Methods used by Dutch Tax and Customs Administration unlawful and discriminatory
The Benefits Office of the Dutch Tax and Customs Administration should not have processed the (dual) nationality of childcare benefit applicants in the way it did for many years. According to the results of the Data Protection Authority’s investigation, this practice was unlawful and discriminatory, and a serious and improper breach of the General Data Protection Regulation (GDPR). Today Aleid Wolfsen, chairman of the Data Protection Authority, submitted the investigation report to State Secretary for Benefits and Customs Alexandra van Huffelen.
The Tax and Customs Administration should have deleted the data on dual nationality back in January 2014. In May 2018, however, some 1.4 million people were still registered as dual nationals in its systems.
Dual nationality should not play a role in the assessment of childcare benefit applications. Nonetheless, the Tax and Customs Administration retained and used this data.
It also processed the nationality data of childcare benefit applicants for the purpose of combating organised fraud, even though this data was not necessary for this purpose.
Lastly, the Tax and Customs Administration used applicants’ nationality (Dutch/not Dutch) as an indicator in a system that automatically designated certain applications as risky. The data was not necessary for this purpose either.
It is unlawful to use nationality data to assess applications, combat fraud and determine risk. In other words, the Tax and Customs Administration was not allowed to do what it did.
By unnecessarily retaining nationality data in its systems, the Tax and Customs Administration acted in a discriminatory way. Entitlement to childcare benefit is not contingent on nationality but on lawful residence in the Netherlands.
The Tax and Customs Administration therefore made an unjustified distinction on the basis of nationality. Under the GDPR, it is improper to process nationality data to combat fraud and determine risks because data processing may not infringe on any fundamental rights. This includes the right to equality and non-discrimination.
‘Our investigation shows that the Tax and Customs Administration’s Benefits Office stored and used large amounts of data in various ways over a long period in a manner that was entirely impermissible,’ said Mr Wolfsen. ‘The way in which the entire system was set up and used was discriminatory. The specific consequences this has had for individual applicants is beyond the scope of this investigation, but we know that the nationality or dual nationality of applicants was consistently and systematically used against them and it should not have been.’
The Data Protection Authority’s investigation of the facts concludes the first step of the investigation process. The next step is for the DPA to determine whether to impose a sanction, such as a fine, on the Tax and Customs Administration. Before it can do so, the Minister of Finance is entitled to first officially respond to the investigation. After he has done so, the Data Protection Authority can announce in late 2020 any sanction it decides to impose.