The Authority for Personal Data (AP) announced the conclusion of intensified supervision over the municipality of Eindhoven, effective March 1, 2025, under certain conditions aimed at ensuring continued adherence to privacy and data protection regulations.
The AP had initiated this heightened monitoring on March 1, 2023, following alarming signals about how personal data and privacy were being handled by the municipality. Issues included delayed reporting on data breaches and excessive retention of personal data without proper risk assessments, which were mandatory. AP vice-chairman Monique Verdier emphasized, “Als inwoner moet je erop kunnen vertrouwen dat je gemeente goed met je persoonlijke gegevens omgaat, ook omdat je voor allerlei praktische zaken in je leven op de gemeente aangewezen bent. Dat was aanvankelijk echt niet goed genoeg geregeld.”
Since the start of this monitoring, significant steps have been taken to improve the municipality’s privacy culture. The AP recognized these efforts, noting the introduction of protocols for handling data breaches and the formal establishment of the role of the Data Protection Officer (DPO). This officer serves as the internal privacy watchdog, operating independently to highlight any issues without needing permission. The municipality is also developing new privacy policies to supplement these enhancements.
Although the intense supervision is lifting, several conditions must be satisfied to maintain elevated standards of data privacy. The newly drafted privacy policy must receive formal approval, and the municipality must conduct a compliance evaluation with the General Data Protection Regulation (GDPR) within six months post-monitoring. The AP will continue its oversight and retains the authority to launch investigations or impose sanctions if necessary. Verdier elaborated on this, stating, “De AP treedt streng op als dat nodig is. Maar regelmatig kunnen dingen ook verbeteren op een andere manier.”
Meanwhile, the Hoorn municipality faces its conditions as it prepares to possibly resume offering starter loans, aimed at supporting lower-income individuals seeking to buy homes. Amid rising market interest rates, which have increased the municipality’s financial burdens to around 400,000 euros annually, the local council will decide by June the additional conditions for these loans. It is anticipated they will proceed, potentially with restrictions on price caps, borrowing limits, or eligibility based on residency or employment criteria.
The resumption of these starter loans is seen as pivotal; it could provide necessary financial assistance to help individuals with lower incomes secure housing, thereby promoting housing mobility and retaining younger residents—an effort to counteract local demographic decline. Discussions during the council meeting indicated widespread support for the resumption of the loan program, recognizing its importance for community stability and growth.
Overall, both the situation surrounding Eindhoven’s privacy management and the discussions for Hoorn’s starter loans highlight the broader theme of conditional permissions within Dutch regulations. Entities are being encouraged to pursue compliance proactively, with the expectations set not only for governance but also for supporting citizens’ needs and rights. The AP and local governments stride toward ensuring sustainable solutions through oversight, conditional permissions, and community programs, demonstrating the importance of balancing governmental responsibilities and citizen trust.