Tax authorities still failing to meet privacy rules
The Dutch Data Protection Authority found shortcomings in ten of the twelve areas examined and is calling for faster action.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
The Dutch Tax and Customs Administration is still failing to meet privacy rules, the Dutch Data Protection Authority concluded after examining twelve areas. According to the regulator, access management, logging and automated selection criteria in particular are insufficiently regulated.
The DPA says that the Dutch Tax and Customs Administration fails to meet the requirements in ten of the twelve areas examined. These include measures intended to prevent employees from viewing personal data when this is not necessary for their work, as well as systems that should record who accesses data.
According to the regulator, the Dutch Tax and Customs Administration also cannot demonstrate that automated decisions involve meaningful human intervention. Algorithms must not make decisions independently when the law requires human assessment. The DPA also sees risks in automated selection criteria that could lead to discrimination.
The regulator wants the Dutch Tax and Customs Administration to stop using citizens’ service numbers in payment references and claim numbers. According to the DPA, someone who knows such a number could thereby potentially infer that a citizen has a tax debt. According to the reported timetable, the Dutch Tax and Customs Administration intends to remove the numbers from these references from the end of this year.
The tax authority has previously faced criticism and fines from the privacy regulator on several occasions. According to the DPA, it has specifically supervised the privacy organisation of the Dutch Tax and Customs Administration since 2024. In January 2026, the regulator published an investigation into hundreds of locally developed applications, which the DPA says pose risks to citizens’ rights and freedoms.
The Dutch Tax and Customs Administration says the conclusions are not satisfactory and is examining which improvements can be implemented more quickly. At the same time, according to reports, the agency acknowledges that it could take several more years before data protection is in order everywhere. This makes the issue more than a technical recovery plan: citizens must be able to trust that the government uses only necessary data, controls access and can reconstruct mistakes in good time.
One story, several perspectives
What is established
- The DPA says that the Dutch Tax and Customs Administration fails to meet the requirements in ten of the twelve areas examined.
- The DPA cites shortcomings including in logging, access management, human intervention and automated selection criteria.
- The Dutch Tax and Customs Administration says it is examining improvements, but expects data protection not to be brought fully into line quickly.
Left
Arguments A left-wing approach emphasises that citizens deserve protection from opaque government power and that algorithmic selection without demonstrable human oversight is unacceptable. It would call for rapid investment, redress for affected citizens and strict supervision.
Values Equality, legal protection, privacy and oversight of executive power.
Consequences Delayed improvements could reinforce discrimination and distrust; additional supervision and investment cost public money, but this approach regards them as necessary infrastructure for the rule of law.
Centre
Arguments An institutional centrist position seeks improvement through clear priorities, verifiable deadlines and preserving the continuity of tax collection. It would distinguish between systems that must be stopped immediately and processes that can be improved with temporary safeguards.
Values The rule of law, practicability, proportionality and administrative continuity.
Consequences A phased approach can limit disruption to services, but requires transparent reporting so that delays do not quietly become permanent.
Right
Arguments A right-wing approach emphasises that the government must carry out its core tasks reliably and efficiently, and that failing IT and privacy controls make officials directly responsible. It would be critical of additional bureaucracy, but also of systems that treat citizens as risks without demonstrable grounds.
Values Responsibility, efficiency, legal certainty and protecting citizens from arbitrariness.
Consequences Greater personal responsibility and simpler systems could deliver results more quickly; insufficient resources or poor project management could at the same time damage tax collection and public services.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The current key findings were confirmed in a recent ANP report attributing the conclusions to the DPA. The broader context concerning locally developed applications and earlier systems comes from public DPA and NOS publications.
- confirmed The DPA examined the Dutch Tax and Customs Administration in twelve areas and found shortcomings in ten of them. — This is stated in the current ANP report. source
- confirmed The DPA cites shortcomings in logging and access management. — The current ANP report mentions insufficient logging and overly broad access. source
- confirmed The DPA sees risks concerning human intervention and automated selection criteria. — These points appear in the current report on the DPA’s conclusions. source
- confirmed The Dutch Tax and Customs Administration uses hundreds of locally developed applications with privacy risks. — This is stated in the DPA publication from January 2026. source
- confirmed The Dutch Tax and Customs Administration says it could take several more years before data protection is in order everywhere. — The statement is attributed to a spokesperson in the current ANP report. source
Editor's note
The current conclusions and the Dutch Tax and Customs Administration’s position are based on an ANP report dated 11 November. Earlier DPA and NOS publications provide verified context on structural privacy problems; the current DPA publication itself could not be found publicly in the search results.Sources
- Belastingdienst voldoet niet aan privacyregels, oordeelt waakhond — ANP via ZeelandNet
- Brief Belastingdienst lokaal ontwikkelde applicaties — Autoriteit Persoonsgegevens
- Belastingdienst blijft privacyschendende systemen nog zeker twee jaar gebruiken — NOS Nieuwsuur
More on this in Dutch media
- De Telegraaf — „belastingdienst privacy”
- AD — „belastingdienst privacy”
- de Volkskrant — „belastingdienst privacy”