Privacy policy 2025 - 2028 - municipality of Gemert-Bakel

1. Privacy in general

1.1 General

Everyone has a right to privacy. It is regulated in the Constitution and is about the rights and personal freedoms of everyone. Bodily integrity, domestic law, letter secrecy and informational privacy all fall under that concept. The essence of privacy is that information about our comings and goings remains within its original context and that organizations are transparent about how they handle personal data.

This privacy policy focuses on informational privacy and describes how the municipality of Gemert-Bakel handles personal data and how it protects the right of citizens to have access to their own personal data. In this way, employees, citizens, suppliers and other external parties of the municipality know which principles apply and what is expected of them with respect to privacy and the processing of (special) personal data. In addition, this privacy policy forms a steppingstone for processes, procedures and/or working agreements that apply to specific activities and activities in which personal data are processed.

The municipality values a good way of providing services and cooperation with an efficient processing of personal data. It is also important that the privacy of citizens is respected. Citizens must be able to trust that the municipality and its partners comply with privacy legislation and handle personal data with care so that privacy is protected.

As of May 25, 2018, all countries in the European Union protect personal data according to the same general rules of the General Data Protection Regulation (AVG). The purpose of the AVG is:

• Protecting natural persons in connection with the processing of their data.
• Ensuring the free flow of personal data within the European Union.
• The AVG also strengthens the fundamental rights of citizens in the increasingly digital age. This privacy policy addresses the obligations that the AVG imposes on the municipality of Gemert-Bakel.

This privacy policy is valid for four years (from 2025 to 2028). The policy will be reviewed every four years and possibly updated in case of a change in the law or growth of the organization and/or ambition.

1.2 Scope of privacy

The municipal privacy policy applies to all tasks and processes for which the municipality is responsible.

The privacy policy relates to the personal data of persons whose data the municipality of Gemert-Bakel processes or has processed.

There is soon talk of 'processing' personal data. Collecting, recording, organizing, structuring, storing, updating or modifying, retrieving, consulting, using, transmitting, distributing or otherwise making available, combining, blocking, erasing or destroying personal data all come under the processing of personal data.

1.3 Legal framework

The European General Data Protection Regulation (AVG) and the AVG Implementation Act (UAVG) serve as legal frameworks for how we handle personal data. In addition to the AVG, each EU member state must still legislate on a number of points under the AVG. In the Netherlands, this has largely been done in the General Data Protection Regulation (Implementation) Act. When personal data are processed in the context of carrying out a police task, these are police data. These data are also processed by the municipality. The legal framework for dealing with police data is the Police Data Act (Wpg) and the Police Data Boas Decree (Bpg Boa).

The municipality of Gemert-Bakel performs public law tasks. These tasks stem from many sectoral laws. Examples include the Social Support Act 2015, the Youth Act and the Personal Data (Basic Registration) Act. The sector law may describe how personal data should be handled. This is in addition to the standards described in the AVG. The municipality of Gemert-Bakel also performs tasks under private law. This is subject to general laws and regulations in addition to the AVG. Two different privacy regimes apply to Extraordinary Investigating Officers (boa's): the AVG and the Police Data Act (Wpg). Boas often have multiple tasks and process different types of personal data. The personal data that a boa processes in its role as supervisor falls under the AVG. Personal data that the boa processes in its role as an investigating officer falls under the Wpg. Personal data processed under the Wpg are subject to, among other things, different processing periods and different data sharing rules compared to the AVG. Data management, systems and work processes must be set up differently than for processing done under supervision (AVG). The Wpg also has an audit requirement. An internal audit must take place once a year and an external audit once every four years. The external audit report must be shared with the Personal Data Authority; the independent regulator in the Netherlands that promotes and monitors the protection of personal data.

The municipality of Gemert-Bakel employs police officers who carry out processing operations that fall under the regime of the Wpg. Therefore the Municipality of Gemert-Bakel must ensure that the data management, systems and work processes applicable to the activities of the bailiffs meet the standards of the Wpg.

1.4 Privacy mission and ambition

Careful handling of personal data is the rule for all employees of the municipality of Gemert-Bakel. Those who work for the municipality understand this and are guided by it in their daily work. The municipality has the following mission and ambition regarding privacy: Mission: The municipality of Gemert-Bakel sees the protection of personal data as a matter of good governance. Residents and employees must be able to rely on personal data being processed lawfully, carefully and securely. We therefore work in accordance with the rules of the AVG.

How do we do that?

Vision & ambition: When carrying out tasks involving the processing of personal data, the municipality of Gemert-Bakel always seeks a balance between workability for the employees and its collaborating parties and the risks for the municipality's residents. The municipality of Gemert-Bakel aims to comply with all privacy topics mentioned in the AVG assurance product 3.0 of the Association of Netherlands Municipalities (VNG) by the end of 2028.

