Privacy laws also for churches
Please note: this page was last updated on 16 April 2019.
Denominations are also subject to the General Data Protection Regulation (AVG). The Christian Reformed Churches in the Netherlands want to handle personal data and the privacy of members and visitors with awareness and care. Therefore, it is important that anyone dealing with personal data within the church ensures that he or she complies with the applicable regulations.
Processing of personal data
Processing personal data - in legal terms - occurs when you commit an act that relates to an (identifiable) person or persons.
This includes names and addresses, but also, for example, photos on the website, where people are recognisably in the picture. The AVG is not just about providing data to third parties, it is also about your own actions. For example:
- Sending an e-mail to church members;
- posting a picture of the preacher on the website;
- sending a bill for collection vouchers;
- exporting data from membership records;
- taking notes during an interview, intended to be included in a file;
- including birthdays in the church bulletin;
- Publication of the church bulletin on the website;
- broadcast of church services (via radio or with cameras);
- possible surveillance cameras on the church premises;
- mentioning the sick in the congregation in a Sunday letter;
- reading and saving cover letters;
- possession of personnel data;
- and anything else you do with data traceable to an individual.
Roadmap church and privacy law
What should congregations (and other church institutions) do under the General Data Protection Regulation (GDPR)?
Step 1: make policy and talk about it
Privacy matters. Especially also in the church where people are sometimes at their most vulnerable. A good privacy policy ensures that everyone's personal data is safeguarded, that data is secured and used only when necessary in the church. The AVG leaves full scope for churches and organisations to fulfil its mission and use personal data, as long as safeguards are in place.
So speak about it in your congregation (or classis, or deputation, etc.). Describe your local situation as clearly and concretely as possible.
Step 2: inform people, model privacy statement
Everyone dealing with the church should know what happens to their data. If people use forms online or on paper where they leave their data, they should be informed about how their privacy is handled.
The Services Office has provided a model privacy notice. You can use that, adapted to your local situation. You will find the model below under frequently asked questions.
Step 3: make security standard and know what happens
Security should be standard. You need to know who has what data and why this person is using the data. You also need to make sure that the information is not accessible to just anyone: make sure you have a lockable cupboard, make sure there is a locked section on the website and do not use login codes that several people have. Free services such as google drive or dropbox can be used, as long as it is clear who has access to the data and the data does not end up on the streets.
Security also means deleting old files. For example, if you extract data from the member registration system and download it onto your computer, you have to delete it after use. But it also involves deleting former members who have moved, left or died. More information on when to delete data can be found at the Personal Data Authority.
Step 4: share data only when necessary
The Church Order (Annex 43 (Articles 79 and 80)) is clear: pastors and other church workers are bound to secrecy. Everyone who works with data of the church is bound to secrecy. Data you share within the church should therefore not be passed on (just like that). Only if it falls within the task of the church and it is necessary may you share the data. The rules on when sharing data falls within the church's remit are in your privacy statement.
If you want to use the data for anything other than what is within the church's remit and is reflected in your privacy statement, you must seek explicit permission from the person whose data you want to use.
Step 5: report when things go wrong, report data breaches
Sometimes things go wrong. Perhaps you accidentally sent part of the membership list to the wrong e-mail address. Or the Sunday letter with the names of sick church members ended up on the website after all. In such a case, you should check whether you need to make a report. Read more about reporting data breaches at: https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/beveiliging/acties-bij-datalekken?qa=datalek
or contact the Services agency if such a situation arises.
Frequently asked questions about the AVG
Anything that can be traced - directly or indirectly - to one or more persons, including telephone numbers, postal codes, or certain personal characteristics.
Everyone in the church has a shared responsibility for privacy. Anyone working with personal data from the church should be aware of this.
You must appoint a data protection officer (FG) if it is a core business for the processor to process personal data on a regular, systematic and large scale. Whether this guideline applies to your church depends on your assessment of these three conditions. For small churches, it probably does not apply.
In any case, it is good to document the reasoning why you decide not to appoint a data protection officer (yet), should the Personal Data Authority knock on the door.
