Cities halt sharing of passport photos with Employee Insurance Agency amid privacy probe
The Netherlands’ three largest municipalities have stopped sharing passport photos of residents with the Employee Insurance Agency (UWV), while Amsterdam has reported a potential data breach, and the national privacy regulator has opened an investigation into the agency’s handling of personal data used in fraud enforcement, AD reports.
The developments follow scrutiny of UWV’s practice of requesting passport and ID application photos from municipalities—without informing residents—supporting fraud investigations involving people receiving benefits. The photos, originally submitted for passports or identity cards, were in some cases transferred to UWV’s enforcement division and used for surveillance after reports of suspected undeclared work.
UWV’s internal communications indicate the approach was considered unlawful. The agency has since stated it believes the practice is permitted under applicable rules.
Municipalities have now reassessed the arrangement. The Hague, Rotterdam, and Amsterdam confirmed they have stopped providing such photographs, concluding they should never have been shared with UWV. The cities said earlier instructions had not been properly followed and have since tightened internal policies on handling such requests.
“Providing these passport photos is not allowed, and employees are now clearly aware of that. If there is any doubt after a request, the legal basis can be reviewed with a specialist within the department,” a spokesperson for The Hague said.
The municipalities noted that practice varied widely across the country. Apeldoorn, for example, refused UWV’s requests, while The Hague, Rotterdam, and Amsterdam reportedly complied multiple times per year when asked.
Amsterdam has gone further, formally reporting a data breach to the Dutch Data Protection Authority (AP). The city also requested that UWV delete the received data from its systems. UWV refused, arguing the material must remain in investigative files until cases are concluded or presented in court.
The AP confirmed it is examining the matter. A spokesperson stressed that organizations must be highly cautious when requesting passport copies for identification purposes because they contain sensitive personal data. The regulator is reviewing whether the legal conditions for such requests were met and said it cannot comment further while the investigation is ongoing.
Under Dutch law, passport photos can be shared in specific cases, including by police for victim identification purposes. UWV maintains that it is acting within the law. It says data is retained during active fraud investigations as part of case files and is only destroyed once a case is closed.
The agency added that some specially authorized investigators may request passport photos under limited circumstances, including for criminal investigations, based on the Paspoortwet and the Paspoortuitvoeringsregeling Nederland (PUN).
The controversy has also drawn criticism from the labor union FNV, which filed a complaint with the privacy watchdog last month. The union called the practice “unacceptable and painful,” saying workers are being placed in an impossible position and some employees experience stress over the requests.
