Dutch DPA orders Ministry to delete illegally obtained personal data

The Dutch Data Protection Authority (DPA) has instructed the Secretary of the Ministry of Social Affairs and Employment to delete personal data from members of the Muslim community that was unlawfully collected.

The information was gathered between 2016 and 2019 by conducting secretive investigations into individuals, organizations, and networks within Muslim communities in the Netherlands.

The Ministry of Social Affairs and Employment conducted these investigations without informing the mosques and people who were being investigated. According to Aleid Wolfsen, Chairman of the Dutch DPA, that’s unacceptable.

“Collecting personal data in these investigations was illegal because it was done without a legal basis, and the Ministry wasn’t transparent about it. Moreover, it was discriminatory because it mainly focused on people with an Islamic background. This damages people’s trust in the government,” he says in a statement.

In total, the Ministry launched 12 investigations between 2016 and 2019. The Dutch DPA instituted its investigation in September 2023. It consulted a total of 3,000 documents, including interview reports, emails, and notes.

In addition, the Ministry utilized open sources, including the internet and social media, conducted at least 31 interviews, and did on-site field research as well. Furthermore, it hired a research agency to pay a visit to certain mosques to ‘gain insights into the formal infrastructure and to collect in-depth data.’

The interview reports contained personal data, such as names, education, employers, job descriptions, behavior, and religious beliefs and ideas. Furthermore, hundreds of people were mentioned in these reports and other documents, including their names and relationship to the person who was being investigated.

In September 2023, Secretary Eddy van Hijum acknowledged the unlawful conduct and apologized for it to the House of Representatives. He also sent a letter to inform people they could submit an information request.

According to the Dutch DPA, this is a first good step. Additionally, the Ministry has to delete all data that was collected illegally. This should happen in two months so people will have the opportunity to see what information has been collected.

“The lives of innocent people were mapped out without them knowing. Not by an intelligence service or the police but by a Ministry. This was wrong and discriminatory,” Wolfsen concludes.