Churches are allowed to register data around religious beliefs of their members. This is explicitly provided for in the legislation.
The church website is a great opportunity to inform everyone about the congregation. However, all information on the website is public. Therefore, pay close attention to privacy and make sure that names of people who do not hold office in the church are not on the website. Also make sure that special personal details, such as illness and pastoral information, are not on a public part of the website. As far as possible, use e-mail addresses tied to a function (e.g. scriba@gemeentenaam.nl) rather than personal e-mail addresses. Also pay attention to photos on the website: as soon as individuals are recognisably in the picture, they are protected by privacy laws. Ask (written) permission from people who are recognisably in the public part of the website. Photos where people are not recognisably in the picture (e.g. on the back) are allowed.
If you post photos on the public part of the website and people can be recognised on them, you must ask permission beforehand. You must ask that permission explicitly and someone must feel free to say no. Note: asking if you can take photos is different from asking if you can put them on the website. So you will have to be selective (especially when it comes to photos that are not shielded) in which ones you post. Ask written permission from the people recognisably in the photo. This is especially necessary if children are involved. If you are asked to remove a photo, you must cooperate. You may publish photos without permission where people are not recognisable, for example if only people's backs are visible or if people 'disappear' into a group.
In addition to public pieces about church services and other activities of the church, the church bulletin often contains personal information about church members. This could be a birthday list with addresses (for sending a birthday card), or a list of sick people in the congregation. Make sure such information is only available to members of the congregation. So do not put your church magazine on a website if it contains such information, but select the copy that can be put on the website. Also note that, for example, local journalists may be subscribed to the church bulletin: consider whether this group should actually have access to all the information in the church bulletin.
The congregation is a community that meets (among other things) on Sundays in a church service. Often at a church service, a Sunday letter is also handed out with information about the service, information about sick or birthday people in the congregation and information about upcoming activities with (e-mail) addresses of the organisers. Sharing this information can be an important part of your church congregation: paying attention to each other is important in the church! If you want to include these details in a Sunday letter, make sure that care is taken when disclosing the information. If you ask people's permission to put their details down in the Sunday letter, make sure you do so in writing (e.g. via email) and that people feel free to say 'no'.
As a local municipality, you are responsible for membership records, including keeping the data up to date, and granting access to the right people. From the membership records, you can export various data (e.g. to Excel). Such an export is allowed only if it complies with the law. So be very cautious in this.
Around the posting of church services online, there are not only questions of privacy but also, for example, of copyright. In the brochure Copyright and neighbouring rights in the church of the PKN you will find information on this topic.
If a church service is broadcast, attention will have to be paid to the privacy of those involved.
Download the pdf with workable solutions for sermons and online broadcasting and streaming of church services.
In principle, any publication requires the member's consent. When describing positions with contact details (e.g. pastor at Barneveld with contact details), dissemination can be seen as part of the work.
It is recommended that the yearbook be published only within one's own circle, preferably digitally. After all, in that case immediate adjustments are possible if people do not wish to give consent or withdraw consent. It should also be taken into consideration that commerce has developed around various target groups and that we should be extra careful with personal data from which religious beliefs can be derived.
To sum up: a church yearbook with personal information in bookstores is not allowed and undesirable. Another factor here is that permission must be able to be withdrawn, and that once the book is on sale, the direction is also out of the church's hands.
Anyone may ask an organisation whether - and if so, which - data it holds about them. Only a person's own data may be requested, not data belonging to someone else. You can find out what to do and how such a request for access works at the website of the Personal Data Authority
Sure! You can download a sample privacy statement here. You can add to this Word document yourself.
Archive management and privacy guidelines are at church archives deputies' website.
You can use consent as a basis for using and processing personal data. However, under the AVG, consent is subject to stricter rules than before: the consent must be freely and explicitly given and you must be able to prove that the consent was given (and that you used the data for the previously - specifically - agreed purpose for which the consent was given). In addition, a person may always withdraw their consent. And once you have chosen to use 'consent' as the basis, you cannot fall back on another basis (such as 'legitimate interest'). So be cautious in asking for consent and only do so if there is no other way (e.g. when publishing photos on the church's public website).