This privacy policy framework contributes to the mission, vision and ambition of the municipality of Gemert-Bakel by providing the necessary preconditions for privacy-compliant municipal operations. The college of mayor and aldermen (hereinafter: college) sets the conditions for a privacy conscious organizational culture. We are transparent about our data processing and how we protect personal data. If there are differences of opinion, we enter into discussion with those involved (our residents) and seek solutions.

Due to increasing digitalization, careful handling of the information and data of citizens and organizations is increasingly important for municipalities as well. Computer failures, lost data files or unauthorized access to or manipulation of certain data can have serious consequences for the progress of service provision. Image damage can also result.

Reliable, available and unambiguous information management is therefore essential for the privacy of our residents and the services provided by the municipality.

2. Privacy policy framework

2.1 Objective

The purpose of this privacy policy is to describe frameworks for the responsible handling of personal data and the protection of the privacy rights of persons whose personal data are processed by the municipality of Gemert-Bakel and where the municipality wants to be in terms of compliance with the (U)AVG by the end of 2028.

Reliable, available and unambiguous information management is essential for the municipality's services and the privacy of our residents. This privacy policy framework contributes to this by providing the necessary preconditions for privacy-compliant municipal operations.

2.2 Principles

Under Article 5 AVG, the municipality of Gemert-Bakel is obliged to comply with the AVG principles when processing personal data. These principles are described below:

a. Legality, fairness, transparency

Processing is lawful only when and to the extent that the conditions are met as set out in the AVG, namely: - When the data subject has given permission for the specific processing; - For the performance of an agreement to which the data subject was a party; - To fulfill an obligation set forth in the law; - To combat a serious threat to the health of the data subject; - For the proper performance of municipal duties; - If a careful weighing of interests reveals this. As far as possible, the municipality of Gemert-Bakel processes personal data on the basis of the public duty it has pursuant to the tasks assigned to it. The municipality of Gemert-Bakel also processes personal data when required to do so by law.

b. Basis and purpose

The municipality ensures that personal data are collected and processed only for specifically and explicitly defined and justified purposes. If data are later used for a different purpose, this new purpose must be compatible with the original purpose of collection. Personal data are processed only with a justifiable basis and in accordance with laws and regulations.

c. Data minimization

The municipality processes only those personal data that are minimally necessary for the predetermined purpose. The municipality strives for minimal data processing. Where possible, less or no personal data are processed. Certain laws and regulations specify which personal data are necessary to achieve the purpose. When this is not the case, the municipality of Gemert-Bakel itself makes this consideration in consultation with the Privacy Officer and Data Protection Officer.

d. Retention periods & storage limitation

Retention of personal data may be necessary for the proper performance of municipal duties or to meet legal obligations. Care should be taken to keep the retention period of personal data to a strict minimum. When personal data is stored that is no longer necessary for the purpose for which it was collected, it must be destroyed as soon as possible. This means that these personal data are deleted or are modified in such a way that the data are no longer traceable to a natural person. How long the municipality keeps personal data varies. The Archives Act, the Selection List of the Association of Netherlands Municipalities (VNG) and various other laws stipulate that the municipality may or must retain personal data for a minimum or maximum period. The Register of Processing Activities lists the retention period used.

e. Integrity and confidentiality

The municipality handles personal data with care and confidentiality. The municipality also ensures appropriate security of personal data. The Baseline Information Security Government (BIO) contains the mandatory conditions for municipalities to meet adequate security. The information security policy of the municipality of Gemert-Bakel elaborates on this.

3. Privacy management

Privacy management contains all measures that ensure that the municipality complies with the AVG legislation and is accountable for this. With this, the municipality of Gemert-Bakel complies with the accountability requirement of the AVG. The essence of the accountability requirement is that the responsible governing body, the 'processing responsible party', is responsible for complying with the AVG and can demonstrate this.

This chapter explains who in the organization has what responsibilities and duties in complying with the AVG.

3.1 Roles and responsibilities

All governing bodies of the municipality are responsible for compliance with the privacy laws and regulations, such as the AVG and the privacy policy, each insofar as its administrative tasks are concerned. The governing bodies of the municipality are the municipal council, the college and the mayor. The college is ultimately responsible for compliance with privacy legislation with the mayor as portfolio holder. The town clerk and line management have the official responsibility to implement a proactive privacy policy based on balancing interests and risks in the processing of personal data so that this is done in a balanced manner. That is; properly, carefully and in accordance with the law.

The college is accountable to the city council for the implementation of the privacy policy. The college also ensures that the policy and measures are documented so that it can provide a social and legal explanation of the soundness of the approach at any time. The table below illustrates responsibilities using the RASCI model.

