277,813 SME AUDIT FILES DELETED FROM DATA VAULT

Regret over delayed data vault disclosure: 'No signs of a conspiracy'

‍

On August 19, 2026, rtlnieuws rtlnieuws featured 'The Data Vault'. On behalf of the cabinet, Eelco Eerenberg expressed regret for the delay in disclosing the existence of millions of documents held in a data vault that had remained hidden from parliamentary inquiry committees. In 2019, millions of documents were set aside because they would not pass a GDPR assessment. These included source documents for risk selection, fraud lists, collaboration spaces, FIOD information, and CAF cases. A few days later, a second data vault came to light, containing the contents of the mailboxes of over a thousand Tax and Customs Administration employees, their personal workspaces, and collaboration data. This was related to the criminal complaint filed by the Public Prosecution Service in 2020. Nothing was done with this information.

277,813 SME AUDIT FILES ALSO DELETED

On May 26, 2026, a technical briefing for Members of Parliament took place. It emerged that 277,813 documents out of a total of 698,352 SME files had already been deleted, even before formal approval was granted in April 2025. There was a disproportionate concentration within the SME division, shortly after the conclusion of the PEFD investigation and during ongoing parliamentary attention regarding RAM/FSV. Under Article 8 of the Archives Decree, a declaration is mandatory when destroying archival records. If this is missing, it can be considered an indication of unlawful destruction. These files were deleted in one fell swoop on four dates in 2024. What is in such a file? According to the Tax Administration Audit Handbook, an audit file contains confidential and personal data: the audit assignment, details about the organization, legal form, business activities, contact persons, findings and conclusions from the analysis of the records, the email log, the audit report, and, where relevant, a separate penalty file substantiating the administrative fine. There is a statutory obligation for both retention and destruction; there is no freedom of choice. Once a company was selected, the complete tax audit was created in TOP. This tax audit may have been used for fraud prevention. Therefore, TOP is indirectly part of fraud prevention, both for SMEs and for Large Enterprises (GO), using analytical tools. The SME department also had a heavy-handed risk selection culture, similar to how the CAF team operated. A 2020 memo explicitly mentions the SME division as one that moved data from Q-drives to the vault, using an age criterion of 'older than 5 years'. The SME division (along with GO and CAP) was one of the first departments whose data was deliberately transferred to the vault when this GDPR/Archives Act emergency solution was set up. The vast historical selection and audit data came from the RAM system, which had been specifically set up for SME selections. In May 2018, this system was shut down after twenty years of intensive use due to privacy issues.

On November 29 and December 6, 9, and 17, 2024, 277,813 audit files were deleted.

Regret over delayed data vault disclosure: 'No signs of a conspiracy'

‍