Yesterday, there was a hearing in the Dutch House of Representatives in which the by now notorious Corona app was critically discussed. The House had invited various experts and organizations (among which Privacy First) to submit position papers and take part in the hearing. Below is both the full text of our position paper, as well as the text which was read out at the hearing. A video of the entire hearing (in Dutch) can be found HERE. Click HERE for the program, all speakers and position papers.
Dear Members of Parliament,
Thank you kindly for your invitation to take part in this roundtable discussion about the so-called Corona app. In the view of Privacy First, apps like these are a threat to everyone’s privacy. We will briefly clarify this below.
Lack of necessity and effectiveness
With great concern, Privacy First has taken note of the intention of the Dutch government to employ a contact tracing app in the fight against the coronavirus. Thus far, the social necessity of such apps has not been proven, while the experience of other countries indicates there is ground to seriously doubt their benefit and effectiveness. In fact, these apps may even be counterproductive as their use leads to a false sense of safety. Moreover, it’s very hard to involve the most vulnerable group of people (the elderly) through this means. This should already be enough reason to refrain from using Corona apps.
In Privacy First’s view, the use of such apps is a dangerous development because it could lead to stigmatization and numerous unfounded suspicions, and may also cause unnecessary unrest and panic. Even when ‘anonymized’, the data from these apps can still be traced back to individuals through data fusion. In case this technology will be introduced on a large scale, it will result in a surveillance society in which everyone is being continuously monitored – something people will be acutely aware of and would lead to an imminent societal chilling effect.
Risks of misuse
There is a significant risk that the collected data will be used for multiple purposes (function creep) and be misused by both companies and public authorities. The risk of surreptitious access, hacking, data breaches and misuse is substantial, particularly in the case of central instead of decentral (personal) storage as well as a lack of open source software. However, not even the use of personal storage offers any warranty against misuse, malware and spyware, or, for that matter, makes users less dependent on technical vulnerabilities. Moreover, if the data fall into the hands of criminal organizations, they will be a gold mine for criminal activities.
For Privacy First, the risks of Corona apps do not outweigh their presumed benefits. Therefore, Privacy First advises the House to urge the cabinet not to proceed with the introduction of such apps.
Testing instead of apps
According to Privacy First, there is a better and more effective solution in the fight against the coronavirus. One that is based on the principles of proportionality and subsidiarity, i.e., large scale testing of people to learn about infection rates and immunization. To this end, the necessary test capacity should become available as soon as possible.
Haste is rarely a good thing
If, despite all the above-mentioned objections, it will be decided there is going to be a Corona app after all, then this should come about only after a careful social and democratic process with sufficiently critical, objective and independent scrutiny. This has not been the case so far, judging by the developments of the past few days. In this context, Privacy First recommends that the House calls on the cabinet to put its plans on ice and impose a moratorium on the use of Corona apps.
Privacy by design
The right to anonymity in public space is a fundamental right, one that is crucial for the functioning of our democratic constitutional state. Any democratic decision to nullify this right is simply unacceptable. If indeed the deployment of ‘Corona apps’ will be widespread, then at least their use should be strictly anonymous and voluntary. That is to say, they should be used only for a legitimate, specific purpose, following individual, prior consent without any form of outside pressure and on the premise that all the necessary information is provided. In this respect, privacy by design (embedding privacy protection in technology) must be a guiding principle. For Privacy First, these are stringent and non-negotiable prerequisites. In case these conditions are not met, Privacy First will not hesitate to bring proceedings before a court.
The Privacy First Foundation
Dear Members of Parliament,
You have received our position paper, this is our oral explanation.
First of all: Privacy First is firmly against any form of surveillance infrastructure, with or without apps.
With this in mind, we look at three legal principles:
- Legitimate purpose limitation.
- What is the problem?
- What is the scale of the problem?
- What are possible objectives, how can we achieve these objectives, and how can we measure progress towards them?
It’s already impossible to answer the first question as we now test partially and selectively. The total infected population is unknown, the people who have recovered are unknown also, and do not get reported. There is, however, fearmongering as a result of emotions and selective reporting; deaths with multiple causes (die with as opposed to die from Corona) and admittance to critical care units.
Let us be clear, we will first have to map out the causes of this problem before we can draw conclusions and talk about solutions. Not only IT professionals and virologists should be involved in this, to no lesser extent we need philosophers, legal scholars, sociologists, entrepreneurs and others who represent society also.
- Necessity and proportionality. In terms of test capacity, critical care units, medical materials and medical personnel, we essentially have a capacity problem. So, there is no doubt in our mind what we should be focusing on, also in view of future outbreaks; testing the entire population in order to tell who is infected and who is immune, and be able to determine the real problem. 97% of the population is unaffected. Make sure there will be a division and proper care for high-risk groups. Halt crisis communication and start crisis management. Take all treatment methods seriously, including those that are not profitable for Big Pharma and Big Tech.
