KTDI Pilot DPIA NLD

KTDi $9 (NLD) \ — h \ e # s=e - 4 x5*üë «--=A-s KD Gan, - z * * - - o N gssem ua _s $ * KTDI Pilot - Data Protection Impact Assessment “ g I i / ƒ të 1 a ¥ / * KTDi DPIA Introduction • This DPIA is based on the template as provided by the Dutch government. KDTI • "A Data Protection Impact Assessment (DPIA) is required under the GDPR any time you begin a new project that is likely to involve ‘ a high risk ’ to other people ’ s personal information." • Sou ree: gdpr.eu KTDi DPIA - Introduction (cont ’ d) • TerritoriaI scope ( GDPR, art. 3 ): KDTI • The processing of personal data within the Netherlands is in scope of this DPIA. • Disregarding whether the Data Subject is a Canadian or Dutch Citizen. • The processing of personal data within Canada is not in scope of this DPIA. • Disregarding the fact that personal data of Dutch citizens may be processed in Canada. KTDi DPIA Introduction (cont ’ d) NOID, CBSA, Air Canada).

VisionBox (sub-processor on behalf of Amsterdam Airport Schiphol). KDTI Accenture (on behalf of KLM, Idemia (on behalf of NOID). Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. • Within the context of the KTDI Pilot and as far as within the territorial scope of the GDPR : • Air Canada. • KLM. • National Office for Identity Data (NOID). • National Coördinator for Security and Counterterrorism (NCSC). • Royal Marechaussee (KMar). Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. • Within the context of the KTDI Pilot: • Amsterdam Airport Schiphol (AAS; on behalf of KLM and Royal Marechaussee). Definitions ( GDPR, art, 4 ): • Data Subject: an identified or identifiable natural person. • Within the context of the KTDI Pilot: a Canadian or Dutch Traveller who makes use of one or more KTDI Services within the territorial scope of the GDPR .

KTDi DPIA Introduction (cont ’ d) (More definitions may be added during the DPIA process.) KDTI Definitions: in this DPIA the following terms will be used: • KTDI Service: Service Provider: a Canadian or Dutch private or public organization which offers a KTDI Service to Travellers. • Air Canada; • KLM; • KMar; • NCSC • NOID; and • Schiphol Airport. • Also: Controller. Traveller: a Holder of a Canadian or Dutch e-passport who is eligible to make use of KTDI Services. • Also: Data Subject. KTDI DPIA Scope 6 KTDi Oo AT nTn 177 o H O p Create Departure Create Check-in KTD I profi l e D igital ID Completely in scope of this DPIA. Partially in scope of this DPIA. Not in scope of this DPIA. In scope of pilot process Out of of pi See: 'KTDI NLD Operational Concept Description ’ for a detailed description of each process step. Border control Invite traveller Boarding Access Prepare the trip Out of Scope of DPIA KTDI.

In scope of DPIA Seamless Flow. Book flight Drop-off bag riority access . security KLM Lounge DPIA Scope: KTDI Pilot Process - Departure NLD KTDI KDTI O In scope of DPIA KTDI. 6 6 KTDi DPIA Scope - KTDI Pilot Process - Arrival NLD 0 Prepare the trip l Oo r the trip In scope of pilot process Out of scope of pilot process KDTI In scope of DPIA KTDI. Border control Invite passenger Arrival flig ht In of scope of DPIA KTDI: data processing in the Netherlands (territorial scope GDPR). RTP NL Out of scope of DPIA KTDI. In scope of DPIA Seamless Flow. In scope of DPIA KTDI: applying using the KTDI App. Out of scope of DPIA KTDI but in scope of DPIA RTP-NL: processing the application. RTP_NL Registration KTDI KDTI 9 A. Characteristics of Data Processing KTDi Characteristics of Data Processing Describe the proposed data processing, the goals of the data processing and the importance of the data processing to the stake holders: KDTI Data flows. • See document 'KTDI pilot - NLD Data Flows'. • Global overview of the relevant processes. • See slides xx and xx. • Also see document 'KTDI NLD Operational Concept Description' for a detailed description of each process step. • See slides xx to xx for a high-level description of the evolution of relevant processes from manual processing up to KTDI enabled processes. • See slides xx to xx for an overview of the technological support of the processes. • Personal data which are processed ) see slides xx to xx. • Also see document'KTDI Pilot - data processing (appendix to DPIA)'.

