Inclusion of BSN code in value-added tax registration number incompatible with privacy legislation?

Value-added tax registration numbers issued by the Tax and Customs Administration to sole traders feature the latter’s citizen service number or BSN. This, the Netherlands Data Protection Authority has now asserted, is incompatible with privacy legislation.

It is mandatory for all entrepreneurs to disclose their value-added tax registration number to their clientele, by posting it to their web site or including it in the invoices they raise. A value-added tax registration number issued to a sole trader features the latter’s BSN code. This has prompted the sole trader community to complain to the watchdog organisation for unwarranted disclosure of a personal detail bringing with it the risk of identity fraud being committed.

The Tax and Customs Administration’s policy in this respect has been vetted against and found to be incompatible with the GDPR-based legislation, with the watchdog organisation duly instructing the Tax and Customs Administration to put a stop to this part of the value-added tax registration routine by the first of January 2019.

The Tax and Customs Administration has announced that it is busy developing an alternative scheme, on which it intends to advise the Lower House after the summer recess. The privacy watchdog is authorised to issue a processing ban or impose a penalty in the event that the Tax and Customs Administration fails to fall into line by the agreed deadline.

Dutch version: BSN in BTW-nummer schending van privacywet?