- Subsidiarity. Once we know the problem, we may ask what the solutions are. Additional personnel at municipal health centers? Building a critical care unit hospital specifically for situations like these? Increasing the test capacity in order to be able to take decisions based on figures? All of this is possible within our current health system, with the general practitioner as the first point of contact.
On the basis of trust, we have given our government six weeks to get its act together. And what do we get in return? Distrust and monitoring tools. And still shortages of medical equipment. So, fix the fundamentals, deal with the treatment and test capacity and stop building new technological gadgets and draconian apps used in dictatorial regimes in Asia. And take The Netherlands out of this prolonged lockdown as soon as possible. Privacy First is opposed to a ‘1.5-meter society’ as the new normal, and is instead in favor of a common-sense society based on trust in mature citizens.
With great concern, Privacy First has taken note of the intention of the Dutch government to employ special apps in the fight against the coronavirus. In Privacy First’s view, the use of such apps is a dangerous development because it could lead to stigmatisation and numerous unfounded suspicions, and may also cause unnecessary unrest and panic. Even when ‘anonymized’, the data from these apps can still be traced back to individuals through data fusion. In case this technology will be introduced on a large scale, it will result in a surveillance society in which everyone is being continuously monitored – something people will be acutely aware of and would lead to an imminent societal chilling effect. Furthermore, there is a substantial risk that the collected data will be used and misued for multiple (illegitimate) purposes by companies and public authorities. Moreover, if these data fall into the hands of criminal organizations, they will be a gold mine for criminal activities. For Privacy First, these risks of Corona apps do not outweigh their presumed benefits.
The right to anonymity in public space is a fundamental right, one that is crucial for the functioning of our democratic constitutional State. Any democratic decision to nullify this right is simply unacceptable. If indeed the deployment of ‘Corona apps’ will be widespread, then at least their use should be strictly anonymous and voluntary. That is to say, they should be used only for a legitimate, specific purpose, following individual, prior consent without any form of outside pressure and on the premise that all the necessary information is provided. In this respect, privacy by design (embedding privacy protection in technology) must be a guiding principle. For Privacy First, these are stringent and non-negotiable prerequisites. In case these conditions are not met, Privacy First will not hesitate to bring proceedings before a court.
Below, in alphabetical order, are Privacy First’s main objections against the new Dutch Intelligence and Security Services Act (Wiv2017, or ‘Tapping law’):
A. Authority to hack
Under the new law, the Dutch intelligence services will be able to hack a target through innocent third parties. By hacking a third party (for example an aunt, a sister, a friend, a husband, a grandfather, a colleague, a neighbour, a public authority, a company, etc.), information can be obtained about the target. In other words, any devices of innocent citizens may be hacked by the intelligence services. Citizens will never be notified about this, as there is no duty to inform.
C. Chilling effect
The new law may result in people behaving differently (either consciously or not) than they would do in a free environment. This can have a negative effect on the exercise of their fundamental rights other than the right to privacy, for instance on the right to freedom of expression and the right to freedom of association, assembly and demonstration.
Under both the current as well as the new law, Dutch secret agents are authorized to commit criminal offences. However, up until now, the exact scope of this power has been unknown. Under the current law, this power could be further regulated through a (never introduced) General Administrative Order. A number of years ago, the Dessens Commission recommended introducing such a General Administrative Order after all. In the new Tapping law however, the foundation for this General Administrative Order has been scrapped, leaving behind a legal vacuum.
The new law enables automatic access to databases in both the entire private and public sector. This allows intelligence services direct access to various sensitive databases of companies, public authorities and other organizations, either through informants and agents (infiltrators), or through secret agreements.
The power to conduct ‘research-oriented interception’, popularly known as the ‘trawl net method’ or the ‘the dragnet-surveillance power’, allows intelligence and security agencies (secret services) to tap the internet traffic of large groups of people simultaneously. They may tap a particular municipality, neighbourhood, local community or street, in case one of their targets happens to live there. This entails monitoring the communications of innocent citizens by means of a digital dragnet. Privacy First believes that the data of innocent citizens do not belong in the hands of intelligence services. Apart from that, the collection of huge amounts of data makes the intelligence services less effective.
Under the new law, encrypted data in the possession of companies, public authorities and individuals (for example communications data) must be decrypted on the request of secret services. Refusing to comply with a decryption order will be punished with a maximum of two years’ imprisonment.
Under the Tapping law, the intelligence and security services will have their own DNA database. They may collect DNA of targets and non-targets (innocent citizens). In order to collect DNA, they are allowed to grant themselves access to confined places, such as offices or residences. Dutch magazine Groene Amsterdammer has recently written an extensive article about the DNA Collection Service.
