Dutch tax authority fails privacy requirements in 10 of 12 areas, regulator says

The Dutch Data Protection Authority says the Tax Administration fails to meet privacy requirements in 10 of 12 areas it examined, citing gaps in data security, human oversight of algorithms and safeguards against discrimination.

The regulator said the agency lacks sufficient systems to record who accesses personal data. It also said the Tax Administration could not show that a person meaningfully intervenes when algorithms are used to make decisions. Algorithms must not decide cases on their own, the authority said.

The watchdog also criticised the agency’s safeguards against discrimination in automated selection criteria. It wants the Tax Administration to stop putting citizens’ service numbers in payment references and debt-collection numbers, warning that someone who knows a person’s number could use it to find out whether they owe tax.

The report gives no timetable for the changes in the account published by Nieuws.nl.