AP: Aid organisations cornered due to Israeli requirement to provide personal data
The registration requirement imposed by Israel on aid organisations has cornered these organisations. That is the conclusion of the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, following guidance on the matter. If aid organisations provide all the personal data required by Israel, they will almost certainly violate the privacy rights of employees and their family members. However, if they fail to do so, Israel will no longer allow them to provide aid in the Gaza Strip starting September. The AP is therefore asking the Dutch government to formally protest against this registration requirement.
In a directive, the Israeli government requires all organisations delivering aid in the Palestinian territories to comply with comprehensive registration by early September at the latest. Israel requires personal data not only about employees, but also about their partners and their children. This includes passport data of employees and their family members. Furthermore, aid organisations must provide names of donors, including ‘background information’ on those people and the exact amounts they have donated to the aid organisation. What exactly constitutes background information is unclear.
The Israeli government appears to use this information for screening and profiling purposes. This allows the Israeli government to link the information from the registration to what people have previously shared online. This includes expressions about dignitaries, criticism of the state of Israel, photos, calls, memes or opinions.
Emergency guidance
A Dutch aid organisation* requested the AP for emergency guidance on the matter in late July. Based on the available information, the AP concluded that the aid organisation in question had no valid reason (legal basis) for providing the requested personal data to Israel. It was also not clear to the aid organisation what would happen to the personal data after providing it to Israel. By transferring personal data, the aid organisation would therefore almost certainly be in violation of the General Data Protection Regulation (GDPR). Consequently, the AP advised the Dutch aid organisation not to comply with the registration requirement.
Adjust registration requirement
In an official memorandum to the Ministry of Foreign Affairs, the AP requests the Dutch government to formally protest against this registration requirement. As in the current situation, aid organisations will have to choose between the rights of their employees and carrying out their work in Gaza. The AP has requested the Ministry to also discuss this issue without delay with the European Commission because the registration requirement could also affect other European aid organisations.
In addition, the AP intends to contact the Israeli data protection authority with the request to comment on the registration requirement. And the AP will very shortly enter into discussions with the data protection authorities in Europe on how the registration requirement relates to the European Commission's adequacy decision on Israel. That decision states that personal data protection in Israel shall be of the same level as in the European Union.
*The AP will not publish the relevant guidance as it would disclose the name of the aid organisation that has requested the guidance. The organisation is concerned that providing aid on the ground might be further complicated if it becomes known that they have contacted the AP for guidance.
