On May 1, 2018, the legal framework for the Dutch intelligence community changed with the entry into force of the new Intelligence and Security Services Act. Previously, both chambers of parliament discussed and accepted the law on February 14 and '11 July 2018. A group of students based in Amsterdam, however, was concerned that the law, which included the power to intercept cable communications in a "random" manner and for this reason a public referendum was held, which was held on 21 March 2018.
In what was an intense and prolonged public debate in the months preceding the referendum, critics of the new law advanced their point of view. Among these was the digital civil rights group Bits of Freedom, which claimed that the power to intercept mass cable communications would destroy "the fundamental value of our free society. The law also allows the general intelligence and security service (known by its Dutch acronym AIVD) and the military intelligence and security service (abbreviated as MIVD) to exchange large data sets not evaluated with their foreign counterparts without the prior approval of the new independent auditing commission. Services see this sharing of data as essential to their counter-terrorism mission. But from the point of view of the opponents, the fact that unexamined datasets are exchanged is unacceptable.
In addition, Bits of Freedom has opposed real-time access to partner databases (such as tax authorities, other government agencies, but also banks) that has been granted to intelligence and security services. However, the new law contains too many "open rules", in line with the government's goal to formulate a new act that would have been more independent of technological developments: the 2002 Act was not, and therefore the update was seen as necessary, but it also remains unspecified in which specific circumstances and based on which criteria and rules the new powers may or may not be applied.
The 21 March referendum gave a narrow victory to the opponents of the law. The turnout at the polls was 51,54%. Among those who voted, the 49,9% was against the new law and the 46,54% voted in favor. A surprisingly high number of voters voted blank: 4,04%.
The Dutch cabinet under Prime Minister Mark Rutte said that he would proceed with the introduction of the new law. However, in order to meet citizens' concerns, six "additional guarantees" were introduced.
First: mass interception must be applied "as targeted as possible".
Secondly, the number of years in which global data can be stored without being searched or analyzed is reduced from three years to one year, although the minister can sign up for data storage for an additional year.
Thirdly, the intelligence and security services must submit a memorandum to the Minister of the Interior (for the AIVD) or to the Defense (for the MIVD), addressing the human rights aspects, the democratic context, the professional character, supervision and control of the service, together with which data sets should be exchanged.
The fourth guarantee is that the interception of cable communications will be applied almost exclusively not in domestic contexts. Dutch citizens should not worry, therefore, that their communication can be massively monitored and archived by their secret services.
Fifth, medical data can only be used if it is necessary in a targeted investigation, otherwise it must be destroyed.
And finally, journalists' intelligence can not be shared with a foreign service if national security is not at stake.
Many of these guarantees had already been planned and proposed before the result of the referendum. Furthermore, they will not yet be implemented in the law, but only in political documents.
Furthermore, concerns about new powers that allow hacking through third parties and storing DNA profiles seem to have been completely ignored, prompting civil rights groups to express their disappointment with the political response to public debate.
Opponents of the new act have now put their hopes in a cause, which was launched long before the referendum by a group of activists and lawyers. The cause has become a joint project of twelve organizations, including the Public Interest Litigation Project, the civil rights organization Privacy First, the Dutch Association of Journalists, the Dutch Association of Criminal Lawyers and the Platform for the Protection of civil rights. First they will bring the law before a Dutch court and have already announced that they will go to the European Court of Human Rights if necessary.
Meanwhile, the law has become operational, which means that the Audit Committee on Information and Security Services (CTIVD), an independent expert oversight body, can now begin to monitor the effective implementation of the new powers. In a letter to the parliament, the audit committee stated that it will focus on those issues that have raised most of the public discussions, in particular: non-targeted interception and whether irrelevant data will be duly deleted; the implementation of automated methods of data analysis; and cooperation with foreign partners, including the exchange of unqualified data sets. In addition to this existing ex post control (hereinafter) there is now also a new independent commission (known by its Dutch acronym TIB), which provides a binding ex ante (previous) review of the approval by the minister of a series of special investigative powers. Finally, an independent commission will start in two years with a complete revision of the new law on Dutch security and intelligence services.