11 Characteristics of Data Processing Characteristics of Data Processing KTDi (cont ’ d) • The KTDI concept is a new way of enabling the execution of existing business processes of Service Providers. • Some KTDI specific processes will be introduced. Invite Traveller specific process. Create KTDI Profile specific process. Create Digital ID specific process. Check-in • After check-in: Boarding Pass will be sent to Travellers' Wallet. Existing process. Prepare the Trip specific process. Priority Access Security Existing process. Border Control Existing process. Boarding Access Existing process. KDTI New/existing process If existing process is adapted to KTDI: what is different? Process • Traveller requests to make use of this KTDI-adapted process in advance • Biometric recognition of Traveller. • Traveller requests to make use of this KTDI-adapted process in advance • Biometric recognition of Traveller. • Traveller requests to make use of this KTDI-adapted process in advance • Biometric recognition of Traveller.

KTDi • First time Dutch Traveller; flight NLD^CAN. 0 -92-ED- ë - 7 D i : o o Check-in Drop-offPriority access Border bag security control • Second time Dutch Traveller; flight NLD-CAN. 0 Oo 7 Ö 8 : o o Drop-offPriority access Border Check-in bag security control | In scope Out of scope KDTI Invite traveller Invite traveller Create Digital ID Prepare the trip Prepare the trip Book flight Book flight Create KTDI profile KLM Lounge KLM Lounge Boarding Departure Access Boarding Departure Access Characteristics of Data Processing - cont ’ d Global overview of the relevant processes. KTDi • First time CAN Traveller; flight CAN-)NLD. Oo o • Second time or more CAN Traveller; flight CAN-)NLD. • Dutch Traveller; flight CAN-)NLD. Oo o | In scope Out of scope KDTI Border control Border control Prepare the trip Prepare the trip RTP NL Arrival flight Arrival flight RTP_NL Registration Invite passenger Invite passenger Characteristics of Data Processing - cont ’ d Global overview of the relevant processes.

KTDi Characteristics of Data Processing Global overview of the (technological) development of KTDI related processes - border control KDTI KTDI is a next step in which a traveller shares rheir personal data with the KMar before he arrivés at a border Crossing point. This can be done off-airport at a time and location that suits the traveller. KTDI enables the KMar to process the personal data in advance, which pertain to the concept of information-based acting (goede vertaling van informatiegebaseerd optreden?). In 2014, Self-Service Passport Control is introduced at Schiphol Airport. The traveller presents their e-passport to a scanner in an e-gate, which scans the holder page (including the optical MRZ) as well as the digital MRZ (RFID chip, Data Group 1). The digitalized data of the optical/digital MRZ is used to check enforcement databases. A live facial image of the traveller is taken and compared to the photo stored in the RFID chip (Data Group 2) in order to determine whether the traveller in the e-gate is the rightful holder of the e-passport. • These checks are fully automated. • In case of hits/errors or other unclear situations, a border guard will intervene/assist the traveller.

Manual checks: since a long time the Royal Marechaussee (KMar) manually checks travellers and their travel documents upon arrival and departure at Schiphol airport. This includes a visual inspection of the travel document as well as a check whether the traveller who presents the travel document is the rightful holder of it (by comparing the face of the traveller with the photo in the Visual Inspection Zone of the passport.) • From 2012 to 2015, authenticity of passports wasd a manual process; checks of the enforcement databases were semi-automatic (manual input of relevant data; automated search for hits). • Since 2015, authenticity checks of the passports and the checks of the enforcement databases are fully automated. KTDI A.2 Data KDTI 16 Characteristics of Data Processing Characteristics of Data Processing KTDi (cont ’ d) Personal data which a ersonal data which are processed - enrollment.

Data element* Special Category of Personal data?** Source *** Given Names Travel No NOID NOID er Surnamer (including prefix) Travel No NOID NOID er Date of Birth Travel No NOID NOID er Identification Feature (portrait of the holder) Sensitive data - biometric data Travel NOID NOID er Travel Sex No NOID NOID er Passport Number Sensitive data Travel NOID NOID er Document Code Travel No NOID NOID er Issuing State or Organization Sensitive data Travel NOID NOID er Sensitive data Travel NOID NOID er KDTI NOID NOID NOID NOID NOID NOID NOID NOID NOID NOID NOID NOID No No Travel Travel Travel Travel Travel Travel er er er er er er Date of Issue Date of Expiry Place of Birth Personal Number Sensitive data National Identification Number Sensitive data - biometric data Sensitive data Live Facial Image Nationality Data Subject Flagged in national stolen/lost travel document database Holderpage, RFIDChip DG1 Holderpage, RFIDChip DG1 Holderpage, RFIDChip DG1 Holderpage Holderpage, RFIDChip DG1 Holderpage, RFIDChip DG2 Holderpage, RFIDChip DG1 Traveller Holderpage, RFIDChip DG1 Holderpage, RFIDChip DG1 Holderpage, RFIDChip DG1 Holderpage Holderpage, RFIDChip DG1 Holderpage, RFIDChip DG1 Verificatieregiste r Processor** * Controller** * Recipiënt** * Characteristics of Data Processing KTDi (cont ’ d) Personal data which a ersonal data which are processed - check-in. ** Special Category of Personal Data?

