South Holland province exits privacy watchdog supervision

The Dutch privacy regulator, Autoriteit Persoonsgegevens (AP), has ended its enhanced supervision of the South Holland province following a multi-year improvement process. The oversight was initiated in early 2024 due to the province’s inadequate response to a major data breach discovered in September 2023.

The breach involved an internal system containing approximately 50 million documents, including personal data, salary specifications, and criminal records. It was revealed that employees had access to information beyond their authorized scope. While the province reported no evidence that the data was shared with third parties, it took nearly two years to reset access rights and secure the documents.

The AP noted that the province “had a long way to go,” criticizing the slow pace of initial improvements. To resolve the issues, South Holland had to overhaul its privacy policies and mandate privacy training for all civil servants. The province is also undergoing an “information transition,” involving a 23 million euro investment to replace outdated information systems.