DPA chair Aleid Wolfsen said: 'The government has exclusive responsibility for lots of things. Members of the public don't have a choice; they are forced to allow the government to process their personal data.'

'That's why it's crucial that everyone can have absolute confidence that this processing is done properly. That the government doesn't keep and process unnecessary data about individuals. And that there is never any element of discrimination involved in an individual's contact with the government.'

'That went horribly wrong at the Benefits Office, with all the associated consequences. Obviously this fine cannot undo any of the harm done. But it is an important step within a broader recovery process.'

Unlawful processing

The Tax Administration should have deleted the data on dual nationality of Dutch nationals back in January 2014.

Dual nationality of Dutch nationals should not play a role in the assessment of childcare benefit applications. Nonetheless, the Tax Administration retained and used this data.

In May 2018, some 1.4 million people were still registered as dual nationals in its systems.

The Tax Administration also processed the nationality data of childcare benefit applicants for the purpose of combating organised fraud, even though this data was not necessary for this purpose.

Lastly, it used applicants’ nationality (Dutch/not Dutch) as an indicator in a system that automatically designated certain applications as risky. The data was not necessary for this purpose either.

It is unlawful, and therefore prohibited, to use nationality data to assess applications, combat fraud and determine risk.

Discriminatory processing

By unnecessarily retaining nationality data in its systems, the Tax Administration acted in a discriminatory way. Entitlement to childcare benefit is not contingent on nationality but on lawful residence in the Netherlands.

Under the GDPR, it is improper to process nationality data in a discriminatory manner because data processing must not infringe on any fundamental rights. These include the right to equality and non-discrimination.
 
Aleid Wolfsen commented: 'In a world in which digitalisation is advancing rapidly, it's becoming all the more crucial to protect individuals’ personal data in order to protect other fundamental rights, such as the rights to safety, property and health. This case shows exactly why: unlawful processing by means of an algorithm led to a violation of the right to equality and non-discrimination.'

'Digital applications have become indispensable, and they enable us to swiftly process and conveniently combine huge volumes of information. But when it goes wrong, it really goes wrong. And other fundamental rights can be affected too. The implications for individuals can be enormous, as the Childcare Benefits affair has made painfully clear.'

'That's why the DPA will continue to warn about the serious dangers involved in processing personal data using algorithms and artificial intelligence (AI), particularly because people will increasingly be faced with decisions made by algorithm. In such cases it must be beyond any doubt that their data has not been processed in a discriminatory manner. So it's crucial that we keep issuing these warnings.'

Tax Administration has ceased its violations

Following the DPA investigation, the Tax Administration began cleaning up its internal systems. In the summer of 2020 the dual nationalities of Dutch nationals were completely deleted from them.

The Tax Administration has not used applicants’ nationality in determining risk since October 2018. And it has not used the data to combat organised fraud since February 2019.

The fine was imposed on the Minister of Finance because he is responsible for the processing of personal data within the Tax Administration. Its imposition will not prevent victims from claiming compensation or damages for pain and suffering.

What happens next?

The Tax Administration can lodge an objection to the fine imposed by the DPA.