The Ministry of Finance – €2,750,000 Fine (Netherlands, 2021)

Between 2013 and 2019, the authorities wrongly accused an estimated 26,000 parents of making fraudulent childcare benefit claims, requiring them to pay back the allowances they had received in their entirety. In many cases, this sum amounted to tens of thousands of euros, driving families into severe financial hardship. This is at the centre of the ensuing "childcare benefits scandal": https://en.wikipedia.org/wiki/Dutch_childcare_benefits_scandal. The AP launched an investigation, ex officio, into the processing of the nationality of applicants for childcare benefits by the Tax and Customs Administration (hereafter: the Administration), more specifically the “Benefits Department” (Afdeling Toeslagen), since this department is not only responsible for the granting, payment, and reclamation of benefits, but also for the detection and prevention of benefits-related fraud. The AP did so, because they received a warning in April 2017 about the Benefits Department's possible processing of the dual nationality of applicants for childcare benefits. This investigation resulted in the adoption by the AP of a report of findings on 16 July 2020 (hereinafter: the investigation report). Before discussing the main findings of the report, however, it is important to notice that, on 6 January 2014, a replacement law (Dutch: de Wet basisregistratie personen) was enacted for its citizen registration. One of the resulting changes was that if a person has the Dutch nationality, dual nationalities were no longer recorded. The main findings of the investigation report were: * The Benefits Department retained the registration of Dutch nationals with dual nationalities, even after the enactment of the replacement law on 6 January 2014. In May 2018, approximately 1.4 million Dutch citizens with dual nationalities were still registered in a database of the Benefits Department. * Between March 2016 and October 2018, the Benefits Department used the applicants' nationality (Dutch/not Dutch) as an indicator in an automated "risk-classification model", to assess which applications should be further investigated. * Between 2013 and June 2019, the Benefits Department used applicants' nationality to detect and tackle organised fraud. The letter imposing the fine is addressed at the current Minister of Finance, Wobke Hoekstra, as the Tax and Customs Administration are part of the Ministry of Finance's responsibilities, and therefore the Minister of Finance's responsibilities. The DPA sent an advance notice to the Minister of Finance on 13 August 2020 of their intention to impose a fine, and asked for their response. In the reply (dated September 10th 2020) the Minister recognised the violations and did not refute the facts surfaced in the previous investigation report. Holding The AP addressed the findings against both the GDPR and Wbp, since the violations occurred between 2013 and 2020. These violations will be discussed separately. Unlawful processing First, the DPA found that there were three instances of unlawful processing, violating Article 5(1)(e), in conjunction with Article 6(1) GDPR, and Article 6, in conjunction with Article 8 Wbp for the processing that occurred before 25 May 2018. The first unlawful processing related to the processing of dual nationalities in the FSV database, the DPA found that the Benefits department processed the dual nationalities of 1,400,000 Dutch nationals. The DPA acknowledged that the Benefits department can, in principle, rely on Article 6(1)(e) GDPR since they process personal to fulfill a public task, namely the granting, payment, and reclamation of benefits. Moreover, since the Dutch nationality needs to be confirmed, it is necessary to process this personal data for the fulfillment of that public task. However, the Benefits department also processed the dual nationalities that were retained in the TSV database since 6 January 2014. Since this processing was not necessary for the fulfillment of their public task, the Benefits department therefore unlawfully processed this personal data. The second unlawful processing related to the processing of the applicants’ nationality (Dutch/non-Dutch) as indicator in their risk-classification model, when assessing which applications should be assessed further. In their investigation, the DPA found that the result “non-Dutch” led to a higher risk-score. This indicator, however, did not meet the requirement of necessity. Because the indicator “possession of Dutch nationality, or EU nationality with registration in a Dutch municipality, or non-EU nationality and a valid residence permit”, rather than “Dutch citizenship/non-Dutch citizenship”, also answered the question of whether an applicant was eligible for childcare benefits, a less far-reaching form of processing was also possible. The third unlawful processing related to the processing of the applicants’ nationality in the activities of detection and prevention of benefits-related fraud. The Benefits department clarified that nationality could be an indication of the homogeneity of the research population and that experience would have shown that citizens in the same living environment, including on the basis of nationality, could be an indication of organised abuse. However, the DPA found that this processing did not comply with the principles of proportionality and subsidiarity since a less far-reaching form of processing was also possible, namely to only check the nationality if there were more concrete indications that there was organised abuse. Breach of principle of fairness Second, the DPA found that the second-, and third processing operation violated the principle of fairness within the meaning of Article 5(1)(e) GDPR and Article 6 Wbp. Concerning the processing of the nationality-criterion in the risk-classification model, the DPA considered that it is decisive whether the Benefits department used the criterion “nationality” although there was no objective justification, which means that this was discriminatory. The use of this criterion in the risk-classification model was not proportionate since it was not ultimately decisive in the overall assessment, and a more objective criterion, like “holds Dutch nationality, or an EU nationality with registration in Dutch municipality, or a non-EU nationality and a valid residence permit" would have also sufficed. Considering the use of the nationality-criterion related to the processing of the applicants’ nationality in the activities of detection and prevention of benefits-related fraud, the DPA held that this was not proportionate. Certain nationalities were more linked to fraud than others. Applicants with one of those nationalities, therefore, had an increased chance of being checked compared to applicants who did not belong to a nationality with increased activity. This distinction made is not reasonable and not objectively justified. The resulting disadvantage in treatment is not reasonable and proportionate to the objective pursued. Assessment of the fine The DPA imposed an administrative fine, under Article 58(2) in conjunction with Article 83 GDPR, as it believed the violations were severe, took place over multiple years, and were attributable. The height of the fine was determined as follows: based on the DPA's guidelines in determining the fine amount (see para 2.3 [https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/stcrt-2019-14586_0.pdf Boetebeleidsregels Autoriteit Persoonsgegevens 2019]), a €750,000 fine per violation would suffice considering the severity and the "Category III" violations. However, the DPA took many more factors into account, like: * the severity, scale, duration and deliberateness/negligence on part of the data processor;     * the power imbalance between the government body and its citizens; * the systemic nature of the violations; * the large impact on the lives of affected people; and * insufficient cooperation in the investigation and minimizing consequences. The DPA believed that a fine of €750,000 was not an appropriate punishment and decided to scale the second- and third processing operation as violations that require “Category IV” fines (see para 8.1 [https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/stcrt-2019-14586_0.pdf Boetebeleidsregels Autoriteit Persoonsgegevens 2019]), with a maximum of €1,000,000 per violation. Hence, it imposed a fine of €750.000 for the first processing operation, €1.000.000 for the second processing operation, and €1.000.000 for the third processing operation, which brings the total fine to €2,750,000.