You can anonymously tip the Autoriteit Persoonsgegevens and let them look into the issue if you're afraid of repercussions. Any screenshot containing evidence o

You can anonymously tip the Autoriteit Persoonsgegevens and let them look into the issue if you're afraid of repercussions. Any screenshot containing evidence of PII being leaked will certainly help, and I doubt PostNL will have fixed their terrible terrible systems. Under Dutch law your colleague would've committed a crime by downloading the data he knew he shouldn't be allowed to access, beyond what was necessary to conclude that there was a leak. "Using" this indo during negotiations would've been blackmail, which is very much a thing you wouldn't want to do, especially with a company that big and without real competition; they'd go to the police, and you'd be screwed.