The Dutch Data Protection Authority found that the Tax Administration was doing too little to protect the privacy of citizens and businesses. After assessing 12 areas, the regulator said the service failed to meet requirements in 10 of them, putting fundamental rights at stake.

It demanded improvements to security, human oversight and the protection of social security numbers.