Social domain

Privacy rules in the social domain

As Municipal Executive, you have to make a clear distinction between the various tasks for which you process personal data. You also have to realise which obligations you have to meet for the lawful processing of personal data. The rules for this can be found in the General Data Protection Regulation (GDPR).

In addition, both the GDPR Implementation Act and the specific laws on this subject contain powers, safeguards and requirements that the personal data processing has to meet.

Pursuant to the GDPR, as Executive Council you have to observe the principle of purpose limitation (Article 5 GDPR) when processing these personal data. This means that you are in principle only allowed to process the personal data (further) for the task specifically described in the relevant law and, therefore, not for (the performance of) other purposes and/or tasks.

In addition, you are not allowed to use more data than necessary. You are also obliged to:

• inform people whose data you process properly and correctly about what happens with their data (transparency);
• give people whose data you process the option to exercise their privacy rights.

Furthermore, you have to ensure proper security of the personal data collected.

Task carried out in the public interest

The (public-law) tasks of the Executive Council must be set out in the specific laws. In this way, such specific law offers a legal basis for personal data processing insofar as this is necessary for the performance of that task.

Is processing special categories of personal data, such as health data, necessary for the performance of that task? Then there must also be an exception to the prohibition of processing special categories of personal data (as referred to in Article 9, paragraph 2 GDPR and as referred to in specific national laws or regulations, such as the laws pertaining to the social domain or the GDPR Implementation Act).

Factual service provision or assistance

Factual service provision or assistance is the actual provision of the facility or care that someone receives on the basis of the Youth Act, the Wmo, the Participation Act or the Wgs, such as measuring up a stairlift or the provision of home care by a care organisation.

The processing of (special categories of) personal data is often necessary for the implementation of this factual service provision or assistance. Many municipalities outsource these tasks. As Executive Council, you can also choose to perform these tasks yourself. In that case, you are not essentially different from other service providers or care providers.

The legal basis for processing personal data does not pertain to the performance of a task carried out in the general interest. You need another (legal) basis, for example performance of an agreement (Article 6, paragraph 1, point b GDPR).

Sometimes it is hard to make a distinction between a task in the context of which factual help is provided and a task that pertains to measures facilitating access to assistance (Wmo 2015) and/or you have delegated or mandated your task to another organisation.

In those situations, it is important to take a good look at the following aspects of the (intended) personal data processing:

• who the controller is;
• who has which power;
• what the purpose and the necessity of that specific processing are.

This is particularly important when it concerns the processing of special categories of personal data.

Consent is usually not a valid legal basis 

Your residents must be able to give their free consent for the processing of their personal data by you as Executive Council or by another governmental organisation. In the performance of public-law tasks in the social domain, there is usually a relationship of dependence between the resident and the municipality. In that case, consent from the resident cannot be regarded as a legal basis for personal data processing in the social domain. You will need a different legal basis.

Nevertheless, you may end up in a situation in which asking for consent is desirable: you want to make sure that people in a vulnerable position get help from other organisations. In that situation, valid consent from an administrative body may sometimes still apply.

Data processing for various tasks

In highly limited cases that have been laid down in law, personal data that you have collected for a specific task may be used for a different task or law (in the social domain). However, a partnership for a comprehensive approach to or direction of the assistance, for example, does not (yet) fall under this exception. This is because the separate laws in the social domain (the Youth Act, Wmo, Participation Act and Wgs) do not provide for a comprehensive implementation of these laws.

The above-mentioned laws sometimes offer the option to use data collected on the basis of a specific law for another task in the social domain. But this is always for the performance of one specific statutory task only.

An example: The Youth Act arranges that in certain cases, personal data processed on the basis of the Wmo 2015 or the Participation Act may be used for the provision of youth support. But this does not mean that these data may also be processed for purposes outside the Youth Act.

Legislative proposal for the Wams

The legislative proposal for the Multiple Problems in the Social Domain Act (Wams) provides for statutory tasks for municipalities (Executive Council) in the areas of research, planning and coordination when dealing with multiple problems in the social domain and any adjoining areas.

These statutory tasks form the legal basis for the necessary processing and exchange of personal data for the performance of those tasks. This legislative proposal was submitted to the Second Chamber in January 2023 and has not yet entered into effect.

Read the advice of the Dutch DPA on the Wams

Municipal Debt Counselling Act (Wgs)

The amended Wgs provides more clarity about what is and is not allowed when personal data are processed for (facilitating access to) debt counselling. All the same, it turns out that in practice there are still many questions. That is why the Dutch Data Protection Authority (Dutch DPA) has drawn up the Guide on the Municipal Debt Counselling Act (Wgs) with points for attention. These are the points that municipalities and assistance providers have to take into account for meeting the requirements of the privacy legislation.

Also read

Dutch DPA advises on better assistance to people with problematic debts

Dutch DPA advises on preventive debt counselling by municipalities