Dutch Data Protection Authority Imposes Fine for Implementation of Waste Policy

The Dutch Data Protection Authority has imposed a fine of EUR 30,000 on the municipality of Voorschoten. The municipality was fined because it retained residents’ personal data for longer than necessary. The data in question concerned the use of gray and underground trash containers. The municipality has since adjusted its procedures and is considering filing an appeal.

Starting in March 2019, all gray trash cans were replaced with chip-enabled containers. Residents who used an underground container on the street were given a token. Both the resident’s own container and the token were linked to their home address. When waste was placed out for collection, the municipality recorded the chip number, the time, the location, and the type of waste.

The Dutch Data Protection Authority determined that the municipality had retained this personal data for longer than was necessary for the implementation of its waste management policy. Following the investigation, the municipality reduced the retention periods. In addition, the municipality sent a letter to all residents to inform them of this.

Setback

On November 2, the Dutch Data Protection Authority decided to impose an administrative fine of EUR 30,000 on the municipality after all. “That’s a setback,” says Alderman Hubert Schokker. “You can only spend each euro once, and of course we’d much rather spend the money on health, safety, education—you name it. That’s why we’re considering filing an appeal.”

Still, there is some consolation. The alderman said, “The fine could have been much higher. The Dutch Data Protection Authority chose not to impose a higher fine because we immediately adjusted our procedures. We didn’t do that just because of the threat of a fine, though. As a municipality, we are committed to handling our residents’ personal data with care in any case.”