# Belastingdienst fails 10 of 12 privacy checks, regulator says

> The Dutch privacy regulator says the tax authority still does too little to protect the personal data of citizens and businesses, and wants it to stop using citizen service numbers in payment references.

Politics · published 2026-11-11 10:49 · https://nlnow.nl/a/belastingdienst-fails-10-of-12-privacy-checks-regulator-says/

The Autoriteit Persoonsgegevens, the Dutch privacy regulator, checked the Belastingdienst, the tax authority, on twelve components and found that it does not meet the requirements on ten of them. The regulator concludes that the tax authority still does too little to protect the privacy of citizens and businesses.

The regulator wants the Belastingdienst to stop processing citizen service numbers (BSN) in payment references (betalingskenmerken) and claim numbers (vorderingsnummers). Anyone who knows a person's BSN could then find out whether that person has a tax debt.

On security, the regulator says the tax authority does not take enough measures to protect personal data properly. There are not yet enough systems to log who views which data. The regulator gives these as examples of where the Belastingdienst falls short.

Algorithms must not take decisions on their own; a human must always be involved. The regulator says the Belastingdienst cannot demonstrate that there is "meaningful human intervention" (betekenisvolle menselijke tussenkomst) in such decisions.

The regulator also finds that the tax authority does too little to prevent discrimination in its "automated selection criteria" (geautomatiseerde selectiecriteria).

## Background

- **Autoriteit Persoonsgegevens**: The Dutch Data Protection Authority is the independent supervisory body that checks whether organisations follow privacy law, including the GDPR (AVG) for the handling of personal data. It can investigate organisations, issue binding instructions and impose fines. It matters because it is the body that enforces data protection rules against government agencies and companies in the Netherlands.
- **Belastingdienst**: The Dutch Tax and Customs Administration is the agency of the Ministry of Finance that collects taxes and levies, such as income tax and VAT, and handles customs duties. It processes tax returns and sends assessments and payment requests to residents and businesses. Because it holds large amounts of personal and financial data, its handling of privacy is closely supervised.
- **BSN (burgerservicenummer)**: The Dutch citizen service number is a personal identification number assigned to people registered in the Dutch population register (Basisregistratie Personen). It is used to identify a person when dealing with government bodies, including the tax authority. Its use is restricted by law, so it should only be used where a legal basis allows it.

From NLnow, news from the Netherlands in English. How stories are made: https://nlnow.nl/about/