Belastingdienst – Court Ruling (Netherlands, 2022)

This dispute is between a tax payer (data subject) and an inspector of the Dutch Tax Authority (the controller). The data subject was mentally ill and his parents provided the care and assistance he needed. On his tax return, the data subject used several deductions for specific care costs. The Tax Authority, however, deemed these deductions unlawful and issued corrections in 2013. Since then, his tax returns were manually audited and corrected in 2016, 2017 and 2018. The data subject was also included in the database 'Fraud Notification Facility' (FSV). After rejecting the data subject’s objection to these corrections, the case was brought to court. During the proceedings, the data subject expressed the suspicion that he had been the subject of ethnic profiling. As a result, the deductions for specific healthcare costs had been unjustly scrutinised for years. He followed that this suspicion was confirmed by a letter from the Tax and Customs Administration (dated 27 May 2021), stating that his data had been included in the database FSV. The data subject argued that his inclusion in the database did not comply with the GDPR. The Court stated, with reference to a judgement of the Dutch Supreme Court, that if the Tax Authority finds that deductions were incorrectly applied in a tax return, it can manually check that individual's tax returns of the following years.[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2021:1748&showbutton=true&keyword=ECLI%3aNL%3aHR%3a2021%3a1748 HR 10 December 2021, ECLI:NL:HR:2021:1748] In principle, this also applies if that observation leads to the storage of the taxpayer's data in a database, and even if that data processing is in itself unlawful. The court held that this may be different if the audit results from a risk selection based on a criterion that violates a fundamental right of the data subject (such as a violation of the prohibition of discrimination on the basis of origin, orientation, or religion). Howev