The Accountability Matrix: Who Knew What About the Data Vault, and Who Is Still There?
The people who controlled the data vault in 2019 and 2020 have almost all left. Whoever is responsible today was mostly not there when the key decisions were taken. This investigation maps the full chain of responsibility: political, administrative and parliamentary, with verified careers and current positions. The most striking fact: State Secretary Palmen worked as a management team member at the Tax and Customs Administration during the vault's creation and as national technical coordinator of Benefits during the inquiry period, according to her own government CV. Also documented: the 2022 signal, the nine months of silence, the second data vault, and the indications that more shielded environments exist. The conclusion: personnel changes do not make the state's responsibility disappear.
Summary
Earlier, OpenBrief reconstructed how the data vault with 64 million files stayed outside every parliamentary investigation for years (The full data vault timeline) and why the cabinet refuses to involve the Public Prosecution Service (Why justice is kept out). This third part answers the question that remains: who was responsible at each moment, and who is still there in September 2026?
The most striking fact stands in the government’s own CV. State Secretary Sandra Palmen-Schlangen, now politically responsible for handling the file, worked as a management team member and strategic adviser at the Tax and Customs Administration when the data vault was created (2019), and as national technical coordinator of Benefits during the PEFD period (2020-2021). In 2026 she co-signed the parliamentary letters about the vault, as an executive of the very organisation she belonged to when that vault emerged and stayed out of view.
Around it lies the pattern this file maps. Almost everyone politically or administratively responsible in 2019 and 2020 has left: Snel, Hoekstra, Vijlbrief (relocated), Van Huffelen, and all seven MPs who were informed about the vault in June 2019. The state itself has not left. Responsibility for the system, for the silence of 2025-2026 and for the evidence persists, even though the personal continuity is broken. And there is a new, open question: the victims’ complaint names a second data vault, motion 1563 asks for an inventory of all shielded data environments, and the profiling where all this began, the Region Data Model for SMEs, ran through multiple departments of the tax authority for years. The chance that there was only one vault is small.
Five kinds of responsibility
This investigation names people, and uses five categories that must not be mixed. Established: a court, regulator or inquiry committee has determined it. Politically responsible: an official headed the ministry or portfolio. Administratively responsible: a functionary held a management or executive role. Possibly personally culpable: there are indications requiring further investigation. Proven personally culpable: only after independent investigation or judicial ruling.
Nobody in this matrix is guilty in advance. The claim of this investigation is narrower and harder to refute: the Dutch state demonstrably bears responsibility for the system, and personnel changes do not let that responsibility evaporate.
The chain in one picture
LEGISLATURE
|
CABINET -> MINISTER / STATE SECRETARY OF FINANCE
| |
| SECRETARY-GENERAL -> DIRECTOR-GENERAL TAX AND CUSTOMS ADMIN
| |
| DIRECTORATES (incl. Benefits, IV&D, CFD, Customs)
|
-> INFORMATION MANAGEMENT -> SOURCE SYSTEMS
|
+-- RAM / RDM (SME risk model, 1998-2018)
+-- FSV (2013-2020)
+-- CAF / Project 1043 / Heidi
+-- DATA VAULT (2019-present, + second vault)
|
RISK SELECTION -> CITIZENS -> CLAWBACK -> HARM
Control layers that could have intervened:
House of Representatives, Senate, Dutch Data Protection Authority,
Audit Service Rijk, National Ombudsman, judiciary,
Public Prosecution Service, National Archives
The profiling began, this deserves emphasis, with SMEs. The Region Data Model was built early this century as a risk model for small and medium-sized entrepreneurs and grew into the Risk Analysis Model that profiled nearly all taxpayers for twenty years. What began as an instrument against entrepreneurs ended as surveillance on a national scale, with the data vault as the storage bin of its traces.
More data vaults: the question motion 1563 asks
The cabinet speaks of “the” data vault, by now of two. But there are indications there may be more, and those indications do not come from the margins of the file but from its centre.
The first sign is the complaint itself: according to lawyer Van Leeuwen it concerns two data vaults. The House of Representatives suspects the same. Motion 1563 by MP Moinat asks the government for an inventory of all shielded data environments at the Tax and Customs Administration, precisely because nobody knows whether the vault of 64 million files is the only one. The official timeline provides a third sign: the vault was used in 2024 for a clean-up pilot with Customs documents, while in 2023 nobody inside the organisation could say who the administrator was. An environment without an owner, used by multiple directorates, is not a rarity but a pattern. And finally, the BDO report and NRC’s reporting (10 August 2026) confirm that the Tax and Customs Administration had placed over 19.6 million documents in the separate environment and did not supply them to the inquiry committee; that figure is separate from the 64 million files the vault contains in total.
