IRMA and ‘referendum students’ win Dutch Privacy Awards
In the context of the National Privacy Conference organized by Privacy First and ECP, today the very first Dutch Privacy Awards have been awarded. These Awards offer a podium to companies and governments that consider privacy as an opportunity to positively distinguish themselves and want privacy-friendly entrepreneurship and innovation to become a benchmark. The great winner of the 2018 Dutch Privacy Awards is IRMA (I Reveal My Attributes). The students who organized the Dutch referendum about the controversial Tapping law received the incentive prize.
Winner: IRMA (I Reveal my Attributes)
IRMA (I Reveal my Attributes) is a state of the art, open source identity platform which allows users to authenticate themselves by using an app on the basis of one or several attributes related to their different roles (contextual authentication). This form of authentication does not reveal one’s identity: a one-to-one relation between the user and the service provider makes brokers redundant and allows the former to use services anonymously, without a password and with minimal attributes.
The system has been developed by the Digital Security Research Group of the Radboud University Nijmegen. Since the end of 2016, IRMA is part of the independent Dutch Privacy by Design foundation.
The Awards panel praises the academic community for developing IRMA as a general purpose privacy-by-design application intended for both the private as well as the public sector. As a means of privacy-friendly authentication, the panel regards the innovative capacity of the open source technology used, the instant deployability and the potential impact on society of IRMA as great assets. That is why the panel unanimously chose IRMA as the winner of the 2018 Dutch Privacy Awards.
Winners: ‘Tapping law students’
On the initiative of five University of Amsterdam students, a national referendum about the new and controversial Dutch Intelligence and Security Services Act (‘Tapping law’) will be held on 21 March 2018. Regardless of the outcome of the referendum, one of its results will be a heightened awareness of and a more critical stand towards privacy issues among the Dutch. This fact alone was sufficient ground for the panel to unanimously reward the students with a Dutch Privacy Award (incentive prize).
There are four categories in which applicants are awarded:
1. the category of Consumer solutions (from companies for consumers)
2. the category of Business solutions (within a company or business-to-business)
3. the category of Public services (public authorities to citizens)
4. The incentive prize for a ground breaking technology or person.
Out of the various entries, the independent expert panel chose the following nominees per category:
|Consumer solutions:||Business solutions:||Public services:|
|IRMA (I Reveal My Attributes)||TrustTester||Youth Privacy Implementation Plan (municipality of Amsterdam)|
|Schluss||Personal Health Train|
During the National Privacy Conference the nominees have presented their projects to the audience in Award pitches. Thereafter, the Awards were handed out. Click HERE for the entire Award panel report (pdf in Dutch), which includes participation criteria and explanatory notes on all the nominees and winners.
From left to right: Paul Korremans (panel member), Luca van der Kamp (‘referendum student’), Esther Bloemen (Personal Health Train), Nina Boelsums (‘referendum student’), Bas Filippini (panel chairman), Bart Jacobs (IRMA), Arjan van Diemen (TrustTester), Marie-José Hoefmans (Schluss) and Wilmar Hendriks (Youth Privacy Implementation Plan (municipality of Amsterdam). Photo: Maarten Tromp.
National Privacy Conference
The National Privacy Conference is an initiative of ECP (Dutch Platform for the Information Society) and Privacy First. From now on, the conference will bring together once a year Dutch industry, public authorities, the academic community and civil society with the aim to build a privacy-friendly information society. The mission of both the National Privacy Conference and Privacy First is to turn the Netherlands into a guiding nation in the field of privacy. To this end, privacy-by-design is key.
The speakers during the 2018 National Privacy Conference were, in successive order:
Aleid Wolfsen, chairman of the Dutch Data Protection Authority,
Gerrit-Jan Zwenne, professor of Law and the Information Society (University of Leiden),
Jaap-Henk Hoepman, associate professor Privacy by Design (Radboud University Nijmegen),
Ulco van de Pol, chairman of the Amsterdam Data Protection Commission,
Tim Toornvliet, Netherlands ICT,
Lennart Huizing, Privacy Company.
