News item | 06-03-2025 | 16:45
The KPMG study into the earlier operation of the Risk Analysis Model (RAM) was sent to the Lower House today. The research is reflected in the operation of this so-called ‘data combination system’ within the Tax Authorities that were used intensively between 1998 and 2018. The investigation notes that RAM did not sufficiently meet the then applicable requirements in the field of privacy legislation, security regulations and archiving. The KPMG study thus confirms the images from previous investigations on data use at the Tax Authorities at the time. From 2018, the improvements have been implemented by the Service that lead to a better balance between supervision and data protection. State Secretary Van Oostenbruggen reports this in the policy response to the report prior to the Tax Authorities Commission Bat on 13 March 2025.
The research shows that RAM was created in the late 90s due to a lack of practical support in supervising. The disclosure of data from systems was still limited at that time. With the use of RAM, employees no longer had to visit information in different source systems per taxpayer, but in RAM they could consult data from different sources in one go. The need for a search system like RAM increased at that time due to the felt social and political pressure to combat fraud. In this way, RAM was able to grow from a local application to a widely used national system. With that growth, the applicable guarantees have not been taken sufficiently into account.
The Tax Authorities of Nu works differently than the Tax Authorities of the time. For example, it is now being tested in advance whether a distinction is made between groups on unwanted grounds and there is a team that works on the ethical issues concerning the use of algorithms.
State Secretary Van Oostenbruggen (Taxation, Tax Authorities and Customs): “Although I understand how RAM could arise on the basis of the spirit of the times, it is certain for me that the RAM tax authorities should not have been allowed to use. I cannot change the past, so I want to focus on what we should do in the present. That means that I want to have clear whether with the use of RAM may have been violated by the use of nationality in the selection at the time. I want to provide clarity about this at the latest in June 2025. ” The minister continues: “And I want the existing laws and rules to be properly complied with. That is why the Tax and Customs Administration continues unabated with the approach to comply with the AVG and will continue with support and training for employees in the field of data processing and information security. ”
Other systems also investigated
As part of the investigation, KPMG has mapped twelve systems on the basis of criteria that can be comparable to RAM. Five systems of this are still in use at the Tax Authorities. For these systems, the service investigated whether they meet legal requirements and frameworks for privacy and information security. This analysis shows that no automated selections and profiling take place. It has also not been shown that there are special personal data in these systems, as referred to in the AVG. In order to limit access to tax data, a large number of authorizations of employees are withdrawn for one system who do not need direct access for their work. Furthermore, active monitoring on the use of the system will be entered immediately. This is in line with the approach to resilience that the House was informed about in April 2024.
The customs and surcharges also used RAM at the time. For these services, the report shows that some employees had access to RAM per service, but that it does not make clear whether and how they actually used RAM. In addition, it applies to customs that it uses one system that is comparable to the RAM criteria. This is a system to make selections on the goods declarations of entrepreneurs who receive customs through various declaration systems-a legal task from the Customs Code of the Union. You will find more information in the letter of Parliament about RAM and the KPMG examination below.