Over the past few years, travel data relating to hundreds of students has been shared by Trans Link, the company responsible for the ov-chipkaart (an electronic public transport card used in the Netherlands) with the Dutch Executive Education Agency (Dienst Uitvoering Onderwijs, DUO). DUO requested this data in order to investigate potential fraud cases.
By transferring this data to DUO however, Trans Link violated the policy that such data can only be transferred to a third party upon the instruction of the public prosecutor (officier van justitie). This regular transfer of data by Trans Link to DUO (between 5 to 10 cases a week) was discovered when a student who was caught for committing fraud (the student had falsely claimed to be living on their own in order to receive a higher scholarship) brought this case before the court of first instance in The Hague. The court found that DUO was in breach of the Wbp, and the student was pardoned as a result of this breach of law by DUO.
Duo has announced its intention to bring an appeal before the Central Appeal Council (Centrale Raad van Beroep) as it believes that it does have a legal ground for obtaining such data under the Dutch the General Administrative Law Act (de Algemene Wet Bestuursrecht). DUO also pointed out that it does take into account the right to privacy of individuals in the process of investigating potential fraud cases. It also pointed out that such investigations are necessary considering that from the 7000 investigations it carried out, 3300 involved fraud, meaning that a substantial amount of public money is being abused.
Whilst Trans Link had announced to consider protecting the privacy of students a top priority when the ov-chipkaart was introduced in 2006, the travel interest group (Reizigersorganisatie Maatschappij voor Beter OV) feels that Trans Link has shown no regard for the privacy rights of these public transport users. The interest group has therefore requested the AP to investigate this matter.
We will keep you updated as this matter progresses. In the meantime, the above discussed ruling can be found here (in Dutch only).