Two suspects in the criminal case surrounding the ‘GGD leak’ say that they were not aware that poking around in personal files was not allowed. Their lawyers feel that they have had too little guidance and that it has been made too easy for them to leak confidential data.
Today a first hearing was handed over in the court in Utrecht the data theft at the GGD in January. According to the agency, about a thousand people have personal data stolen and possibly sold.
This includes names, addresses, telephone numbers and social security numbers of people who have made an appointment with the GGD for a corona test. The police arrested seven people, two of whom had to appear for the first time. The twenties did not know each other.
200 social media ads
“I did stupid and stupid things, but I was not aware that it was very serious,” said a 21-year-old call center operator from Heiloo. The news that several GGD employees had viewed the data of the Rotterdam mayor Aboutaleb aroused his curiosity. “Only then did I realize that you could visit people just like that.”
His lawyer says that he visited famous Dutch people a few times and sold an address once for 50 euros. In contrast, according to the Public Prosecution Service, he advertised more than 200 times on social media that he could obtain personal data.
Click through and check off
The other suspect, a 23-year-old man from Alblasserdam, sent photos of personal files to someone else. “I thought I could just click on files. Nothing was ever said about it. I sent those photos to someone who also works at the GGD. I thought I could if I kept it within the GGD.”
Their lawyers want further investigation into the work instructions of the call center employees. They feel that their clients have been put to work without proper training, leaving them unaware of the risks of confidential data leakage.
They worked from home and had to take two online training courses. The suspects said that it was mainly a matter of ‘clicking through and ticking off’ in order to get to work as quickly as possible.
The defense wants to hear witnesses, including André Rouvoet, the chairman of the GGD sector association. The lawyers also want to interview team leaders of Teleperformance, the call center company hired by the GGD. They want to know to what extent employees have been made aware of the importance of privacy protection.
The Public Prosecution Service finds this unnecessary and says that the suspects should have known in any case that they were not allowed to pass on personal data.