A new report from the Dutch Intelligence Oversight Committee (CTIVD) reveals that the country’s intelligence services – AIVD and MIVD – are not adhering to regulations regarding the handling and storage of large datasets containing personal information. The CTIVD considers this a serious issue, highlighting that these datasets include highly sensitive data and information on a broad range of citizens, sourced even from data breaches like the recent Odido hack. Critics point to a historical pattern of informal data management within the intelligence services, contrasting the rigorous protection of intercepted communications with the less secure handling of bulk datasets. Concerns exist over broad access to data amongst personnel, raising the risk of misuse, potentially including “love intelligence” – using data to track personal relationships. The CTIVD emphasizes that even data acquired from breaches must be managed in accordance with the rules. The report calls for improved data governance and restricted access to sensitive information within the intelligence agencies.