In July 2011, the Dutch Data Protection Authority (Dutch DPA) imposed an order subject to a penalty of EUR 125,000 on the Dutch National Railway (NS) for exceeding the maximum retention period of travel data of students. The penalty forms part of a broader inquiry conducted by the Dutch DPA in December 2010 with regard to travel data processing, such as the card number and actual travel data (e.g. destination, location, time) by several Dutch transport companies. The Dutch DPA concluded that the transport companies retained the travel data of the students longer than necessary, as the data were stored for a period of seven years. All transport companies were obliged to reduce their data retention period subject an administrative penalty. The Dutch DPA is of the opinion that a maximum retention period of 24 months should apply for travel data.
The Dutch DPA granted the NS time up to and including November 2011 to introduce the compliant retention period. Furthermore, the NS was forced to delete the processed travel data after 24 months. The NS did not delete these data but informed the Dutch DPA that the data were anonymized and could therefore no longer qualify as personal data.
However, it turned out that the data could in fact be (in)directly traced back to the travelling student. Therefore, the NS has incurred the penalty. The NS has informed the Dutch DPA that it has now introduced the shortened retention period and that all travel data older than 24 months have been deleted. Furthermore, the penalty has been paid.
In the course of the 2010 inquiry, the Dutch DPA had also imposed an order subject to a penalty to the NS with regards to non-compliance with the information duty. The NS obliged students to check in and out with their travel chip card also during periods where they were entitled to travel for free, while this was actually not mandatory. The train company, however, did not inform the students that this was in fact optional and could therefore process the travel data of those students travelling during the free travel hours. Since the NS has in the meantime informed the students sufficiently, the NS will not incur this specific penalty.
The Dutch DPA is still investigating whether or not the other Dutch transport companies involved in the 2010 inquiry have complied with the requirements set in their administrative enforcement orders. (FVDJ)