Intensive surveillance of the municipality of Eindhoven terminated subject to conditions
As from 1 March 2025, the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, terminates a period of intensified surveillance of the municipality of Eindhoven. Since the intervention of the AP, the municipality has stepped up its efforts in the area of privacy and data protection. The AP has attached a number of conditions to thistermination though.
The intensified surveillance by the AP started on 1 March 2023. The reason for this measure was a series of worrying signals about the way the municipality of Eindhoven handled personal data and the privacy of people. An improvement of the privacy culture proved necessary.
Points of concern
Among other things, this concerned signals that the municipality did not report data breaches or did not report them in time. And that data of people in Eindhoven were structurally retained for too long. At the time, the municipality also collected and used personal data without analysing the privacy risks first, even though this is mandatory.
Steps taken
The AP observes that the municipality has made steps in the right direction in several areas since then. For example, a protocol for dealing with data breaches is now in place. In addition, the role and position of the Data Protection Officer (DPO) has been formally recorded and worked out. The Data Protection Officer is the internal privacy supervisor who must be able to operate independently and must also be able to sound the alarm without being asked to. The municipality is also working on a new privacy policy.
‘As a resident, you must be able to trust that your municipality handles your personal information properly, also because you have to rely on the municipality for all sorts of practical matters in your life,’ vice chair of the AP Monique Verdier says. ‘That had really not been arranged properly at first. It is good to see that the Municipal Executive of Eindhoven has taken up the challenge and implemented demonstrable improvements in the meantime.’
Conditions
The termination of the intensified surveillance is subject to a number of conditions, however. These conditions serve as an incentive for the municipality to keep working on an adequate level of privacy and data protection. Because there are still steps to be taken. For example, the new privacy policy still has to be formally adopted. In addition, there will be an evaluation interview with the AP no later than six months after the end of the intensified surveillance. And the Municipal Executive will have to measure the level of compliance with the GDPR and have this validated by an external expert party.
Even after termination of the intensified surveillance, the AP will be able to start an investigation and possibly impose sanctions at any time. Of course, this is not what the AP is after, Verdier explains: ‘The AP takes decisive action where necessary. But frequently, things can also improve in a different manner. For example, through a somewhat stricter supervision, combined with advice, to help an organisation take steps in the right direction. This is what the AP did in the case of the municipality of Eindhoven. Now it is up to the municipality to bring this process to a good close. The AP will keep monitoring the situation.’