E. European Convention on Human Rights (ECHR)
The right to privacy is a human right: this right is protected by article 8 of the ECHR. Privacy First is of the opinion that the new Tapping law violates the right to privacy. We are ready to start interim injunction proceedings (lawsuit) against the Dutch government in case the Tapping law comes into force. This would enable a judge to scrutinize the new Act and possibly render it (partly) inoperative on account of violation of article 8 ECHR.
Exchange of data
The data of innocent citizens and journalists that are collected through the use of internet dragnet surveillance can be shared with foreign intelligence agencies before first being evaluated by the Dutch agencies.
F. Fake news from the Dutch government
According to the Dutch Minister of the Interior Kajsa Ollongren, it’s not necessary that the government puts neutral information about the Tapping law referendum on its website rijksoverheid.nl. This means that the Dutch government does not provide objective information to voters.
The law gives too much power to intelligence and security services and too little privacy guarantees to citizens. After the Tapping law referendum, the law will have to go back to the legal drawing board, where proper privacy guarantees should be added and the exercise of powers be reviewed.
H. Human rights
Privacy is a human right. The right to protection of one’s private life applies to everyone and is being guaranteed by numerous international and European treaties. The Tapping law will massively violate this right, considering the fact that it allows for the collection, storage and international exchange of data of large groups of innocent citizens.
Hyping the terror threat
Proponents of the Tapping law have often put forward the argument that it will prevent terror attacks, as was shown by Dutch television show Zondag met Lubach. However, other countries have already shown that working in a focused, targeted way is much more effective. Opponents of the Tapping law agree that the current law needs to be updated, but they demand that the law be modified and improved in crucial aspects.
I. I’ve got nothing to hide
Everyone is entitled to having a private life. That’s why the data of innocent citizens do not belong to intelligence and security agencies. It’s important for these data, which include medical information, personal conversations, private emails, work-related emails, news stories, hobbies, interests and internet search results, to be protected properly. You may have ‘nothing’ to hide, but other citizens, like medical professionals, attorneys, activists, whistle-blowers and journalists certainly do.
Interception of cable-bound data
It is falsely being argued that the intelligence and security services are currently allowed to intercept data over the ether (non cable-bound) only and not any cable-bound data. Under current legislation, they may intercept cable-bound data when the target concerns, for example, a particular individual. Under the new law, secret services will be authorized to intercept cable-bound data on a large scale and without specific targets (the dragnet method).
Internet of Things
An ever increasing number of devices are connected to the internet. All these devices can be tapped and hacked under the new Tapping law. Think of a car, a camera, microphone, printer and perhaps even a pacemaker. After all, the Tapping law doesn’t exclude this possibility.
The communications of journalists may be intercepted under the new Tapping law by means of dragnet surveillance, among other ways. Secret services may acquire knowledge about this confidential information. This constitutes a threat to the freedom of the press and the journalistic right to non-disclosure of sources. Only retrospectively will secret services delete information that turns out not to be useful for any investigation.
In most cases, a judicial verification of the exercise of powers is lacking. As explained under ‘Review Board for the Use of Powers’(TIB), the new Review Board lacks the investigatory powers for effective and independent monitoring.
In his tv programme Zondag met Lubach, comedian and television presenter Arjen Lubach has looked into the Tapping law three times, explaining why it’s good to be critical about it. You can watch the videos (in Dutch) here: Tapping law 1, Tapping law 2 and Tapping law 3.
M. Medical confidentiality
Under the new law, the medical confidentiality of patients and the medical secrecy of doctors cannot be guaranteed: secret services can make a request to anyone, including doctors and hospitals, to hand over relevant data and to grant access to their data system (Electronic Health Record). They can also hack into such systems. This can lead to the evasion of health care among patients, which could endanger national health.
N. Notification obligation
Under the new law, the notification obligation is insufficient. Five years after exercising a certain power, the person concerned should, in principle, be notified about this. This, however, applies to only a few of the newly introduced powers. Privacy First thinks the notification obligation should apply to the exercise of all powers.
O. Other countries
Under the new Tapping law, data that have been collected may be shared with other countries without being evaluated first. This means that Dutch intelligence services can share unseen and unselected data (of innocent citizens) with foreign secret services. Once the data have been shared, Dutch intelligence services won’t be able to monitor the use of these data anymore.
P. Presumption of innocence
With the introduction of the new law, the presumption of innocence gets inverted. The dragnet-surveillance makes every single citizen a potential suspect, without any concrete ground to monitor someone in particular. Moreover, large-scale data collection increases the chance of false positives.
Q. Quest for data
The Dutch government has developed an enormous thirst for data. Whereas neighbouring countries go back to a target-centric approach, the Netherlands embraces Big Data. This leads to an ever growing haystack in which finding the needle will become increasingly difficult. More data is no equivalent to more security.
