Belastingdienst fails privacy checks on 10 of 12 areas

The Autoriteit Persoonsgegevens (AP) found that the Belastingdienst does not meet the requirements on ten of the twelve areas it checked. The AP has supervised the tax administration in an "intensified" way since 2024 and will continue until mid-2029.

Why it matters

• At the end of this year the citizen service number (bsn) will no longer appear in the payment reference.
• The AP wants discrimination in automated selection criteria tackled by 2029.

"The fact that compliance is still not in order on so many points is a serious finding," the AP wrote. "This concerns one of the largest processors of personal data in the Netherlands."

The AP says the Belastingdienst cannot show there is "meaningful human intervention" when algorithms are involved in decisions. It also does too little to prevent discrimination in automated selection criteria, which puts citizens' fundamental rights at stake, the AP says.

On data security, there are not yet enough systems to track who views which data. Data are kept too long, and too many employees have access to sensitive personal data, the AP says.

The tax administration does now comply on reporting data breaches and on carrying out privacy impact assessments (DPIAs), which was not the case before.

The AP also wants the Belastingdienst to stop processing the bsn in payment references and claim numbers. Anyone who knows a person's bsn could find out whether that person has a tax debt. Over the next three years the Belastingdienst must give priority to the problems that carry the greatest risk for citizens, the AP says, and better monitor which employees consult personal data.