Government agency requests more data than necessary — what now?

Government agencies have heightened obligations under GDPR because they may not use "legitimate interest" as basis (Art. 6(1) last sentence). For government: only legal obligation, vital interest, or official authority — interpreted narrowly. What is "too much"? Tax authority asks for social-media name beside your return (no basis), municipality asks religion for subsidy application (Art. 9 prohibited), employment authority asks family history at sick-leave (proportionality issue), police ask biometrics without compelling reason. Routes: (1) Request specific statutory provision in writing: "under which specific article of which law are you asking this?" For government a statutory basis is required (Art. 6(3) GDPR + Dutch Administrative Law Act). No solid answer = no basis = no obligation to provide. (2) Object: AWB objection within 6 weeks. State GDPR data minimisation + basis requirement. (3) National Ombudsman: for improper government conduct. Non-binding but heavily weighted. (4) AP complaint: for GDPR aspect. AP has extra priority since childcare-benefits scandal for government-data violations. (5) Administrative court: on refusal of service or sanction based on refused data. Appeal possible. Important detail: The childcare-benefits scandal made clear that government can be convicted for structural unlawful data use. Oversight has tightened since 2022.