Source *** KDTI Traveller Traveller Traveller Traveller Airline Airline Airline Airline Airline Airline Airline Airline Airline Airline Airline Airline No No No Sensitive data Airport of Departure Flight Number Date of Departure Passenger Sequence Number Data Subject Processor*** Controller*** Data element* Recipiënt*** KTDi .* ** • * * Data element' Special Category of Personal Data? Data necesary for background Source SIS2 SLTD Travel Schiphol Given Names No MoD Yes Yes Yes No er n.a. Surname (including prefix) Travel Schiphol No MoD Yes Yes Yes No er n.a. Date of Birth Travel Schiphol No MoD Yes Yes Yes No er n.a. Identification Feature (portrait of the holder) Sensitive data - biometric data Travel Schiphol MoD Yes Nee Nee No er n.a. Travel Schiphol Sex No MoD Yes Yes Yes No er n.a. Live Facial Image Sensitive data - biometric data Travel Schiphol MoD Yes Nee Nee No er n.a. Nationality Sensitive data Travel Schiphol No?

MoD Yes Yes Yes er n.a. Passport Number Sensitive data Travel Schiphol Yes? No? MoD Yes Yes er n.a. Document Code Travel Schiphol Yes? No? Yes? No MoD Yes er n.a. Date of Expiry Travel Schiphol Yes? No? ? No MoD Yes er n.a. Sensitive data Travel Schiphol No? Yes? Issuing State or Organization MoD Yes Yes er n.a. Travel er Reiziger HitNoHitCode Schiphol Reiziger MoD Yes No No No n.a. Match on Data Element Schiphol Reiziger MoD Yes No No No n.a. Required Action Schiphol Reiziger MoD Yes No No No n.a. Gevarenklasse Schiphol Reiziger MoD Yes No No No n.a. Schiphol Description Reiziger MoD Yes No No No n.a. KDTI n.a. n.a. MoD MoD Schiphol Schiphol No No No No No No Yes Yes Video Footage (CCTV) Flagged in Law Enforcement Database check E&S Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG2 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 Holderpage, RFID Chip DG1 CCTV SISII, E&S, SLTD SISII, E&S, SLTD SISII, E&S, SLTD SISII, E&S, SLTD SISII, E&S, SLTD SISII, E&S, SLTD Data necessaryfor executing Border Control Process Sensitive data - biometric data Personal data relatingto criminal convictions and offences (only in case of ’ hit ’ ) Personal data relatingto criminal convictions and offences (only in case of ’ hit ’ ) Personal data relatingto criminal convictions and offences (only in case of ’ hit ’ ) Personal data relatingto criminal convictions and offences (only in case of ’ hit ’ ) Personal data relatingto criminal convictions and offences (only in case of ’ hit ’ ) Personal data relatingto criminal convictions and offences (only in case of ’ hit ’ ) Controller' * Characteristics of Data Processing (cont ’ d) Personal data which are processed - border control.

Data Subject*** Recipiënt** * Processor** * Characteristics of Data Processing KTDi (cont ’ d) Personal data which are processed - boarding. Data element* Special Category of Personal Data? ** Controller*** Processor*** Sou ree TBD KDTI Data Subject*** Recipiënt*** Characteristics of Data Processing KTDi Send: Notifications ■ Mobile App Application Da Mobile Keychain - Secured PIC/P5Y5 PAC KTDI Mobile App ProvC m Vaalt KTDI Data Keychain /Status Off-Chain Data Wallet Existing F Updated Data Application Data Off-Chain Data Off-Chain Data [Cache] Send: Pairwise Channels, Attestations ■ - Auditing and Legging Data - Revocation tal Is files Send: Pairwise Channels, Proofs T - Auditing and Legging Data Send: Notifications ± t AW55N5 Send: Push Notifications Apple Cloud Google Cloud KDTI Send: Device ID Device Token - Decryption Key | App. Data] - Decryption Key (Wallet) Send: Chann Attestations (NOID), Revocati Proofed Data - Pairwise Channels - Issued Attestations - Off-Chain Storage Credential -•NWIdentity Credentials - Decryption Key (Wallet) - Logging Credentials - Public DID DDCs - Credential 5chermas - Credential Definitions - Revocation Lists - Attestations -Traveller Data -Trips - Channels Read / Write: ■Public DID ■ Public DID DOC ■ Credential Schema - Credential Definition ■ Revocation Registries Vault -NW Identity Credentials - Off-Chain Storage Credentials - Directory Manager Credentialls - Logging Credentials Wallet - Pairwise Channels ■ Attestations Revocation References (revocable Attestations) - Pairwise Channels -Tamp; storage of Attestation Data - Temp, storage of Trip Data - Temp, storage of Messages - - Attestation Revocation i - issued Attestations (NOID) -Temp, storage of Notification data (no PU) Legend [StorageTypes) Off-Chain Data permanent j Vault - Secured Backend Se m Auditing and Logging Data (cont ’ d) KTDI Pilot - 'Data Architecture'.