In order to truly promise that privacy protection is incorporated into the organization, it is necessary that all employees of the organization (including hired and external employees), each from their role. These various roles and responsibilities to implement this privacy policy are briefly outlined below. To clarify roles and responsibilities of individuals in line work, the municipality of Gemert-Bakel uses the RASCI method. Below is the RASCI model privacy roles.

3.2 Management structure

The City Council

• Has a supervisory role on the basis of the monitoring task given to them by the Municipalities Act, and in that state monitors the implementation of the privacy policy by the college.
• Ensures that budget is made available to meet AVG compliance.

The College of Mayor and Aldermen

• Is ultimately responsible for compliance with privacy legislation.
• Establishes policies for the protection of privacy based on laws and regulations.
• Accountable to the City Council for the implementation of privacy policy.
• Designate the Data Protection Officer as the internal supervisor.

The mayor

• Is portfolio holder for the implementation of privacy legislation within the municipality.

The town clerk

• Has final official responsibility for privacy.
• Is responsible for the proper use of privacy in business processes and (information) systems.
• Is operationally responsible for the proper use of and compliance with privacy in processes, (information) systems and projects. He/she appoints a process manager or system owner for each (information) system.
• Ensures that privacy awareness is improved within the organization.
• Managing organizational and privacy risks.
• Reviews the privacy policy at regular intervals and makes any necessary adjustments.

The employees

Every employee, including external workers, is responsible for protecting the privacy of the person(s) involved. This means that everyone must ensure, among other things, that personal data are processed lawfully, properly and transparently at the operational level.

Employees ensure that:

• They consciously address the issue of privacy within their daily work.
• They are aware of where to go with questions about privacy.
• They report data breaches in a timely manner.
• They use the communication channels and means prescribed by the municipality of Gemert-Bakel.
• They work from the case system and other systems provided by the ICT department. Storage of official documents or documents containing personal data in other places is not allowed.

3.3 Process ownership

The management is responsible for ensuring that the municipal task is carried out within the boundaries of this privacy policy framework and reports on this to the management, which in turn reports to the college. The college is accountable to the municipal council.

A manager is a process owner, meaning that process owners direct the process(es) on the basis of process plans that provide sufficient overview of the process for effective steering within the team concerned. A process plan must fit within this privacy policy framework and is always consistent with the actual situation.

For departmental processes, a coordinating manager or other official may be appointed.

The 'controller' within the meaning of the AVG, in most cases the college, is and remains ultimately responsible for the privacy compliance of municipal processes.

3.4 Organization

Privacy Officer

The Privacy Officer (PO) implements the municipality's privacy policy. The appointment of the PO helps ensure that the legal privacy tasks are carried out within the organization. The PO is the first point of contact for questions about privacy for all colleagues. The PO must be involved by the organization in all processes where personal data are processed.

Tasks

The duties of the PO are:

• Advisor within the municipality regarding privacy-related questions.
• The first point of contact on privacy for employees.
• Draws up policy documents, such as the privacy policy, privacy statement(s), processing register, procedures around, for example, data breaches and Data Protection Impact Assessments (DPIAs).
• Ensures that these documents are periodically updated.
• Supports and carries out actions that contribute to privacy awareness within the municipality.
• Responds to data breaches and forwards them to the Data Protection Officer.
• Coordinates and supports the execution of DPIAs.
• Reports directly to management and the college
• Is the central point of contact for the implementation of the Wpg.

By separating the functions of advice (PO) and control (FG), we prevent the FG from controlling her own work. This promotes quality and integrity.

The Chief Information Security Officer

The Chief Information Security Officer (CISO) supports, coordinates and advises the organization in monitoring and increasing the reliability of the information provision. He does this from an independent position. The CISO reports directly to the city clerk.

Tasks

The duties of the CISO are:

• Drafting, implementing, updating, renewing and revising information security policies and the resulting plans.
• Acting as an information security advisor to the process owner at the management level.
• Setting up the information security organization.
• Coordinating and advising on handling security incidents(external link).
• The alignment of information security with other security domains.
• Monitoring compliance with information security requirements.
• Improving information security awareness about the municipality.
• Preparing for future information security risks and ICT security risks.
• Advising on and supervising risk analyses.
• Measuring and reporting on information security(external link), by initiating or commissioning (periodic) security audits and evaluations.

The Data Protection Officer

The Data Protection Officer (FG) has an independent role within the organization. The FG is in any case responsible for supervising and advising the organization on the proper handling of personal data. This means that the FG must be involved by the organization in all processes where personal data are processed.

Tasks

The FG has the following duties:

• Informing and advising on privacy legislation. For department-specific issues, the relevant MT member can be contacted directly.
• Monitor compliance with the AVG and the organization's privacy policy; Reports directly to the general manager/municipal secretary: In case of crisis or serious deficiencies, the FG may report directly to the privacy portfolio holder and the college.
• Ensure awareness at the managerial level.
• Advising on DPIAs and monitoring their implementation.
• Collaborate with and act as point of contact for the Personal Data Authority.
• Ensuring employee privacy
• The FG works closely with the PO and the CISO.