This is a hypothesis, not an established fact, and it is presented here as such: the number of shielded storage environments at Finance is unknown, no inventory has ever been published, and the vote on motion 1563 on 22 September 2026 determines whether one is coming.
The political matrix 2017-2026
| Period | Name | Position | Role in this file | Status September 2026 |
|---|---|---|---|---|
| 2017-2019 | Menno Snel | State Secretary of Finance (Tax and Customs Administration/Benefits) | Signed the 28 May 2019 letter formally describing the data vault, including the option to “actually delete” outdated data; resigned 18 December 2019 | Alliander supervisory board member since 17 October 2025, chair since 15 April 2026; partner/adviser FGS Global |
| 2017-2022 | Wopke Hoekstra | Minister of Finance | Politically responsible for the period when PEFD material was not supplied; heard by the questioning committee | European Commissioner for Climate, Net Zero and Clean Growth, with taxation in the portfolio |
| 2020-2022 | Hans Vijlbrief | State Secretary of Finance | Portfolio holder when the vault “disappeared from view” in 2020-2021; co-recipient of Omtzigt’s 2020 questions on archive destruction | Minister of Social Affairs and Employment in the Jetten cabinet; the UWV falls under his ministry |
| 2020-2022 | Alexandra van Huffelen | State Secretary of Finance (Benefits and Customs) | Answered Omtzigt’s questions on illegal destruction and a moratorium on 29 September 2020; the moratorium was not imposed, the hotspot never set up | Later Minister for Digitalisation; no longer an office-holder |
| 2024-present | Sandra Palmen-Schlangen | State Secretary (Recovery) Benefits | See the profile below; co-signed the 2026 letters; worked inside the organisation during the critical period | In office, non-partisan, since 13 December 2024 with an interruption in August-September 2025 |
| 2026-present | Eelco Eerenberg | State Secretary of Finance | Inherited the file on 23 February 2026, continued the silence until April, defends the refusal to file a complaint | In office |
| 2024-present | Eelco Heinen | Minister of Finance | Ultimately responsible for the ministry, the vault, the investigation and the destruction decision | In office |
| 2017-2025 | Pieter Omtzigt | MP (CDA/NSC/BBB) | Asked for a destruction moratorium on 31 August 2020 and cited article 361 of the Criminal Code; moved the hotspot archive motion adopted unanimously | No longer an MP |
The profile that stands out: Sandra Palmen-Schlangen
Her official career record at the central government site, consulted 15 September 2026:
| Period | Position |
|---|---|
| 1997-2001 | Case handler, Tax and Customs Administration |
| 2001-2006 | Team leader, Tax and Customs Administration |
| 2006-2014 | Senior policy officer, ministry of Finance |
| 2014-2017 | Technical coordinator, Tax and Customs Administration |
| 2017-2018 | Senior adviser on implementation and supervision, ministry of Finance |
| 2018-2021 | Management team member and strategic adviser, Human Dimension programme, Tax and Customs Administration |
| 2020-2021 | National technical coordinator Benefits, Benefits Service |
| 2021-2022 | Quartermaster for adjudication, Inspectorate of Taxes, Benefits and Customs |
| 2021-2023 | Deputy justice, Central Board of Appeal |
| 2022-2023 | Strategic adviser on rule-of-law government action, Finance |
| 2023 | Member of the House of Representatives for NSC |
| 2024-present | State Secretary (Recovery) Benefits |
Read that table as a timeline of the data vault. The vault is set up in 2019: Palmen is then a management team member at the Tax and Customs Administration. Omtzigt asks his questions about destruction in August 2020: she is then a senior adviser at Finance and shortly afterwards national technical coordinator of exactly the service those questions concerned. The PEFD search runs in 2021-2022: she is then quartermaster for the Inspectorate. None of these positions proves she knew of the vault, and that is not claimed here. A management team member of the Human Dimension programme is not the management team of the entire Tax and Customs Administration, and a technical coordinator does not manage storage environments. But the institutional proximity is exceptional: the woman now leading the handling of the vault worked inside the same organisation, in relevant posts, while it emerged and disappeared. Whether she warned at the time is not public. Whether, on taking office in December 2024, she confronted her former employer with her own knowledge of the implementation practice, equally not. These are precisely the questions an independent investigation should ask, of her and of others.