R. Review Board for the Use of Powers (TIB)
Independent supervision in all phases of the exercise of powers by secret services (before, during and afterwards) is insufficiently guaranteed. Since intelligence services operate secretly, citizens against whom such powers are exercised cannot object to this themselves. That’s why the exercise of powers is to be reviewed independently. The new Review Board for the Use of Powers (Toetsingscommissie Inzet Bevoegdheden) reviews beforehand whether the minister has rightfully given approval for the exercise of a relatively far-reaching (‘special’) power under the new law. This review is substantiated by less guarantees than the review by a judge. Furthermore, the Review Board doesn’t have any investigative powers of its own and is completely dependent on the information it’s provided with by others. Various authorities, such as the Dutch Data Protection Authority, have warned that the Review Board shouldn’t become a 'rubber stamping machine'.
Review Committee on the Intelligence and Security Services (CTIVD)
The judgments of the Review Committee on the Intelligence and Security Services, which retrospectively reviews whether or not powers have been applied lawfully, are not binding. The Minister of the Interior may not take the findings and recommendations into account and continue to unlawfully use powers.
Privacy and security are unduly placed on opposite sides of the balance. In a free and democratic society, privacy and security go hand in hand. It’s possible to draft an Intelligence and Security Services Act that has good privacy safeguards under which information of innocent citizens doesn't end up in the hands of intelligence agencies.
Unevaluated data that have been collected through ‘dragnet surveillance, may be stored for three years. These data may also be shared with other countries, even without first being evaluated. Data that the intelligence and security agencies deem relevant may be kept for as long as they are regarded as such.
Z. Zero days
The intelligence and security services have the power to make use of unknown software vulnerabilities, so called zero-days. Such vulnerabilities are known to them, but not to the creator or manufacturer of the software. They don’t have to notify the manufacturer about it. This allows malicious parties to exploit vulnerabilities, even over longer time periods. It also creates a black market, where such vulnerabilities and data breaches are traded.
This list is not exhaustive and can be supplemented at all times.
The Dutch government and Parliament aim to quickly introduce the privacy-violating Tapping law. A coalition of privacy advocates will start interim injunction proceedings to prevent this from happening.
Implementation of unaltered Tapping law imminent
In recent months, there has been a thorough public debate in the Netherlands about the new Dutch Intelligence and Security Services Act, the so-called ‘Tapping law’. In a referendum that was held on 21 March 2018, a majority of the Dutch citizenry voted AGAINST this act. In response to this, the Dutch government has promised only a few minor, superficial policy changes as well as a few non-fundamental legislative amendments. Both the Dutch government and the House of Representatives have with full intent pushed for a prompt entry into force of the Tapping law in its unaltered form, as per 1 May to be exact. The envisaged legislative amendments will be presented by the government only after the summer. Regrettably, a motion to postpone the implementation of the Tapping law until after these legislative amendments have been discussed, was yesterday repealed by the House of Representatives. With that, it seems Parliament has had its say and it is now again up to society to make a move.
Interim injunction proceedings
It is Privacy First’s established policy to try to prevent massive privacy violations. Unmistakeably, the implementation of the current Tapping law is a massive privacy breach, because as a result of it, there will be large-scale tapping into the Internet traffic of innocent citizens and, moreover, the data of innocent citizens will be exchanged with foreign secret services without first being evaluated. This is a blatant violation of the right to privacy. Therefore, we cannot wait for any possible legislative amendments that serve to ‘rectify retrospectively’. After all, by that time the violations will have already occurred. Today, a coalition of Privacy First and various other civil organizations and companies urge the government to postpone the introduction of the Tapping law (or at least those parts of it that constitute the gravest privacy violations) until all legislative amendments have been discussed in Parliament. In case the government refuses this request, our coalition will not hesitate to start interim injunction proceedings in order to enforce the postponement of the Tapping law before court.
Alongside Privacy First, the coalition that has been created for these proceedings is comprised of the Netherlands Committee of Jurists for Human Rights (NJCM), Bits of Freedom, the Dutch Association of Criminal Defence Lawyers (NVSA), the Dutch Platform for the Protection of Civil Rights, Free Press Unlimited, BIT, Voys, Speakup, Greenpeace International, Waag Society and Mijndomein Hosting. The case is taken care of by Boekx Attorneys and is coordinated by the Public Interest Litigation Project (PILP) of the Netherlands Committee of Jurists for Human Rights. Apart from said interim injunction proceedings, since March 2017 Privacy First and other organizations are preparing a larger scale lawsuit in order for multiple parts of the Tapping law to be declared unlawful as it contravenes international and European privacy law.
