The Dutch chamber of commerce generated revenue of more than €3.3m in the last six years when it bundled and sold details of companies, mostly to direct marketing firms.

A Freedom of Information request (WOB) by DutchNews.nl has revealed that a sales product that was discontinued, after criticism from the Dutch Data Protection Authority, was a lucrative one.

The Kamer van Koophandel (KvK) ‘adressenbestand online’ service, selling masses of data, had led to complaints about nuisance calls and breaches of privacy, particularly from freelancers. Although tough European data protection regulation came into effect on May 25, 2018, the product was not withdrawn until more than a year later.

Sole traders are legally obliged to register their details with the KvK. If they have no office, they have to register a personal address, and if they have no landline, a mobile number: these are made publicly available, for payment, as part of Dutch business probity law.

But privacy watchdogs and a privacy lawyer have told DutchNews.nl that the KvK could face legal action for a historic breach of privacy for the mass data sale product, and is continuing to breach the privacy of freelancers in their opinion by making personal data available for sale.

Claim

Marieke Berghuis, attorney at law at bureau Brandeis, told DutchNews.nl that there could be a case for a claim for the mass sale of data, under GDPR legislation. ‘We believe this in principle could be possible when conditions that are currently clarified in case law, are met,’ she said.

‘The GDPR explicitly states that any person who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation from the controller or processor for the damage suffered.’

She added that according to article 51 of Dutch commercial register degree of 2008, freelancers have a right to shield their addresses if they have no publicly-listed landline, among other factors. Dutch telecommunications law is, in any case, changing on July 1 so that people have to ‘opt in’ to receive calls from organisations such as telemarketers.

‘Where the Kamer van Koophandel sells personal data of sole traders, this processing activity should have a legal basis, as required in the GDPR,’ added Berghuis. ‘However, the AP [Dutch Data Protection Authority] concluded that for the selling of other products than “uittreksels” and “inzage”, a legal obligation that could form a legal basis as required in the GDPR does not exist.

‘The central objective of the Handelsregisterwet is the legal certainty in trade. When products are offered that solely benefit the Kamer van Koophandel or the profit of a certain company, the AP confirmed that these purposes cannot be considered compatible with the initial purpose of legal certainty.’

Profit

In its last annual report, the KvK listed ‘reputational damage, claims and/or fines’ due to ‘open data developments’ as top of the list of risks it faces. The agency does not structurally aim for profit but carries out government functions by enacting trade laws. According to the report, however, its four top functionaries had annual compensation packages worth more than €175,000 each per year. Dutch prime minister Mark Rutte has an annual salary of €170,910.

A spokesman for campaign group Bits of Freedom, which has been campaigning with the Open State Foundation to better protect people’s private details from open public access, said he hopes more change will come quickly to protect sole traders.

‘There was a situation where the Kamer van Koophandel, like a sort of commercial organisation, sold data in bulk to energy companies and annoying call centres,’ he said. ‘This has been stopped, which is good news, although it won our Big Brother award for the biggest privacy breachers.

‘But this is only half of the story. Everyone can still get hold of private details belonging to freelancers and sole traders, which can be used for intimidation, stalking and other nefarious acts, and this is what we are campaigning to stop. We hope that [economic affairs] minister Mona Keijzer and parliament will change the trade register.

‘You could make the register protected but if there’s a case of fraud or criminality, police can see it…but that doesn’t mean that Charles on the third floor or whoever else can have a look too. That does more harm than good.’

Concerns

Bits of Freedom is one of a collective of organisations that has raised concerns about breaches of privacy, leading to nuisance marketing calls, but also to more severe concerns such as threats against freelancers such as artists, journalists and writers. Individuals last week told Dutch media that they are very concerned about an ongoing breach of privacy.

The Dutch economic affairs department has said that it needs to work on a better balance between open business and protecting individual freedom, and has started an online consultation. The ministry of economic affairs has now said that freelancers’ addresses will be shielded in the KvK business register (except from official agencies such as lawyers, bailiffs and government bodies) from some time later this year.

A spokeswoman for the KvK stressed that the body sells details from the companies register in order to raise the money for its own running costs, and is simply carrying out Dutch law and its legal functions, as decided by government.

Balance

‘The adressenselectie online [product] was stopped in 2019 because the KvK had the impression that this product was primarily used for direct marketing, and a large number of businesses find unwanted telephone approaches a nuisance,’ she said in an email.

‘The law says that the KvK must cover its costs for performing its statutory duties (including managing the trade register) by charging costs to users. If you want to use the register and request data, you pay for this. The costs of carrying out the public task are only partly covered by this…and the rest is charged to the national budget.

‘Different groups think differently about the right balance between openness and transparency: one group wants more openness, and the other wants things to be closed off more….The government has announced that it will brief parliament about the options for doing justice to balancing these different interests.’

A spokesman for economic affairs minister Mona Keijzer, told DutchNews.nl: ‘We have started a consultation and asked everyone for their ideas, policy suggestions and opinions. This includes companies that need legal assurances, and consumers.

‘The companies register can, for example, ensure that if something goes wrong that you can find somebody’s address and telephone number, which is important, versus the other side of protecting the right to private life, especially of sole traders. It is, of course, a very complex discussion so we are asking everyone with an interest to submit their ideas so that we can take further steps.’

The online consultation is accessible here. Unless you specify otherwise, your reaction will be made public.

Update: The Kamer van Koophandel has contacted DutchNews.nl to assert that it does not consider that it has infringed the GDPR.

The Dutch Data Protection Authority has confirmed to DutchNews.nl that: ‘”Adressenbestand online’’ was a violation of the GDPR and therefore unlawful.’