Local Pilsner or American Lager?
You shouldn’t waste or leak citizens’ information. Yet the reality turns out to be quite different! Hundreds of Dutch municipalities are violating privacy*. Data is being shared with U.S. tech companies without consent. Nearly six out of ten** municipal web applications (59.2 percent) run on infrastructure provided by U.S. cloud providers. That means much of our data may unexpectedly have a U.S. twist to it.
The risk
Simply put, data belonging to Dutch citizens can fall into American hands the moment that personal information is stored on a U.S. server. To stick with the beer-brewing analogy: thanks to the Cloud Act, the U.S. government can, as it were, organize an unexpected tasting. Without your knowledge, they seize, inspect, and sample citizens’ sensitive data. What they do with it afterward? There’s no oversight over that.
But isn't our data stored on European soil anyway?!
This commonly heard statement does not automatically mean that things are in order when it comes to supposed digital sovereignty. To clarify: attitudes toward privacy are fundamentally different between Europe and the United States. Our GDPR legislation prohibits the sharing of personal data without consent, but under the U.S. Cloud Act, American tech companies are required to hand over data to U.S. law enforcement agencies, regardless of where that data is stored.
And that’s where the problem lies. A large portion of European data centers (estimates suggest more than 40%) are managed by American companies. This means that even personal data stored on servers located in Europe may be accessible to law enforcement agencies. So our advice is to always ask where the data is actually stored. Otherwise, as a municipality, you still run the risk of privacy violations.
What can municipalities do right now to protect data?
Municipalities can already do a great deal to regain control over data and reduce risks. It starts with raising awareness: it is important that policies and processes related to data use are properly established and regularly reviewed. In addition, it pays to anonymize data whenever possible and ensure that only authorized employees have access to sensitive information. Regularly purging data that is no longer needed and centralizing information as much as possible also helps maintain an overview and reduce the risk of errors or unauthorized access.
“Being wonderfully clear”
“Okay, first let’s have a…” Good advice?
We thought that would be a fitting way to wrap things up. The world keeps turning thanks to solutions from Microsoft, Google, and Amazon. We can’t do without them either. However, when it comes to secure information management, municipalities can make a healthier choice.
OneXillium offers solutions in the field of information processing. For example, we have our own OneXillium DOP Cloud environment, which was developed specifically for Dutch municipalities. We use this Digital Orchestration Platform (DOP) to route all incoming information from citizens. Information such as emails, WhatsApp messages, invoices, and attachments is forwarded via secure connections to the appropriate municipal systems, in the correct file format and with the correct metadata.
Naturally, we use a secure environment in a Dutch data center, which is managed by OneXillium. This means that municipal data never leaves the country!
Want to talk about it sometime?
Preferably with coffee or tea, but a local beer is also fine. Contact us to lay a solid foundation for information security and management.
Sources used:
*Telegraaf
**Computable