Protocol for safe and responsible reopening of museums
Together with the government and following the RIVM guidelines, the Dutch Museums Association has issued a 'protocol for safe and responsible reopening of museums’. Compliance with this protocol – by all parties involved – is a mandatory condition for reopening/resuming of the use of museums. The protocol mandates that visitors can be traced by the GGD [Municipal Health Services] in case a visitor proves to have been infected with COVID-19. In that case, the visitors who were at the museum at the same time will be contacted and informed. This means that people can only make ticket reservations for themselves and for those who are part of their household or with whom they form a social unit such as family members, partners, or people sharing a house. The person making the reservation will be the contact person for the entire party.
Because of the COVID-19 pandemic, the Dutch Museums Association has instructed the Nederlands Fotomuseum to process the personal details of all visitors (primarily based on reservations made through the website). These details include a person's first and last name, email address, and home address. The date and time of the visit to the museum will also be processed.
This instruction to process personal details is part of the ‘Provisional protocol for safe and responsible reopening of museums’, in which this regulation has been stipulated following – and to comply with – the statutory task of the GGD, the RIVM and other organisations involved in fighting the COVID-19 pandemic. Therefore, the aforementioned personal details may have to be disclosed to and at the request of the GGD, the RIVM, or other government bodies entrusted with fighting the COVID-19 pandemic. The transfer of these details will be done securely and within the Netherlands (meaning not via servers abroad, for example). These details will be transferred to ensure that the government bodies involved can ascertain who might have been in contact with a person who has tested positive for COVID-19 (‘test and trace’).
This processing of personal details is first and foremost necessary to execute a task in the general public interest and will be carried out by the aforementioned bodies. Moreover, this processing will be required to fulfil the agreed measures as museum visits will not be allowed without complying with this Protocol. The processing is also required to ensure a vital interest of our society, the Nederlands Fotomuseum, and our visitors, and thus based on a justified interest of the Nederlands Fotomuseum. In this respect, we also refer to the declaration issued by the European Data Protection Board dated 19 March 2020, which states that the COVID-19 pandemic is seen as an emergency situation and that the GDPR does not restrict any measures taken to fight COVID-19.
The retention period of these details, to guarantee compliance with such a possible request, has been limited to the duration that the GGD or the RIVM deem to be necessary (which currently has been set at a maximum of three months). If details have been transferred, the Nederlands Fotomuseum will retain these details in an encrypted form for one year so that evidence can be given about which details were transferred.
