The Dutch Data Protection Authority (AP) published a damning report about the Fraud Signaling Facility (FSV) of the Tax Authorities. The regulator labels the system that collects possible fraud signals as a blacklist and says that the tax authorities should never have processed personal data in this way.
Nevertheless, the tax authorities have been able to use the list for years. Seven questions and answers.
What offenses have the tax authorities committed?
From 2013 to March 2020, the Tax and Customs Administration registered personal data of possible fraudsters. The predecessors of that system had been in existence since 2001. And registering personal data in this way for twenty years is an unlawful violation of fundamental rights, unprecedented in scope, concludes the Dutch Data Protection Authority.
For example, medical data and criminal data were registered in the fraud system. But the report shows that the Tax and Customs Administration did not have the right to store personal data, because this requires a precise legal provision. And there isn’t one.
In fact, the service violated almost all core principles of privacy legislation: data was kept for no valid reason, with no clear purpose, sloppily kept, poorly secured and kept for far too long.
The use of blacklists was discontinued when Trouw and RTL Nieuws discovered them. KPMG then concluded that the fraud system violated the GDPR privacy legislation. As a result, the system was discontinued in 2020.
Although that privacy law – the AVG – was only introduced in 2018, the tax authorities also violated privacy legislation in the years before due to carelessness, according to the regulator.
Who was a potential fraudster?
In total, 270,000 people were blacklisted, including 2,000 minors. Companies, NVs or BVs, were also registered.
Anyone who has been labeled as a potential fraudster can submit a request for access. But the tax authorities estimate that for half of the people it cannot be said why they were on the fraud list.
People ended up on the blacklist when the Tax and Customs Administration received so-called risk signals. This already happened, for example, by stating a high mileage allowance in the tax return, while the person lived close to work.
The simple request for information by other institutions, such as from the UWV for benefits, could also be seen as a risk signal. The AP took particular issue with tips from others to the tax authorities, as a result of which someone was labeled as a possible fraudster.
How could the blacklist last so long?
The regulator says it is inconceivable that thousands of employees of the tax authorities knew about the existence of the list and that it continued to exist.
Budget cuts are the cause of the list’s survival for many years, says NCF, the trade union for employees of the Tax and Customs Administration and the Ministry of Finance. “Fighting fraud is a profession in its own right and you cannot automate it through a system. That requires a human touch,” says Albert van der Smissen, NCF chairman.
FNV director Mieke van Vliet agrees. “You can’t let software take over, except for simple processes.” According to the union, employees did raise the problem, but were told by their supervisors that protocols and rules must be implemented. Van Vliet: “And that’s where it went wrong.”
What are the consequences?
PwC consultancy is currently investigating the effects of the blacklist on entrepreneurs and citizens. The Tax Authorities previously announced that the blacklist had a financially adverse effect on 5,000 to 15,000 people.
For example, a personal payment arrangement or amicable debt rescheduling was wrongly rejected. It is also possible that their tax return was checked more strictly by the tax authorities.
Outgoing State Secretary Hans Vijlbrief wants at least compensation for those people. Whether a group will receive (generic) compensation still depends on the outcome of the PwC study.
Is there a connection with the allowance scandal?
According to the Tax Authorities, there is overlap on this point: people can be victims in the allowance affair and appear on the blacklist. PwC is also conducting research into this. If it turns out that people had to repay allowances unlawfully because they had been labeled as possible fraudsters, the compensation will be examined.
How do I know if I was blacklisted?
Earlier this year, the tax authorities sent so-called letters of apology to people who were on the fraud list, except for the group of people who, for example, are involved in an ongoing criminal investigation. NVs and BVs were also not informed.
How do you get off the blacklist?
Once people were labeled as potential fraudsters, they didn’t get off the list. The fraud system was closed in 2020 and will no longer be used, according to the tax authorities. The AP has not investigated whether this actually happened.
The PwC investigation will have to show to what extent the registration on such a detailed list is also shared with organizations outside the Tax and Customs Administration.