Send: Attestation Data Trip Data Trip Service Status Updates, Trip Service Messages Private Permissioned NetWork Read: - Push Notification Content - Pending Notifications -Public DID DOC • Credential Definition - Credential Schema - Revocation Lists -_ceIDs ■ Device Tokens - Notification Endpoints Read: - Public DID DOC - Credential Definition * Credential Schema - Revocation Registries 5.1.2.E 5.1.2.E 5.1.2.E 5.1.2.E 5.1.2.E 5.1.2.E KTDI A.3 KDTI 22 Characteristics of Data Processing Goal of Data Procesing Characteristics of Data Processing KTDi (cont ’ d) • Goal(s) of the data processing. KDTI • The main goal of the data processing is to enable a seamless travellers journey where the Traveller (the Data Subject) will be identified using biometrics. This will be possible because the Traveller requests to make use of specific KTDI Services by sending the required data to the Service Provider.

While at the airport, the Traveller will not need to show their Travel Document* or Boarding Pass at selected touch points since they wil be recognized using biometrics. • Another goal of the data processing is to enable the Service Providers to process service requests of Travellers even before the Traveller ’ s journey has begun, thereby expediting their processes at the airport. *) Due to the Schengen Borders Code, Canadian Travellers do need to collect and entry/exit stamp at the Dutch Border upon arrival/departure. KTDI A.4 KDTI 24 Characteristics of Data Processing Controllers, Processors & Locations Characteristics of Data Processing KTDi (cont ’ d) • Parties involved in the data processing and the locations of the data processing. the Netherlands (?) Invite Traveller ? KLM Air Canada ? (theoretically: everywhere) Create KTDI Profile ? NOID (Idemia) Create Digital ID the Netherlands KMar ?

(theoretically: everywhere) Prepare the Trip ? KLM Air Canada ? NOID AAS (Vision-Box) NCSC AAS (Vision-Box) KMar AAS (Vision-Box) the Netherlands Priority Access to security NCSC Border Control NLD (ARR/DEP) AAS (Vision-Box) the Netherlands KMar KLM/Air Canada the Netherlands (?) Boarding Access KDTI Controller Processor & Sub-processor Process Location Idemia Accenture ? AAS (Vision-Box) ? Accenture Characteristics of Data Processing KTDi (cont ’ d) • Parties involved in the data processing and their interest in the data processing. Air Canada Controller Controller KLM Controller KMar Controller NOID Controller NCSC Accenture Processor Idemia Processor AAS Processor Vision-Box Processor KDTI Role Interest in the data processing Party KTDI KDTI 27 A.5 Characteristics of Data Processing Processes & Supporting Technology Only once € E r "i □ na Oo ATN nTn *77 8 □ hn uu ----- L J ------ E-mail Each trip KTDI Blockchain Each trip r < Platform B : E Each trip J Airline DCS -um E Boarding Pass Check-in r n uu E SF Platform - J Priority Access Security Only once Each trip N KMar KTDI KTDI Blockchain o J Each trip Airline DCS - E• Boarding Access r "i © EIII L J KTDI Blockchain Airline DCS - Boarding Access KDTI Border control Partner Agent Component Partner Agent Component Mobile Device - Download/install KTDI Mobile App Create Digital ID Prepare the trip Boarding Access Invite traveller Mobile Device - Scan QR Code Gov. system - Facial recognition Central Information System Schiphol Register KTDI Account with KTDI Provider Provider System - Register KTDI Account Gov. system - Generate QR Code Gov. system - Generate Attestation Mobile Device - Create User Account (local) + biometric authentication Of SF Platform Create KTDI profile $ >> S Eomm CBSA System - EF Border Control CAN Priority access security (1 Mobile Device - dm Telephone H. Gov. system - Scan e-passport SF Platform Partner Agen Component E2 SF Platform - Border Control NLD KTDI Pilot Process & Supporting Technologies AR - Departure NLD KTDI Pilot Process & Supporting Technologies TD) Arrival NLD Each trip C• 1 o Only once Initial RTP-NL application A DM os KTDI Blockchain $ ' KTDI Blockchain N i Each trip Each trip E •-» r 1 DM L J DM DM q Provider System KTDI Blockchain KDTI E KM EI DM Partner Agent Component Partner Agent, Component I Border control Prepare the trip Partner Agent, Component Arrival flight RTP-NL Registration RTP NL AH NLD Travellers > 2nd ti me CAN Travellen E SF Platform - DM Border Control NLD SF Platform - - Border Control \ 1 i i i i 1 \ \ \ \ SF Platform Partner Agent Component <(® . i / SF Platform - \- Finalize RTP-NL application E C KTDI KDTI 30 Processes & Supporting Technology - Blockchain A.5 Characteristics of Data Processing KTDi KDTI Characteristics of Data Processing (cont ’ d) - some remarks about blockchain Source: Blockchain and the General Data Protection Regulation.