Aleid Wolfsen, chairman of the Dutch Data Protection Authority. Photo: Maarten Tromp.
Panel of the Dutch Privacy Awards
The independent expert Award panel consists of privacy experts from different fields:
• Bas Filippini, founder and chairman of Privacy First (panel chairman)
• Paul Korremans, data protection & security professional at Comfort Information Architects
• Marie-José Bonthuis, owner of IT’s Privacy
• Bart van der Sloot, senior researcher at Tilburg University
• Marjolein Lanzing, PhD Philosophy & Ethics, Eindhoven University of Technology.
In order to make sure that the award process is run objectively, the panel members may not judge on any entry of his or her own organization.
Privacy First organized this first edition of the Dutch Privacy Awards in collaboration with ECP, with the support of the Democracy & Media Foundation and the Adessium Foundation. Would you like to become a partner of the Dutch Privacy Awards? Then please contact Privacy First!
The Dutch government and Parliament aim to quickly introduce the privacy-violating Tapping law. A coalition of privacy advocates will start interim injunction proceedings to prevent this from happening.
Implementation of unaltered Tapping law imminent
In recent months, there has been a thorough public debate in the Netherlands about the new Dutch Intelligence and Security Services Act, the so-called ‘Tapping law’. In a referendum that was held on 21 March 2018, a majority of the Dutch citizenry voted AGAINST this act. In response to this, the Dutch government has promised only a few minor, superficial policy changes as well as a few non-fundamental legislative amendments. Both the Dutch government and the House of Representatives have with full intent pushed for a prompt entry into force of the Tapping law in its unaltered form, as per 1 May to be exact. The envisaged legislative amendments will be presented by the government only after the summer. Regrettably, a motion to postpone the implementation of the Tapping law until after these legislative amendments have been discussed, was yesterday repealed by the House of Representatives. With that, it seems Parliament has had its say and it is now again up to society to make a move.
Interim injunction proceedings
It is Privacy First’s established policy to try to prevent massive privacy violations. Unmistakeably, the implementation of the current Tapping law is a massive privacy breach, because as a result of it, there will be large-scale tapping into the Internet traffic of innocent citizens and, moreover, the data of innocent citizens will be exchanged with foreign secret services without first being evaluated. This is a blatant violation of the right to privacy. Therefore, we cannot wait for any possible legislative amendments that serve to ‘rectify retrospectively’. After all, by that time the violations will have already occurred. Today, a coalition of Privacy First and various other civil organizations and companies urge the government to postpone the introduction of the Tapping law (or at least those parts of it that constitute the gravest privacy violations) until all legislative amendments have been discussed in Parliament. In case the government refuses this request, our coalition will not hesitate to start interim injunction proceedings in order to enforce the postponement of the Tapping law before court.
Alongside Privacy First, the coalition that has been created for these proceedings is comprised of the Netherlands Committee of Jurists for Human Rights (NJCM), Bits of Freedom, the Dutch Association of Criminal Defence Lawyers (NVSA), the Dutch Platform for the Protection of Civil Rights, Free Press Unlimited, BIT, Voys, Speakup, Greenpeace International, Waag Society and Mijndomein Hosting. The case is taken care of by Boekx Attorneys and is coordinated by the Public Interest Litigation Project (PILP) of the Netherlands Committee of Jurists for Human Rights. Apart from said interim injunction proceedings, since March 2017 Privacy First and other organizations are preparing a larger scale lawsuit in order for multiple parts of the Tapping law to be declared unlawful as it contravenes international and European privacy law.
Today, on behalf of the coalition, our attorneys will send a letter to the Dutch government (the ministers of the Interior and Defence) requesting the postponement of the implementation of the Tapping law. The government will have the opportunity to respond to this request until Friday, 20 April.
Update 20 April 2018: the government has rejected the appeal of the coalition. The coalition will now continue preparing interim injunction proceedings.
Update 17 May 2018: today the coalition summons has been sent to the Dutch state attorney; click HERE for the full version (pdf in Dutch). The summary proceedings will take place at the District Court of The Hague on Thursday 7 June 2018, 10.00 am - 12.00 pm CET.
