Enforcement
Dutch DPA: Tax Administration still falls short of the GDPR on 10 of the 12 topics reviewed
- Date
- Status
- final
- Body
- Autoriteit Persoonsgegevens
- Reference
- Staat van de gegevensbescherming bij de Belastingdienst, eerste editie (11 november 2026)
What it is about
On 11 November 2026 the Dutch DPA published the first State of data protection at the Tax Administration. It takes stock of the intensified supervision that started in 2024. On 12 topics the DPA assesses whether the Tax Administration complies with the law and how fast it improves. On 2 topics compliance is in order: reporting data breaches and carrying out DPIAs. On the other 10 compliance falls short. Selection algorithms are not sufficiently substantiated to prevent discrimination, the Tax Administration cannot show meaningful human intervention in algorithmic decisions where the law requires it, security and the review of logging are not in order, data are not deleted on time, access requests are not always handled on time and correctly, and the record of processing activities is incomplete. According to plan the citizen service number (BSN) will be removed from the payment reference for citizens by the end of 2026, and the applications Informatiesjabloon and KTA are to be switched off in 2027 and 2028. The intensified supervision runs until mid 2029 for now; the next edition follows in January 2028.
What this means in practice
The report shows what the DPA looks at in a large organisation, and those points apply to everyone. A DPIA alone is not enough: anyone selecting with algorithms must substantiate the selection criteria to prevent discrimination and be able to show that a person genuinely reviews the outcome where Article 22 requires it. Control who has access to personal data and review the logging. Do not use the citizen service number where it is not needed, such as in a payment reference. Measures must also keep working; that requires a privacy organisation that holds on to improvements (Article 24). The report is not a fine in itself, but the Tax Administration must follow the DPA's instructions, and otherwise the DPA can take enforcement action.
The GDPR articles concerned
- Article 5: Principles relating to processing of personal data
- Article 15: Right of access by the data subject
- Article 22: Automated individual decision-making, including profiling
- Article 24: Responsibility of the controller
- Article 30: Records of processing activities
- Article 32: Security of processing
- Article 33: Notification of a personal data breach to the supervisory authority
- Article 35: Data protection impact assessment
Source: Autoriteit Persoonsgegevens, AP: Vooruitgang Belastingdienst gaat langzaam (met de rapportage als PDF)checked on 12 November 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Themes where this returns
- Assessing risks in advance: DPIA and FRIA
- Automated decisions and human oversight
- Data quality, minimisation and data governance
- Keeping records: record of processing, technical documentation and logs
- Reporting: data breaches and serious incidents
- Rights of people: access and explanation of decisions
- Security and robustness
- Using special categories of personal data to detect bias
- Who is responsible: roles in both laws
The counterpart in the other law
- Article 2 AI Act: Scope
via Using special categories of personal data to detect bias
- Article 3 AI Act: Definitions
- Article 9 AI Act: Risk management system
- Article 10 AI Act: Data and data governance
- Article 11 AI Act: Technical documentation
via Keeping records: record of processing, technical documentation and logs
- Article 12 AI Act: Record-keeping
via Keeping records: record of processing, technical documentation and logs
- Article 14 AI Act: Human oversight
- Article 15 AI Act: Accuracy, robustness and cybersecurity
- Article 16 AI Act: Obligations of providers of high-risk AI systems
- Article 18 AI Act: Documentation keeping
via Keeping records: record of processing, technical documentation and logs
- Article 19 AI Act: Automatically generated logs
via Keeping records: record of processing, technical documentation and logs
- Article 25 AI Act: Responsibilities along the AI value chain
- Article 26 AI Act: Obligations of deployers of high-risk AI systems
via Keeping records: record of processing, technical documentation and logs
- Article 27 AI Act: Fundamental rights impact assessment for high-risk AI systems
- Article 73 AI Act: Reporting of serious incidents
- Article 86 AI Act: Right to explanation of individual decision-making
Case law8 of 17
- Gelderland District Court: bankruptcy trustee is controller, DPA fine for unsecured hard drive cut to 58,125 euros
