This article was published in 2021. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
The Digital Government Act (Wet digitale overheid, Wdo for short) is expected to enter into force in phases from 1 June 2021. The Digital Government Act lays the foundation for the digitalisation of government. In essence, the Act ensures that citizens, clients, patients and their representatives gain secure online access to the electronic services of (semi-)public government institutions.
This article covers the following topics:
- The purport of the Wdo from July 2021;
- The scope of the Wdo (which organisations does the Digital Government Act apply to?);
- The obligations under the Wdo;
- The action points for organisations to comply with the Wdo.
THE PURPORT OF THE DIGITAL GOVERNMENT ACT FROM JULY 2021
As mentioned above, the Wdo sets requirements for the way in which patients can log in online to exercise their client rights, such as access to their client file and medication overview. The Wdo:
- sets out the tasks and responsibilities for secure access to the digital government;
- imposes obligations on (semi-)public organisations to connect securely and reliably, and to classify their services according to a level of assurance;
- lays down rules on supervision of compliance with the obligations under the Wdo;
- regulates the obligations regarding information security and the processing of special categories of personal data;
- provides guidance on the use of open standards.
THE SCOPE OF THE DIGITAL GOVERNMENT ACT
The Wdo ensures that citizens, clients and patients gain secure access to the electronic services of government bodies and (semi-)public institutions, including educational institutions, healthcare institutions and pension funds.
The Digital Government Act specifies which organisations and companies fall within its scope and will be subject to the new rules for access to their electronic services.
At present, these are:
- administrative authorities within the meaning of the General Administrative Law Act (Algemene wet bestuursrecht, Awb), such as municipalities and implementing agencies (UWV, SVB, the Tax and Customs Administration, DUO, RDW, etc.);
- organisations named in the Wdo, such as educational institutions, housing associations, healthcare institutions and pension funds;
- the judiciary.
The obligations under the Wdo are therefore also relevant to home care institutions, dentists and organisations providing care for people with disabilities. In addition, this Act is highly relevant to builders and administrators of applications, such as websites, portals and apps that form part of care processes.
THE OBLIGATIONS UNDER THE WDO
The organisations mentioned above must classify their digital services according to the applicable level of assurance. The Act requires these organisations to use only recognised electronic means of identification (eID) with a level of assurance of “high”. Providing access on the basis of a password and login, for example to the client portal to meet the right of access to medical data and/or medication overview, holding consultations via a video link, or offering the option to digitally read and/or record the development of, for example, heart rate, weight or blood sugar levels, will then no longer be permitted.
Instead of a password and login, you will soon use a login method that is recognised by the government and has the highest possible and widely available level of assurance. The DigiD app with the required ID check meets these requirements. This, together with the authorisation facility and the European requirements set by the eIDAS Regulation, means that adjustments must be made to the ICT systems used by healthcare providers and that patients must be informed about these adjustments.
This means that your organisation, insofar as it falls within the scope of the Digital Government Act, must take adequate measures to safeguard information security and protect the privacy of data subjects.
Annual audit obligation
The Digital Government Act also regulates supervision of security (of access to the online environment and of the personal data in that environment). Organisations are required to demonstrate security through an annual audit by an independent party.
Privacy protection a top priority
The bill and the accompanying Explanatory Memorandum show that privacy protection is a top priority for the organisations. The available information shows that rules will be drawn up on the provision of personal data and the retention periods for them. The legislator also indicates that additional requirements will be imposed on the processing, security and reliability of personal data. These will be based on GDPR principles such as data minimisation, transparency and safeguarding the quality of personal data.
LET US ADVISE YOU ON THE WDO
Would you like to take the right measures in good time to comply with the obligations under the Wdo? Then you have come to the right place. We can support your organisation in a practical and pragmatic way with your privacy management by means of a quick scan. This will show you how information security and privacy protection are arranged within your organisation. Based on the results, we can provide your organisation with the right measures to comply with the Wdo and the GDPR.
Please feel free to contact us for a no-obligation conversation.