Municipalities collect and process a great amount of personal data for various statutory tasks. Because of the large number of separate task areas (domains), municipalities process great amounts of personal data, often in a variety of incompatible systems. The mutual exchange of data between task areas is usually not allowed. Even within domains there are sometimes strict rules.
Nevertheless, citizens expect that municipalities can demonstrate their care in handling personal data. According to the GDPR, citizens can exercise their rights to access the data which the municipality holds on them and to manage their own personal data.
What do we offer municipalities
We offer a variety of services to municipalities:
- We have made an inventory of the relevant legislation and regulations for the most critical areas (social services, security, surveillance and enforcement), including sector-specific legal policies;
- The legal policies form the basis for baselines for municipalities. The baselines provide a practical translation from legislation to municipal business processes. We used reference models for this translation. The baselines are used to put in place effective management and security measures and to carry out accountability studies;
- There is an accountability obligation for data protection for the three pillars of the municipality: the council, the mayor and the board of aldermen. Each have their own responsibilities, as well as common responsibilities. We have drawn up a model for accountability;
- Municipalities often cooperate with other municipalities. To this end, joint regulations have been drawn up, in which the board of aldermen usually remains responsible. Sometimes a joint scheme has its own provisions for the processing of personal data (i.e. (purpose and means);
- Other collaborations take place with public and private parties, such as housing corporations, public utilities, the police and the public prosecution service. Agreements in such cases are laid down in a covenant, which include soft and firm agreements, whereby the exchange of personal data is subject to strict rules. Sometimes protocols are required, e.g. for exercising public authority. It is important that the covenant clearly expresses the purpose of the cooperation, including the necessary exchange of (personal) data and the legal grounds for this;
- In the social domain, the execution of the Youth Act, the Social Support Act and the Participation Act have been transferred by the government to the municipalities. Each of these sub-domains have their own legislation and data sharing is usually impossible. Municipalities are struggling on the one hand with the limitations that result from this, while at the same time they have to maintain a social safety net for the resident.
We have implemented privacy legislation for municipalities and embedded it within the organization’s procedures. Within the framework of the legislation, we have implemented the guidelines provided by the Dutch Federation of Municipalities (VNG).
The new laws and regulations in the area of privacy and information security have a great impact on municipal organizations. Our professionals can assist with reviewing business processes and, if necessary, rearranging the processes, assessing contractual agreements and the process of contracting in chains with suppliers of information services, and interpreting responsibilities and liabilities in joint regulations with partners.
The number of municipal task areas is extensive and the business processes are complex in their diversity. There are many internal and external organizations and stakeholders, with their own motivations whether or not to make the necessary changes to the processes. Protection citizens’ personal data requires first of all a behavioral change within the municipal organization. Next, the organization and especially the IT systems should be adjusted within the statutory frameworks.
Want to know more?
Would you like to know more or use our expertise in the field of municipal government? Contact us. We are delighted to meet you.