Data Breaches: UWV Reports Over 900 Incidents to Dutch Data Protection Authority

By Netvora Tech News

The Dutch Public Employment and Social Service Office (UWV) disclosed over 900 data breaches to the Dutch Data Protection Authority (AP) last year. Of these, more than 300 were required to be reported. In 64.5% of the reported data breaches, this was done within the required 72-hour timeframe. According to UWV's 2024 annual report, organizations must report a confirmed data breach within 72 hours, unless it is unlikely to pose a risk to the rights and freedoms of the individual whose personal data has been leaked.

Data Breaches: A Growing Concern

In 2024, UWV reported a total of 919 data breaches to the AP. Of these, 749 were confirmed breaches, with 334 requiring mandatory reporting. One notable data breach occurred at Werk.nl, a website where job seekers can communicate with the UWV, search for job openings, and create a CV. Employers can create an account to view and use CVs to fill active job openings. In one instance, 150,000 CVs were viewed and potentially downloaded through a single employer account. In response to the incident, the UWV has decided to fully mask personal data in CVs. From this year onwards, the UWV will only display personal data necessary for employers to identify and match potential candidates, such as name, address, phone number, and email address.

Data Protection Measures

Employers will have the option to choose whether to display phone number and email address, while job seekers will still be able to create a CV without displaying name and address information. Additionally, the UWV has announced that it will take technical measures to prevent unauthorized use of CVs on Werk.nl.

Over 900 data breaches reported by UWV to the AP in 2024
64.5% of reported breaches were reported within the 72-hour timeframe
150,000 CVs viewed and potentially downloaded through a single employer account
UWV to fully mask personal data in CVs from this year onwards
Employers will have the option to choose whether to display phone number and email address
Job seekers will still be able to create a CV without displaying name and address information