AP: data breaches from misuse of personal data at municipalities often remain under the radar

European municipalities are grappling with a persistent challenge in identifying and reporting internal data breaches stemming from the misuse of personal information by their own employees. This often occurs when officials, under duress, illicitly share data with criminal actors, leading to significant privacy violations. Such breaches frequently go unnoticed until external entities, such as the National Criminal Investigations Department or concerned citizens, bring them to light, highlighting systemic weaknesses in internal oversight. Despite the mandatory requirement to report data protection incidents to the Autoriteit Persoonsgegevens (AP), municipalities that do discover such misuse often fail to make the necessary notifications. This non-compliance means that a substantial number of these internal data security failures remain officially undocumented, hindering regulatory oversight and the potential for broader systemic improvements. The AP emphasizes that these incidents, involving the exploitation of sensitive personal data, necessitate prompt and transparent reporting to ensure accountability and safeguard citizen privacy. The implications of these unreported data leaks extend beyond individual privacy concerns, impacting public trust in municipal institutions and potentially creating vulnerabilities for organized crime. The failure to adhere to reporting obligations under data protection laws like GDPR deprives authorities of crucial information needed to assess risks and enforce compliance effectively. Addressing this issue requires a concerted effort to enhance internal detection mechanisms and foster a culture of transparency and accountability within municipal administrations.