The Dutch Data Protection Authority (AP) has imposed a fine of €30,000 under the General Data Protection Regulation (GDPR) on the municipality of Vorschoten. The municipality has kept household waste data for a long time and has not reported it enough to them.

Privacy Monitor It opened an investigation after a complaint from a resident. The municipality of Forsschoten replaced the wheeled bins and underground containers in 2018 and 2019. Boxes and tokens for underground containers contain a chip with a number associated with the home address. The goal is to collect more segregated waste by limiting the amount of residual waste residents can submit.

Residents may deposit remaining waste into the underground bin up to 5 times daily, and bins submitted more than once every two weeks are rejected by garbage trucks. This is updated in municipal systems.

“This in itself fits with the overall mission of the municipality. But what went wrong was that the municipality kept the data for too long: the wheelie bins for as long as they were in use and the codes for five years. This is too much,” the AP explains. “It takes longer than necessary to verify whether the family exceeds the permissible amount.”

The municipality also did not inform residents adequately. I sent messages about new chests and tokens, but not about the use of personal data. The municipality has now reduced the holding period to 14 days. According to the Associated Press, the municipality of Forschoten can still appeal the fine.