Today, on behalf of the coalition, our attorneys will send a letter to the Dutch government (the ministers of the Interior and Defence) requesting the postponement of the implementation of the Tapping law. The government will have the opportunity to respond to this request until Friday, 20 April.
Update 20 April 2018: the government has rejected the appeal of the coalition. The coalition will now continue preparing interim injunction proceedings.
Update 17 May 2018: today the coalition summons has been sent to the Dutch state attorney; click HERE for the full version (pdf in Dutch). The summary proceedings will take place at the District Court of The Hague on Thursday 7 June 2018, 10.00 am - 12.00 pm CET.
Update 7 June 2018: this morning the hearing took place before the District Court of The Hague; click HERE for the pleading of our attorneys (pdf in Dutch). The court is expected to deliver a ruling on Tuesday, 26 June 2018.
Update 26 June 2018: to the great disappointment of Privacy First, today the District Court of The Hague has unfortunately rejected the case. Find the complete ruling (in Dutch) HERE. From a legal point of view, the bar was set high in these interim injunction proceedings: in order to be able to win our case, the judge had to declare the Tapping law ‘unequivocally ineffective’ on account of blatant (unequivocal) violation of international or European privacy law. However, the court ruling reads like a foregone conclusion in favor of the State, not least because various objections of our coalition have remained unidentified. That being said, it needs to be stressed (as the court itself does too), that this ruling constitutes only a preliminary opinion and that a thorough (‘full’) review was lacking in this case.
The coalition of organizations that has initiated these proceedings regrets the judgment. In view also of the result of the referendum, the coalition is of the opinion that the government should have waited to introduce the contested parts of the Tapping law until the parliamentary legislative process in response to the referendum is finished. Introducing the Tapping law unchanged on 1 May 2018 before proposing amendments at a later stage (after the summer) is and remains incorrect.
The coalition will soon discuss possible follow-up legal action.
The Dutch citizenry has rejected the new Dutch Intelligence and Security Services Act. This act will now have the be amended. If not, legal action will be pursued.
Historic red line
Wednesday 21 March 2018 is a historic day: for the first time ever, the populace of a nation has spoken out against a law on intelligence services in a referendum. In this referendum, the Dutch had the chance to cast their ballots on the new Dutch Intelligence and Security Services Act, better known as the ‘Tapping law’. By now, it is known that a clear majority is AGAINST the law. Privacy First considers this as a historic victory and hopes that, as a result, similar developments will unfold in other countries: developments that contravene mass surveillance and the creation of controlled societies, and that lead to better legislation with true respect for the liberty of innocent citizens.
Objections against the Tapping law
The main objections of Privacy First against the Tapping law relate to the fact that it authorizes not only large-scale tapping into the Internet traffic and communications of innocent citizens, but also allows for the storage of these data for many years and the unsupervised exchange of these data with foreign secret services. These and other concerns of Privacy First have been listed in alphabetical order. The liberty-restricting Tapping law should not be viewed in isolation, but is part of a wider negative trend, as can be read in a recent column (in Dutch) by Privacy First chairman Bas Filippini.
Right from the very start, Privacy First has supported the organization of the Dutch referendum against the Tapping law. Alongside Privacy First, there are numerous other civil organizations that have been very active over the past few months to inform the citizenry about the Act. Most of the work, however, has been done by the referendum instigators: the students of the University of Amsterdam who, at the end 2017, collected enough signatures to make this referendum possible. For this unique achievement, Privacy First gave them a Dutch Privacy Award at the start of this year. Privacy First has recently called on all political parties at municipal level to take a stand against the Tapping law. Furthermore, through public debates, advertisements and social media and through interviews on the radio, on television and in newspapers, we have been as active as possible to create a critical mass. Moreover, Privacy First organized a public debate about the Tapping law in Amsterdam. It featured various renowned speakers, among them our attorney Otto Volgenant and the Dutch National Coordinator for Counter Terrorism and Security Dick Schoof. This debate (in Dutch) has been broadcasted on NPO Politiek several times and can also be viewed on our website and on YouTube. Even according to advocates of the Tapping law, this referendum was characterized by a substantive discussion among critical and well-informed members of the public. It is also in this regard that the referendum can be called a great success, a bright day for democracy and something that has increased general awareness about privacy in the Netherlands. After today, abolishing the referendum, which is what the Dutch government intends to do, should really be out of the question.
The law should be improved. Otherwise there will be legal action.
The consequences of the Dutch referendum about the Tapping law are clear: the law should be modified and improved immediately. If not, Privacy First and various other plaintiffs (organizations) will start a large-scale lawsuit with the express purpose of having various parts of the Act declared unlawful and rendered inoperative by a judge. In 2015, Privacy First and coalition partners succeeded in suspending the Dutch Data Retention Act in the same way. In recent years, Privacy First has on several occasions warned the Dutch government as well as both houses of Dutch Parliament that a similar lawsuit against the Tapping law would be imminent. The result of the current referendum has bolstered our position enormously. By now, the summons against the government has been prepared and our attorneys are ready to litigate. The choice is up to the government: change course or back down!
