Your privacy

Why does the CAK need my data?

The CAK implements a number of statutory schemes. To perform that task, we need access to personal data, such as your name, address, place of residence, citizen service number (BSN) and sometimes also details of your income. The data we are allowed to ask for is stipulated by law. We try to minimise the amount of your data that we store. We never store more than is necessary to perform our tasks and provide the associated services.

Who is responsible for processing my data?

The CAK is responsible for implementing a number of regulations. To do this, we work together with a number of different parties, such as the Central Judicial Collection Agency, the Tax and Customs Administration, the Social Insurance Bank (SVB), the Employee Insurance Agency (UWV) and municipalities. Within that context the CAK is responsible for the processing of your personal data.

Does the CAK also pass on my data to other organisations?

Yes, we sometimes pass on data to other organisations. We do this if necessary in order to perform our statutory tasks. In some cases we pass on data to the Tax and Customs Administration, for example, to request details of your income or assets.

We are extremely careful when passing on any data. It is important that your data does not end up in the wrong hands. We never use your data for commercial purposes.

The CAK regularly engages other organisations to perform tasks for us. We make sure these organisations handle your data just as carefully as we do ourselves.

What data does the CAK store about me?

The data that we process differs depending on the scheme we are implementing. By ‘processing’ we are referring to the storage of data, for example. In almost all cases we require the following data from you:

• Name
• Address
• Town/city
• Date of birth
• Sex
• Citizen service number (BSN)

In some cases we also need you to provide the following data, for example:

• Bank account number
• Details of your income
• Your partner’s details

If we are in contact with you, we will also store your:

• Telephone number and/or
• Email address

The two examples below make clear why we need what types of data.

Example 1: you live abroad and are entitled to Dutch-funded medical care in that country. You will therefore pay a contribution to the CAK. The level of that contribution depends on your age, the composition of your family, your income and your country of residence. In such a case we will therefore require your name, date of birth, address, country of residence and income details. We will also need that data from people who are registered through you with a health insurer in your country of residence, such as your partner and/or children.

We settle the costs of medical care with your country of residence. As part of this process we also exchange personal data with other countries. For that reason we will sometimes process data about your health. The same may also apply to anyone who is registered through you with a health insurer.

Have you given us your telephone number or address? If so, we will store that information. This will allow us to contact you if we have any questions or want to explain something. Are you due a refund because you have overpaid? In that case we will need your bank account number so we can refund the money to you.

Example 2: you are receiving care at home under the Social Support Act (Wmo). You will therefore receive an invoice from us. The level of that invoice will depend on your living situation, your income and how much care you are receiving. In such a case we will therefore require your name, address, income details and details of your care. We will also need data about the person with whom you form a household (if you are married or cohabiting).

If you have a question about the invoice, we will also store your telephone number and/or email address. This will allow us to contact you. Are you due a refund because you have overpaid? In that case we need your bank account number so we can refund the money to you.

For how long will the CAK retain my data?

We will use and store your data for as long as is necessary to perform our statutory tasks. The Public Records Act also stipulates for how long we have to retain data. After the end of the retention period we will delete your data where possible.

How does the CAK obtain that data?

We receive most of the data from other organisations, such as healthcare providers, health insurers, municipalities, the Tax and Customs Administration, the Social Insurance Bank or the UWV. Some data is obtained when you fill in forms on our website. That includes data such as telephone numbers and email addresses.

For the health insurance outside the Netherlands scheme we settle the costs of medical care with other countries. That means we also exchange personal data with other countries, within and outside Europe.

What does the CAK store in cookies?

Under ‘Cookies’ you can read about what kind of cookies we use and for what exact purpose.

What are my privacy rights?

As a client you have the following rights:

1. The right to inspect your data.
2. The right to correct your data.
3. The right to have your data deleted.
4. The right to restrict the processing of your data.

1. The right to inspect your data

As a client you have the right to inspect which data we are storing about you. Under the question ‘What data does the CAK store about me?’ above you can read about which types of data we store and why.

Are you receiving care under the Long-Term Care Act (Wlz) or support under the Social Support Act (Wmo)? In that case you can log in to My CAK. Once you have logged in you will be able to see for yourself the main items of data that we hold about you. My CAK only shows data from 1 January 2016.

Would you like to inspect your data? Please submit your request online or send it in a letter.

2. The right to correct your data

As a client you have the right to correct your data.