Can distributed ledgers be squared with European data protection law? (Secretariat of the European Parliament; Brussels 2019), pages i-iv. "Indeed, almost one year after the GDPR became binding and although the legal regime is largely based on the previous 1995 Data Protection Directive, it is evident that many pivotal concepts remain unclear. ” "there is an ongoing debate surrounding whether data typically stored on a distributed ledger, such as public keys and transactional data qualify as personal data for the purposes of the GDPR. Specifically, the question is whether personal data that has been encrypted or hashed still qualifies as personal data. Whereas it is often assumed that this is not the case, such data likely does qualify as personal data for GDPR purposes... " "It will be seen that the regulation is an expression of principles-based regulation that was designed to be technologically-neutral and stand the test of time in a fast-moving data-economy."

KTDi "It is the tension between the right to erasure (the 'right to be forgotten') and blockchains that has probably been discussed most in recent years." KDTI Characteristics of Data Processing (cont ’ d) - some remarks about blockchain Source: Blockchain and the General Data Protection Regulation. Can distributed ledgers be squared with European data protection law? (Secretariat of the European Parliament; Brussels 2019), pages i-iv. "This analysis leads to two overarching conclusions. First, that the very technical specificities and governance design of blockchain use cases can be hard to reconcile with the GDPR. Therefore, blockchain architects need to be aware of this from the outset and make sure that they design their respective use cases in a manner that allows compliance with European data protection law. Second, it will however also be stressed that the current lack of legal certainty asto how blockchains can be designed in a manner that is compliant with the regulation is not just duetothe specific features of this technology.

Rather, examiningthistechnology through the lens of the GDPR also highlights significant conceptual uncertainties in relation tothe regulation that are of a relevance that significantly exceeds the specific blockchain context. Indeed, the analysis below will show that the lack of legal certainty pertaining to numerous concepts of the GDPR makes it hard to determine how the latter should apply both to this technology and to others." "Whereas the GDPR requires that personal data that is processed be kept to a minimum and only processed for purposes that have been specified in advance, these principles can be hard to apply to blockchain technologies. Distributed ledgers are append-only databases that continuously grow as new data is added. In addition, such data is replicated on many different computers. Both aspects are problematic from the perspective of the data minimisation principle. It is moreover unclear how the 'purpose' of personal data processing ought to be applied in the blockchain context, specifically whether this only includes the initial transaction or whether it also encompasses the continued processing of personal data (such as its storage and its usage for consensus) once it has been put on-chain."

33 Characteristics of Data Processing Characteristics of Data Processing KTDi (cont ’ d) • Legal and policv fra Legal and policy framework: KDTI • Security: Commission Implementing Regulation (EU) 2015/1998 of 5 November 2015 laying down detailed measures for the implementation of the common basic standards on aviation security, paragraph 1.2.2.1 - 1.2.2.4 • Border Control: Schengen Borders Code . • The KTDI pilot will last six months and can be prolonged for another six months. After that period, the pilot will be terminated and travellers can no longer make use of any KTDI related service. • The KTDI mobile application does not support any back-up functionality. • Attestations will only be stored in the wallet of the KTDI mobile application and in databases of Service Providers which have requested them from the Travellen • Data of non-core Building Blocks will only be stored in the wallet of the KTDI mobile application and in databases of Service Providers which have requested them from the Travellen • Retention periods: • These are not specific for or adapted to the KTDI concept. • During the pilot, statistical data will be collected as well as data on user experience/(dis-)satisfaction.

This will be input for an evaluation of the KTDI concept. • Next steps are still to be defined. KTDI KDTI 35 Data Processing KTDi Lawfulness of Data Processing • Legal basis for data processing ( GDPR, art. 6 ). • For Border Control: the Data Subject does not give consent for the data processing , a Data subject is under the legal * obligation to have their passport checked. KDTI • GDPR, article 6.1 (c) : "processing is necessary for compliance with a legal obligation to which the controller is subject"; and • GDPR, article 6.1 (e): "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller". • For Airlines (KLM, Air Canada), a Data Subject will have concluded a contract under which they are obliged to share certain personal data with the Airlines in order to make use of the KTDI Service ‘ Boarding ’ . • GDPR, article 6.1(b): "processing is necessary for the performance of a contract to which the data subject is party ..." • However: sharing the facial image is not part of the (current) contract between a Data Subject and the Airline.