Her interrupted term in 2025 is also documented: her first Schoof-term ran from 13 December 2024 to 22 August 2025, after which she was reappointed per 5 September 2025, non-partisan after the NSC rupture.
The seven MPs of June 2019
According to the reconstruction in The Corrupt Agenda of the Data Vault, the following MPs were informed at the 19 June 2019 general consultation where the data vault came up as a GDPR agenda item: Anne Mulder (VVD, chair of the Finance committee), W.J.H. Lodders (VVD), Henk Nijboer (PvdA), Renske Leijten (SP), Bart Snels (GroenLinks), Pieter Omtzigt (CDA) and Steven van Weyenberg (D66).
Not one of these seven is still an MP in September 2026. Mulder became an alderman in The Hague, Lodders left in 2021, Nijboer, Leijten, Snels and Van Weyenberg also left the House, Omtzigt left national politics. Caution requires saying: their departures do not prove they left because of the data vault. What is established is the consequence: the MPs formally told of the vault’s existence in 2019 were all gone before the blow fell in April 2026. The parliamentary memory of this file had to be rebuilt time and again, by new MPs, on the basis of documents the Tax and Customs Administration did or did not supply. That is not an accusation against individuals. It is a structure of amnesia that keeps the system upright.
The administrative layer
The parliamentary questioning committee on childcare benefits heard, in November 2020, the men and women who led the tax authority when things went wrong.
| Name | Position | What is known |
|---|---|---|
| Peter Veld | Director-General Tax and Customs Administration, until 2015 | Head of the tax authority while the risk cultures were built; later criticised by Follow the Money over statements to parliament |
| Hans Blokpoel | Director-General of Taxes, later COO | Veld’s successor in day-to-day leadership; attended the MT Fraud meetings |
| Gerard Blankestijn | Director of Benefits | Led the service that hit the parents; later still director of SMEs at the Tax and Customs Administration |
| Jaap Uijlenbroek | Director-General Tax and Customs Administration | Testified in November 2020 that it was “a disaster in slow motion” and that the entire government apparatus was responsible |
| Manon Leijten | Secretary-General, ministry of Finance | Testified that a “spin” was put on events and set up a crisis team around Uijlenbroek, which failed through “system thinking” and fear of the bill |
| Peter Smink | Director-General Tax and Customs Administration since May 2020 | The DG through the entire “forget period” of the vault: the 2021 transfer, the PEFD deliveries, the 2024 clean-up pilot |
Of the first five, none still holds the position in which they were heard. Smink, the director-general under whose leadership the vault slipped from view and returned, is the only one whose departure this investigation could not establish; his current position is not independently verified. The current administrative leadership of Finance stands in the official organograms (Secretary-General Van den Dungen, deputy SG Quak), but none of them has kept accounting for the vault in the public record. That too is the exodus: not only the politicians leave, the administrative memory wears away, exactly as the archive memory of the Tax and Customs Administration wears away in a vault without an owner.
2022: the signal that stayed down
From the parliamentary questions following the BDO report, a chronologically dangerous point emerges. An internal signal already existed in 2022 that the data vault could be relevant to the parliamentary inquiry. It was not followed up. BDO, which took 29 interviews, could not establish whether the questions about including the vault in the PEFD search were answered or deliberately ignored. The House has therefore formally asked who knew the signal, why it stayed down, who knew of the vault in 2025 and who decided not to inform parliament immediately.
That is why this file cannot be closed with 2019. The reconstruction shifts from “nobody knew” to “who knew, and what was done with that knowledge”. For that last question no expiry through departure applies: the decisions of July 2025 to April 2026 on informing parliament were taken by officials and office-holders who are still in office today or were until recently.
A concession by the cabinet itself belongs here too. In answering parliamentary questions on the data vault, the government wrote: “We share the view that it is wise not to let the Tax and Customs Administration itself be the client of investigation into the data vault.” A view this investigation wholeheartedly endorses, and which simultaneously raises the question of why practice still looks the way it does.
Contracts: the money nobody sees
Strikingly little is public about the contracts around the data vault. The follow-up investigation is conducted by BDO, hired by the ministry that is itself under investigation. The amount, the assignment description and the conditions have not been published in the documents this investigation could find. About the suppliers who technically managed and filled the vault (the official timeline shows a party carrying out the final fill of 18 December 2020) no public contract information exists either. Every senior investigative journalist knows what that means: a FOI request is lying ready here. Until it is public, the same principle applies as for the contents of the vault itself: whoever controls the money and the means also controls the independence of the investigation.