Are you receiving care under the Long-Term Care Act (Wlz) or support under the Social Support Act (Wmo)? In that case you can log in to My CAK. Once you have logged in you will be able to make corrections yourself to some of the data that we hold about you.

Would you like to have your data corrected? Please submit your request online or send it in a letter.

3. The right to have your data deleted

As a client you have the right to have your data deleted, for example if you are mistakenly registered with the CAK.

Would you like to have your data deleted? Please submit your request online or send it in a letter.

4. The right to restrict the processing of your data

You may think the CAK should not be using certain items of your data, for example because:

• your personal details are incorrect.
• you think certain data no longer needs to be processed.
• you think the CAK does not have the right to process certain data.
• you have objected to the processing of your data and are awaiting a decision.

In such cases you can ask us to restrict the processing of your data.

Would you would like to restrict the processing of your data? Please submit your request online or send it in a letter.

Can the CAK apply a charge or refuse my request?

The CAK does not normally apply a charge if you make a request. We can, but will only do so in exceptional cases, for example if you make a large number of requests and we can demonstrate that the costs we are incurring are very high. In such a case we may ask you to pay a reasonable charge or may refuse your request.

You can find out more about this on the website of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Who can I contact if I have any questions about privacy?

In this privacy statement we have tried to answer the most frequently asked questions about privacy. If you still have questions after reading them, or want to make a complaint, please contact us on one of our telephone numbers.

What can I do if I have a complaint about the use of my personal data?

You can submit a complaint to the CAK’s Data Protection Officer, who can be contacted at the email address [email protected].

Are you unable to resolve the matter with the CAK? In that case you can contact the Dutch Data Protection Authority, which is responsible for external supervision of compliance with privacy legislation. You can submit a complaint to that body.

Does the CAK hold my personal data securely?

Yes. We apply the Government Information Security Baseline (BIO). This is a framework of nationally recognised standards in the area of information security. We take this matter extremely seriously and are constantly striving to ensure that the information we hold is as secure as possible.

When we exchange data with the SVB, UWV and Tax and Customs Administration, for example, we always use a secure, encrypted connection. Web forms on our website are secure and our employees sign a confidentiality declaration. They are also trained in how to handle personal data with care.

We enter into agreements with software suppliers to ensure they also comply with all the relevant requirements.

Are the contact forms on the website secure?

Yes, they are secure. Any data you send to us in that way is transmitted via a secure, encrypted connection. If you send attachments, they are also encrypted.

Why do you ask me for my BSN and date of birth?

If you call us, we ask you for your citizen service number (BSN) and your date of birth. That allows us to check that you are actually who you say you are. It also helps us to avoid getting individuals mixed up. The law allows us to use the BSN for that purpose.

You can find out more about this on the Dutch Government’s website (Rijksoverheid.nl).

Why do emails from the CAK say that sensitive data has been removed?

With emails we can never be absolutely certain who the sender or recipient is. That is why we remove any privacy-sensitive data from emails. That may include details about a person’s income, a bank account number or a citizen service number.

Can I record a call with the CAK?

Yes, you can. We sometimes also record calls ourselves for training purposes.

The rules laid down by the Ombudsman apply to you and to us:

• You are permitted to make an audio recording, unless there are compelling reasons why you should not do so.
• If we do not allow you to make an audio recording, we will offer you another solution.
• You must make clear in advance that you wish to make an audio recording.
• You must provide us with a copy of the recording if we request it (or vice versa if we make the recording).
• Nobody may edit an audio recording unless the other party is informed.
• Nobody may pass on audio recordings to third parties without the other party’s permission.
• Nobody may make audio recordings public without the other party’s permission.

I have received an invitation for a feedback survey from Market Respons. Why?

We would like to provide you with the best possible service. That is why we regularly ask you if you are satisfied with us. We have this survey carried out by the organization Market Response, our partner for surveys. We therefore share your telephone number and e-mail address with Market Response. You always have the option to decline or respond anonymously to a survey.

Do you object to the invitation? Please let us know. We will then no longer invite you for our surveys.

We have made agreements with Market Response about the use of personal data. We have established that your data is confidential and that your data may only be used for research. And that the data is not kept longer than necessary. We have laid this down in a so-called processing agreement. That is required by law.

We also keep general figures for customer research. These so-called statistics are anonymized. This means that it does not contain any personal data.

Please read the Market Response privacy statement for more information.

Do you want to report a vulnerability?

We make every effort to keep our ICT systems secure. Have you nevertheless identified a vulnerability? Find out how you can report it to us.