2025-08-07 · status not established, Rechtbank Gelderland
- Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
- SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
- The Hague District Court cuts DPA fine on police for mobile camera cars without completed DPIA to 30,000 euros
2024-10-08 · status not established, Rechtbank Den Haag
- SyRI: legislation for a government risk model without insight into indicators and model offers insufficient safeguards
2020-02-05 · final, Rechtbank Den Haag, NJCM c.s. en FNV tegen de Staat der Nederlanden
- Council of State: DPA could fine DPG Media for routinely demanding ID copies, fine halved to 262,500 euros
2025-09-24 · final, Raad van State, Afdeling bestuursrechtspraak
- Noord-Nederland District Court upholds DPA fine for village livestream, reduces it to 375 euros
2025-01-09 · status not established, Rechtbank Noord-Nederland
- Schrems v Meta: no unlimited retention and aggregation of data for targeted advertising
2024-10-04 · final, Hof van Justitie van de EU (Vierde kamer), Maximilian Schrems tegen Meta Platforms Ireland Limited
Guidelines8 of 19
- Guidelines 4/2019 on Article 25 Data Protection by Design and by Default
2020-10-20 · final, European Data Protection Board (EDPB)
- Guidelines 01/2021 on Examples regarding Personal Data Breach Notification
2021-12-14 · final, European Data Protection Board (EDPB)
- Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus
2026-01-13 · final, Autoriteit Persoonsgegevens
- Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
- Guidelines 03/2026 on web scraping in the context of generative AI
2026-07-07 · under consultation, European Data Protection Board (EDPB)
- Consultation on the draft list of processing operations for which no DPIA is required (Dutch DPA)
2026-06-24 · under consultation, Autoriteit Persoonsgegevens (AP)
- Guidelines 02/2025 on processing of personal data through blockchain technologies
2026-07-07 · final, European Data Protection Board (EDPB)
- EDPB Template for personal data breach notification
2026-06-10 · under consultation, European Data Protection Board (EDPB)
Enforcement and fines8 of 17
- Dutch Tax Administration fined 3.7 million euros for the FSV fraud blacklist
2022-04-07 · status not established, Autoriteit Persoonsgegevens
- EDPB picks automated decisions in recruitment as the topic of its 2027 coordinated enforcement action
2026-11-11 · adopted, European Data Protection Board (EDPB)
- Netflix fined 4.75 million euros for failing to properly inform customers
2024-11-26 · under appeal, Autoriteit Persoonsgegevens
- HAN University of Applied Sciences fined 175,000 euros for inadequate security
2025-12-15 · final, Autoriteit Persoonsgegevens
- 150,000 euro fine for ICS for missing DPIA on digital identity checks
2023-12-18 · final, Autoriteit Persoonsgegevens
- Dutch DPA study: algorithms and AI at debt collection agencies
2026-10-29 · final, Autoriteit Persoonsgegevens
- Dutch DPA and tennis federation KNLTB end litigation: fine cut from 525,000 to at most 250,000 euros
2025-10-18 · status not established, Autoriteit Persoonsgegevens
- 600,000 euro fine for AS Watson (Kruidvat) over tracking cookies without consent
2024-05-02 · annulled, Autoriteit Persoonsgegevens
Legislation in motion6 of 8
- Proposal: reformulation of automated individual decision-making (Article 22 GDPR)
2025-11-19 · proposal, Europese Commissie
- European Parliament: joint ITRE-LIBE draft report, amendments tabled, no committee vote yet
2026-06-22 · under negotiation, Europees Parlement, commissies ITRE en LIBE (gezamenlijke commissie)
- Proposal: refusing requests that abuse the right of access (Article 12(5) GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: breach notification only for high risk, within 96 hours, via a single entry point (Article 33 GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: EU-wide DPIA lists, template and methodology (Articles 35, 57, 64 and 70 GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: definition of scientific research, purpose limitation and information duty for research (Article 4(38), 5(1)(b) and 13(5) GDPR)
2025-11-19 · under negotiation, Europese Commissie
Analysis6 of 24
- Agentic AI under the EU AI Act: how to govern autonomous agents
2026-07-07
- AI DPIA: when is it required? Five-step check (2026)
2026-03-23
- AI agents and GDPR Article 22: no hard stop, no consent fix
2026-10-14
- The agent register: what to record for each AI agent
2026-11-05
- Regulators will look at automated candidate screening in 2027: what to put in place now
2026-11-13
- AI agents and the GDPR: what you need to arrange
2026-11-05