The Dutch tax office still falls short of privacy law on 10 of 12 points

The Dutch tax office, the Belastingdienst, still does not comply with privacy law on 10 of 12 points, the Dutch Data Protection Authority (AP) said on Wednesday. Improvements are also coming too slowly, the watchdog says in the first edition of its report on data protection at the tax office.

Where it falls short

The AP checked 12 topics. On 2 of them, the tax office now follows the law: reporting data breaches and carrying out privacy impact assessments for new projects.

On the other 10, compliance still falls short. The AP says the tax office’s selection algorithms are not properly justified, while that is needed to prevent discrimination. The tax office also cannot yet show that a person checks the decisions of its algorithms where the law requires it. And personal data is not secured well, so there is a risk of misuse.

“The tax office is one of the largest processors of personal data in the Netherlands,” AP board member Katja Mur said. She called it a worrying conclusion that the often sensitive data of almost everyone in the country is still not protected well enough.

Changes ahead

The AP expects some improvements soon. By the end of 2026, the citizen service number (BSN) will disappear from the payment reference for citizens. There are also plans to switch off some problematic systems.

The AP has supervised the tax office more strictly since 2024, and this will continue until mid 2029. Its next report is due in January 2028.