‘Privacy is a right, not a privilege'

The IND Privacy Office is part of the Legal Affairs Department of the IND. Employees of the Privacy Office make sure that the data of applicants and employees are protected and that everyone in the organisation acts in a privacy-conscious manner. In addition, the Privacy Office is responsible for compliance with the General Data Protection Regulation (GDPR) within the IND. In his role as a senior privacy lawyer, Mostapha ensures that the IND organises its work processes in such a way that privacy risks are limited. 

Make privacy a priority 

I have four children; the oldest is now eleven years old,' says Mostapha. 'She recently asked: can I use TikTok or Instagram, dad?’ ‘Don't even think of me seeing you have it’, - I replied. He laughs. 'Years ago, I also joined in the hype. Back then I didn't know anything about it. But I know better now. Your privacy, your personal information, your data: that is worth money. You have to be really careful with that.

That awareness also drives him in his work. At the IND, Mostapha works to protect the personal data, including that of people in vulnerable positions, every day. ‘Lots of our applicants have already had a long, difficult journey. The least we can do is to make sure that their data is safe and that they know exactly what happens to it.

From risk analysis to raising awareness

Every working day looks different for Mostapha. One day he assesses risk analyses and the next day he answers complex requests for access from employees or applicants. ‘For example, an applicant wants to know what data we have about him, why we process it, who we share it with and how long we keep it,’ he explains. 'I then look into this and make sure everything is correct: are the data still correct, have we not kept anything longer than necessary?’

In addition, Mostapha advises colleagues and departments within the IND on how we organise our work according to the GDPR. ‘Suppose a department starts a new project and wants to collaborate with an external party for this purpose,’ he says. ‘Then we look at the privacy risks together. Are we not processing too much or unnecessary data? Is privacy sufficiently guaranteed? I only give the advice. The department itself is responsible for the choices it makes. It is my job to make them aware of any risks and to ensure that everything in the area of privacy is legally correct.’

Preventing fines 

‘Maybe you remember that the Ministry of Foreign Affairs received a fine of 565,000 euros from the Dutch Data Protection Authority?' asks Mostapha. ‘They did not inform their clients sufficiently about what happened to their personal data. That was a wake-up call for me. I realised that at the IND we also had to look more closely at how we inform our applicants if we want to avoid such a fine.’

‘I discovered that asylum applicants often were unaware of what was happening with their personal information during the registration interview. That's why I proposed adding standard information to the process, explaining what data we collect, why it happens and what the applicant's rights are. Initially, there was some resistance because it would cost extra time and money to adjust the work process. Eventually we found the solution by referring to an online privacy statement and adding a short text in the format of the registration interview.’ 

Moral responsibility 

‘With this approach, the IND is now fully transparent about processing of personal data during an application interview, Mostapha continues. 'I am proud that I do not only protect the fundamental rights of the applicants, but also contribute to confidence in the government. I believe that everyone has the right to transparency and security when it comes to their personal information. Privacy is a right, not a privilege. No one should have to fight for it. As a lawyer, I do not only look at the law, but also at what someone needs in order to feel safe. I think this is a moral responsibility.’

Respect for others 

‘And that's why I think I'm in the right place at the IND', laughs Mostapha. 'I can really make a difference here, because we work directly with people who are seeking protection. This organisation makes a difference in people's lives. That affects me personally. Privacy-conscious behaviour is not only a legal obligation, but also a way to show respect for others. The IND takes that responsibility seriously and I am grateful that I can be part of it.’