"Twelve organizations teamed up to file a lawsuit to stop the implementation of a new data mining law in the Netherlands. The new law was adopted by the Dutch Senate on Tuesday and gives the intelligence services more capabilities to spy on internet traffic on a large scale.
"We trust that the Dutch judges will pull the brake and say: this law goes too far", human rights lawyer Jelle Klaas, who is representing the coalition of organizations in their lawsuit, said to RTL Nieuws. The coalition includes the Public Interest Litigation Project, civil rights organization Privacy First, the Dutch Association of Journalists, the Dutch Association of Criminal Law Attorneys and the Platform for the Protection of Civil Rights.
According to the organizations, this law is a serious violation of Dutch citizens' privacy. The case will first be presented to a Dutch court, who will test it against the European Convention of Human Rights. If the Dutch court rules against the organizations, they will take it to the European Court.
Klaas is currently preparing the case. He expects that the lawsuit will only actually start after the new law is implemented on January 1st, 2018, but he hopes it happens earlier."
Source: http://nltimes.nl/2017/07/12/lawsuit-started-new-dutch-data-mining-law, 12 July 2017.
After numerous lawsuits in various European countries, the decision has finally been made: in a break-through ruling, the European Court of Justice has decided this week that a general requirement to retain telecommunications data (data retention) is unlawful because it is in violation of the right to privacy. This ruling has far-reaching consequences for surveillance legislation in all EU member States, including the Netherlands.
Previous data retention in the Netherlands
Under the 2009 Dutch Data Retention Act, the telecommunications data (telephony and internet traffic) of everyone in the Netherlands used to be retained for 12 months and 6 months, respectively, for criminal investigation purposes. This legislation stemmed from the 2006 European Data Retention Directive. However, in April 2014 the European Court of Justice declared this European Directive invalid because it violates the right to privacy. Subsequently, former Dutch minister of Security and Justice Ivo Opstelten refused to withdraw the Dutch Data Retention Act, after which a broad coalition of Dutch organizations and companies demanded in interim injunction proceedings that the Act would be rendered inoperative. The claimant organizations were the Privacy First Foundation, the Dutch Association of Defence Counsel (NVSA), the Dutch Association of Journalists (NVJ), the Netherlands Committee of Jurists for Human Rights (NJCM), Internet provider BIT and telecommunications providers VOYS and SpeakUp. Boekx Attorneys in Amsterdam took care of the proceedings, and successfully so: rather uniquely (laws are seldomly rendered inoperative by a judge, let alone in interim injunction proceedings), on 11 March, 2015, the Dutch district court in The Hague repealed the entire Act at once. The Dutch government decided not to appeal the ruling, which has been final since then. Consequently, all telecom operators concerned have deleted the relevant data. In relation to criminal investigations and prosecutions, so far this does not seem to have led to any problems.
European Court makes short shrift of mass storage once and for all
Unfortunately, the April 2014 decision of the European Court left some margin for interpretation under which broad, general retention of everyone’s telecommunications data could still be allowed, for example through close judicial supervision before access and use of those data. In a Swedish and a British case about data retention, the European Court has now ensured full clarity in favour of the right to privacy of every innocent person on European territory:
"The Charter of Fundamental Rights of the European Union must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication’’, the Court judges.
In other words: mass storage of everyone’s data for criminal investigation purposes is unlawful. After all, according to the Court this ‘‘exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society’’.
In conventional language, the Court basically says that such legislation doesn’t belong in a free democracy under the rule of law, but in a totalitatrian dictatorship instead. And this is exactly the raison d'être of the Charter of Fundamental Rights of the European Union (which was inspired by universal human rights), on which the verdict of the Court is based.
Consequences for the Netherlands
Recently the current Dutch minister of Security and Justice, Ard van der Steur, has again presented to the Dutch House of Representatives a legislative proposal to reintroduce a broad, general telecommunications retention Act. Moreover, a similar legislative proposal pending in the Dutch Senate concerns the recognition and retention of number plate codes of all cars in the Netherlands (i.e. everyone’s travel movements and location data). Following the EU Court ruling, both legislative proposals are unlawful in advance on account of violation of the right to privacy. The same goes for planned mass storage of data that flow in and out of the Netherlands through large internet cables under the new Dutch Intelligence and Security Services Act (and the international exchange thereof), the possible future reintroduction of central databases with everyone’s fingerprints, national DNA databases, national records which include everyone’s financial transactions, etc. etc.
