Privacy

19 april 2021

Statistics Netherlands (CBS) will treat your personal data with the utmost care. This page lists the measures we have taken to safeguard your privacy.

Personal data

Personal data is information about an identifiable person, for example a name, a home address or an email address, or someone’s income. A full description of what personal data entails is provided by the General Data Protection Regulation.

What CBS does with your data

CBS collects data from people, companies and institutions. Upon receipt of these data, all directly identifying personal details are removed as soon as possible and replaced by a pseudo key. CBS uses these so-called pseudonymised data to conduct statistical research. CBS will only publish statistical information without identifiable or traceable personal data. Furthermore, CBS has taken measures to ensure protection from theft, loss or abuse of personal data.
CBS will never supply identifiable data to third parties, including other government institutions. However, (academic) institutions may, under strict conditions, be given access to pseudonymised personal or corporate data. These are referred to as microdata.

CBS and the General Data Protection Regulation

CBS meets the most stringent requirements as regards data protection. Every year, a privacy audit takes place which is carried out by an accredited external organisation and which results in a Privacy Audit Proof certificate.
This is how CBS demonstrates its compliance with the regulations of the GDPR (the accountability principle).
External registrars (data suppliers) are controllers in themselves and in many cases bear a statutory obligation to supply datasets to CBS. The controlling responsibility of data suppliers under the GDPR ceases to exist as soon as data have been received by CBS.

Measures

CBS protects your data with technical and logistical measures. Following are the most important measures:

• When you complete a survey or submit any data, this information is delivered to CBS in encoded form. The data are received by CBS in a secured environment. Only authorised personnel shall have access to these data.
• At the earliest possible stage in the process, all directly identifiable personal data are removed from the files. This means datasets for research will never contain any data such as names, addresses or citizen service numbers (BSN).
• All CBS employees are bound by an obligation of confidentiality and have signed a confidentiality agreement.
• CBS only uses data for statistical and scientific purposes. CBS is excluded by law from using the data for fiscal, administrative, verification and legal purposes. Furthermore, CBS is not allowed to use data for marketing.
• All statistical processes at CBS are certified in terms of personal data protection. This privacy proof audit is carried out by an accredited external party.

CBS has made a Data Protection Impact Assessment (DPIA) applicable for most of our statistical processes.

The General Data Protection Regulation

CBS is bound by the European General Data Protection Regulation (GDPR). This Regulation helps protect the privacy of citizens. In addition, CBS adheres to the privacy stipulations in the Statistics Netherlands Act, the European Statistics Code of Practice, and its own Code of conduct (Dutch only).

The rights of data subjects in the GDPR and the GDPR Implementation Act

• 13 (and 14). Right to information
• 15. Right of access
• 16. Right to rectification
• 17. Right to erasure (‘right to be forgotten’)
• 18. Right to restriction of processing
• 20. Right to data portability
• 21. Right to object
• 22. Right not to be subject to a decision based solely on automated processing, including profiling

The Dutch GDPR Implementation Act lists a number of exceptions to the above in Article 44:

• Article 44. Exceptions concerning scientific research and statistics
  Where processing is carried out by institutions or service organisations for scientific or statistical research, and the necessary provisions have been made to ensure that personal data may be used solely for statistical or scientific purposes, the controller may disregard Articles 15, 16 and 18 of the Regulation.
• Right to information (GDPR Articles 13 and 14)
  CBS fulfills the conditions of this provision by informing its direct data suppliers in writing about what CBS will do with the data. Indirect data suppliers – persons whose data are received by CBS through registrations – are informed by CBS via the CBS website.
• Right to erasure/right to be forgotten (GDPR Article 17)
  CBS is allowed to keep the personal data in a secure manner for an indefinite period of time until CBS no longer needs these data.
• Right to data portability (GDPR Article 20)
  In accordance with the Statistics Netherlands Act, CBS is not allowed to provide any personal data to third parties.
• Right to object (GDPR Article 21)
  Since CBS never provides data to third parties and a data subject can never suffer any direct disadvantage or benefit as a result of the processing of data by CBS, CBS will reject objections to the processing of data.
• Right not to be subject to a decision based solely on automated processing, including profiling (GDPR Article 22)
  CBS will never subject an individual to auomated individual decision-making or profiling.

Supervision

• CBS has its own Data Protection Officer (DPO). This officer monitors the implementation of and compliance with the GDPR by CBS and keeps a register of all personal data processing at CBS.
• The Dutch Data Protection Authority (DPA) supervises compliance with regulations of the law concerning personal data protection. An important contact person for the Dutch DPA is the CBS Data Protection Officer.

Contact

Requests pertaining to the General Data Protection Regulation (GDPR) must be submitted in writing. They can be submitted either by post or by email in an attachment. This means that GDPR requests submitted via other media (such as social media, fax, etc.) or delivered in person to the CBS will not be processed. This also applies to formal notices of default and objections.

A written request, notice of default or objection should be addressed to:

Statistics Netherlands (CBS)
Attn. Director General
P.O. Box 24500
2490 HA The Hague, the Netherlands

Please state clearly that this is an GDPR request at the top of your letter and, if applicable, in the subject line of your email.

If you wish to know more about the reports register or the processing of personal data, please contact the Statistics Netherlands Data Protection Officer:
Mr Laurens Mommers via infoservice.