Belastingdienst fails 10 of 12 privacy checks, regulator says
The Dutch privacy regulator says the tax authority still does too little to protect the personal data of citizens and businesses, and wants it to stop using citizen service numbers in payment references.
i
Illustrative photo: Choinowski / CC BY-SA 4.0
The Autoriteit Persoonsgegevens, the Dutch privacy regulator, checked the Belastingdienst, the tax authority, on twelve components and found that it does not meet the requirements on ten of them. The regulator concludes that the tax authority still does too little to protect the privacy of citizens and businesses.
The regulator wants the Belastingdienst to stop processing citizen service numbers (BSN) in payment references (betalingskenmerken) and claim numbers (vorderingsnummers). Anyone who knows a person's BSN could then find out whether that person has a tax debt.
On security, the regulator says the tax authority does not take enough measures to protect personal data properly. There are not yet enough systems to log who views which data. The regulator gives these as examples of where the Belastingdienst falls short.
Algorithms must not take decisions on their own; a human must always be involved. The regulator says the Belastingdienst cannot demonstrate that there is "meaningful human intervention" (betekenisvolle menselijke tussenkomst) in such decisions.
The regulator also finds that the tax authority does too little to prevent discrimination in its "automated selection criteria" (geautomatiseerde selectiecriteria).
More on digital, tech and privacy · taxes and benefits
Guide: DigiD: how to get it, the app and the ID check, from abroad, without a Dutch passport
See more of NLnow in Google: add it as a preferred source