FPS Finance – Complaint Upheld (Belgium, 2020)

The Federal Public Service of Finance maintain FisconetPlus, an online repository of Belgian tax laws, rulings and guidelines, aimed at informing tax payers on taxation questions and at easing their fiscal compliance. As a part of a revamp in 2018, FisconetPlus was moved to a SharePoint website, hosted in the Belgian federal government’s G-Cloud infrastructure. Thereafter, access to the repository was still free but required logging on to the portal with a Microsoft user account. As a part of their registration process for a Microsoft account, users needed to accept Microsoft’s privacy policy, which by default enabled certain tracking and advertising features. This change within FisconetPlus was examined by the Belgian Data Protection Authority, following a series of complaints. The DPA’s Inspection Service found in February 2019 that the update constituted a breach of the GDPR. The DPA considered that there was no legal basis that would allow the FPS Finance to force citizens to entrust their personal data to a private undertaking as a precondition for accessing public sector information. In June 2020, the DPA’s Inspection Service issued (for the first time in history!) a provisional measure that obliged the FPS Finance to provisionally suspend FisconetPlus, specifically the access to the repository via Microsoft’s SharePoint portal. This decision followed the recommendation published by the DPA’s in February 2019 on the obligation to create a user account with Microsoft for the purpose of consulting public service applications. As a result, the FPS Finance deactivated the access to its FisconetPlus portal via a Microsoft account, which however remained accessible through other means of access. The FPS Finance promised to rewrite FisconetPlus and switch from Microsoft tools to a platform developed internally and hosted entirely on its own infrastructure. Identification and authentication would then be done via the Federal Authentication Service ("FAS”); the creation of a Microsoft account would no longer be a requirement. But for budgetary and human resources reasons, temporary solutions were to be implemented, namely a simple consultation via MyMinfin without authentication and a consultation via the creation of a Microsoft account as an anonymous user (which does not require the transmission of data, so that neither the FPS nor Microsoft knows the user). In the meantime, the file was being thoroughly examined by the DPA’s Litigation Chamber, who – in its decision of 23 December 2020 – confirmed the GDPR violations and issued a reprimand to the FPS Finance (pursuant to the Belgian Data Protection Act of 30 July 2018, the DPA is not empowered to impose administrative fines to public bodies). The DPA considered: 1) Basic principles The FPS Finance offers the possibility to access information on FisconetPlus in a way that does not require the use of any Microsoft user account (whether or not anonymous), namely via the basic search engine on MyMinfin (which does not require any authentication). But in the DPA’s opinion, it is not because the user can choose an access option (with fewer functionalities) where no or less personal data are processed, that the other access option (more user-friendly) where personal data are collected and further processed can enjoy less protection under the GDPR. In other words, it is not because the access to the information is not in itself precluded without the use of a Microsoft user account, that such authentication via a third service provider cannot constitute a breach of Article 6 of the GDPR when it implies that the personal data of the data subjects are not properly processed. In casu, the data processing operations were lacking transparency. The FPS Finance did not offer the most privacy-friendly choice (direct access without authentication) in a clear manner and as a default choice. For that reason, there has been a breach of Article 25 of the GDPR on data protection by design and data protection by default. The FPS Finance did not explain neither transparently enough to (potential) data subjects how their personal data would further be used by Microsoft. There is clearly data flows to and from Microsoft, which have not been transparently brought to the attention of the user. This includes the authentication data and the email address of the data subject. The fact that an anonymous Microsoft account could be used to access FisconetPlus (with arbitrarily allocated login data) also proves by definition that the access option through a new or already existing Microsoft account implies the processing of more personal data than strictly necessary within the meaning of Article 5(1)(c) of the GDPR. The FPS Finance therefore does not comply with the data minimization principle. Moreover, the DPA ruled that as a matter of principle, no authentication mechanism or identification obligation of any kind – government controlled or otherwise – should be necessary to access information that should be publicly available; and that personalized services (storing favorite sources, automated warnings, etc.) should not require systematic unique identification of the users. The DPA therefore considered that the principle of proportionality has been breached. 2) Failure to conduct a Data Protection Impact Assessment Given the potential risks to the rights and freedoms of the data subjects, in particular with regard to the security of the platform (Article 32 of the GDPR), the FPS Finance should at least have conducted a Data Protection Impact Assessment before putting such a system in place. 3) Use of cookies In order to create an account, users must accept Microsoft’s privacy and cookies policies as well as its standard cookie settings. These standard settings do not respect the principles of data protection by design and data protection by default, since they let Microsoft collect a large series of data on its users. The use of a Microsoft account involved the placement of non-essential cookies for which no legally valid consent was obtained, given that the cookie banner used on the website included consent by means of “further browsing”. It stated that if the user continued browsing, he/she accepts the use of cookies. This so-called "further browsing" was considered by the FPS Finance to be a legally valid consent for the use of cookies. There must however be a clear statement or active action on the part of the user in order for him/her to give free, specific, clear and unambiguous consent in light of the GDPR. Not only the technique of "further browsing", but also the cookie policy raises doubts, as there was a discrepancy between the cookies listed in the cookie policy and the cookies actually loaded when the website was opened.