- Enforcing jurisdiction
- Netherlands · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
AP (The Netherlands) – Court Ruling (Netherlands, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Dutch court ruled that the social security administrator SVB improperly shared personal data of a child with the Tax Administration. This ruling is significant because it stresses the importance of protecting personal data and ensuring that sharing practices are justified. Organizations must be cautious about how they handle sensitive information.
What happened
SVB shared personal data of newborns with the Tax Administration without proper justification.
Who was affected
Families of newborns whose data was shared with the Tax Administration without consent.
What the authority found
The court found that SVB unlawfully invaded the privacy of the child by sharing personal data without a valid legal basis.
Why this matters
This decision reinforces the need for organizations to conduct thorough assessments before sharing personal data. It serves as a reminder for companies to prioritize data protection and privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The SVB (controller), a social security administrator in the Netherlands, structurally send personal data of newly born children to the Tax Administration. The controller has this data, as it is responsible for paying out the general child allowance. The tax office is responsible for paying out the child-related budget (an extra allowance for low-income families). The data subject's father believed that the controller wrongfully shared his daughter's information with the Tax Administration in connection with the child-related budget. He never submitted an application for this allowance and, in view of his income, he was not eligible for it. Complaint 1: on 4 January 2017, the data subject's father submitted a complaint with the Dutch DPA. He argued that the controller failed to carry out a proportionality test, which was a breach of the Wpb.'Wet bescherming persoonsgegevens,' the implementation of Directive (EU) 2016/680 (the GDPR predecessor) He requested the DPA to order the controller to immediately cease the structural provision of data on all children to the Tax Authorities. Complaint 2: on 17 May 2019, the data subject filed another complaint with the DPA against the controller and the Tax Authority (now based on the GDPR). He argued that the controller violated the principle of proportionality and subsidiarity contained in the GDPR. He requested the DPA to order the controller and the Tax Authority to remove his daughter's personal data from their systems. (He has now limited this complaint to the controller). On 19 November 2020, the DPA rejected the complaint. The data subject's father also started legal proceedings against the controller. This resulted in a [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_AWB_-_20_3811 Court ruling on 4 May 2021], where the Court held that the controller had indeed unlawfully invaded the privacy of the data subject by providing her personal data to the Tax Administration. The controller appealed this decision t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for AP (The Netherlands) in NL
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
13 December 2021
Authority
Autoriteit Persoonsgegevens
About this data
Cite as: Cookie Fines. AP (The Netherlands) - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: