The Dutch government is facing a decision to potentially halt its use of Facebook for communication due to privacy concerns. A recent privacy study conducted by the government highlighted several high risks associated with using the platform. The government is calling on Meta to address these issues, but the company has so far refused to comply.
In a letter to the House of Representatives, Outgoing State Secretary Alexandra van Huffelen of Digitalization revealed the findings of a data protection impact assessment conducted by the Dutch Data Protection Authority on the use of Facebook Pages by the government. The Authority concluded that government organizations should refrain from using Facebook if there is uncertainty surrounding the handling of visitors' personal data on their pages. The assessment identified seven high privacy risks, including insufficient transparency regarding data collection, control loss due to unlawful processing, and misleading tracking cookies.
Meta, the parent company of Facebook, has been reluctant to make adjustments to address these risks. Despite discussions between the government and Meta in 2023, the company has not shown willingness to modify Facebook Pages and data processing practices to align with government requirements. This refusal to take joint responsibility for data processing has put the Dutch government in a challenging position.
Van Huffelen has consulted with the Dutch Data Protection Authority regarding the next steps. The Authority has advised that government organizations should cease using platforms like Facebook for communication if there are uncertainties about data handling. Clear transparency and data protection are essential, according to AP chairman Aleid Wolfsen.
In response to these concerns, Van Huffelen plans to engage with Meta again and seek clarity on how the company will address the privacy issues raised. Failure to provide satisfactory solutions may result in the government discontinuing its activities on Facebook Pages, as recommended by the Dutch Data Protection Authority.