# Belastingdienst fails privacy checks on 10 of 12 areas

> The data protection authority says the tax administration still breaks privacy rules on most points, including on discrimination in automated decisions, and will keep it under close watch until mid-2029.

Politics · published 2026-11-11 13:56 · https://nlnow.nl/a/belastingdienst-fails-privacy-checks-on-10-of-12-areas/

The Autoriteit Persoonsgegevens (AP) found that the Belastingdienst does not meet the requirements on ten of the twelve areas it checked. The AP has supervised the tax administration in an "intensified" way since 2024 and will continue until mid-2029.

**Why it matters**

- At the end of this year the citizen service number (bsn) will no longer appear in the payment reference.
- The AP wants discrimination in automated selection criteria tackled by 2029.

"The fact that compliance is still not in order on so many points is a serious finding," the AP wrote. "This concerns one of the largest processors of personal data in the Netherlands."

The AP says the Belastingdienst cannot show there is "meaningful human intervention" when algorithms are involved in decisions. It also does too little to prevent discrimination in automated selection criteria, which puts citizens' fundamental rights at stake, the AP says.

On data security, there are not yet enough systems to track who views which data. Data are kept too long, and too many employees have access to sensitive personal data, the AP says.

The tax administration does now comply on reporting data breaches and on carrying out privacy impact assessments (DPIAs), which was not the case before.

The AP also wants the Belastingdienst to stop processing the bsn in payment references and claim numbers. Anyone who knows a person's bsn could find out whether that person has a tax debt. Over the next three years the Belastingdienst must give priority to the problems that carry the greatest risk for citizens, the AP says, and better monitor which employees consult personal data.

## Background

- **AP (Autoriteit Persoonsgegevens)**: The Dutch Data Protection Authority is the independent supervisor that checks whether organisations handle personal data in line with the GDPR and Dutch privacy law. It can investigate, issue instructions, and impose fines. It is the body that handles privacy complaints and oversees government bodies as well as businesses.
- **Belastingdienst**: The Dutch Tax and Customs Administration is the government agency that levies most taxes and social security contributions in the Netherlands, and it also handles customs. It holds large amounts of personal and financial data on residents and businesses, which is why its handling of that data is supervised closely.
- **bsn (burgerservicenummer)**: The bsn (burgerservicenummer, citizen service number) is a unique nine-digit personal number assigned to people registered in the Dutch Personal Records Database (BRP). Government bodies and some other institutions use it to identify a person in dealings such as tax, healthcare and education. Because it is a sensitive identifier, its use is restricted by law and organisations may only process it where a legal basis allows.

From NLnow, news from the Netherlands in English. How stories are made: https://nlnow.nl/about/