SINT MAARTEN/THE NETHERLANDS – The Dutch immigration service IND is looking into reports that it twice compromised the privacy of British nationals by sending letters about their immigration status to the wrong address.
At the end of January, the IND wrote to all British citizens registered in the Netherlands about their residency rights in the wake of Brexit. But in around 7,000 cases, the agency failed to include letters or numerals denoting the recipient’s exact house number.
When the IND wrote to those 7,000 people informing them of the data breach, they enclosed a copy of the original letter. But DutchNews has learned of dozens of cases in which the letter about the privacy problem was addressed to the wrong person – constituting another, more serious, data breach.
DutchNews is aware of at least 30 cases so far in which people have been sent a letter about the privacy breach which was meant for someone else. One reader said he had phoned the IND helpline and been told that they had been ‘inundated’ with calls all day.
Amsterdam resident Steven received a seemingly random letter for someone in Wassenaar. ‘There is no similarity in surnames or house numbers,’ he told DutchNews.
‘It is extraordinary to have a data breach on top of a data breach,’ he said. ‘The first one was fairly minor, but this attempt to correct it is more serious. I now know their name, their address and their immigration status.’
David Zetland, also of Amsterdam said he didn’t know there had been a mistake until he got the letter saying there had been a problem. ‘It was addressed to another Brit. Pretty good way to help me see the mistake,’ he told DutchNews. DutchNews journalist Deborah Nicholls-Lee was the only one in her family of four to get a wrongly-addressed letter.
‘I hadn’t noticed the first breach, so I was surprised to receive this letter,’ she said. ‘Ironically, this letter represented a far greater breach of privacy than the previous one as my second letter had clearly gone to someone else and I had received a letter addressed to a British citizen in Utrecht in its place.
‘I am not angry or worried about the letter mix-up, but I do think that the data breach suggests that the IND is struggling to cope with the workload created by Brexit.’ A spokesman for the IND told DutchNews officials are now trying to find out what has happened.
‘We are currently looking into the claims, the cause of them and the scale on which this has happened,’ he said. On Twitter, the agency is suggesting people who have had a wrongly-addressed letter return it.
A spokeswoman for the Dutch privacy watchdog said they did not comment about individual complaints and could not say if a second data breach had been reported. Note: This article has been updated to reflect the number of reports of wrong deliveries.