Dutch municipalities still leaking citizen data 9 years after order to tighten security
Dutch municipalities are still accidentally publishing citizens’ personal data on the internet, NOS and Nieuwsuur discovered. They found hundreds of documents online containing citizens’ email addresses, phone numbers, addresses, and even passport and citizen service numbers (BSNs). In 2017, the Dutch Data Protection Authority (AP) alerted municipalities to this issue and instructed them to handle the publication of citizens’ data with more care.
These data leaks occur, for example, when residents apply for a permit or respond to a plan in their area, such as plans for an asylum shelter or housing construction. Municipalities are obliged to publish these as part of the Open Government Act, but they must first redact personal data. NOS and Nieuwsuur found that this doesn’t always happen, or not well enough.
NOS found citizens’ BSNs in 255 documents, including one document from Pijnacker-Nootdorp that contained the BSNs of 43 people who commented on a new construction project. These documents also contained names, address details, email addresses, and telephone numbers.
The vast majority of documents found containing BSNs were published in 2016 and 2017. Since the introduction of stricter privacy rules in 2018, BSNs have been leaked in 99 documents.
The careless use of BSNs can lead to crimes like identity fraud, the AP told NOS. There is no reason to publish a BSN. “As a rule, this is not allowed, and it is therefore a data leak,” a spokesperson for the AP said.
NOS informed municipalities about the leaked data last week. Many municipalities have removed the offending documents or are in the process of doing so, a spokesperson for the VNG, the association of Dutch municipalities, told the broadcaster.
“Municipalities take the findings of the NOS investigation very seriously. Personal data must be well protected,” the VNG spokesperson said. They added that anonymizing millions of documents is a massive task, and municipalities do not receive a separate budget for this.
The AP told NOS that BSNs and passport numbers are not the only data that constitute a leak. Publishing an address or incorrectly listing a name is already a data leak. It is unclear how often municipalities leak citizens’ data. NOS and Nieuwsuur only conducted targeted searches for data that clearly should not be published, such as BSNs.
The AP received over 120 reports of data leaks from municipalities so far this year. Last year, it received 75 reports. The increase in reports may be partly due to more awareness of the issue. But “it is plausible that the problem is actually larger,” the regulator told NOS.
