The Tax and Customs Administration, which is part of the Ministry of Finance, has for years “treated the (dual) nationality of applicants for childcare allowances in an illegal, discriminatory and therefore inappropriate manner,” said the Dutch DPA in a press release. press release translated. The government agency should have deleted this data in January 2014, but kept it and used it. In May 2018, the month the GDPR entered into force, the tax system still contained dual nationality information for 1.4 million people, according to the DPA.
In addition, the DPA said tax authorities unnecessarily process the nationality of applicants to fight organized fraud. In a report published in October (in Dutch), the DPA discovered that tax authorities were processing personal data in a fraud management system called the “Fraud Signaling Facility,” which the data regulator said served as a blacklist to identify potential fraudsters. Often, however, the data was inaccurate or out of date.
“More than a quarter of a million people were, often wrongly, on this fraud list for too long without their knowledge,” DPA Chairman Aleid Wolfsen said in a statement. translated statement October 29. “As a result, they couldn’t defend themselves and they couldn’t be taken off the list.”
In addition, the DPA found that the tax authorities were also processing unnecessarily and “using the nationality of applicants as an indicator (Dutch or non-Dutch) in a system which automatically designated certain applications as high risk”.
Citizens do not have the freedom of choice regarding how their data is handled by the government, Wolfsen said. Rather, they must “blindly trust” the government to treat their data correctly and fairly. In this case, the tax authorities violated that trust, he said.
Entitlement to child care allowance does not depend on nationality, the DPA said. Under the GDPR, the processing of data must not infringe fundamental rights.
“By unnecessarily including data on nationality in all kinds of systems, the tax and customs administration has acted in a discriminatory manner,” said the DPA.
In this case, the illegal processing of data using an algorithm went “terribly wrong”, resulting in a violation of citizens’ rights, Wolfsen said. He added that the DPA “will continue to warn of the serious dangers of processing personal data with algorithms and AI”.
The tax and customs administration dealt with the violations, according to the DPA. The agency has completely removed the dual nationality of the Dutch from its internal systems.
Since October 2018, the tax administration no longer uses the nationality of applicants in the risk system, and since February 2019, no longer uses the nationality of applicants to fight against fraud.
The tax and customs administration can appeal the fine, which was imposed on the Minister of Finance, who is responsible for processing personal data within the agency. the late notice (in Dutch) addressed to the Minister of Finance is dated 25 November.