Vacation Rental Registry: Is Your Data Privacy Protected?

The government wants vacation rental owners to register online. Before owners submit personal information and supporting documents, they deserve answers: where does that information go, who controls it, and what prevents its misuse?

My earlier articles questioned the legal foundation of registration. This time, the focus is privacy. Calling participation voluntary does not answer what happens after someone presses “submit.”

Baas de nos mes cas?

We like to say we are: “Baas de nos mes cas,” which translates to something like being “boss in our own home.” But where will Aruban residents’ information be stored: in Aruba or another country? Where will the backups be kept? From where can contractors access them, and which foreign laws could compel disclosure?

Overseas hosting is not automatically improper. But the government should explain what protection follows the information abroad. Can it require its return, transfer or deletion? Can it enforce those requirements if a supplier refuses, closes its business or loses control of the records? Being boss in our own home should include knowing whether we retain control over information collected in our name.

A registry or a campaign list?

A database containing thousands of names, property addresses and contact details could be valuable to a political campaign. What safeguards prevent those records from ending up on a candidate’s laptop, becoming a mailing list or being used to call owners and visit their homes?

Who can export the database? Are downloads logged and access restricted? Can officials or contractors retain copies? Do enforceable rules expressly prohibit party political use, and what consequences follow misuse? This is about prevention, not an allegation that misuse has occurred. Information collected for a government registry must not become a campaign asset. Owners deserve to know how that boundary will be enforced.

Secure is not the whole answer

An encrypted connection does not explain who may use the information or for what purpose. Will submissions be shared with tax authorities, inspectors, other departments or private platforms? Under which conditions? How long will records remain, and what happens when an owner withdraws?

Aruba’s Landsverordening persoonsregistraties addresses lawful handling, use, disclosure and security of personal information. Has this registry been assessed against those requirements? Who performed that assessment, and will the government publish its conclusions? Identify the responsible institution and its service providers. Explain how owners can inspect and correct their records, request deletion where available, and report suspected misuse. Confirm that appropriate independent privacy and security checks have been completed.

Privacy crosses borders

Owners also live in the Netherlands, elsewhere in Europe, the United States and Canada. Privacy obligations can extend beyond national borders. GDPR can apply outside Europe. Canada’s PIPEDA can reach foreign commercial organizations with a real and substantial connection to Canada, while California’s privacy legislation can cover qualifying businesses outside that state.

Which obligations apply to this registry, its contractors and participating platforms? Has that assessment been completed? These laws have different scopes. That is precisely why the government should establish which requirements apply rather than leave owners guessing.

Imagine Dutch parliamentarians asking how information concerning Netherlands residents is protected. Imagine American or Canadian authorities raising similar concerns. Could Aruba produce a documented answer? If changes were necessary, could the government require its suppliers to make them? Aruban residents deserve equally clear protection, without waiting for a foreign government to take an interest.

Put the safeguards on a legal footing

The government should identify the legal basis for collecting and processing this information and establish any additional safeguards through the appropriate legal instrument. Publish that instrument through the applicable official channel, whether the Afkondigingsblad or Landscourant, so everyone can examine its authority, scope and effective date.

Responsibility, permitted uses, access, disclosure, retention and protection against political misuse should rest on clear, enforceable rules. Website wording that can be changed overnight cannot replace that foundation. The website should explain the protections and link to the officially published instruments.

We live in a democracy. Its strength includes our freedom to question our leaders and their willingness to answer. The government is asking owners to put their information on record. It should also put the rules protecting that information on record.

Until next week, take care. Visit www.lincolngomez.com for more of my columns and podcasts.