Minister Adriaansens (EZK) responds to questions about the letter to parliament regarding the status of the investigation into the authorization management of the Trade Register. These questions were posed by the VVD, D66, and SP parliamentary parties.
Date: July 12, 2022
Subject: Answers to questions from the written consultation Status of the investigation into authorization management of the Trade Register
Dear Chairman,
I hereby present to your House the answers to the questions posed by members of the VVD, D66, and SP parliamentary parties regarding the letter of April 21 concerning the status of the investigation into authorization management at the Trade Register (Parliamentary Document 32761, no. 219).
The questions were submitted on June 15 with reference number 32761.
M.A.M. Adriaansens
Minister of Economic Affairs and Climate
Questions and answers
Questions asked by members of the VVD parliamentary party
The members of the VVD parliamentary party have read that all unconfirmed authorizations have been revoked. How many authorizations have been revoked? Are there any known cases among these revoked authorizations where private addresses may have been requested unlawfully? If so, will the persons whose private addresses may have been requested unlawfully be informed of the request for their private address?
Answer In the letter dated April 21, 2022, I indicate that the Chamber of Commerce (hereinafter: KVK) has revoked the authorizations of more than 700 authorization holders who did not respond to the KVK's request within the specified response period (1). The requests made by these customers were investigated in depth and discussions were held with the (former) authorization holders. The KVK ultimately deemed the inquiries of three authorization holders to be unlawful. These concerned three extracts that included private addresses. In accordance with the guideline of the Autoriteit Persoonsgegevens , the KVK did not contact the parties involved because this was a low-risk situation (2).
The members of the VVD parliamentary party have read that authorizations of primary authorized persons have been revoked when they are no longer registered with the respective professional organization. Here too, these members would like to know how many authorizations have been revoked and whether there are any known cases of unlawful requests for private addresses in connection with these revoked authorizations. If so, are the persons whose private addresses may have been unlawfully requested informed about the request for their private address?
Answer After completion of the first check in the fall of 2021, 249 authorizations of professionals were revoked, followed by the cleanup operation in early 2022, during which more than 700 authorizations of professionals and their employees were revoked. For background information, please refer to the respective letters to parliament dated November 2021 , and April 2022 (3). The Chamber of Commerce's administration has since been organized in such a way that a distinction can be made between primary and delegated authorizations. Periodic checks on primary authorizations were then immediately initiated. The priority here is to immediately revoke an authorization as soon as a professional is deregistered.
If, during its periodic checks, the Chamber of Commerce finds that an authorisation holder has requested trade register information products after being removed from the professional register, it will investigate this further. If necessary, the Chamber of Commerce will inform those involved about the unauthorised access to the data, in line with the guidelines of the Autoriteit Persoonsgegevens. No irregularities have been found to date.
The members of the VVD parliamentary party have read that the Chamber of Commerce, in collaboration with professional organizations, is conducting research into the automation of periodic inspections. These members believe that automation could prevent a great deal of manual work and (unintentional) human error. When does the Minister of Economic Affairs and Climate Policy expect the automation to be ready?
Answer With the periodic checks that are now in place, authorization management has improved significantly and become more manageable. The automation process is currently in the analysis phase, which means that the lead time is not yet clear. When planning the implementation, it must be taken into account that the Chamber of Commerce is already facing a major digitization task. This is mainly due to the cleanup of legacy systems and the large number of legislative processes currently underway, including the upcoming changes related to the implementation of the Data Vision on the Trade Register. Automation also depends on the IT agenda of the professional organizations and requires good coordination.
The members of the VVD parliamentary party note that the Chamber of Commerce will continue to work on improving authorization management. These members would like to be informed about how this improvement will take place and what improvement measures will be taken. These members believe that it is good that the Chamber of Commerce continues to improve its authorization management. In this regard, the members refer to the amended motion by members Kathmann and Rajkowski (Parliamentary Document 32 761, no. 217), which was submitted to improve the Trade Register in a quick and simple manner by introducing an opt-in system. Is the minister prepared to introduce an opt-in system so that self-employed persons can decide for themselves whether their private address is made public by the Chamber of Commerce?
Answer The Chamber of Commerce has already taken significant steps to improve authorization management. In addition to the measures announced in the letter to parliament dated April 21, 2022, no other measures are planned for the time being. Despite the tightening of the authorization policy, it is of course possible that areas for improvement may arise in the practical implementation of the authorization policy. The Chamber of Commerce will address these promptly, given the importance of good authorization management.
The proposed opt-in system does not affect which data an authorization holder can view. Authorizations are only granted to professional groups that are designated by law (Art. 28 Hrb) and that have specific rights for the purpose of performing their public duties. The opt-in system only affects users of the Trade Register who do not have authorization and can therefore only view public data. For this reason, the aforementioned professional groups have a great responsibility to use authorizations responsibly, and the Chamber of Commerce has organized its management in such a way that it is no longer dependent on the authorization holder to keep the user database up to date.
Questions asked by members of the D66 parliamentary party
The members of the D66 parliamentary party note that the letter states that no explanation has been received from five former lawyers regarding the unauthorized access to address details from the Trade Register. These members ask what further legal or procedural steps have been taken against these five lawyers.
