National Archives warned because of online disclosure

Theme:
Archiving by the government

For a longer period of time, various agencies have been working on a project for full online disclosure and searchability of the Central Archives for Special Criminal Jurisdiction (Dutch CABR), the biggest war archives in the Netherlands. The CABR contains files about people who were suspected of collaboration during the Second World War. These archives are of wide social relevance and offer new opportunities to find out what happened in the past. But the manner in which the National Archives want to disclose the CABR online is contrary to the Public Records Act and the General Data Protection Regulation (GDPR).

Since 2022, the National Archives have been alerted to this risk on several occasions, by advisers from within and outside the organisation, but the organisation has not done enough with these warnings. That is why the Dutch Data Protection Authority (Dutch DPA) now feels obliged to issue a formal warning against disclosing the CABR from 1 January 2025 in the manner as planned.

As supervisory authority, the Dutch DPA is obliged to warn organisations if they are about to violate the GDPR. On 26 November 2024, the warning was issued to the Minister of Education, Culture and Science, responsible for the National Archives.

Contents of the CABR

The CABR contain around 485,000 files of individuals who were suspected of and/or tried for collaboration. The archives contain many criminal data, including of people who may still be alive, for example in official reports, interviews, and witness statements. The files also contain personal documents such as letters, diaries, and photos. As a result, the CABR also contain many sensitive data about, for example, the religion, political preference, health or ethnicity of people.

These sensitive data relate not only to the suspects, but also, for example, to victims, witnesses and surviving relatives who may still be alive in 2025. The law – including the Public Records Act – stipulates that sensitive data may not be made available to everyone without a good reason if they are about people who are still alive.

Making documents publicly accessible is possible. But in doing so, a proper assessment must be made of what will be made public, and how this will be done. This is where the intended approach of the National Archives falls short.

Browsing without limits

In practice, the disclosure envisaged by the National Archives means that every Internet user, anywhere in the world, can search all files of the war archives that have been published online, at any time of any day, meaning any first name and family name and any keyword that can be thought of. So anyone can browse the archives without limits.

This also entails the risk that the sensitive information from the archives is disseminated publicly through, for example, social media. Overall, this unlimited accessibility results in unnecessarily big privacy risks.

Special arrangement possible

It should be noted that the privacy regulations (GDPR) offer scope to make an arrangement for the disclosure of archives such as the CABR. So far, the legislator has not used this scope. But the possibility exists. In that case as well, the interests of people who are still alive must be assessed properly.

Why a formal warning?

In the spring of 2024, the Dutch DPA received a signal from a surviving relative that there was a possibility that the scheduled disclosure of the CABR was not organised lawfully. The Dutch DPA then made inquiries at the National Archives. From that time until October, the Dutch DPA received information from the National Archives on several occasions.

This information showed that since 2022, the National Archives had requested several legal opinions, which always identified the same privacy risks. In spite of these opinions, the National Archives did not sufficiently adjust the intended manner of disclosure. One of these opinions came from the National Archives' own legal department.

Nor did the National Archives request any advice from the Data Protection Officer (DPO), its own internal privacy supervisor. While according to the law, this should have been done. Nor did the National Archives contact the Dutch DPA for a prior consultation, while there was cause to do so in this case. A prior consultation is an advice about how to deal with privacy risks.

On 21 October 2024, the Dutch DPA had a conversation with the National Archives and the Ministry of Education, Culture and Science. It appeared from this conversation that National Archives had no intention of making another assessment about the online disclosure of the CABR. This leaves the Dutch DPA no option other than giving the Minister of Education, Culture and Science a formal warning that the scheduled online disclosure of the CABR cannot go ahead in this way.

Based on the advice received at an earlier time and the warning of the Dutch DPA, the National Archives will now have to set to work with an alternative procedure. The Dutch DPA has indicated its willingness to advise on this matter.