Eindhoven Municipality is going to replace all 268,000 of its city passes. This operation is necessary to comply with the AVG privacy law and will cost €826,000.
Everyone who currently has a city pass will receive a new one. This must be done because it is more than a year since the introduction of the AVG legislation. And the Municipality still appears to be disregarding that law. The card contains information that it may not.
The cost of €826,000 is not only for the replacement of the passes. It is but also for the entire organisation surrounding this as well as the essential software adjustments. Not only Eindhoven residents use these city passes. People from outside the city who, for example, have a subscription to the swimming pool also receive a city pass. These passes are used to open underground waste containers and for car and bicycle parking too.
Identity theft
The problem with the current passes is not only that someone could illegally use the swimming pool, or park their bike for free. The vulnerability lies more in the personal details that are stated on the pass. These include the holder’s full name, date of birth, and in the case of elderly citizens, their social security number too.
For example, if a card is lost, unauthorised people have the combination of full name, date of birth, and social security number. The Government has been campaigning for some time to delete the social security number when making copies of identity documents.
In newer city passes, the social security number is no longer visible on the pass. It can easily be scanned via NFC/RFID. This is the same technique that is used for contactless payments – with the exception that, on the city pass, the social security numbers is not encrypted.
Legislation
It is unclear why the Municipality is only replacing all its passes now. The AVG legislation has, after all, been in force for more than a year. Even before that, organisations and authorities were given ample time to get their administration in order. The City Council says that city passes’ administrative side is in order. The concern is about the information on the pass.
According to the AVG legislation, only personal data that is deemed necessary for the intended purpose may be shared. For example, a photo is permitted if cashiers must be able to verify the person at the counter’s identity. If a pass must only be able to open specific waste bins in the area, name details should be enough. But, for example, a person’s gender is irrelevant. And, officially, that may not be mentioned either.
Everyone who now has an Eindhoven Municipality city pass will, therefore, receive a new one. But that will take a while. The Council will replace all passes between 2020 and 2022. This means the Municipality will continue to violate the AVG legislation for a considerable time.
The operation is part of the Council’s Framework Paper. Politicians will make a final decision on this next week. The responsible City Councillor, Marcel Oosterveer, did not want to explain the plans on camera. This reluctance is because it is still unclear what the replacement operation will look like.
Source: www.studio040.nl
Translator: Chaitali Sengupta
Editor: Melinda Walraven
