Records Act Versus The Right To Be Forgotten

From May 25, 2018, the General Data Protection Regulation (GDPR) will apply. The GDPR replaces the Privacy Directive and with it the Personal Data Protection Act. The GDPR includes rules for the processing of personal data. "Personal data" includes any information about an identified or identifiable natural person (the data subject). An identifiable natural person is considered to be a person who can be identified directly or indirectly. This does not include data about a deceased person or a legal person Click here.

As a controller, government organizations must respect the rights that the GDPR offers to data subjects. In particular, the 'right to erasure' that is granted to the data subject, and the legal obligation for governments to properly archive certain data, clash in this context. Does the Archives Act take precedence over the GDPR?

Government Archiving

Under the Archives Act, governments are obliged to archive various digital documents. That obligation also extends to government websites, emails, and posts on social media such as Twitter and Facebook. In addition to a digital archive, however, the vast majority of government organizations also have meters or kilometers of physical (paper) archives stored in their basements and attics.

At the moment there is a physical archive of a total of 175 kilometers that was built up in the period from 1975 to 2005. – National Archives

According to the Archives Act, 'something' must be done with the archive records that can be found in these cellars and attics: either they must be kept or they must be destroyed. Checking all records is a labor-intensive job, which means that it regularly prevents governments from lagging behind in maintaining this physical archive. In addition, hybrid archives were often built up in the early 2000s. Some files are stored both physically and digitally, others only physically or digitally. This does not make the situation any easier.

The staff of the National Archives are currently busy digitizing the current physical collection. The intention is that within 15 years about 10% of all existing documents based on open data can be consulted online in the e-Depot . In addition, the collection is supplemented every year with new documents and an archive is currently being built up with which the collection will be supplemented in twenty years' time.

The person charged with the care of the archive documents (caregiver) is obliged to design selection lists in which documents are included that are eligible for destruction or permanent storage. This list is published in the Government Gazette (Article 5 of the Archives Act). When designing and determining the selection lists, the caretaker must take into account, among other things, the task of the government body for which he draws up the selection list, what the relationship is between the government bodies themselves, the value that the archive documents have in view of the cultural heritage and the importance of this for government bodies, litigants and historians (Article 2 Archives Decree 1995). The selection lists can be found on the website www.nationaalarchief.nl.

According to the recently established selection lists for municipalities, online content must be permanently stored. Government organizations are obliged to bring and keep their archival documents in a good, orderly and accessible state. The archival documents that are not eligible for destruction and that are older than twenty years must be transferred to the National Archives or to one of the Regional Historical Centers (Article 12 of the Archives Act).

The GDPR applies as soon as personal data has been included in the files to be archived. The processing for archiving purposes is considered compatible with the original processing according to the GDPR. This is therefore always allowed, even if the archiving purpose was not originally communicated to the data subjects. Moreover, the archivist does not have to inform the data subject about the processing, as this would require a disproportionate effort. There are further exceptions in the GDPR for the archiving task.

For example, personal data may in principle not be kept longer than necessary, but longer storage is permitted for archiving purposes in the public interest. Now, however, the data subject could invoke the so-called right to erasure. This right is included in Article 17 of the GDPR. In that case, the government would be obliged to delete the personal data without undue delay. This is undesirable for archives because it would alter the integrity of the archive.

The European Parliament and the Council recognized this problem at an early stage. For this reason, the right to erasure has been declared inapplicable if this right threatens to make archiving for the public interest, scientific or historical research or statistical purposes impossible or seriously jeopardize it (Article 17(d) of the GDPR) .

This exception only applies if appropriate safeguards have been taken during the archiving to protect the data subject (Article 89 GDPR). Government organizations are therefore obliged to take the technical and organizational measures with regard to archiving to guarantee the principle of data minimization. Where possible, this could be done by pseudonymizing the data in the archive.

Finally, the right of access, rectification and data portability do not apply when data has been transferred to the National Archives or another archive repository. If the person concerned is of the opinion that the transferred data is incorrect, then according to the Implementation Act still to be discussed by Parliament, he is entitled to add his own reading to the relevant archive documents Click here.