Update 7 June 2018: this morning the hearing took place before the District Court of The Hague; click HERE for the pleading of our attorneys (pdf in Dutch). The court is expected to deliver a ruling on Tuesday, 26 June 2018.
Update 26 June 2018: to the great disappointment of Privacy First, today the District Court of The Hague has unfortunately rejected the case. Find the complete ruling (in Dutch) HERE. From a legal point of view, the bar was set high in these interim injunction proceedings: in order to be able to win our case, the judge had to declare the Tapping law ‘unequivocally ineffective’ on account of blatant (unequivocal) violation of international or European privacy law. However, the court ruling reads like a foregone conclusion in favor of the State, not least because various objections of our coalition have remained unidentified. That being said, it needs to be stressed (as the court itself does too), that this ruling constitutes only a preliminary opinion and that a thorough (‘full’) review was lacking in this case.
The coalition of organizations that has initiated these proceedings regrets the judgment. In view also of the result of the referendum, the coalition is of the opinion that the government should have waited to introduce the contested parts of the Tapping law until the parliamentary legislative process in response to the referendum is finished. Introducing the Tapping law unchanged on 1 May 2018 before proposing amendments at a later stage (after the summer) is and remains incorrect.
The coalition will soon discuss possible follow-up legal action.
The Dutch citizenry has rejected the new Dutch Intelligence and Security Services Act. This act will now have the be amended. If not, legal action will be pursued.
Historic red line
Wednesday 21 March 2018 is a historic day: for the first time ever, the populace of a nation has spoken out against a law on intelligence services in a referendum. In this referendum, the Dutch had the chance to cast their ballots on the new Dutch Intelligence and Security Services Act, better known as the ‘Tapping law’. By now, it is known that a clear majority is AGAINST the law. Privacy First considers this as a historic victory and hopes that, as a result, similar developments will unfold in other countries: developments that contravene mass surveillance and the creation of controlled societies, and that lead to better legislation with true respect for the liberty of innocent citizens.
Objections against the Tapping law
The main objections of Privacy First against the Tapping law relate to the fact that it authorizes not only large-scale tapping into the Internet traffic and communications of innocent citizens, but also allows for the storage of these data for many years and the unsupervised exchange of these data with foreign secret services. These and other concerns of Privacy First have been listed in alphabetical order. The liberty-restricting Tapping law should not be viewed in isolation, but is part of a wider negative trend, as can be read in a recent column (in Dutch) by Privacy First chairman Bas Filippini.
Right from the very start, Privacy First has supported the organization of the Dutch referendum against the Tapping law. Alongside Privacy First, there are numerous other civil organizations that have been very active over the past few months to inform the citizenry about the Act. Most of the work, however, has been done by the referendum instigators: the students of the University of Amsterdam who, at the end 2017, collected enough signatures to make this referendum possible. For this unique achievement, Privacy First gave them a Dutch Privacy Award at the start of this year. Privacy First has recently called on all political parties at municipal level to take a stand against the Tapping law. Furthermore, through public debates, advertisements and social media and through interviews on the radio, on television and in newspapers, we have been as active as possible to create a critical mass. Moreover, Privacy First organized a public debate about the Tapping law in Amsterdam. It featured various renowned speakers, among them our attorney Otto Volgenant and the Dutch National Coordinator for Counter Terrorism and Security Dick Schoof. This debate (in Dutch) has been broadcasted on NPO Politiek several times and can also be viewed on our website and on YouTube. Even according to advocates of the Tapping law, this referendum was characterized by a substantive discussion among critical and well-informed members of the public. It is also in this regard that the referendum can be called a great success, a bright day for democracy and something that has increased general awareness about privacy in the Netherlands. After today, abolishing the referendum, which is what the Dutch government intends to do, should really be out of the question.
The law should be improved. Otherwise there will be legal action.
