Dutch councils still publishing residents’ personal data

Local governments are still publishing residents’ private phone numbers, email addresses and even BSNs, an investigation by Nieuwsuur and NOS has found.

Private information is supposed to be redacted from public documents, but Nieuwsuur discovered hundreds of documents with personal data on permit applications and responses to requests for comment on projects, among others.

The investigation found residents’ BSNs in 255 documents, alongside ID and passport numbers, and the Data Protection Authority says the true scale is probably larger.

The BSNs, names, address details, email addresses and sometimes phone numbers of 43 people who voiced an opinion about a proposed construction project were visible on a document from Pijnacker-Nootdorp, a town near Rotterdam.

Councils were warned in 2017 by the Dutch Data Protection Authority that they needed to handle private information with more care.

“It involved a human error, and we immediately made the documents inaccessible. We filed a report straight away,” a spokesperson for the municipality of Pijnacker-Nootdorp told broadcaster NOS.

The Data Protection Authority has received over 120 reports in 2026 about municipalities accidentally making personal data public. Last year, there were 75 such reports.

Since stricter rules about personal data were introduced in 2018, councils have begun using software to redact documents before they are published. In most cases, a staff member then checks the documents before they are published.

By far the most of the documents containing BSNs dated from 2016 and 2017, but 99 were published after the stricter rules took effect in 2018.