Following the EU Court ruling, the Dutch government can draw one conclusion only: both the legislative proposal that regards the new telecommunications retention Act as well as the legislative proposal that relates to the registration on a massive scale of number plate codes, are to be withdrawn this instant. Otherwise Privacy First will again enforce this in court and will do likewise with every other legislative proposal that threathens to violate the right to privacy of innocent citizens on a large scale.
Privacy First wishes you happy holidays and a privacy-friendly 2017!
"Facebook continues to breach personal data privacy rights in Europe, says a group of human rights organizations, and it demands that Facebook’s EU-US data transfers stop by February 6, 2016. Facebook has formally responded.
As previously reported, the Privacy First Foundation, Public Interest Litigation Project PILP and the Dutch Platform for the Protection of Civil Rights (collectively, “Privacy First”) sent Facebook a demand letter, to which Facebook has now replied in writing.
Facebook’s written response
Facebook responded to Privacy First’s demand letter by giving written assurances of data protection in accordance with current law–that is, those parts of the Privacy Directive that survived the ruling in Schrems, the case that invalidated Safe Harbor.
Specifically, Facebook states that “the grounds for transfer of data set out in Article 26 of the Directive remain entirely lawful,” and that it complies with “these other grounds to transfer data legally from the European Union to the United States .” Facebook further challenged the Dutch tribunal Privacy First plans to use, as lacking competence over Facebook Ireland, the party it asserts is the data controller for data of Facebook Netherlands.
Privacy First’s reply
Privacy First, in its reply through its counsel Boekx, Amsterdam, reiterated its position that the other instruments currently used as basis for EU-US data transfers (such as Standard Contractual Clauses or individual consent) are “fundamentally flawed, as these options do not resolve the problems identified by the European Court of Justice in the Schrems judgment.”
Privacy First’s reply further reserves its rights to initiate legal proceedings in the Hague “requesting a preliminary injunction and/or raising prejudicial questions with the European Court of Justice” if Facebook doesn’t stop EU-US data transfers or provide adequate protections by February 6th, 2016.
Clearly, Privacy First and its co-plaintiffs are not happy with Facebook's response. (...)
Facebook’s letter also challenges the competence of Dutch courts to hear proceedings in the Netherlands against Facebook Ireland, which it alleges is the true data controller, not Facebook Netherlands B.V. Regarding the competence issue, [Boekx] said that Dutch courts have rendered decisions in the past against both Facebook parties.
As reported, the EU and US are currently negotiating replacement of the Safe Harbor Agreement; there is a meeting of the negotiating parties scheduled for February 2nd to discuss EU-US data transfers and how to ensure protections for EU citizens in the legal uncertainties left by Schrems.
Further delays possible
Due to delay in legislation in the U.S. that may be one of the EU’s preconditions to Safe Harbor (the Judicial Redress Act), further delays in Safe Harbor resolution are expected (by some) that could take those negotiations beyond the February 6 deadline set by Privacy First. These delays could set Facebook up for proceedings that, if successful, would result in a shutdown of its EU-US data transfers. (...)"
Source: http://www.forbes.com/sites/lisabrownlee/2016/01/27/facebook-fires-back-in-eu-privacy-dispute/#2fe9f2801d5b, 27 January 2016.
"Non siamo la pecora nera, e rispettiamo le stesse regole degli altri. Potremmo così sintetizzare il nocciolo della difesa di Facebook contro le accuse di alcune organizzazioni pro-privacy e utenti olandesi che hanno chiesto, con lettera formale, di impedire il trasferimento di dati personali degli iscritti verso gli Stati Uniti, dove risiedono molti suoi data center e molte delle sue aziende inserzioniste. Minacciando azioni legali nel caso il social network non interrompa questa pratica prima del 16 gennaio. Le radici della vicenda sono note: dalla denuncia inoltrata nel 2013 dallo studente austriaco Max Schrems, fino alla recente decisione della Corte di Giustizia dell’Unione Europea di invalidare gli accordi regolati dal Safe Harbor.Vero è che le nuove regole comunitarie travolgono non solo la creatura di Mark Zuckerberg bensì circa quattromila aziende statunitensi presenti sul Web, però è altrettanto vero che l’attenzione mediatica e le preoccupazioni si concentrano inevitabilmente su Facebook, luogo dove più di ogni altro le vite private diventano condivise. Ma anche il social network delle immagini, Instagram, e la più popolare fra le applicazioni di messaggistica, WhatsApp (entrambe proprietà dell’azienda di Menlo Park) sono coinvolti.
La lettera in questione, infatti, è stata inviata alle sedi di Facebook in California, in Olanda e in Irlanda così come alle sedi di Instagram e Whatsapp. Il mittente è uno studio legale di Amsterdam, Boekx, che parla in rappresentanza di tre associazioni pro-privacy (Stichting Privacy First, Public Interest Litigation Project e Dutch Platform for the Protection of Civil Rights) e di privati cittadini olandesi. La richiesta è, appunto, quella di interrompere il trasferimento dei dati verso gli States entro le ore 18 del gennaio, a meno di non voler incorrere in azioni legali.