The Data Subject will need to give informed consent to the Airlines allowing them to process their facial image during the KTDI Service ‘ Boarding ’ . • GDPR, article 6.1 (a) : "the data subject has given consent to the processing of his or her personal data for one or more specific purposes". *) See: DPIASSPC. KTDi Lawfulness of Data Processing (cont ’ d) • Legal basis for data processing ( GDPR, art. 6 ). KDTI • The Data Subject shares their personal data for every journey and within every journey for every KTDI Service they wish to make use of. • A ‘ subscription model' (subscribe once, use multiple times) is not envisioned for the KTDI pilot. • See document 'KTDI Pilot - Services' (Excel file). • For RTP-NL Application a (Canadian) Data Subject will have given informed consent to the processing of personal data by the KMar so they can make use of the KTDI Service 'Cross NLD Border - Arrival'. • For the Airport, a Data Subject will have given informed consent to the processing of personal data by the airport so they can make use of the KTDI Service 'Priority Access to Security'. • GDPR article 6.1(a): "the data subject has given consent to the processing of his or her personal data for one or more specific purposes".

KTDi Lawfulness of Data Processing (cont ’ d) KDTI Subsidiarity : participation to the KTDI Pilot is on voluntary basis only. Dutch and Canadian Travellers who are invited to participate, may at all times refuse or terminate their participation. In that case, 'normal' border control facilities are available: Self-Sevice Passport Control and the manual counter. Necessity of data processing ( GDPR, art, 6 ): • Proportionality of the data processing: data processing is based on the principle of 'Data Minimisation' ( GDPR, art. 5.1.c ). The data which is collected for a specific KTDI Service is limited to what is necessary in order to enable the Data Subject to make use of that KTDI Service. Is the data used for another goal than originally collected for ( GDPR, art 6.4 )? • Personal data is only collected for a specific KTDI Service: • 'Cross NLD Border (Departure/Arrival)'. Legal basis = the law; • 'Priority Access to Security '.

Legal basis = informed consent; • 'Boarding' (the execution of the agreement between the airine and the Travellen) Legal basis = the contract; and • Boarding using biometrics. Legal basis = informed consent. • 'RTP-NL Application'. Legal basis = informed consent. • The consent refers to giving the personal data via the KTDI mobile application to the relevant controllers in order to be able to make use of the KTDI services. • Concluding: no. The personal data, which is collected in order to enable a Data Subject to make use of a specific KTDI Service, is only used to provide that KTDI Service to the Data Subject. KTDi Lawfulness of Data Processing (cont ’ d) • NOID persistenly stores the digital identity of all participating Ifa participating wishes KDTI to have their personal data deleted, they can request the NOID does mean that the Dutch Traveller will not be able anymore to consume Dutch and Canadian KTDI Services. • Canadian participants who are member of the RTP-NL programme: see DPIA RTP-NL/3L. • Rights of the data subject: • Information to be provided where personal data are collected from the data subject ( GDPR, art. 13 ). • This Information will be made available to the Data Subject at the time when the personal data are obtained. • The Information will also be published on the web site of KTDI ( www.ktdi.org ). • Information to be provided where personal data have not been obtained from the data subject ( GDPR, art. 14 ). • As far as applicable, this Information will be published on the web site of KTDI ( www.ktdi.org ). • Right of access by the data subject ( GDPR, art. 15 ). • A participating Traveller can ask the appropriate Controller access to their personal data. • Right of rectification ( GDPR, art. 16 ). • A participating Traveller can ask the appropriate Controller to rectify their personal data. • Right of erasure ( GDPR, art. 17 ).

KTDi Lawfulness of Data Processing (cont ’ d) Travellers. Ifa participating wishes • The Royal Marechausseee persistently stores RTP-NL membership data of participating Travellers. If a wishes to transfer their personal data from the RTP-NL programme to any other participating KDTI organization, than they can request the Royal Marechaussee to supply them with the requested pesonal data. Airlines: ? to transfer their personal data from NOID to any other organization, than they can request the NOID to supply them with the requested pesonal data. • Right to data portability ( GDPR, art. 20 ). • NOID persistenly stores the digital identity of all participating • Rights of the data subject: • Right to restriction of processing ( GDPR, art. 18 ). • A participating Dutch or Canadian Travellermay at all times invoke their right to restriction of processing by informing the appropriate Controller.

KTDi Lawfulness of Data Processing (cont ’ d) KDTI • Rights of the data subject (cont'd): • Right to object ( GDPR, art. 21 ). • The right to object is only applicable on data processing based on GDPR article 6.1(e) and 6.1(f): • Article 6.1(e): "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller". • Article 6.1. (f): "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data". • Making use of the KTDI Service ‘ Priority Access to Security' is based on informed consent (GPDR, article 6.1(a). Therefore, the right to object can not be executed while making use of this service. • Making use of the KTDI Service ‘ RTP-NL Application' is based on informed consent (GPDR, article 6.1(a).

