New criminal procedure code insufficiently protects citizens privacy, regulator says
The new Code of Criminal Procedure does not sufficiently safeguard citizens’ privacy, the Dutch Data Protection Authority (AP) said about a bill to update the outdated penal code. It allows the authorities to collect too much data and store it for too long, which could result in citizens only tangentially connected to an investigation ending up in the police systems.
“Of course, the police and the judiciary must have modern powers to detect crime in this digital age. But the government now seems to have forgotten to build in the necessary guardrails,” said AP chairman Aleid Wolfsen.
The AP raised several concerns about the bill to modernise the Code of Criminal Procedure, which stipulates the rules for the investigation and prosecution of criminal offenses. First, it allows the police to collect and keep data that’s not relevant to the investigation. It also does not clearly regulate the possible reuse of collected data and includes no rules for the analysis and investigation of large datasets. That poses significant risks, the AP said.
“If you collect large amounts of persona data, there is a good chance that it will also contain data from people who have nothing to do with crime,” Wolfsen said, mentioning examples like someone who emailed or called a suspect once. “How do you prevent data from those innocent people from ending up in the police systems without a good reason and continuing to wander around there? This proposal does not have a good answer to that.”
He stressed that having your data in a police system is not without consequence. “Where there’s smoke, there’s fire, people often think. So, if your name appears in the police systems even though you have done nothing wrong, you can still get into trouble. For example, if the police do not properly register that you are not a suspect at all, the idea can still arise that you had something to do with a crime.” That could be enough for the Tax Authority or municipality to investigate someone for benefits fraud, for example. Or, if the data ends up in a foreign police system, it could result in entry bans to certain countries.
The AP recommended adjusting the bill so that the police must immediately destroy all collected data that is not relevant to the investigation. The bill currently only obliges the police to destroy irrelevant data obtained through hacking, and not, for example, data from smartphones and laptops that the police confiscated.
The privacy watchdog also wants more safeguards against the police reusing collected data for other purposes. “We must prevent data that has been collected with far-reaching powers in a murder investigation, for example, from then simply being used to keep an eye on certain demonstrators,” Wolfsen said. The AP wants a judge to approve the reuse of data.
“The AP trusts that the Minister [of Justice and Security] will take our assessment to heart and come up with additional legislation. Do it right the first time, we would say. Arrange both the powers and the guarantees in one go.”