The asymmetry
A citizen once registered by the government as a risk, signal or fraud suspicion carries that registration for years. He cannot “leave” his file. The official who entered the registration can be promoted. The director who approved the system can become a supervisory board member. The state secretary who signed the letter can chair a supervisory board. The minister can become a European Commissioner. The system remembers the citizen. The organisation forgets the responsible. The data vault widens that asymmetry again, because as long as the contents have not been independently investigated, a victim can never fully reconstruct why he was selected, which data were used and which warnings existed. That is why the vault is not an archiving matter but an evidence file, and the struggle over it a struggle over the memory of the constitutional state.
What is at stake for the six investigations
At least six processes ran without the data vault: the parliamentary inquiry on fraud policy and service delivery, the parliamentary investigation into childcare benefits, the investigations into FSV, CAF and RAM, and the recovery operation. If an investigation is based on an incomplete data set, a later-found source can be reason to revise earlier conclusions. That makes the demands on the vault simple and not loose: a moratorium on any destruction, independent and complete indexing, independent substantive analysis, connection to the recovery operation, personal access for victims, reconstruction of the risk profiles (FSV, RAM, CAF, Project 1043, nationality, postcode), investigation of the information chain and the 2022-2026 period, and independent assessment of possible criminal offences, not because guilt is established but because parliament itself has that possibility under consideration.
What this investigation claims and does not claim
Established: the positions, dates and careers in the tables above, drawn from official sources. Not claimed: that any named person consciously evaded responsibility, that departures were connected to this file, that Palmen knew of the vault, or that anyone personally committed a criminal offence. The author’s personal note, as a victim who lost everything, stands in the earlier investigation and applies undiminished. But the core of this matrix is cool and verifiable: the state remains responsible, however many names change.
Minimal moratorium. Maximum independence. Destroy nothing before justice and parliament have been able to look. On 22 September 2026 there is another vote.
Frequently asked questions about the accountability matrix
What did Sandra Palmen do at the Tax and Customs Administration during the data vault period?
According to her official government CV, Palmen was a management team member and strategic adviser at the Tax and Customs Administration from 2018 to 2021, and national technical coordinator of Benefits from 2020 to 2021. The vault was set up in 2019 and stayed outside the PEFD search. Whether she knew of the vault is not public; her institutional proximity is exceptional and calls for independent investigation.
Where is Menno Snel now?
The state secretary who signed the May 2019 letter about the data vault has been a supervisory board member of Alliander since 17 October 2025 and chair of the board since 15 April 2026. He is also a partner and adviser at communications firm FGS Global.
What are Hoekstra, Vijlbrief and Van Huffelen doing now?
Wopke Hoekstra, Finance minister 2017-2022, is European Commissioner for Climate, Net Zero and Clean Growth, with taxation in the portfolio. Hans Vijlbrief, State Secretary of Finance 2020-2022, is now Minister of Social Affairs, under whom the UWV falls. Alexandra van Huffelen, State Secretary for Benefits 2020-2022, who answered Omtzigt’s destruction questions without imposing a moratorium, holds no office anymore.
Are there more data vaults?
Compared to “the” data vault, there are indications of more shielded environments: the complaint of 26 August 2026 names a second vault, motion 1563 asks for an inventory of all shielded data environments, the vault was used for a Customs pilot in 2024, and in 2023 its administrator was unknown. The number of vaults is unknown; no inventory exists.
