TU Delft shares names of protesters with police, Data Protection Authority asks for clarification

TU Delft passed the names of activists on the campus to the police. The Data Protection Authority wants to know from the university and the police how this was handled and is asking for clarification.

At the start of 2024 the action group End Fossil announced an occupation on the campus of the Delft University of Technology. They wanted to protest against the fossil fuel companies that come to recruit students at a career fair. The protesters informed the university of their plans for the protest.

University paper Delta discovered last week that TU Delft had shared the names of five activists with the police in advance. These reportedly included a member of staff from the faculty of mechanical engineering and four others. Delta suspects they were students.

According to a spokesperson for TU Delft, the university shared the data ‘on the basis of a request from the police’. But that’s not allowed, says the Data Protection Authority, the privacy watchdog that also oversees the Police Data Act. The DPA will ask the university and the police how they arranged this.

The DPA doesn’t want to comment on the case itself yet, but stresses that students, like everyone else, have the right to demonstrate. That is a fundamental right, just like privacy and careful handling of personal data.

Serious

There is an important distinction between a demand and a request from the police, explains a DPA spokesperson. “With serious indications or suspicions, the police may of course act and also seize documents. But then something serious must be going on. The public prosecutor must also have given their approval.”

However, it doesn’t appear that a demand was involved at TU Delft. The university tells Delta that an agreement was made with the police that would provide the possibility to exchange information.

But the DPA spokesperson emphasises: “The sharing of personal data can only take place if there’s a legal basis for it. An agreement alone is not enough.” Was there a legal basis for sharing data with the police in the case of this peaceful occupation? “If that’s the case, then the university must be able to explain that. And it must also be able to demonstrate that there were no ways that would’ve made a smaller infringement on fundamental rights possible.”

Risk assessment

According to TU Delft sharing the data was necessary for an adequate risk assessment. The DPA, however, states that ‘making such a heavy infringement on fundamental rights’ is only allowed ‘if a less intrusive method is not possible’. A university must therefore be able to show that other methods would not work.

“A police officer can also just go and see what is happening to assess the risk”, adds the spokesperson. “Personal data are not needed for that.”

University paper Delta suspects that TU Delft shares names of protesting students and staff with the police more often. To what extent this also happens at other institutions is unclear. College paper Bron asked university of applied sciences Fontys; a spokesperson said that the university of applied sciences does not pass names on to the police.

‘No names passed on by the EUR’

EM asked Erasmus University whether names were ever passed on to the police during the OccupyEUR protests or pro-Palestinian demonstrations. “At the EUR we don’t register the names of demonstrators at protests”, a spokesperson said in writing. “Those are therefore not shared with the police. That also applies to recent protests on the campus, such as the pro-Palestinian demonstrations.”

About the OccupyEUR period the spokesperson can ‘not give complete certainty’ because since then the university’s security organisation has been organised very differently and therefore detailed knowledge about those demonstrations is not readily available. A student who acted as a spokesperson for the demonstrators at both Occupy and the pro-Palestinian protests is also not aware of any situation in which names would have been passed on.