Dutch Oversight Body Finds AIVD and MIVD Violated Privacy Law in Large-Scale Data Processing

The Dutch oversight body CTIVD found the AIVD and MIVD unlawfully processed personal data within large bulk datasets, in some cases granting groups of employees unauthorized access and retaining data beyond the legal limit of eighteen months plus a possible one-year extension, in some cases without even tracking how long files had been held 1234. The datasets, which can contain millions of entries including names, phone numbers, location and social media data, are drawn from other government agencies, commercial sources, and in some cases material obtained by hackers, including data from the Odido breach, and sold online 1234. CTIVD chair Hugo Hillenaar said the processing constitutes a privacy intrusion for individuals in the datasets, most of whom have no connection to espionage or terrorism, and the commission issued thirteen recommendations to improve safeguards 13. Defense Minister Dilan Yeşilgöz and Interior Minister Pieter Heerma told parliament they recognize CTIVD's findings, said improving bulk dataset management is a priority, and stated some recommendations will feed into the planned revision of the 2017 Intelligence and Security Services Act 34. Digital rights group Bits of Freedom said the services have a history of over-collecting citizen data and voiced concern they may be training AI systems on it, including data obtained from leaks 1.