Hooray! Bits of Freedom freed the data of millions of people from the clutches of the secret services!

After the Dutch digital rights organisation filed a complaint about the secret services unlawfully storing data of millions of citizens, the Complaints Department ruled that the data of millions of citizens unlawfully in the possession of the secret services must be immediately deleted. This is the first time that the Complaints Department has used its binding authority since it received it four years ago. The fact that the ruling is binding means that the secret services cannot ignore it.

The data hunger of the secret services must be limited

The complaint filed by Bits of Freedom is about the so-called ‘relevance assessment’. This is an important safeguard in the Intelligence and Security Services Act 2017, which stipulates that when collecting huge amounts of data (bulk data), the secret services must delete the data of citizens they are not investigating as quickly as possible – but within eighteen months at the latest. The services have been collecting more and more data, but they are not as enthusiastic about removing them. And thus they are breaking the law.

Bits of Freedom believes that limits must be set to the data greediness of the secret services. Therefore, they filed a complaint about the unlawful retention of the data. In the complaint, they asked the Complaints Department to have this data deleted. After a thorough investigation lasting months, talks with the Dutch secret services AIVD and MIVD and an inspection of their systems, the Complaints Department ruled that there had been improper conduct and that the data the secret services were storing unlawfully had to be deleted.

Fig 1. Data retention process oversight

There is talk of improper conduct

The Dutch Minister of Interior Affairs and the Dutch secret services refused to remove the data because it is “not necessarily irrelevant.” But this reason can substantially legitimise the storage of every piece of information as one day it may be relevant. The law doesn’t provide that much room to keep data at all. The Complaints Department now states that the Minister’s view is incorrect, and endorses the opinion that the Oversight Department gave already since 2019: the retention of these data is unlawful, and therefore now also improper and has to be deleted immediately.

To make straight what is crooked, the Minister had drawn up a Temporary regulation for the further processing of bulk datasets in novermber 2020. This gave the secret services more leeway than the law provides, which makes it contrary to a higher law. The investigation by the Complaints Department now shows that the secret services exceeded even these extra-wide boundaries. For example, the MIVD only began to examine whether the data were still relevant after we had submitted the complaint. And the guarantee that only a limited number of employees of the secret services would have access to the data was not fulfilled.

Moreover, the longer deadlines in that Temporary regulation are contrary to a higher law, and therefore not really valid at all.

Even when the Complaints Department asked the secret services to explain exactly what they needed this data for, they were unable to do so. They didn’t get much further than the number of times they had queried the datasets. But that, of course, says nothing about what that yields in concrete terms.

What does this mean?

The decision of the Complaints Department shows two things:

• The Dutch secret services do not respect the national regulations. They collect more data than they can handle and keep that data longer than permitted. Even the Temporary regulation that the Minister drew up to give them more leeway was not enough for the services, as they also broke the rules in that Regulation.
• The supervisory system is not capable to intervene by itself when the secret services are breaking the law. The Oversight Department, which previously ruled that this practice was unlawful, has no binding powers. The Complaints Department does have binding powers, but can only use them if someone files a complaint. This makes the Dutch society dependent on organisations like Bits of Freedom for good and effective supervision. And that really needs to change.

This article is available here in Dutch.

Image credit: Bits of Freedom.

(Contribution by: Lotte Houwing Policy Advisor, EDRi member Bits of Freedom)