Therefore, the right to object can not be executed while making use of this service. • Making use of the KTDI Service 'Cross NLD Border (Departure and Arrival)' is based on public interest orthe exercise of official authority vested in the controller (GPDR, article 6.1(a). Therefore, the right to object can be executed while making use of this service. • Making use of the KTDI Service ‘ Boarding' is based on a contract (GDPR, article 6.1(b) with the Participating Airline. The use of biometrics is based on informed consent. Therefore, the right to object can not be executed while making use of this service. KTDi Lawfulness of Data Processing (cont ’ d) KDTI • Rights of the data subject (cont'd): • Automated individual decision-making, including profiling (GDPR, art. 22 ). • Not applicable to the KTDI Pilot. • SeeDPIAof: • Seamless Flow; and • RTP-NL/3L. • Airlines: ? KTDI KDTI 43 C./D. - Risks & Mitigation KTDi Risks & Mitigations - Introduction In this chapter, risks are described which a Data Subject may run as they travel the 'KTDI way ’ , including: • The negative consequences which the Data Subject may experience; • The source of these consequences; • The possibility that these risks may occur; and For each risk, mitigating measures are identified and described in this chapter as well. • A mitigating measure can be of a technological, organizational or legal nature.

KDTI • It may very well be possible that parts of a risk are not covered by the measures. In these cases, it will be explained why those residual risks are acceptable. • The impact of the risk on the Data Subject. The impact is assessed taking into account: loss of freedom, are special categories of personal data processed , can the Data Subject experience financial damage. KTDi Risks with regard to the KTDI Mobile Application Lawfulness, fairness and transparency Art.5(l)(a) Purpose limitation Art.5(l)(b) Data minimisation Art.5(l)(c) Accuracy Art.5(l)(d) Outdated data pose identity theft risks. Sources: Privacy and data protection in mobile applications (ENISA; november 2017), page 22; Smartphone Secure Development Guidelines (ENISA; december 2016). KDTI GDPR Principle Privacy Risks Mitigations Unlawful, excessive and incorrect processing (e.g. due to permissions to unauthorised parties to access personal data through the app).

Excessive collection and sharing of data (e.g. due to multiple sensors of mobile devices that are activated without need). Excessive processing (e.g. due to use of third party libraries). Rectification processes into data management should be embedded in the app design. App providers/developers should make sure that they have a legal basis for the processing of personal data. App providers/developers should inform the data subjects properly about their data processing activities. This may help the users to understand what personal data is collected by them and why. App providers/developers should be aware of data subject rights such as rights to access, rectification, erasure, data portability. They should implement appropriate processes to support these rights App providers/developers should use the data for a specific purpose that the data subjects have been made aware of and no other, without further consent.

If the personal data is used for purposes other than the initial, they should be anonymised or the data subjects must be notified and their consent must be re- obtained. The minimum amount of data for specific processing should be processed by app providers/developers. For instance, they should not store the exact location point when a generic location area is sufficiënt for their app functionalities. Measures : • The KTDI Mobile Application must only process data which are absolutely necessary for a user to make use of a KTDI Service. • The KTDI Mobile Application must not collect geolocaton data. KTDi Storage limitation Art.5(l)(e) Sources: Privacy and data protection in mobile applications (ENISA; november 2017), page 22; Smartphone Secure Development Guidelines (ENISA; december 2016). KDTI GDPR Principle Privacy Risks Mitigations Risks with regard to the KTDI Mobile Application cont ’ d Undue data disclosure (e.g. due to cloud storage services used by mobile app developers).

Personal data must not be stored longerthan necessary. App providers/developers should provide the "right to be forgotten" to the data subjects. This data must be kept only for a certain period of time for non-active users. Measures: • The KTDI Mobile Application & Wallet must not persistenly store Attestations issued by NOID containing persona data. These Attestations (and other objects in the cache of the app) must be irrevocably deleted after: • xx seconds of idle time; or • The Traveller has terminated the KTDI Mobile Application. KTDi Integrity and confidentiality Art.5(l)(f) Sources: Privacy and data protection in mobile applications (ENISA; november 2017), page 22; Smartphone Secure Development Guidelines (ENISA; december 2016). KDTI GDPR Principle Privacy Risks Mitigations Risks with regard to the KTDI Mobile Application cont ’ d Unlawful data processing, data loss, data breach, data destruction or damage App providers/developers should ensure that the security requirements of the personal data and the processing systems are met.

