The Dutch Data Protection Authority (AP) has published its first report on the "State of Data Protection within the Tax Administration," highlighting slow progress in compliance despite increased oversight.

This report, resulting from intensified monitoring implemented in 2024, reveals that the Tax Administration still does not comply with data protection legislation in 10 of the 12 areas examined. The main shortcomings concern insufficiently justified selection algorithms, the inability to demonstrate human intervention in algorithmic decisions when required by law, and inadequate securing of personal data. The Tax Administration cites the obsolescence of its IT systems and competing political priorities. However, the AP considers that data protection must be a priority, especially for high-risk processing.

Progress is nevertheless noted in two areas now compliant: data breach notification and the conduct of Data Protection Impact Assessments (DPIAs). Further improvements are expected, such as the removal of the citizen service number (BSN) from payment references by the end of 2026. This enhanced monitoring, planned until mid-2029, was established following a high number of sanctions imposed on the Tax Administration between 2019 and 2022. A member of the AP's board described the still insufficient protection of citizens' data as "concerning," while noting that the organization's management is striving to resolve the issues. The next report will be published in January 2028.