Almost all Dutch municipalities and other government agencies use social media as a service channel. But should governments use commercial companies for their services? Can they still guarantee the privacy of citizens?
Just ask your municipality about a broken lamppost or just as quickly ask a question about your Wmo benefit via Facebook. A tour of NU.nl along the 355 Dutch municipalities shows that almost all municipalities use social media such as Facebook and WhatsApp to answer questions from their residents.
Jeroen van den Hoven, professor of Ethics and Technology at Delft University of Technology, warns that this is a privacy risk. Privacy-sensitive information can thus not only end up in the municipality's archive, but also on Facebook's servers. "And that's not desirable."
NU.nl listed the social media channels used at all 355 Dutch municipalities:
- 122 municipalities use WhatsApp.
- Of the remaining 233 municipalities, 229 have a Facebook page.
- But four municipalities do not have an official Facebook page: Borger-Odoorn, Cuijk, Grave and Terschelling.
What is the risk?
It is very difficult to estimate the actual risk, says Van den Hoven. "The communication is added to Facebook's databases. That company in Europe must adhere to the General Data Protection Regulation (AVG), the European privacy law. But whether they do and continue to do so, we must believe them on their word. Because that data remains in their management. "
Gerrit-Jan Zwenne, professor and lawyer in the field of privacy and data protection, nuances the risks, because WhatsApp messages are encrypted. This means that only you and the recipient can read the content of this message. WhatsApp's parent company Facebook cannot see these messages, the company says.
"When it comes to the confidentiality of the message, that is pretty well arranged at WhatsApp," says Zwenne. "You do use a means of communication from a company that you don't know very well. But that's the same with e-mail, PostNL or SMS; in all cases you trust an external company."
The messages in Facebook Messenger are not yet automatically encrypted at this time. Users can enable this function, but that is only possible if Messenger is used in the app.
This is how you turn on encryption with Facebook Messenger
- Create a new message.
- Click on 'secret' at the top right of the screen.
- Choose the person you want to send a message to.
According to the Public Records Act, WhatsApp communication from municipalities must also be stored internally at the municipality. That is possible in a cloud as well as in an internal system, says Frank Bruijninckx, online media consultant at various municipalities on behalf of his company HowAboutYou. "Where that is stored differs per municipality." If WhatsApp communication is exported to a cloud service such as iCloud or Google Drive, the strong encryption is canceled.
See also: WhatsApp encrypts my apps, but what does that mean exactly?
"Do not send personal data via social media channels"
The municipality of Amsterdam uses both WhatsApp and Facebook, keeping in mind that citizens do not send any special personal data via these channels, says a spokesperson.
"We refer an Amsterdammer who asks privacy-sensitive questions or shares information to another medium. We also tell the citizen that it is better not to share privacy-sensitive information via WhatsApp or other companies. We have laid down this method in our WhatsAppiquette ."
The municipality emphasizes on its own contact page that citizens should not send privacy-sensitive information via social media. That is not a legal requirement and is therefore done by few municipalities. Of the 122 municipalities that use WhatsApp, 36 warn against not sending privacy-sensitive information.
'Fine communication must be done in a responsible manner'
"For many municipalities and citizens, social media are a great way to communicate," the Dutch Data Protection Authority (AP) believes, which supervises the AVG. "But this must be done in a responsible manner." That is why the supervisor's municipalities must conduct research into the privacy risks of social media use in advance.
The Information Security Service (IBD) of the Association of Dutch Municipalities (VNG) has carried out such a DPIA, says IBD spokesperson Remco Groet. This research shows the risks regarding the privacy aspects of WhatsApp use for municipal services.
It emerged that the risk when using WhatsApp as an additional communication channel is very small. "WhatsApp does have access to the contacts on the phone. But if WhatsApp is used as an additional channel, people are not forced to install it," said Groet.
"Nobody downloads WhatsApp just to send a message to the municipality"
"If you give your contact list to Facebook, you actually give it a bit of privacy," says Groet. "But if you don't want that, there are plenty of other ways to get in touch with your municipality, such as calling or e-mailing. Because citizens who want to get in touch with their municipality don't necessarily have to use WhatsApp for that. we regard the privacy risk as limited. "
The VNG has not conducted a separate investigation into Facebook Messenger, but emphasizes that citizens should not send privacy-sensitive files via channels that are not encrypted.
See also: Contact with municipality more difficult: 54 municipalities stop using WhatsApp