Belastingdienst – Court Ruling (Netherlands, 2023)

The data subject is the owner of multiple companies that were subject to several investigations that subsequently led to him losing subsidy grants. The data controller filed a request to access all information related to him and his companies in the Tax Authorities' records to understand why the grant was lost. The data subject specifically inquired about any information on him that was processed by the Tax Authority's Fraud Signalling Provision (FSV) and whether he was being subject to automated decision-making. The Tax Authority confirmed that the data subject’s personal data was held by the FSV and indicated that the information was not used for automated decision-making or profiling. The Authority denied the data subject access to information held by the FSV because there was an ongoing investigation into the legality of the systems used by the Tax Authority. Following the rejection, the data subject appealed the decision and requested access to information about him in eight of the Tax Authority's systems, including the FSV. In a decision of 10 January 2022, the Tax Authority rejected the appeal and stated that the request fell outside of the scope of the initial request and that access could not be granted due to the ongoing investigation. The data subject appealed the decision of 10 January 2022 to the Gelderland District Court. The Court first evaluated if the controller met the obligation to grant access to data according to Article 15 GDPR. In this instance, the controller is the Minister of Finance, as they are responsible for the oversight of the Dutch Tax Authority. Given the first request's broad nature, which requested information from FSV and similar systems controlled by the Tax Authority, the Court acknowledged that ongoing investigations into these systems prevented the Authority from providing access to them. However, the Court ruled that the controller was required to confirm whether the data subject's personal data was held in systems used by the Tax Authority. Next, the Court considered whether the data subject's second request made in their appeal fell within the scope of the first access request and if the controller was obligated to comply with it. The Court held that the first request's broad nature meant that the request regarding the eight specified systems were not an expansion of but a clarification of the original request. The Authority's refusal, based on the ongoing investigations of the FSV and similar systems, was deemed not to be a reasonable basis for refusing the access request. The Court held that if specific systems could not be accessed, the controller should specifically explain to the data subject why this was, rather than offering a generalised answer. Therefore, the Court concluded that the controller was obligated to meet the data subject's request and that the Authority's grounds for refusal were invalid. Lastly, the Court assessed whether the data subject had received a sufficient response about the use of his data for automated decision-making or profiling, in line with Article 22 GDPR. Given that the data subject's information was identified in the FSV's systems, he held the right to be informed about the existence of any automated decision-making. The Court argued that simply informing the data subject that his information was not used for automated decision-making or profiling was not sufficient and that, in this regard, the data subject had the right to inspect and validate the use of his information. As a result, the Court annulled the Tax Authority's decision of 10 January 2022 and instructed the Minister of Finance to issue a new decision regarding the data subject's appeal within six weeks of the Court decision.