Nelle parole dell’avvocato Otto Volgenant dello studio Boekx, “Vogliamo fare pressione su Facebook” e indurre Zuckerberg a pronunciarsi in merito al dibattito sulla privacy in corso nei governi di diversi Paesi. Se poi Facebook facesse ostruzionismo, la protesta degli olandesi potrebbe arrivare dapprima in un tribunale nazionale e poi da qui alla Corte Europea di Giustizia.
La replica della società californiana, arrivata tramite Forbes da un portavoce dell’azienda, Matt Steinfeld, esordisce ribadendo che il social network “utilizza i medesimi meccanismi impiegati da migliaia di altre aziende per trasferire legittimamente dati dall’Europa agli Stati Uniti e ad altri Paesi in tutto in mondo”. E poi fa una proposta: “Crediamo che il modo migliore per risolvere l’attuale dibattito sul trasferimento dei dati oltre l’oceano sia creare un nuovo patto di Safe Harbour, che garantisca adeguate tutele ai cittadini europei”. Il social network, dunque, non si sottrae alla possibilità di modifiche del regolamento ma anzi si auspica che le discussioni in corso fra organismi regolatori europei e statunitensi, e fra essi e i rispettivi governi sfocino presto in un “esito positivo”, ha dichiarato Steinfeld."
Source: http://www.ictbusiness.it/cont/news/l-attacco-olandese-e-la-difesa-facebook-non-siamo-peggio-di-altri/36065/1.html#.VoJYKfFIiUn, 17 December 2015.
"Facebook, Inc. and related entities have received a letter demanding them to stop EU-US data transfers until U.S. laws comply with the EU data protection regime, or risk lawsuit in the Netherlands. Facebook must cease transfer by 15 January 2016. The complaining parties have reserved rights to file suit if compliance is not forthcoming.
The demand and summons letter was sent today by the Boekx law firm in Amsterdam on behalf of numerous plaintiffs including:
• Privacy First Foundation (Stichting Privacy First)
• Public Interest Litigation Project PILP
• Dutch Platform for the Protection of Civil Rights
and other users of Facebook, Instagram and WhatsApp. The letter was sent to Facebook Netherlands B.V., Facebook Ireland Limited, Facebook Inc. and Instagram LLC (California), and WhatsApp Inc. (California).
Facebook spokesperson Matt Steinfeld provided (...) the following written statement:
“Facebook uses the same mechanisms that thousands of others companies across the EU use to transfer data legally from the EU to the US, and to other countries around the world. We believe that the best solution to the on-going debate around transatlantic data transfers is for there to be a new Safe Harbor agreement with appropriate safeguards for EU citizens.”
“We understand that authorities in the EU and US are working hard to put such an agreement in place as soon as possible. We trust that these groups are engaging with their respective governments on this process to help it reach a successful conclusion.”
Lawsuit intended to pressure Facebook
Otto Volgenant of the Boekx stated to Dutch outlet RTLZ, “We want to put pressure on Facebook. Mark Zuckerberg must make its voice heard in the debate about privacy, the US government has the solution for this problem.” According to Volgenant (as reported), the case would first be brought in The Hague, which could exercise its option to refer the case to the European Court of Justice.
Volgenant predicted that such referral would not be made, given the clarity of law on the topic since the recent Schrems ruling of the European Court of Justice (discussed further below).
U.S. compliant-laws required
Specifically, the demand requires that Facebook “end the current unlawful transfer of personal data from the European Union to the United States” until the U.S. adopts laws “essentially equivalent to” European data protection laws, or face lawsuit in the Netherlands. The summons gives Facebook until Friday 15 January 2016 (18:00 CET) to cease EU-US transfers, or risk having a court force it and related Facebook entities, through an injunction, to cease such transfers.
Facebook “remarkably absent” in data privacy discussions
In its letter, Boekx accuses Facebook of being “remarkably absent” in the public debate over EU-US data transfers, following the European Court of Justice decision in Schrems, which decision invalidated the so-called “Safe Harbor Agreement” between the U.S. and the E.U. and thus made such transfers illegal under E.U. law., effective immediately upon rendering of that decision. (...)
The demand letter further articulates the specifics of the Schrems decision, including that court’s conclusions that the NSA violated “European fundamental rights to respect for private life” by its “access on a generalized basis to the content of electronic communications.”
The letter concludes:
If we cannot find an amicable solution and Facebook does not refrain from further transfer of personal data of data subjects from the European Union to the United States by then, we reserve the right to initiate legal proceedings in the Netherlands and to request a preliminary injunction from the competent Dutch Court."