The Dutch data protection authority, Autoriteit Persoonsgegevens, fined tax authorities 3.7 million euros for violating the EU General Data Protection Regulation. The fine, the highest the DPA has ever imposed, was based on six violations including no legal basis for the processing of personal data, the goal of Fraud Signaling Facility was not defined in advance, contained incorrect information and information was kept for too long. The tax authorities can appeal the decision.