Articles

Part two - GDPR and Public Law: Data protection in public procurement

Part two - GDPR and Public Law: Data protection in public procurement

Part two - GDPR and Public Law: Data protection in public procurement

05.06.2019 BE law

Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss some GDPR-related aspects of public procurement.

CVs and references

Public authorities may require contenders to demonstrate their technical and professional capacity and experience during the selection phase, by requesting references and CVs. References and CVs often contain personal data of the contenders’ employees and of contact persons of (previous) customers. Therefore the obligations of the GDPR need to be complied with.

Firstly, such personal data should be limited to what is strictly necessary for the tender in question (e.g. no information on hobbies, family situation, etc.).

Secondly, information on how these personal data will be processed must be provided to the data subjects. The contracting authority can provide this information in the tendering specifications. The contenders in turn need to provide the relevant information to their employees and to the contact persons of their (previous) customers.

Thirdly, the processing requires a lawful basis. The contracting authority can justify its processing through its task in the public interest or the exercise of official authority. For the contenders, it is recommended to collect consent from their employees or to include in the employment agreement the necessity of sharing CVs with customers and prospects, amongst which public authorities. Importantly, in employment relations consent is generally not considered as being “freely given” due to the imbalance in the relationship, and therefore cannot constitute a valid basis. Vis-à-vis contact persons of (previous) customers, consent may be collected upon signature of the agreement or upon signature of the certificate of good performance (“attest van goede uitvoering / attestation de bonne exécution”) via a specific tick box. Alternatively, consent may also be collected on an ad hoc basis, though this may pose a larger administrative burden. The contenders could justify the processing on their legitimate interests. As this lawful basis requires a balance of interests, the provision of information towards data subjects in order to manage their reasonable privacy expectations becomes even more important.

Data Processing Agreements

Not every contender will qualify as a data processor. The key question is whether the future service provider will be processing personal data on behalf of and following the instructions of the contracting authority. Simply transferring or receiving personal data is not sufficient. Typical examples of data processors include issuers of service vouchers and hosting providers, although this depends on the specific circumstances.

If a data processing agreement is required, when and how does this need to be managed in a tendering process? The qualifications of data processor and data controller should be allocated as soon as possible in order to avoid discussions at a later stage. The determination of the exact content and modalities of the data processing agreement depends on the type of the tendering procedure. In a procedure with negotiations, the input of suppliers may be taken into account, whereas in a classic – more strict – attribution procedure without negotiations, the provisions will be stipulated unilaterally. In any event the content should be determined during the competition and at the latest in the request for proposal document, as changes after the competition are restricted. Strict provisions that the contenders can possibly not comply with (e.g. Supplier may not transfer personal data outside the EU) should be avoided, as this may possibly render the tendering process invalid.

Conclusion

Recital 78 GDPR emphasizes that the principles of data protection by design and by default should be taken into consideration in the context of public tenders. Attention must be paid to the capacity in which the public entity is acting (e.g. “public authority”, “data controller”, etc.) and to the data protection obligations throughout the whole tendering process. We strongly believe that it is of utmost importance for public authorities to properly set-up and organize the function of a Data Protection Officer, who should then be involved in all issues relating to data protection.

 

Carolien Michielsen & Niels Tack

Team

Related news

29.07.2020 NL law
Over temperaturen ten tijde van corona

Articles - Met haar standpunt ten aanzien van het meten van temperaturen van werknemers, geeft de Autoriteit Persoonsgegevens (AP) verduidelijking over de reikwijdte van haar toezicht. Deze nuancering houdt in dat, als er geen sprake is van verwerking van persoonsgegevens, de AVG niet geldt en de AP dus niet handhavend kan optreden.

Read more

27.07.2020 NL law
De Whatsapp-conversatie tussen Grapperhaus en Halsema: ook openbaar via de Wob?

Short Reads - Deze heb je vastgelegd voor de Wob Zo luidde een van de berichten van de Whatsapp-correspondentie tussen burgemeester Halsema van Amsterdam en minister Grapperhaus van Justitie en Veiligheid over de demonstratie op de Dam, die plaatsvond op 1 juni 2020. Een angst van menig bestuurder werd waarheid: de gehele conversatie stond dezelfde dag nog afgedrukt op alle nieuwswebsites. Deze correspondentie werd openbaar gemaakt op grond van artikel 68 van de Grondwet, dat kort gezegd de informatieplicht van bewindslieden aan het parlement regelt.

Read more

21.07.2020 NL law
Vestigingsbeleid datacenters gemeente Amsterdam 2020 – 2030 vrijgegeven voor inspraak

Short Reads - Van 1 juli tot 31 augustus 2020 legt de gemeente Amsterdam het Vestigingsbeleid Datacenters gemeente Amsterdam 2020 - 2030 ter inzage voor inspraak. Na de inspraakperiode wordt het vestigingsbeleid ter vaststelling voorgelegd aan de gemeenteraad. In dit blog bespreken wij de hoofdlijnen van het vestigingsbeleid: nieuwe datacenters zijn onder strenge voorwaarden en op beperkte schaal welkom in gemeente Amsterdam. Met dit beleid wordt vervolg gegeven aan het voorbereidingsbesluit datacenters, dat ook in dit bericht wordt besproken.

Read more

27.07.2020 NL law
Maatwerk bij ontvankelijkheidsbeslissingen

Short Reads - Kent u een termijn die de ontvankelijkheid van een bezwaar of beroep bepaalt en niet in de wet is te vinden? Je zou hopen dat zo’n termijn niet bestaat. Ontvankelijkheid bepaalt immers de toegang tot de rechter en die toegang moet niet belemmerd worden door onbekende of slecht kenbare fatale termijnen. Toch kent ons recht zo’n termijn en die termijn is bovendien zeer kort. Ik doel op de twee weken die een belanghebbende wordt gegund om alsnog bezwaar te maken, nadat hij op de hoogte is geraakt van het bestaan van een besluit waarvan de bezwaartermijn al is verstreken.

Read more