The Netherlands – Court Ruling (Netherlands, 2020)

The digital tool called System Risk Indication (SyRI) is used by central and local Dutch authorities to prevent and combat fraud in the areas of tax and social security. It carries out different processing operations on personal data. SyRI gathers large-scale data and generates risk notification about people likely to commit fraud, which is called “risk report”. These risk reports have significant consequences on citizens' life; they indicate s that a specific person is worthy of investigation related to fraud. A number of civil society organisations and citizens sued the State claiming that SyRI violates fundamental rights. The Sate argued that SyRI provides sufficient guarantees for protecting the human right to privacy. The litigation raised numerous issues related to International and European Law, mainly the violation of Article 8(2) ECHR which allows interferences with the exercise of the right to respect for private and family life by a public authority under three conditions: it must be provided by law, be necessary in a democratic society and pursue interests such as the prevention of disorder or the economic well-being of the country. Nevertheless, this summary will focus on the protection of personal data and the interplay between the new technologies and the ECHR. The Court had to pronounce itself on whether the processing of personal data by the digital tool SyRI falls within the scope of Article 8(2) ECHR. It assessed whether SyRI was prescribed by law and under which conditions to know if it was necessary for the pursue of the prevention of fraud within a democratic society. Thus, it addressed importantly the interplay between Article 8 ECHR and EU law, including the Charter and the GDPR for the purpose of the assessment of the interference in private life under the ECHR. Focusing on data protection, the Court focused on the processing operations in the context of the deployment of the SyRI and the technical safeguards contained in the tool. It referred to several further processing operations, namely: the mutual exchange of personal data by administrative bodies, the provision of personal data to the Minister, the profiling, the provision of personal data to the Minister, the making of risk notifications and/or the inclusion of (information about) notifications in the Register of Notifications. Mainly, It had to assess whether Article 8 of the Charter; Articles 5, 6, 22 and 35 GDPR have been violated. The Court decided to assess the compliance with Article 8 ECHR in the lights of the Charter and the EU law data protection principles. Indeed, the Court recalled that the ECHR provides for a minimum protection of the fundamental right to privacy. It pointed out that the content and scope of EU fundamental rights in the Charter and the ECHR are alike insofar they are corresponding to each other’s. It also reminded, that the Charter provides for a least the same minimum level of protection and that rights guaranteed by the ECHR are part of the general principles of EU law under Article 6(3) TEU. Finally, as the Court considered that the Charter and the GDPR go beyond the ECHR in some respect, the ECHR have to be interpreted in the lights of the general principles of the Charter and the GDPR. Regarding the concrete assessment of the interference in the lights of the EU data protection principles, the Court considered that the risk model, the indicators and the data that are actually processed are neither public nor known to those involved and it has a significant effect on the private life of the person to whom the report relates. More precisely, with regard to the condition of “provided by law”, the Court acknowledged the SyRI legislation. Nevertheless, it left open the question on whether the legislation is sufficiently accessible and foreseeable to constitute an adequate legal basis and, thus, to justify the restriction of the right to privacy. Concerning the condition of “necessary in a democratic society”, the Court assessed the risk model and the processing operations on personal data and concluded that the SyRI legislation does not take sufficiently into account the purpose of limitation principle (Article 5(1)(b) GDPR) and data minimization (Article 5(1)(c) GDPR). For example, the Court noticed that the data protection impact assessment had been carried out prior the entry in force of the GDPR and could not meet the requirements under the national data protection act and Article 35 GDPR.