The Dutch Data Protection Authority (AP) has published an opinion detailing the conditions for processing personal data in the context of fraud or non-compliance reports.

This opinion is addressed to public bodies providing benefits, subsidies or credits, as well as to supervisory authorities receiving such reports. It sets out 11 basic conditions to be met, such as the prior definition of the purpose, data minimisation, rigorous assessment of the reliability of the information, and particular attention to the processing of special categories and criminal data. Appropriate security measures and respect for the rights of the data subjects are also required. The opinion does not apply to processing already governed by specific legislation, such as the Data Processing Act by Partnerships (WGS) and the Act on the Promotion of Cooperation and Legitimate Care (Wbsrz).