Managers at crypto firm Bitvavo had easy access to client data: Report

For years, the management and owners of the Dutch crypto platform Bitvavo had easy access to customer data and accounts, NOS and the Financieele Dagblad reported. Dutch privacy regulations stipulate that only a limited group of company employees, such as the anti-money laundering department and customer services, may have access to this data.

The company confirmed to NOS that managers had access to customer data until the spring of 2024, arguing that this was necessary in the early years when managers still helped register new customers and answer questions.

A Bitvavo spokesperson told the broadcaster that the company was much smaller back when managers had access to client data. The Amsterdam crypto exchange now has 460 full-time jobs, about 300 more than in that period.

An investigation, conducted by the law firm Stibbe and accounting firm PwC, is currently underway to determine whether the company and employees have complied with the privacy and conduct rules.

Privacy law professor Gerrit-Jan Zwenne told FD that “given the company’s size and growth, it might have been useful to grant management all kinds of access rights. But that is at odds with privacy law.”

Bitvavo says that only authorized departments now have access to customer data.