Tax and Customs Administration beaten by GDPR deadline

GDPR, the EU’s General Data Protection Regulation (which in the Netherlands is referred to as “AVG”), has been in full force and effect since the 25th of May of this year. Although the new privacy regime applies businesses, institutions and the authorities alike, the Dutch State Secretary for Finance in response to Parliamentary questions has recently had to concede that the Tax and Customs Administration will be needing another year to achieve compliance, even though – on the upside – it has successfully set up the requisite across-the-board data processing register, thus ensuring according to the State Secretary that any changes to processing activities, be they pre-existing or newly embarked upon, will be duly recorded.

The Tax and Customs Administration’s web site (dutch) features an overview of the various types of personal data processing activity, for some of which proper legislative footings are being construed or alternatives developed – on suspension for now of personal data processing in the relevant categories – as they currently lack adequate statutory grounding.

The array of applications the Tax and Customs Administration has traditionally had at its disposal in which details for use in supervisory and operational processes have been compiled are either being modified or overhauled in their entirety, as they do not comply with GDPR requirements where it concerns data (access) limitation. In addition to this the Tax and Customs Administration has fallen behind in its data clean-up activities.

Any security incidents that involve the potential loss of personal data or any unlawfully processing of personal data are assessed by the Tax and Customs Administration, with which a total of 1,275 reports were logged last year 225 of which were escalated to the Netherlands Data Protection Authority. Those whose details it concerned were notified in 84 cases in view of the grave impact on their rights and freedoms the incidents in question may have had.

Dutch version: Belastingdienst niet klaar voor AVG