Enforcing jurisdiction
Netherlands · Geography does not establish applicable law.
Confirmed applicable legislation

Sociale Verzekeringsbank – Court Ruling (Netherlands, 2021)

Court Ruling
DPA RbMidden-Nederland4 May 2021Netherlands
final
Court Ruling

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

The Sociale Verzekeringsbank shared personal data of all newborns in the Netherlands with the tax office without proper justification. Although the court found this was a breach of GDPR, the claimant could not prove damages, so no compensation was awarded. This case highlights the importance of ensuring data sharing is necessary and proportionate.

What happened

The Sociale Verzekeringsbank sent personal data of all newborns to the tax office without a proper legal basis.

Who was affected

Parents of newborns in the Netherlands whose children's data was shared with the tax office.

What the authority found

The court ruled that while there was a breach of GDPR, the data sharing was excessive and the claimant was not entitled to compensation.

Why this matters

This ruling emphasizes that organizations must carefully assess the necessity of sharing personal data. Companies should ensure they have a valid legal basis and avoid excessive data sharing.

Recorded legal citations
Automatically processed
Art. 5(1)(a) GDPR
Art. 6(1)(c) GDPR
Art. 82 GDPR
View original scraped data
Art. 5(1)(a) GDPR
Art. 6(1)(c) GDPR
Art. 82(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
8:88 Awb
38 Awir
Decision AuthorityRb. Midden-Nederland

Source checks

Linked-source text retrieved.

Automated check recorded — 20 March 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The Sociale Verzekerinsbank (Social Security bank, hereafter SVB) sends personal data of all newly born children in the Netherlands to the 'toeslagen' (welfare benefits) department of the tax office in a 'start-message'. The start-messages are shared on the basis of an agreement between the SVB and the tax office. Data includes the BSN-number (a state-issued identity number), date of birth and country of residence of the child. The SVB has this data as it is responsible for paying out the general child allowance, to which all parents/caretakers are entitled. The tax office is responsible for paying out the 'kindgebonden budget' (child-related budget), an extra allowance for relatively low-income families. The data in the start-messages is used to quickly decide on applications for the child-related budget. The claimant has a daughter born in 2016, whose personal data was shared by the SVB with the tax office in a start-message. The claimant's daughter does not qualify for the child-related budget. The court considered whether the child's personal data was legally shared with the tax office under the GDPR, and where it was not, whether the representative of the child have a right to monetary compensation. It held that whilst there was an infringement of the GDPR, the claimant is not entitled to compensation as damages could not be proven. The court considers that there is a proper legal basis in the law for sharing the data in the start-messages in the form of Article 38 of the Algemene wet inkomensafhankelijke regelingen (General law on income-related schemes) which requires state organs to share all relevant information with the tax office which they may need to fulfil their obligations. However, the data sharing through start-messages as required by the agreement between the SVB and the tax office is excessive. The court considers that data of all children is shared, whereas only about 42% of them qualify for the child-related budget. The agreement could therefo

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Sociale Verzekeringsbank in NL

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

4 May 2021

Authority

DPA RbMidden-Nederland

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Sociale Verzekeringsbank - Netherlands (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: