It’s of paramount importance that the Netherlands leads the way not only in terms of digitalization, but also in the field of digital privacy. Public authorities should make people aware of the privacy risks in the digital world and set a good example by providing sufficient privacy-friendly alternatives to existing apps and platforms. This call was made today by a broad coalition of organizations and companies – the Privacy Coalition – to members of the Dutch House of Representatives, who were handed a manifesto.
The new Privacy Coalition notes in a joint manifesto that more and more digital platforms, services and apps are collecting users’ data without them realizing it. Those data are resold and integrated and then used to track people, follow their online behavior and influence them. “This creates digital profiles on the basis of which companies and even public authorities make decisions that have a major impact on our lives, without us being able to influence it”, the coalition states. It also warns of further polarization in society because people are no longer in control of what information they can and cannot see online.
Freedom of choice
Legislation is being drafted at both the European and national level to curb the unbridled use of personal data. But regulations and supervision alone will not be enough; developments are so rapid that we will always be lagging behind, the Privacy Coalition asserts.
The Privacy Coalition is calling on the Standing Committee on Digital Affairs of the Dutch House of Representatives to much more actively raise awareness among the citizenry about the importance of digital privacy. Public authorities, but also the business community, could set a good example by only using digital platforms and services that respect privacy. The coalition also advocates greater support for privacy-friendly alternatives to existing apps and platforms, so that people have freedom of choice.
“Digital platforms are becoming more adept at collecting data from users without being transparent about it”, says Haykush Hakobyan of Privacy First, one of the initiators of the Privacy Coalition. “People believe many services are offered for free, but they are unknowingly paying a high price with their personal data. We need to stop that trend now. It is a social responsibility of companies, public authorities and other organizations to actively promote digital privacy. There are plenty of technological possibilities to be active in the digital realm without having your privacy violated.”
Hakobyan called on the House of Representatives to organize a technical briefing with providers of privacy-friendly solutions. “Recently, the House held a hearing with Google and Facebook, among others. It is now time to consult with parties that do respect people’s privacy.” The Privacy Coalition invited the Committee on Digital Affairs to continue the conversation with stakeholders and seek solutions.
“As far as I’m concerned, privacy is non-negotiable”, commented Lisa van Ginneken upon receiving the manifesto. Van Ginneken is a member of the Digital Affairs Committee on behalf of D66. “It is a basic principle that guarantees our freedom and our right not to be spied upon either in physical space or on the Internet. Digital human rights should not be the final element, but rather the starting point of any technological development.”
You can read the current manifesto of the Privacy Coalition and all co-signatories HERE.
CEDO, a newly established Coalition for Fair Digital Education in the Netherlands, has recently launched a manifesto and a petition for privacy-friendly education. The coalition consists of parents, teachers, IT professionals and privacy advocates. Privacy First has for years been concerned about the increasing lack of privacy of children and school pupils. We therefore strongly support this initiative.
CEDO notes that public education – i.e. today’s digital learning systems – are dominated by a handful of tech giants and is deeply worried that fundamental rights, such as the privacy of children, parents and teachers, cannot be adequately safeguarded.
Whether it concerns the processing and storage of digital educational projects or the use of email services, online notepads and video tools, the digital infrastructure of Dutch education is almost entirely in the hands of foreign companies such as Google and Microsoft. This can be convenient – it allowed for homeschooling to come off the ground quickly during the first Covid lockdowns for example – but these companies restrict the right to privacy and are not transparent about what happens with the data they collect.
The presence of Big Tech in education means that digital security of pupils cannot be guaranteed by schools. In fact, children lose control over their data as early as kindergarten. They are offered only limited and one-sided knowledge of the products they use, instead of the (digital) skills to learn critical thinking.
The coalition therefore advocates an alternative way of designing digital learning environments, one that does indeed safeguard public values and autonomy in education.
Digital education must and can be organized differently!
As an NGO that promotes civil rights and privacy protection, Privacy First has been concerned with financial privacy for years. Since 2017, we have been keeping close track of the developments surrounding the second European Payment Services Directive (PSD2), pointing out the dangers to the privacy of consumers. In particular, we focus on privacy issues related to ‘account information service providers’ (AISPs) and on the dangerous possibilities offered by PSD2 to process personal data in more extensive ways.
At the end of 2017, we assumed that providing more adequate information and more transparency to consumers would be sufficient to mitigate the risks associated with PSD2. However, these risks turned out to be greater and of a more fundamental nature. We therefore decided to launch a bilingual (Dutch & English) website called PSD2meniet.nl in order to outline both our concerns and our solutions with regard to PSD2.
Central to our project is the Don’t-PSD2-Me-Register, an idea we launched on 7 January 2019 in the Dutch television program Radar and in this press release. The aim of the Don’t-PSD2-Me-Register is to provide a real tool to consumers with which they can filter out and thus protect their personal data. In time, more options to filter out and restrict the use of data should become available. With this project, Privacy First aims to contribute to positive improvements to PSD2 and its implementation.
Protection of special personal data
In this project, which is supported by the SIDN Fund, Privacy First has focused particularly on ‘special personal data’, such as those generated through payments made to trade unions, political parties, religious organizations, LGBT advocacy groups or medical service providers. Payments made to the Dutch Central Judicial Collection Agency equally reveal parts of people’s lives that require extra protection. These special personal data directly touch upon the issue of fundamental human rights. When consumers use AISPs under PSD2, their data can be shared more widely among third parties. PSD2 indirectly allows data that are currently protected, to become widely known, for example by being included in consumer profiles or black lists.
