The Tax Authorities currently exceed the legal deadline for 80 percent of requests from citizens for access to their personal data. The Dutch Data Protection Authority (AP) already warned the service last year about the slow processing and called it “unacceptable”.
The Tax Authorities confirmed this after questions about an internal report in the hands of NRC. This shows that at the end of last year, more than half of the access requests remained unanswered for too long.
In recent years it has become apparent that the Tax Authorities regularly pursue citizens for incorrect, outdated or discriminatory information, or, for example, put them on blacklists, putting them under increased supervision. For citizens who have had this happen to them – or who for some other reason suspect that they have been wrongly treated by the Tax Authorities – a request for access is crucial to demonstrate incorrect treatment.
The Fraud Signaling Facility (FSV) is the best-known blacklist at the Tax Authorities. Parents with childcare allowance who ended up on this could end up in major financial and personal problems because their allowance was wrongly reclaimed. But from one inventory it emerged a year and a half ago that 39 lists were still circulating “with risk signals, suspicions of fraud and references to nationality” where the risk of misuse was considered “high” and the chance of adverse consequences for citizens was “probable”.
Right of access
Citizens who want to know whether their data appears on lists comparable to the FSV will not receive an answer from the Tax Authorities, because according to the service “it is not known what this should mean”. The service previously said it could comply with access requests with a “broader scope”.
Since the introduction of the General Data Protection Regulation (GDPR) in 2018, citizens right of access in the personal data that organizations process about them. Agencies must respond to such requests within one month, although that period may be extended by two months for complex requests. The Tax Authorities write on their own website “usually within 1 month” to decide on access requests.
It now appears that the Tax Authorities do not respond on time in 56 percent of cases, even to more generally formulated requests for access to the personal data used. Between the beginning of 2021 and the end of 2022, there were 413 requests, the report shows. Things went slightly better in the first half of this year and 54 percent of the seventy new requests were processed on time. Of the requests that are still open, 80 percent have exceeded the legal period.
According to the confidential report, the slow processing is partly due to the lack of “guidance and coordination” in the handling of such requests. It is often not clear who should handle the requests internally. There is no administrative support for employees and the available manual is outdated. In addition, the chaotic state of the computer systems poses a problem: “It is difficult to collect all the personal data of a citizen, because they are spread across many different systems,” the service writes in the report.
In most cases, the Tax Authorities handle specific requests for information from the FSV list on time. Of the 7,500 access requests since January 2021 that were limited to the FSV, the service handled 97.5 percent within the legal period.
Clarification
The Tax Authorities conducted the internal investigation into the handling of access requests after criticism from the AP, the document shows. The privacy regulator demanded clarification in March last year because it received “many complaints and signals” about the slow response to access requests.
When asked, a spokesperson for the AP confirms that the regulator has “instructed the Tax Authorities to improve the handling of access requests”. The AP calls the right of access “essential, because otherwise you cannot check whether your data is processed correctly and fairly.”
In the November 2022 report, the top management of the Tax Authorities acknowledges the problem and promises improvements.
It is painful that the AP has again criticized the handling of personal data at the Tax Authorities. In April last year she submitted a complaint to the tax authorities record fine of 3.7 million euros due to the years of illegal processing of personal data via the FSV, a list that included more than a quarter of a million Dutch people and which played a central role in the Benefits Scandal. The AP found “a long list of violations” of privacy legislation surrounding the FSV.
State Secretary Marnix van Rij (Tax, CDA) then promised that the Tax Authorities would do everything they can “to prevent violations of privacy legislation in the future.”
After questions from NRC State Secretary Van Rij will soon have one letter to the House of Representatives sent. According to Van Rij, the requests are now being processed more quickly, partly because the Tax Authorities register them centrally.