Independence

The FG may give free and independent advice. It may not receive instructions about the handling of a case or be influenced in any other way. The DPO cannot give binding advice, but her advice is weighty. The FG will be given the opportunity to make clear any dissenting opinion (if any) to the College and a record will be made of why any advice is not followed. The FG can report directly to the college. In addition, the FG is not given any other duties or tasks that could lead to a conflict of interest. Also, the FG retains the right to contact the AP directly when its advice is repeatedly not heard/ followed within the organization.

The FG reports its findings on compliance with the AVG annually, along with advice on how to improve this. The city council is informed via the planning and control cycle.

4. Embedding in the organization

The following measures have been taken internally in order to embed privacy in the organization:

Information duty

Data subjects are given clear information in advance via the privacy statement on the website of the municipality of Gemert-Bakel and the services they can expect (by telephone, in writing) about the processing of their personal data and the purpose of the processing.

Awareness

Awareness of privacy is essential for protecting privacy in the organization. Continuous attention is given to awareness of privacy in the municipality, among other things by planning structural training courses.

Register of processing activities

The register of processing activities contains all processing activities of personal data kept for the municipality.

Data Protection Impact Assessment

When introducing new policies or regulations or when using new technologies, the municipality considers the protection of personal data by conducting a DPIA.

The DPIA is drawn up with the aim of reducing the privacy risks of high-risk processing to a minimum.

Reporting data breaches

There is a procedure within the municipalities for reporting incidents and data leaks. These reports go through the ticket system. A register is kept of reported security incidents/data breaches.

Supervision reporting and evaluation

Periodically it is checked whether the policy and daily practice correspond. Together with the Privacy Officer it is determined whether a privacy audit will be performed in addition to the supervision by the FG.

Every year, the college reports to the council on risks and control measures related to the privacy policy. The privacy policy is evaluated after four years or, if necessary, in case of internal changes or changing legislation and regulations.

4.1 Exchange with third parties

In carrying out its municipal duties, the municipality of Gemert-Bakel collaborates a great deal with external parties such as other municipalities, public authorities, joint arrangements, software suppliers and consultancies. In order to protect personal data, the municipality makes agreements with these external parties about how we deal with privacy.

To the extent that cooperation partners are designated as processing parties, the municipality enters into a processing agreement with them. In the processor agreement, agreements are made about guaranteeing privacy obligations and security of personal data. When cooperation partners are designated as processors, the agreements on handling personal data are laid down in a personal data agreement, general purchasing conditions, existing cooperation agreements, covenants, joint arrangements, etc. The Privacy Officer monitors compliance with the agreements made.

4.2 Privacy by design & Privacy by default

The Municipality of Gemert-Bakel strives as much as possible to apply the principles of "privacy by design" and "privacy by default" to its processing operations. Privacy by design' means that the protection of personal data is included and incorporated in the development of products, procedures and services that process personal data.

Privacy by default' means that the default settings when setting up systems are chosen in such a way that the protection of personal data is guaranteed. This means that, where possible, no more personal data are shared/disclosed than necessary for the performance of the task.

Securing these principles must take place in the procurement process and the change management of systems, among other things. This requires a common approach between the departments, information services and information security and privacy. In this way, any (privacy) risks are mitigated in a timely manner.

5. Privacy rights of data subjects

5.1 Rights

The AVG defines not only the obligations of those who process personal data, but also the rights of individuals whose data is processed. These data subjects have the following rights:

• Right to information: data subjects have the right to know what happens to their personal data and why.
• Right of inspection: data subjects have the right to inspect the personal data that has been collected from them and thus to control how that data is processed.
• Right of correction: data subjects have the right to have incorrect personal data corrected if it is found to be incorrect.
• Right to object: data subjects can in certain cases ask the municipality to (temporarily) stop processing or changing their personal data.
• Right to be forgotten: in cases where consent has been given to process data, a request can be made to have that data removed.
• Right to object: the right to object to the processing of their data. The municipality complies with this unless there are legitimate grounds for the processing.
• Right to transfer data (data portability): the right to transfer personal data in certain cases.
• Right not to be subjected to automated decision-making: the right to a human perspective in decisions.

To exercise his/her rights, the data subject can make a request in writing, via e-mail or via the municipality's website. Identification of the person concerned takes place when submitting a request via DigiD or at the counter of the town hall in person. The municipality assesses within one month whether the request is justified. If it is, the municipality must approve the request within the same month.

5.2 Requests and objections

Requests relating to the above rights and objections can be submitted in writing and digitally to the FG via the e-mail address fg@gemert-bakel.nl. These requests are registered and their handling is accounted for.