Privacy watchdog Autoriteit Persoonsgegevens has been inundated with calls from people worried about identity theft following the revelation this week that regional health board corona testing data had been stolen and offered for sale on social media.

Two people, thought to be part of a larger group, were arrested for selling the information, which they had gleaned from regional health board data bases used to share details of people who have had a coronavirus test, police confirmed on Tuesday.

Broadcaster RTL which has been investigating the sale of personal information via health board networks, reported its findings to the GGD health board association earlier this month.

RTL said not only names, addresses and phone numbers but also personal BSN numbers are up for sale. The information comes from two different data bases, one used in contact tracing and one for people who have been tested, and dozens of sources have been offering information from the data bases for sale via services like Telegram, Snapchat and Wickr.

RTL journalist Daniël Verlaan, who discovered the trade in data, said on Twitter that health minister Hugo de Jonge’s claim that all regional health board workers with access to sensitive and personal information had to hand over a declaration of good behaviour (VOG) is not true.

Verlaan said that he had information that at least 10 people had not done so, two of whom even had a criminal record.

He also said that the security of the system is not continually checked, as the minister said, and that only spot checks are done. Earlier Nieuwsuur claimed that hundreds of unauthorised staff also had access to personal information.

The AP said it is referring all callers to the health board, which has said it will inform those people whose data are among the ones that have been compromised.