The Dutch Data Protection Authority (DPA) on Tuesday announced a fine of €2.75 million (U.S. $3.1 million) against the government’s Tax and Customs Administration for violations of the EU’s General Data Protection Regulation (GDPR).
The Tax and Customs Administration, part of the Ministry of Finance, for years “processed the (dual) nationality of applicants for childcare allowance in an unlawful, discriminatory, and therefore improper manner,” the Dutch DPA stated in a translated press release. The government agency should have deleted this data in January 2014 but instead kept and used it. In May 2018, the month the GDPR took effect, the tax authorities’ system still contained the dual nationality information of 1.4 million people, according to the DPA.
