Good news for the Autoriteit Persoonsgegevens. The House of Representatives has agreed to a motion calling on the cabinet to increase the budget for the regulator to the extent that it can better perform its duties. The number of full-time jobs (FTE) should grow from 184 to 470 next year. RTL News was the first medium to write about the adopted motion.
Aleid Wolfsen, chairman of the board of the Autoriteit Persoonsgegevens (AP), has been saying for some time that his organization cannot cope with the volume of work. In an interview with newspaper Trouw in November, he spoke of "laughable backlogs. And that while the work of the regulator, in his view, is becoming 'more important and voluminous' by the day. The consequences of a data breach can be enormous, Wolfsen warned. "If your data is stolen, it is much more severe than if your bicycle is stolen. You are your data in the digital age."
Investigating privacy violations is not the only duties of the Autoriteit Persoonsgegevens. The regulator can also impose fines, which has already happened several times since the AVG came into force in May 2018. In addition, the AP is also engaged in providing information, but there are hardly any staff for that. For the entire public administration -from municipalities to provinces, from independent administrative bodies to ministries- 2 fte are available to provide information activities. The financial sector has to make do with 1.75 fte.
As many as 27,800 privacy complaints were filed with the regulator in 2020. Currently, less than one employee deals with these complaints full-time. The average waiting time for handling a complaint has increased from three months to six months. Katja Mur, board member of the privacy watchdog, said the regulator currently handles only 0.04 percent of all complaints. Tips from citizens about possible privacy violations are not dealt with because of staff shortages. Of all data breaches that come to the AP, only 0.3 are investigated. Projects such as monitoring algorithms that collect personal data are currently not getting off the ground.
The figures and examples show that the Autoriteit Persoonsgegevens needs significantly more staff. The Lower House now also sees the seriousness of the current situation. Last week, Maarten Hijink (SP) submitted a motion to increase the regulator's budget.
In the motion - which in addition to the SP was also signed by D66, PvdA, GroenLinks, ChristenUnie, PVV, DENK, 50Plus and PvdD - the drafters ask the Minister of Justice and Security Ferd Grapperhaus to increase the budget of the regulator in such a way "that it is enabled to meet the realistic growth path. To do so, the AP must grow from 184 to 470 FTEs.
"With the broad support for the motion to give the AP more clout, today has once again underlined how important the Netherlands considers the protection of personal data to be," Wolfsen said in an initial response.
Note that a motion is a wish of the House of Representatives directed to the government to take (or refrain from taking) action. The government is not obliged to comply with a motion. However, as a minister, you have to be of very good character to disregard a motion, especially when it is as widely supported as this one.
The House of Representatives is not alone in saying out loud that the Autoriteit Persoonsgegevens needs more staff to carry out its duties. Last year, KPMG conducted a study of the regulator's resources. The researchers concluded that the privacy watchdog needs to grow to 470 FTEs to properly carry out its work. The budget must also grow from 24.6 million euros to more than 66 million euros by 2025.
Law Minister Sander Dekker tried to temper expectations after the KPMG report was published. He described the regulator as an organization that is still growing. "The development of the AP has the consequence that at the moment there are insufficient processes perpetuated so that the tasks and required financial resources can only be described with uncertainties," Dekker said. He said the results of the report gave "too wide a bandwidth to attach structural financial consequences to this."
Last November, Minister Dekker acknowledged the regulator's problems. However, he was of the opinion that a subsequent cabinet should tie the knot on the AP's staffing and budget expansion.
State Secretary of the Interior and Kingdom Relations Raymond Knops decided last year that the Autoriteit Persoonsgegevens will move to premises on Lange Voorhout in The Hague. This location will accommodate up to 400 employees.
