New legislation aimed at governing the use of personal data collected by government agencies by other state institutions is not tight enough and information may be spread or sold without the knowledge of those involved, the Dutch privacy watchdog AP said on Thursday.

The draft legislation aims to ensure that as much government data as possible is made available for research, but also for commercial use. The data must also be searchable with software and combined with other data.

‘When it comes to the amount of trees planted in a certain neighborhood or the air quality in an area, there is of course no objection,’ AP deputy president Monique Verdier said. ‘But when it comes to people, and their addresses, their telephone numbers, their property, it is something else entirely.’

The basis of the legislation should be that you are in charge of your own personal data, Verdier said. ‘It should not be left to government agencies to consider whether personal data can be shared.’

The AP has previously criticised the publication of personal data in Chamber of Trade records and Land Registry, and the cabinet is working on plans to make it possible for the self employed to protect their addresses if they work from home.

But the cabinet’s proposals will make it even easier to retrieve personal data from those registers, Verdier said. ‘By using an algorithm and combining the personal data with other sources, companies can, for example, create profiles of people and sell them.’

It may also become even easier to find out where someone live and threaten them, she said.

The AP says the reuse of personal data in public registers should be banned in principle and that legislation should focus instead on when to make exceptions.