80/20 rule as far as security is concerned. By focusing on risk groups a lot of money and misery can be saved. Exceptions prove the rule, which in this case is a free and democratic constitutional State and not the other way around. Say yes to a free and secure Netherlands as a global pioneer in the field of privacy!
Since we are a foundation that has privacy very high on its agenda, it is only natural for us to make use of a privacy-friendly hosting service for our website. Therefore the websites of Privacy First (privacyfirst.nl and privacyfirst.eu) are hosted on the servers of Greenhost in Amsterdam since this month. This decision was preceded by a thorough exploration of foreign alternatives, varying from hosting services inside a nuclear bunker in Sweden to VPN tunnels in Switzerland and an old fortress in the North Sea. However, Greenhost proved to be well ahead of its foreign competitors in terms of customer-friendliness, rapid response, sustainability and low costs for reliable and secure hosting, including Privacy by Design. Even the physical location is an advantage: Greenhost is situated in Amsterdam just a few hundred metres from the Privacy First office. Moreover, Greenhost has been a trustworthy partner of a number of NGOs, including Bits of Freedom. For Privacy First however, the decisive aspect was the fact that Greenhost has for years taken up an exemplary role of privacy pioneer, whereas many other ICT companies lagged behind in this respect. In 2009 Greenhost stopped logging email data and called for other companies to do the same. At the beginning of 2011 Greenhost wrote a manual for the security of internet traffic: the Basic Internet Security Manual. These initiatives not only reflect audacity and leadership, but also corporate social responsibility in the sense of privacy-friendly entrepreneurship. In that regard Greenhost and Privacy First have a shared vision on society. Therefore Privacy First looks forward with great confidence to the cooperation with Greenhost in the years to come!
On Thursday 28 February 2013 there will be an important debate about the Dutch 'OV-chipkaart' (Public Transport chip card) in the Dutch House of Representatives (permanent commission for Infrastructure and Environment). In preparation of this debate the Privacy First Foundation today brought the following points to the attention of relevant Dutch Members of Parliament:
- The 'anonymous' OV chip card is not anonymous because it contains a unique identification number in the Radio Frequency Identification (RFID)-chip with which travellers can be identified and tracked afterwards through the linking of transaction data. In the view of Privacy First, this constitutes a violation of two human rights, namely the freedom of movement in conjunction with the right to privacy, in other words the classic right to travel freely and anonymously within one’s own country. Privacy First is eager to learn from the House of Representatives as well as the responsible member of government which steps have already been taken for the introduction of an anonymous OV chip card that is truly anonymous, for example through the development of new chip technology and modern forms of encryption without a unique identification number (privacy by design).
- As long as (truly) anonymous OV chip cards and anonymous discount cards do not exist, printed travel tickets are to remain available for travellers who want to travel anonymously. Moreover, a special, anonymous discount card for children and elderly people should also be introduced.
- Compulsory check-ins and check-outs for students carrying student OV chip cards contravenes with the right of students to travel freely and anonymously. Compulsory check-ins and check-outs therefore have to be abolished.
- The planned closure of turnstiles at Dutch National Railway stations (Nederlandse Spoorwegen, NS) constitutes an unnecessary restriction to people's freedom of movement and can lead to dangerous situations in the event of calamities. It also creates unsafe situations in individual cases, for example for children, elderly people, ill or incapacitated people who need to be accompanied through the station by family or friends. Therefore Privacy First makes an urgent appeal to leave the turnstiles open at all times or to get rid of them and replace them with anonymous check-in and check-out poles.
- The current retention period of OV chip card data should be reduced to an absolute minimum. Moreover, travellers should be offered the option to erase their travel history at any given moment.
- The OV chip card dramatically increases costs for travellers, either when purchasing a chip card, when forgetting to check out, in the event of a malfunctioning card or check-out pole or when deciding to travel anonymously with a printed ticket. Privacy First is eager to hear from the House of Representatives as well as the responsible government member which measures will be taken to make travelling with an OV chip card cheaper while preserving people's privacy.
Privacy-wise these are turbulent times. Partly because of the pressure by Privacy First, a positive change is ongoing since last year. Privacy is higher up on the Dutch political agenda. Dutch media more often and more extensively report on privacy matters. This enhances privacy awareness among the Dutch population. It also reinforces our democratic constitutional State. Examples of positive developments are the abandonment of the electronic toll system (no ‘espionage units’ in cars), voluntary instead of compulsory ‘smart energy meters’, voluntary instead of compulsory body-scans at airports, abandonment of the storage of fingerprints under the Dutch Passport Act and the introduction of Privacy Impact Assessments for new legislation that invades the privacy of citizens. All of these developments go hand in hand with Privacy First’s motto: ‘‘your choice in a free society’’. Meanwhile, privacy restricting forces from the old days still have their say. Bad habits die hard. In recent months this became particularly obvious through developments towards a private restart of the Dutch Electronic Health Record (Elektronisch Patiëntendossier, EPD). Earlier this year the Senate had rightly binned the EPD. Apparently some policy makers and commercial parties are having none of this. With similar stubbornness others are currently trying to press through their old plans for Automatic Number Plate Recognition (ANPR) and camera surveillance along the Dutch border. These plans were already on the drawing board years ago, in a time in which privacy increasingly seemed to become a taboo. A time in which the American Bush administration was able to burden the entire European Union with biometric passports and associated databases. That time is over, but the heritage of that era still exerts its influence to this day...
In the meantime privacy is back where it once was. Privacy is the ‘‘new green.’’ In that respect advocates of the national EPD and ANPR are behaving like a bunch of old environmental polluters. They’re like rusty old factories from the 70s being teletransported to the year 2011, without them realizing it. The Dutch House of Representatives seemed to have a good sense for this when last week it unanimously accepted a motion about something that Privacy First has been emphasizing since its foundation: ‘‘Privacy by Design’’. In other words, incorporating privacy from scratch in a technical sense, at the micro level, through Privacy Enhancing Technologies (PET). In the view of Privacy First, however, the principle of ‘‘Privacy by Design’’ also applies to the meso- and macro-levels. That is to say, in an organizational and legislative sense. After all, this is the way you get to a privacy-friendly design as well as a privacy-friendly reality of a sustainable information society as a whole. Well, you can pursue your own line of thoughts here. As a source of inspiration Privacy First is pleased to provide the entire text of the parliamentary motion:
The House of Representatives,
on the advice of the deliberation,
considering that in ICT projects of the government there is too little attention for the protection of privacy and too little attention for the prevention of abuse of these systems;
considering that the privacy of citizens is not to be invaded any more than is strictly necessary and that insecure systems can put privacy in danger;
considering that systems that can easily be hacked seriously affect the reputation of government;
considering that modifying systems to safeguard privacy and enhancing security afterward, is usually more expensive and more often leads to a lower level of protection compared to when privacy and security are prerequisites from the outset of the project;
requests the government to apply privacy by design and security by design in the development of all new ICT projects in order for new ICT systems to be more secure and better prepared against abuse and only to contain privacy-sensitive information when strictly necessary,
and proceeds to the order of the day.