The best form of protection is to prevent special personal data from getting processed in the first place. That is why we have built the Don’t-PSD2-Me-Register, with an Application Programming Interface (API) – essentially a privacy filter – wrapped around it. With this filter, AISPs can detect and filter out account numbers and thus prevent special personal data from being unnecessarily processed or provided to third parties. Moreover, the register informs consumers and gives them a genuine choice as to whether or not they wish to share their data.
We have outlined many of the results we have achieved in a Whitepaper, which has been sent to stakeholders such as the European Commission, the European Data Protection Board (EDPB) and the Dutch Data Protection Authority. And of course, to as many AISPs as possible, because if they decide to adopt the measures we propose, they would be protecting privacy by design. Our Whitepaper contains a number of examples and good practices on how to enhance privacy protection. Among other things, it lays out how to improve the transparency of account information services. We hope that AISPs will take the recommendations in our Whitepaper to heart.
Our Application Programming Interface (API) has already been adopted by a service provider called Gatekeeper for Open Banking. We support this start up’s continued development, and we make suggestions on how the privacy filter can be best incorporated into their design and services. When AISPs use Gatekeeper, consumers get the control over their data that they deserve.
Knowing that the European Commission will not be evaluating PSD2 until 2022, we are glad to have been able to convey our own thoughts through our Whitepaper. Along with the API we have developed and distributed, it is an important tool for any AISP that takes the privacy of its consumers seriously.
Privacy First will continue to monitor all developments related to the second Payment Services Directive. Our website PSD2meniet.nl will remain up and running and will continue to be the must-visit platform for any updates on this topic.
Privacy-wise these are turbulent times. Partly because of the pressure by Privacy First, a positive change is ongoing since last year. Privacy is higher up on the Dutch political agenda. Dutch media more often and more extensively report on privacy matters. This enhances privacy awareness among the Dutch population. It also reinforces our democratic constitutional State. Examples of positive developments are the abandonment of the electronic toll system (no ‘espionage units’ in cars), voluntary instead of compulsory ‘smart energy meters’, voluntary instead of compulsory body-scans at airports, abandonment of the storage of fingerprints under the Dutch Passport Act and the introduction of Privacy Impact Assessments for new legislation that invades the privacy of citizens. All of these developments go hand in hand with Privacy First’s motto: ‘‘your choice in a free society’’. Meanwhile, privacy restricting forces from the old days still have their say. Bad habits die hard. In recent months this became particularly obvious through developments towards a private restart of the Dutch Electronic Health Record (Elektronisch Patiëntendossier, EPD). Earlier this year the Senate had rightly binned the EPD. Apparently some policy makers and commercial parties are having none of this. With similar stubbornness others are currently trying to press through their old plans for Automatic Number Plate Recognition (ANPR) and camera surveillance along the Dutch border. These plans were already on the drawing board years ago, in a time in which privacy increasingly seemed to become a taboo. A time in which the American Bush administration was able to burden the entire European Union with biometric passports and associated databases. That time is over, but the heritage of that era still exerts its influence to this day...
In the meantime privacy is back where it once was. Privacy is the ‘‘new green.’’ In that respect advocates of the national EPD and ANPR are behaving like a bunch of old environmental polluters. They’re like rusty old factories from the 70s being teletransported to the year 2011, without them realizing it. The Dutch House of Representatives seemed to have a good sense for this when last week it unanimously accepted a motion about something that Privacy First has been emphasizing since its foundation: ‘‘Privacy by Design’’. In other words, incorporating privacy from scratch in a technical sense, at the micro level, through Privacy Enhancing Technologies (PET). In the view of Privacy First, however, the principle of ‘‘Privacy by Design’’ also applies to the meso- and macro-levels. That is to say, in an organizational and legislative sense. After all, this is the way you get to a privacy-friendly design as well as a privacy-friendly reality of a sustainable information society as a whole. Well, you can pursue your own line of thoughts here. As a source of inspiration Privacy First is pleased to provide the entire text of the parliamentary motion:
The House of Representatives,
on the advice of the deliberation,
considering that in ICT projects of the government there is too little attention for the protection of privacy and too little attention for the prevention of abuse of these systems;
considering that the privacy of citizens is not to be invaded any more than is strictly necessary and that insecure systems can put privacy in danger;
considering that systems that can easily be hacked seriously affect the reputation of government;
considering that modifying systems to safeguard privacy and enhancing security afterward, is usually more expensive and more often leads to a lower level of protection compared to when privacy and security are prerequisites from the outset of the project;
requests the government to apply privacy by design and security by design in the development of all new ICT projects in order for new ICT systems to be more secure and better prepared against abuse and only to contain privacy-sensitive information when strictly necessary,
and proceeds to the order of the day.
(Remix voice sample: astronaut Yuri Gagarin.)
"These are the days of lasers in the jungle
Lasers in the jungle somewhere
Staccato signals of constant information
These are the days of miracle and wonder
This is the long distance call
The way the camera follows us in slo-mo
The way we look to us all"