Dutch DPA fines Ministry of Foreign Affairs 565K euros for GDPR violations

The Netherlands' data protection authority, Autoriteit Persoonsgegevens, fined the Ministry of Foreign Affairs 565,000 euros for processing approximately 530,000 visa applications per year over the last three years without sufficient personal data protections, a violation of the EU General Data Protection Regulation. The DPA identified risks that unauthorized individuals could access and change files within the ministry’s National Visa Information System. It also determined the ministry did not adequately notify visa applicants about the sharing of their personal data with other parties.