This encompasses integrity and confidentiality as well as availability and resilience (Art. 35(l)(b) GDPR). For instance, the appropriate control access mechanisms should be embedded into the apps infrastructure in order to detect or monitor unauthorized access to the data. Measures: • Data at rest must be encrypted using a state-of-the-art encryption. • Data at transport must be encrypted using a state-of-the-art encryption. • The KTDI Mobile Application may nog have a 'debug mode' or 'developper mode'. • The password of the user account must follow a strong password policy. • The password must be masked while the user enters it in an input field. • The password of the user account must be securely stored on the mobile device, making use of encryption and key-store mechanisms provided by the mobile OS. KTDi Risk - Data Subject cannot execute their rights The Data Subject cannot execute their rights.

KTDI's data processing is complex because multiple organisations are involved. Some of them are based Description Data Subject could also choose to make Possibility • The possibility that this risk may occur is 'high'. Impact KDTI Risk Data Subject cannot execute their rights This can be caused by: • Unclear Information. • Unclear agreements between controllers and processors. Currently, there are no data processing agreements between Data Controllers and Data Processors. Before the actual pilot will start, these agreements must be concluded. That may solve the issue of unknown data processing. However, due to the complex nature of the KTDI processes, it may very well be that Data Subjects do not fuIly understand the KTDI concept, the possible consequences of the concept to their rights and how they execute their rights in relation with the KTDI concept. within the EU, some outside of the EU.

Data processing can happen within the EU, but also outside of the use of a KTDI Service by accident. KTDi Mitigation B B B § T F T F 1 F 5 F KDTI Risk Data Subject cannot execute their rights Possibility Impact Risk - Data Subject cannot execute their rights - cont ’ d Risk before implementation of mitigating measures Risk af ter implementation of mitigating measures • Terms and Conditions will be made available in gthe KTDI mobile application, KTDI web site, web site of Service Providers. • Including a clear desciption how a Traveller can execute his rights. • A clear Processing Agreement must be concluded between each Controller and their Processor(s) before the actual pilot starts. KTDi Risk - Stigmatization & Discrimination Description Possibility • The possibility that this risk may occur is 'medium'. Impact • The impact of this risk is 'high'. KDTI Risk Stigmatization & Discrimintion Personal data (biographic as well as biometric) can fall into the wrong hands and be used in order to discriminate of stigmatize the Data Subject.

It is also possible that a Data Subject who has enrolled into KTDI and wants to make use of KTDI Services cannot be recognized by a touchpoint and will be referred to manual processing causing negative feelings. Also, it has been proofed that matching algorithms may have difficulties recognizing dark coloured skins which may also cause negative feelings. A Data Subject could experience discrimination or stigmatization. As a result of a system error the Data Subject may inadvertently be denied border Crossing or boarding possibly even resulting in the Data Subject missing their flight. Service Providers and Information Systems used in the KTDI pilot must comply with security measures according to international standards (ISO, OWASP) but unfortunately a data leakage or system error cannot be ruled out completely. Currently, there are no data processing agreements between Data Controllers and Data Processors.

Before the actual pilot will start, these agreements must be concluded. That may solve the issue of unwanted data processing. This can be caused by: • Data leakage. • System errors. • Unclear agreements about data processing (access to personal data). • Function creep which caused personal data to be processed for other purposed than collected for. KTDi Risk - Stigmatization & Discrimintion - cont ’ d Mitigation § B B B 1 F T F 1 F KDTI Risk Stigmatization & Discrimintion Possibility Impact Risk before implementation of mitigating measures • Each Controller and Processor must have a procedure in place how to act in case of data leakage or system error. • Each Controller and Processor must demonstrable comply to international Information Security standards. • A clear Processing Agreement must be concluded between each Controller and their Processor(s) before the actual pilot starts. • Each Controller and Processor must only process data for the purpose the data was collected for. • Audits may be executed in order to verify if a Controller or Processor has implemented the above mentioned measures.

Risk af ter implementation of mitigating measures KTDi Risk - Adverse decision taking due to erroneous data A Service Provider could take a decision based on erroneous data. This has a negative impact on the Data Subject. Description Possibility • The possibility that this risk may occur is 'medium'. Impact • The impact of this risk is 'high'. KDTI Risk Adverse decision taking due to erroneous data A Data Subject could experience negative feelings discrimination or stigmatization. As a result of a system error the Data Subject may inadvertently be denied border Crossing or boarding possibly even resulting in the Data Subject missing their flight. This can be caused by: • Erroneous record keeping: data of a Data Subject is combined with data of another Data Subject. • Controllers need to implement measures guaranteeing data integrity. Mitigation 8 8 8 KDTI Risk Adverse decision taking due to erroneous data Possibility Impact Risk before implementation of mitigating measures Risk af ter implementation of mitigating measures Risk - Adverse decision taking due to erroneous data AR - cont ’ d KTD