According to the Dutch State Secretary for Finance, Menno Snel, the Tax and Customs Administration need another year to be able to comply with the new European Privacy Act GDPR. The GDPR entered into force on 25 May but the Dutch IRS is not yet ready for GDPR.
Apparently some processes within the Administration are not GDPR compliant:
- how they process citizen service numbers (social security numbers) that are used on a form (IB47) for entrepreneurs to determine whether they have paid someone for certain work or services.
- how they use camera images to monitor motor vehicle tax.
However, the Tax and Customs Administration has set up a processing index needed for GDPR where they register how personal data are processed. According to the State Secretary, the Dutch Data Protection Authority (AP) is aware of their situation but it has not yet been decided whether they will intervene.
Source: nu.nl