The consequences of the Dutch referendum about the Tapping law are clear: the law should be modified and improved immediately. If not, Privacy First and various other plaintiffs (organizations) will start a large-scale lawsuit with the express purpose of having various parts of the Act declared unlawful and rendered inoperative by a judge. In 2015, Privacy First and coalition partners succeeded in suspending the Dutch Data Retention Act in the same way. In recent years, Privacy First has on several occasions warned the Dutch government as well as both houses of Dutch Parliament that a similar lawsuit against the Tapping law would be imminent. The result of the current referendum has bolstered our position enormously. By now, the summons against the government has been prepared and our attorneys are ready to litigate. The choice is up to the government: change course or back down!
"Twelve organizations teamed up to file a lawsuit to stop the implementation of a new data mining law in the Netherlands. The new law was adopted by the Dutch Senate on Tuesday and gives the intelligence services more capabilities to spy on internet traffic on a large scale.
"We trust that the Dutch judges will pull the brake and say: this law goes too far", human rights lawyer Jelle Klaas, who is representing the coalition of organizations in their lawsuit, said to RTL Nieuws. The coalition includes the Public Interest Litigation Project, civil rights organization Privacy First, the Dutch Association of Journalists, the Dutch Association of Criminal Law Attorneys and the Platform for the Protection of Civil Rights.
According to the organizations, this law is a serious violation of Dutch citizens' privacy. The case will first be presented to a Dutch court, who will test it against the European Convention of Human Rights. If the Dutch court rules against the organizations, they will take it to the European Court.
Klaas is currently preparing the case. He expects that the lawsuit will only actually start after the new law is implemented on January 1st, 2018, but he hopes it happens earlier."
Source: http://nltimes.nl/2017/07/12/lawsuit-started-new-dutch-data-mining-law, 12 July 2017.
After numerous lawsuits in various European countries, the decision has finally been made: in a break-through ruling, the European Court of Justice has decided this week that a general requirement to retain telecommunications data (data retention) is unlawful because it is in violation of the right to privacy. This ruling has far-reaching consequences for surveillance legislation in all EU member States, including the Netherlands.
Previous data retention in the Netherlands
Under the 2009 Dutch Data Retention Act, the telecommunications data (telephony and internet traffic) of everyone in the Netherlands used to be retained for 12 months and 6 months, respectively, for criminal investigation purposes. This legislation stemmed from the 2006 European Data Retention Directive. However, in April 2014 the European Court of Justice declared this European Directive invalid because it violates the right to privacy. Subsequently, former Dutch minister of Security and Justice Ivo Opstelten refused to withdraw the Dutch Data Retention Act, after which a broad coalition of Dutch organizations and companies demanded in interim injunction proceedings that the Act would be rendered inoperative. The claimant organizations were the Privacy First Foundation, the Dutch Association of Defence Counsel (NVSA), the Dutch Association of Journalists (NVJ), the Netherlands Committee of Jurists for Human Rights (NJCM), Internet provider BIT and telecommunications providers VOYS and SpeakUp. Boekx Attorneys in Amsterdam took care of the proceedings, and successfully so: rather uniquely (laws are seldomly rendered inoperative by a judge, let alone in interim injunction proceedings), on 11 March, 2015, the Dutch district court in The Hague repealed the entire Act at once. The Dutch government decided not to appeal the ruling, which has been final since then. Consequently, all telecom operators concerned have deleted the relevant data. In relation to criminal investigations and prosecutions, so far this does not seem to have led to any problems.
European Court makes short shrift of mass storage once and for all
Unfortunately, the April 2014 decision of the European Court left some margin for interpretation under which broad, general retention of everyone’s telecommunications data could still be allowed, for example through close judicial supervision before access and use of those data. In a Swedish and a British case about data retention, the European Court has now ensured full clarity in favour of the right to privacy of every innocent person on European territory:
"The Charter of Fundamental Rights of the European Union must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication’’, the Court judges.
In other words: mass storage of everyone’s data for criminal investigation purposes is unlawful. After all, according to the Court this ‘‘exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society’’.
In conventional language, the Court basically says that such legislation doesn’t belong in a free democracy under the rule of law, but in a totalitatrian dictatorship instead. And this is exactly the raison d'être of the Charter of Fundamental Rights of the European Union (which was inspired by universal human rights), on which the verdict of the Court is based.
