Right to Privacy: Can Temporary Dutch Law Withstand European Scrutiny?

The Netherlands introduced a Temporary Act on 1 July 2024 that expands the powers of the AIVD and MIVD. In the meantime, the European Court of Human Rights (ECHR) made an important ruling on 13 May 2024 regarding the right to privacy in the Podchasov/Russian Federation case. Given the ruling in the Podchasov case, it is questionable to what extent our Dutch Temporary Act can withstand the test of Article 8 of the ECHR.

The Podchasov/Russian Federation case

On 13 May 2024, the judgment of the European Court of Human Rights (ECHR) in Podchasov v. Russian Federation (33696/19) became final.

The Podchasov case focuses on the importance of encryption in protecting the ‘right to privacy’. This right is enshrined in Article 8 of the European Convention on Human Rights (ECHR).

This case concerns the legal obligation imposed by the Russian government on “internet communication operators” (in this case Telegram). They must store all communication data for one year and retain the content of all communications for six months. They must, under certain legal circumstances, provide this data to law enforcement or security services, together with information necessary to decrypt encrypted messages.

Right to privacy versus national interest

The ECtHR recognises that governments and their services may have an interest in exercising certain powers to protect their populations, particularly at a time when terrorists and criminals are using digital means to commit serious crimes.

“However, it goes too far if a government can oblige organisations to search, store and make available all communications without concrete reason and without prior independent judicial review. In the case of end-to-end encryption, even the keys would have to be made available, which automatically nullifies the encryption of others. Moreover, the lack of transparency and legal remedies for the data subject was considered to be restrictive for safeguarding the right to privacy. In the case of the implementation of regulations by the FSB (the former KGB), this judgment seems logical and desirable.”

Temporary law in force in the Netherlands

At the same time, an extensive legislative package has been set up in the Netherlands, with which intelligence services can carry out their task. As of 1 July 2024, the Temporary Act on AIVD and MIVD investigations into countries with an offensive cyber programme, bulk datasets and other specific provisions will come into force. This temporary act is an addition to the Intelligence and Security Services Act 2017 and also aims to provide the possibility of, among other things, collecting data en masse on internet cables with the aim of seeing who should be investigated.

“Article 8 - The protection of personal data
3. An independent authority shall ensure that these rules are complied with.”

Appointed assessment committees

The Assessment Committee for the Use of Powers has been established for the use of powers. This committee consists of at least two former judges, who are appointed for six years, with a possible extension of another six years. As a result, the Assessment Committee cannot be equated with an independent judge. For the retrospective assessment, a Committee for the Oversight of the Intelligence and Security Services has been established, which also cannot be equated with an independent judge, since these members are also appointed for six years and their term can be extended by six years.

Minister can appeal decision on legality

The Temporary Act stipulates that the Review Committee can decide on the use of powers. In addition, the Supervision Division of the Intelligence and Security Services Supervision Committee can decide whether the use of resources was lawful. The Minister can challenge these decisions by appealing to the Administrative Law Division of the Council of State. The storage and destruction of datasets in particular is particularly difficult to monitor.

No access to the independent court for citizens

A citizen whose rights and freedoms have been violated under Article 8 of the ECHR will not be able to appeal to an independent judge under this law. Given the Podchasov ruling, it is questionable to what extent this Temporary Law can withstand the test of Article 8 of the ECHR. Finding a balance between the powers of the government to protect society and, on the other hand, protecting the individual against the all-powerful government requires a degree of transparency that makes an appeal to an independent judge possible. The Netherlands has not yet reached that level of legal protection.

Privacy law and your business operations

Privacy law regulates everything that has to do with protecting people’s personal data. Of course, this entails obligations for your business operations. Would you like to know more about the legal side of this subject? Our Privacy Law specialists are ready to help you. Call or e-mail them today.