DPA case 05.08.2025 – Violation Found (Netherlands, 2025)

In 2024, the Dutch bank ABN Amro released information stating that their third-party service provider AddComm had suffered a ransomware attack. The DPA carried out an investigation regarding the incident. On July 4, 2025, the data subject made a request to the DPA under the Open Government Act (Woo) for the disclosure of documents related to a data breach at AddComm, including the full investigation and report. The DPA decided not to disclose the requested documents based on several different grounds. Business and manufacturing data provided to the DPA by AddComm and other entities were considered confidential and therefore exempt from disclosure under Article 5.1(c) of the Woo. Even non-confidential data that was commercially sensitive was withheld to prevent potential harm to the economic interests of companies, as disclosed under Article 5.1(f) of the Woo. Moreover, personal data within the requested documents, such as names, contact details, and case numbers, were protected under the exemptions in Article 3.1(e) of the Woo. On top of this, the DPA argued that disclosure of the investigation's strategic aspects, such as how the DPA exercises its supervisory role, could undermine the DPA’s effectiveness in monitoring compliance, as it could lead controllers to alter their behavior to circumvent scrutiny. In a related manner, disclosing the documents could harm the DPA’s ability to effectively exercise its supervisory duties, as organisations might lose trust and become less willing to share information with the DPA. As a result, the DPA refused the disclosure request in its entirety and emphasised that such information must remain confidential to maintain trust in the DPA’s role.