Consequences for the Netherlands
Recently the current Dutch minister of Security and Justice, Ard van der Steur, has again presented to the Dutch House of Representatives a legislative proposal to reintroduce a broad, general telecommunications retention Act. Moreover, a similar legislative proposal pending in the Dutch Senate concerns the recognition and retention of number plate codes of all cars in the Netherlands (i.e. everyone’s travel movements and location data). Following the EU Court ruling, both legislative proposals are unlawful in advance on account of violation of the right to privacy. The same goes for planned mass storage of data that flow in and out of the Netherlands through large internet cables under the new Dutch Intelligence and Security Services Act (and the international exchange thereof), the possible future reintroduction of central databases with everyone’s fingerprints, national DNA databases, national records which include everyone’s financial transactions, etc. etc.
Following the EU Court ruling, the Dutch government can draw one conclusion only: both the legislative proposal that regards the new telecommunications retention Act as well as the legislative proposal that relates to the registration on a massive scale of number plate codes, are to be withdrawn this instant. Otherwise Privacy First will again enforce this in court and will do likewise with every other legislative proposal that threathens to violate the right to privacy of innocent citizens on a large scale.
Privacy First wishes you happy holidays and a privacy-friendly 2017!
Privacy First New Year’s column
Looking back on 2016, Privacy First perceives a renewed attack on our democratic constitutional State from within. Incident-driven politics based on the everyday humdrum prevails and the Dutch government’s frenzy efforts to control the masses is relentless, arrogant and driven by industry and political lobbying. The democratic principles of our constitutional State are being lost out of sight ever more while the reversion of legal principles has become commonplace. Every (potential) attack thus becomes an attack on our civil rights.
Current constitutional State unable to defend itself
Barely a single day has gone past in the current mediacracy and governors without any historical or cultural awareness hand us, our children and our future over to a new electronic dictatorship fenced off by 4G masts. Citizens who autonomously seek to inform themselves have become ‘populists that spread fake news’. It’s not just the government that has lost its way, but so have the mainstream media, so it seems. The model characterized by fear, hate and control adopted by many authoritarian states headed by a strong leader is increasingly seen as the way to go.
Privacy First has said it before but will reiterate: we are of the opinion that State terrorists who continuously change legislation restricting civil liberties are ultimately much more harmful to our society than a single ‘street terrorist’, however terrible and shocking an attack is for those directly involved. The galling thing is that our constitutional State cannot adequately defend itself against the erosion of democratic principles from within: among other things, there is a lack of independent review of our Constitution. Therefore we are very happy that the European Court of Justice has recently ruled all forms of trawl net technology unlawful in advance. A great verdict that has far-reaching consequences for the State terrorists among our politicians and civil servants. A clear line in the sand.
Our democratic constitutional State came into existence out of the 19th century way of thinking and will have to be reshaped through a public debate, provided this is done taking into account the basic principles of living together - a human experience that goes back thousands of years. Love, trust en freedom are fundamental pillars. Privacy First discerns a number of changes over the past 150 years to which our constitutional State has no adequate answer, if any answer at all. These changes will have to be integrated into a newly structured democratic constitutional State which will have to be partly parliamentary and partly shared. In other words: the democratic foundation is there, but will have to be adapted to the desires and developments of our time.
Towards a Shared Democracy: adjusting parliamentary democracy to our present time
Privacy First calls on (and challenges, if necessary) every Dutch citizen to participate in a broad public discussion in order to shape a democracy 3.0. After Athens (1.0) and our parliamentary democracy from the 19th century onwards (2.0), in our eyes it’s time for the concept of a Shared Democracy (3.0), which is both a disruptive way of thinking as well as a social model for which we identify seven big drivers that help adjust our current 19th century system. Privacy First notices that these seven drivers are currently undermining our model from the inside and the outside. But by thinking differently, one will find that these pillars also offer an opportunity to move towards a new form for the future: the so-called Shared Democracy.
1. Changing role of the media; towards a mediacracy
Originally, in the 19th century model, the media didn’t yet have the scale and level of outreach today’s media have. The influence of the media has become large to the extent it will have to be one of the pillars of the future Shared Democracy.
