The Dutch data protection authority (Autoriteit Persoonsgegevens or AP) has rejected the license application of a Dutch association of small and medium enterprises (VODIOM associations) to keep a blacklist of possible fraudsters and share that blacklist with companies from different sectors in their fight against fraud and other crime.
In the Netherlands, managing a blacklist of fraud data is subject to strict conditions, which may include a license requirement. The AP grants such licenses only when (1) it is necessary for the data to be shared, and (2) sufficient safeguards have been put in place to protect the alleged fraudsters who are on the list, such as implementing a data collection and sharing protocol.
In the past, the AP rejected a license application for Fraudehelpdesk (only available in Dutch), amongst others, for not having in place an implemented protocol on the collection and sharing of the personal data of alleged fraudsters.
Following the rejection, however, the AP confirmed that it considers fraud prevention and detection extremely important. The AP reconfirmed this position in a press release following the recent rejection of VODIOM’s license application, in which the AP stated that “a license application will be granted for sharing blacklists where privacy is guaranteed.” This leaves room for companies and associations that are willing to implement appropriate measures to submit a license application for managing the data of alleged fraudsters and work together against fraud, subversion, and other forms of crime, which cost them billions a year and may have a substantial impact on their businesses.
The AP’s press release is available here (only in Dutch).
[View source.]
