Of course, the term stealing is not entirely correct here, because our data is not taken away. But the secret services illegally store the data of millions of citizens that they do not investigate. The supervisory authority has already indicated that this is unlawful, but the minister is putting this judgment aside and is maintaining this practice.

What exactly are the secret services doing that is not allowed?

It is of course no surprise that the secret services collect data. One way they do that is with so-called bulk capabilities. With bulk capabilities the secret services collect data from millions of people, the vast majority being about people they are not and will not be researching. They do this to be able to obtain a small part that ís relevant for an investigation. This can only be justified if all data of citizens that are not relevant to this investigation are immediately destroyed. Therefore, they have to assess all the data in such a dataset on its relevance.

And that's where it goes wrong. The services collect so much data that they are unable to assess this within the one-year deadline. And so they devised a trick for that: they no longer assess the data itself, but do the assessment on the level of (bulk) datasets. As a consequence, a set containing some relevant data is treated in its entirety as if all data were relevant. That way, our data, when it should be destroyed, remains in the hands of the secret services. Even as this is against the law. We already discussed this problemRead the blog we wrote about this earlier at the end of 2019. And also the supervisorThe supervisor adressed this in this, soundedthis, the alarmand this report. But because the minister decided not to listen and perpetuate the problem, we are now doing it again.

What are the consequences?

This practice means that, while the secret services should no longer have this data at all, they can still access it and there is no fixed period for retention. How long your data is stored on the servers of the secret services therefore depends on the data hunger of the services themselves. With all the consequences that entails, having access to data for a longer period of time entails a greater risk of misuse, and a greater security risk. This data can now also be shared with foreign services, which entails an extra great risk for journalists or activists who, for example, express themselves critically about these governments.

And that hurts. It is not without reason that the law entails safeguards. They are there because it is inconvenient that there are secret services that have to collect data in the interest of national security, which also includes data from citizens, in the first place. This is only acceptable if it is handled with the utmost care. So that citizens know that they are protected and that they can trust that this is done within the limits of the law. It greatly undermines this trust, and the rule of law, when these boundaries are crossed.

What should be done now?

To begin with, our data must be freed from the clutches of the secret services. This means that all data illegally held by the services must be destroyed immediately.

In addition, there must be ensured that this does not happen again. And for that, the supervisor has to be listened to. All data must be assessed for relevance, as required by law. That means, all data by itself, and not on the level of (bulk) datasets.

Finally, the fact that this illegal practice can last for so long shows two things:

• The handling of bulk data by the secret services must be regulated better, with consistent safeguards that cannot be circumvented.
• And for effective oversight, the oversight committee needs both the possibility to initiate investigations itself ánd have binding powers, so that it can intervene when the practice of the services goes off the rails. And its recommendations in addressing wrongdoings cannot be ignored again.

Fortunately, a new amendment proposal to the Intelligence and Security Services Act 2017 is on its way. So these two points can be taken into account immediately.

A big thank you to Amber Balhuizen for the translation of this articleHere you can find the article in Dutch

in English.