2. Changing role of citizens
The enormous financial and social emancipation, the elevated level of education and the individualization of citizens is currently leading to huge tensions in the democracy of parliamentary representation. As part of the old way of thinking, citizens are still regarded as an unassertive, inferior, necessary evil. However, citizens want to have decision-making power on numerous issues and this – supported by the newest technologies and means of communication - will have to be structurally implemented in the Shared Democracy on the basis of various structures of representation and participatory leadership based on personal responsibility, an area in which politics and the government are still falling far behind in their relationship with citizens.
3. Scientific, technological and information revolution
These revolutions create new opportunities and offer an almost real-time insight in the developments and events within society. Moreover, the internet and associated infrastructures enable completely new forms of exchange and marketplaces of ideas and decisions. This happens on a worldwide scale between like-minded people and people who hold different views. Where supply and demand are ill-aligned, new services that have a disruptive effect on old structures pop up. Think of the clear imbalance between citizens and politics. A solution for that problem can be found in completely new and invigorating systems and structures, set up with an open and free attitude, with privacy by design enshrined in legislation and with the application of advanced technology - all elements that distinguishes the Shared Democracy.
4. Unrestrained proliferation of public authorities
The house is ready to move into, but the contractor keeps coming back every day to see whether there are still tasks to be done... likewise our government exerts its influence on our daily life and on today’s economy. The unrestrained proliferation of public authorities has got to stop immediately and the government has to be brought back to normal proportions, in line with a standard that has yet to be established. By now, citizens serve the government instead of the other way around. The power of (central) public authorities is no longer commensurate with those of individual citizens. A key trait of the Shared Democracy will be the size, power and scope of the government.
5. Lifelong professional politicians
Another thing the founders of the 19th century model didn’t take into account (despite the seperation of powers) is the fact that many current (national) representatives are fulltime politicians, some of whom carry out public sector activities quite directly related to their political function. Particularly these latter ones have lost all connection to society and virtually live off taxpayers’ money without any risks. In the Shared Democracy we envisage, we advocate that representatives of citizens make clear choices and are in favour of all possible mixed forms of citizens and representatives in order to create a much larger engagement and responsibility among individual citizens when it comes to being active politically.
6. Financial sector, upscaling and mass control
The centralization and management of financial flows disconnected from the underlying value, erodes both the economy and society. The human dimension is disappearing into the background in upscaling and efficiency models dominated by financial flows. By introducing mantras such as ‘cash is criminal’, paying anonymously is being phased out while bank runs that could endanger and destabilize the system are being prevented. Here too, the web continually gets tighter around citizens and money no longer belongs to them, but to banks and the government. With a view to the future and on the basis of current and future technological possibilities, in the Shared Democracy, ownership relationships and the right to anonymous means of payment will have to be firmly embedded in law.
7. Supranational elite of individuals and companies
One of the effects of globalization is the rise of a large group of supranational companies and individuals that are disconnected from their nation-states and societies, benefitting from the rights they have but not fulfilling the duties that society equally brings along. Now that information and power are concentrated within a few very large, global conglomerates, there are many financial corporations and companies that have become larger than nation-states. The intransparent power of lobbygroups backing these conglomerates thrives under the old, authoritarian pyramid structure of centralized political representation. In the Shared Democracy, special attention will have to go out to democratic shaping and modelling on all levels, while the centralized and decentralized power structures have to be continually in balance and be measurable with the most advanced technology.
How will the Shared Democracy deal with all this? How much more freedom are we prepared to give up for the sake of (false) security? 100% security = 0% freedom. How are we going to restructure our society and democratic system in order to hold on to our principles with the seven drivers of development in mind? And on which scale are we willing to do so?
To better define these questions and look for answers, Privacy First will organize a New Year's Reception on 19 January 2017, at 7:30 pm in the Volkshotel in Amsterdam. The reception (in Dutch) will revolve around the Shared Democracy.
Privacy First encourages everyone to contribute to this new movement towards a Shared Democracy in an open and free debate on all available communication channels!
Privacy First Foundation chairman