Extra supervision of the municipality of Eindhoven, which does not protect personal data enough: ‘Seriousness and urgency insufficiently recognized’

The Dutch Data Protection Authority (AP) will monitor more strictly whether the municipality of Eindhoven complies with the privacy protection of its residents. The supervisor writes on Wednesday that the municipality does not report data leaks or does not report them on time, omits mandatory scans for privacy risks and stores personal data of citizens for too long. An improvement plan drawn up by the municipality has not allayed these concerns.

The AP has been in talks with the municipality of Eindhoven for some time about abuses related to the handling of personal data. For example, the data protection officer of the municipality concluded in both 2020 and 2021 that data leaks were regularly not reported on time and that mandatory analyzes of privacy risks were not always carried out. For example, the municipality would have introduced an environmental pass and a pressure meter without this analysis. There was also no report prior to a test with an app that links job seekers to vacancies using an algorithm.

The municipality received a letter from the AP in July and entered into discussions in September, after which the supervisor asked for an improvement plan. The AP now concludes that this plan is not sufficient. According to Vice-President Monique Verdier, it seems that the municipality “does not sufficiently recognize the seriousness and urgency of the concerns,” the statement said.

As part of the stricter supervision, the municipality of Eindhoven must send a report within two months with more information about data leaks, risk analyzes and retention periods, among other things. The AP then examines whether further steps are necessary. The city Council say to ‘study carefully’ the letter from the regulator and to send a response to the city council in May. In the meantime, Eindhoven continues to work on the “points for improvement” identified by the AP.

ttn-32