“Dutch Data Protection Authority Concerned About Conflict of Interest in Amsterdam Municipality’s Privacy Supervision”

The Dutch Data Protection Authority (AP) has received the signal from the Amsterdam Metropolitan Area Ombudsman that the municipality has also deployed the data protection officer as privacy officer (someone who co-creates the privacy policy). This would mean that the same person would have to monitor that policy as an independent supervisor. According to the AP, “combining these two functions could lead to a conflict of interest, with potential risks to citizens’ privacy.”

The Dutch Data Protection Authority (AP) is concerned about the independence of internal supervision at the municipality of Amsterdam and whether this is properly arranged. According to the law, organizations are obliged to employ an internal privacy supervisor. This is the data protection officer (DPO), who supervises the organization independently and also advises it.

Privacy-sensitive information

AP Vice-President Monique Verdier emphasizes that a large city such as Amsterdam, where a lot of privacy-sensitive information from citizens is processed, must have its internal privacy supervision in order. “Citizens must be able to trust that the municipality handles their data with care, and that the supervision is sound and independent.”

The AP has therefore now asked aldermen Hester van Buren (P&O) and Alexander Scholtes (ICT) to come to the AP on behalf of the Municipal Executive of the municipality to explain the position of their internet privacy supervisor. . After this conversation, the AP decides which steps will be necessary.