The Complaints Department of the Dutch intelligence oversight body CTIVD has made use of its binding powers for the first time. After a class action complaint filed by the digital rights organisation Bits of Freedom, the Dutch secret services now need to immediately delete unlawfully held data of millions of citizens. The decision has nevertheless shed light on several vulnerabilities within the Dutch intelligence oversight system.
The Complaints Department of the Review Committee on the Dutch Intelligence and Security Services (CTIVD) ruled that the data of millions of citizens, unlawfully in the possession of the secret services, must be immediately deleted. The class action complaint that led to this decision was filed by the Dutch digital rights organisation Bits of Freedom and is the first of its kind. It is also the first time the CTIVD’s Complaints Department has used its binding authority. An appeal to this binding ruling is not possible. The Minister now has to inform the Complaints Department and the complainant on how the data will be deleted within two weeks.
The data collection of the secret services must be limited
In their complaint, Bits of Freedom referred to the so-called ‘relevance assessment’. This is an important safeguard in the Dutch Intelligence and Security Services Act 2017, which stipulates that, when collecting huge amounts of data (bulk data), the secret services must delete the data of citizens they are not investigating as quickly as possible — and within eighteen months at the latest. The services have been collecting more and more data, but seriously lag behind when it comes to removing data on citizens they are not investigating and will not be investigating. They are thus breaking the law.
Bits of Freedom believes that the data collection of intelligence agencies needs to be limited. Therefore, in July 2021, the organisation submitted a complaint about the unlawful retention of the data. They asked the Complaints Department of the independent oversight body CTIVD to have the bulk datasets deleted. After a thorough investigation lasting months, talks with the Dutch secret services AIVD and MIVD, and an inspection of their systems, the Complaints Department ruled that there had been improper conduct. The data the secret services were storing unlawfully needs to be deleted.
The need for a better oversight system
Earlier, the Oversight Department of the CTIVD had already criticised the way in which the intelligence services implemented the relevance assessment and deemed it unlawful in their oversight report. The Ministers of Interior Affairs and Defence Ollongren and Bijleveld-Schouten reacted by stating they believed otherwise and gave the secret services permission to continue their illegal practice. Since the Oversight Department of the CTIVD does not have binding powers, it could not intervene. On the contrary, the Complaints Department of the CTIVD does have binding powers, but cannot initiate an investigation on their own behalf. Complaints need to be filed by a third party. In this specific case, Bits of Freedom presented themselves as the missing link to trigger the binding powers of the Complaints Department by filing the complaint. However, because of the secrecy inherent in intelligence work, civil society organisations are often not aware of potential illegal practices. This means of initiating investigations is therefore not always possible. Most importantly, the Dutch society should not be dependent on organisations such as Bits of Freedom for effective oversight on the secret services. Therefore, there is a dire need for a better oversight system, which enables oversight to intervene in case of irregularities.
There is talk of improper conduct
The Dutch Minister of Interior Affairs Hanke Bruins Slot and the Dutch secret services refused to remove the data claiming it is “not necessarily irrelevant.” This kind of reasoning is problematic as it can legitimise the storage of substantially any piece of information. The law does not actually provide for that much leeway when it comes to data retention. The Complaints Department has now stated that the Minister’s view is, in fact, incorrect. It endorses the opinion the Oversight Department had already given since 2019: the retention of the bulk datasets is unlawful, and therefore now also improper. The datasets have to be deleted immediately.
The Minister of the Interior had drawn up a temporary regulation for further processing of bulk datasets in November 2020. This gave the secret services more leeway than the law provides, which contradicts superordinate law. The investigation by the Complaints Department now shows that the secret services exceeded even these extra-wide boundaries. For example, the MIVD only began to examine whether the data were still relevant after Bits of Freedom had submitted the complaint. The guarantee that only a limited number of employees of the secret services would have access to the data was also not fulfilled.
When the Complaints Department asked the secret services to explain exactly what they needed this data for, they were unable to do so. The information they provided didn’t go much further than the number of times they had queried the datasets. Applying the number of queries as a sole criteria to assess the relevance of datasets could, however, turn into a dangerous false incentive: it would then suffice for a datasets to have been queried in order for it to be deemed relevant and to be kept. This information is therefore clearly of insufficient value to assess the relevance of stored data.
What are the lessons learned?
The decision of the Complaints Department shows two things:
First, the Dutch intelligence services do not respect national regulations. They collect more data than they can handle and keep that data longer than permitted. Even the temporary regulation the Minister drew up to give them more leeway was not enough for the services, as they also broke these rules.
Second, the supervisory system is not capable of intervening by itself when the secret services are breaking the law. The Oversight Department, which previously ruled that this practice was unlawful, has no binding powers. The Complaints Department does have binding powers, but can only use them if someone files a complaint. This makes the Dutch society dependent on the initiative of civil society organisations, such as Bits of Freedom, for effective checks and balances.