Read also
- The Corrupt Agenda of the Data Vault — the full timeline, 2019-2026
- The Butcher as Gatekeeper — why the cabinet keeps the prosecution service out
- RAM never disappeared: the state profiles on — where the profiling began
- RDM: the Region Data Model — the SME origin
- Rights violated: Archives Act and privacy — the legal lower bound
Sources
- Government of the Netherlands, official career record Sandra Palmen-Schlangen: https://www.rijksoverheid.nl/regering/bewindspersonen/sandra-palmen-schlangen
- Parlement.com, biography Menno Snel: https://www.parlement.com/biografie/drs-m-menno-snel
- Parlement.com, Alexandra van Huffelen (State Secretary of Finance, Benefits and Customs, 29 January 2020 to 10 January 2022): https://www.eerstekamer.nl/persoon/drs_a_c_van_huffelen_d66
- Parlement.com, Uijlenbroek and Leijten hearings, 23 November 2020: https://www.parlement.com/nieuws/202011/oud-directeur-generaal-van-de-belastingdienst-schetste-hetzelfde-beeld-als-zijn-reeds
- Senate, report public hearings POK 2020 (Veld, Blokpoel, Blankestijn): https://www.eerstekamer.nl/behandeling/20201217/rapport_verslagen_van_openbare/document3/f=/vlepnrs59dzy.pdf
- Senior Public Service, Peter Smink Director-General Tax and Customs Administration: https://www.algemenebestuursdienst.nl/actueel/nieuws/2020/05/20/peter-smink-directeur-generaal-belastingdienst-bij-financien
- Alliander, Menno Snel appointed to the supervisory board: https://www.alliander.com/nieuws/menno-snel-beoogd-lid-en-voorzitter-raad-van-commissarissen-alliander
- Alliander, supervisory board page (Snel chair since 15 April 2026): https://www.alliander.com/en/about-us/organisational-structure/supervisory-board
- FGS Global, profile Menno Snel: https://fgsglobal.com/people/menno-snel
- European Commission, Wopke Hoekstra: https://commission.europa.eu/about/organisation/college-commissioners/wopke-hoekstra_nl
- VNO-NCW, Hoekstra gets climate and taxation: https://www.vno-ncw.nl/artikelen/kandidaat-eurocommissaris-hoekstra-krijgt-klimaat-en-fiscaliteit
- NRC, 10 August 2026, 19.6 million documents not supplied: https://www.nrc.nl/nieuws/2026/08/10/de-belastingdienst-leverde-gevoelige-bestanden-niet-aan-de-parlementaire-enquetecommissie-naar-het-toeslagenschandaal-wat-nu-a4934186
- Accountancy Vanmorgen, 20 July 2026, BDO report: https://www.accountancyvanmorgen.nl/2026/07/20/rapport-bdo-fiscus-hield-datakluis-herhaaldelijk-uit-zicht-onderzoekscommissies/
- Trouw, July 2026, report contradicts accidental discovery: https://www.trouw.nl/politiek/rapport-weerspreekt-toevallige-vondst-datakluis-ministerie-ontkent-kwade-trouw~b6230780/
- Open Overheid, answers to parliamentary questions data vault (client role): https://open.overheid.nl/overheid/openbaarmakingen/api/v0/attachment/ae4a1f10-22fd-424d-91ee-5eef375c4807
- Letter 10 July 2026, externally validated timeline and external committee (2026D36494): https://berthub.eu/tkconv/document.html?nummer=2026D36494
- House of Representatives, Parliament in Brief, data vault debate 10 September 2026: https://www.tweedekamer.nl/kamerstukken/plenaire_verslagen/kamer_in_het_kort/datakluis-van-de-belastingdienst
- House of Representatives, questions Omtzigt 31 August 2020 (2020D32903): https://www.tweedekamer.nl/kamerstukken/kamervragen/detail?id=2020Z15232&did=2020D32903
- OpenBrief, The Corrupt Agenda of the Data Vault: https://openbrief.net/en/investigations/corrupt-agenda-data-vault/
- OpenBrief, The Butcher as Gatekeeper: https://openbrief.net/en/investigations/butcher-as-gatekeeper-data-vault/
Sources
- Government.nl, official career record Sandra Palmen-Schlangen (consulted 15 September 2026)
- Parlement.com, biographies Menno Snel and Alexandra van Huffelen
- Parlement.com news, 23 November 2020: Uijlenbroek and Leijten hearings, parliamentary questioning committee childcare benefits
- Senate, report public hearings POK 2020 (Veld, Blokpoel, Blankestijn)
- Senior Public Service, 20 May 2020: Peter Smink Director-General Tax and Customs Administration
- Alliander, October 2025: Menno Snel appointed member and intended chair of the Supervisory Board
- FGS Global, profile Menno Snel
- European Commission: Wopke Hoekstra, Commissioner for Climate, Net Zero and Clean Growth
- VNO-NCW, September 2024: Hoekstra gets climate and taxation
- NRC, 10 August 2026: Tax and Customs Administration failed to supply sensitive files to the inquiry committee (19.6 million documents)
- Accountancy Vanmorgen, 20 July 2026: BDO report, tax authority repeatedly kept data vault out of sight of investigating committees
- Trouw, July 2026: report contradicts accidental discovery of data vault
- Open Overheid, answers to parliamentary questions data vault: do not let the Tax and Customs Administration be its own client
- House of Representatives, debate 10 September 2026 and motions 1556, 1562, 1563
- House of Representatives, questions Omtzigt 31 August 2020 (2020D32903) and answer Van Huffelen 29 September 2020 (2020D37892)
- OpenBrief, The Corrupt Agenda of the Data Vault, 29 July 2026
- OpenBrief, The Butcher as Gatekeeper, 15 September 2026