Response: The Chamber of Commerce did not receive a statement from five former lawyers. The Chamber of Commerce informed six parties involved, whose details were included in the unauthorized inquiries, by letter. Considering the inquiry behavior and the nature of the case, the Chamber of Commerce saw no reason to take further procedural/legal steps against the five former lawyers.
The members of the D66 parliamentary party would like to hear from the minister why the motion by Mr. Van Ginneken et al., requesting the cabinet to protect business addresses in parallel with the current consultations as soon as possible if these correspond to the residential address, if the entrepreneur so wishes and if there are no other laws that already require publication (such as consumer protection laws) (Parliamentary Document 32 761, no. 210).
Why was the above motion not implemented before the May recess? Why has it been decided not to implement the above motion, given that this option has already been included as the baseline in the proposals in the KVK consultation? What is the point of the delay involved in waiting for the outcome of the consultation before implementing the above motion? Does the minister not consider it undesirable that the risks for self-employed persons, including journalists, scientists, and other vulnerable professional groups, continue to exist longer than necessary? If not, why not?
Answer In the letter on the progress of the Data Vision, which your House received on June 29, it was explained that the protection of the visiting address of sole traders will be implemented by the Chamber of Commerce (KVK) as soon as possible at their request (4). This will require the entrepreneur to register a postal address, but no further requirements will be imposed. This solution is in line with the content of the motion, which will thus be implemented in practice. Nevertheless, this change may have consequences for third-party processes, both public and private. That is why it was first tested in the expert sessions in April and May. During the debates in February and March 2022, which led to the motion being submitted, it was already indicated that the need for a careful process would undoubtedly stand in the way of implementation in the short term.
Vulnerable professional groups, such as journalists and scientists, did not have to wait for this amendment. For them, provisional protection was already implemented at the start of the consultation on the relevant amendment to the Trade Register Decree. This was also reported to your House in the letter of April 21, 2022, concerning the motions and commitments relating to the protection of addresses in the Trade Register (5).
Questions asked by members of the SP parliamentary party
The members of the SP parliamentary party believe that action needs to be taken with regard to the authorization management of the Trade Register. These members appreciate that an update has been provided and that the procedures have been tightened up. However, they request clarification of the information provided. These members note that the risk of unauthorized queries by the more than 700 non-respondents has been investigated. With the exception of three organizations, an authorized professional was present at the time of the queries. Can you specify what this means? What is meant by 'present'? Could this mean that in a large organization, there is a professional present who has little insight into the queries from the register? Can you specify what kind of organizations the 1,620 non-governmental organizations that were queried are?
Answer The 1620 non-governmental organizations mentioned are the professional groups of lawyers, notaries, and bailiffs designated by law. By "presence of a qualified professional," the Chamber of Commerce means that at the time of the inquiries, an official registered with a professional organization was working at the office that holds the authorization.
The competent professional (primarily authorized) has the option of requesting delegated authorization for employees. The Chamber of Commerce applies strict authorization conditions for this, whereby the primarily authorized person is and remains responsible for supervising the queries made by his employees. The members of the SP faction note that the Chamber of Commerce's administration is being further synchronized with that of government institutions. Can this be specified? What government data does the Chamber of Commerce have at its disposal? Which government institutions have access to the Chamber of Commerce's data? What safeguards are in place in this regard?
Answer The Chamber of Commerce has asked all government agencies that use the Trade Register whether the authorizations issued to employees of those agencies are still valid. Outdated authorizations, together with the authorizations of non-respondents, have been revoked. Government institutions are responsible for managing the authorizations of their employees. The Chamber of Commerce conducts periodic and continuous checks on the authorizations that have been issued.
The Trade Register is a basic register and forms part of the system of basic registers. The aim of this system is to promote a single query and to ensure that basic registers use each other's authentic data. Other registers used by the Chamber of Commerce include the Personal Records Database (BRP) and the Basic Registration of Addresses and Buildings (BAG).
Public information is accessible to everyone, while non-public information is only accessible to authorities specified by law. This may vary from one government organization to another, as different authorities perform different tasks. The protected residential and business addresses in the Trade Register can be viewed by all administrative bodies that need this information to perform their public duties. They are also required to use the Trade Register for this purpose (6).
The members of the SP parliamentary party also inquire about the status of protecting private addresses when an entrepreneur has established a business at his or her home address.
Answer This question was answered in the letter to your House dated April 21 (7) (see answer to second question from the D66 party).
Parliamentary document 32 761, no. 219
https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/beveiliging/meldplicht-datalekken#moet-ik-alle-datalekken-melden-aan-betrokkenen-5094
Parliamentary document 32 761, no. 201
Parliamentary document 32 761, no. 240
Parliamentary document 32 761, no. 225
An administrative body within the meaning of Article 1:1(1)(a) of the General Administrative Law Act (Awb) is: "a body of a legal entity established under public law." Examples include the Tax and Customs Administration and the National Police.
Parliamentary document 32 761, no. 240
