The Autoriteit Persoonsgegevens last week published its decision imposing a processing ban on the Minister of Finance for the processing of Citizen Service Numbers (BSNs) in VAT identification numbers by the Tax Authorities.
Authors: Anke Holtland, Jacobine van Beijeren
The Tax and Customs Administration is in charge of issuing VAT identification numbers to businesses. For sole proprietorships, the Tax Authorities establish these VAT identification numbers by supplementing the BSN of the natural person concerned with 'NL' (before the BSN) and 'B' (after the BSN). As a result, the BSN is easily deduced from the VAT identification number.
The VAT identification number is widely used in business transactions. In some cases, its use is even mandatory. For example, it is mandatory for sole proprietors to state the VAT identification number on their website if they offer online services. In addition, it is mandatory to disclose VAT identification numbers to (potential) customers on invoices sent out by the sole proprietorship. The VAT identification number is used by more than 1.1 million sole proprietorships.
The AP launched an investigation into this practice by the Tax Administration in 2017 and issued a report on June 26, 2018. Among other things, it stated that there is no legal basis for the Tax Administration's use of BSNs. The BSN may only be processed if required by law.
The Tax and Customs Administration (as a government agency) may use BSNs (pursuant to Section 10 of the General Provisions of Citizens' Service Number Act (Wabb)) to the extent necessary to perform its duties. However, the use of BSNs to determine VAT identification numbers is not "necessary" and therefore not permitted.
At the time the AP started this investigation (in 2017), the Personal Data Protection Act (Wbp) was still applicable. The repeal of the Wbp and the entry into force of the General Data Protection Regulation (AVG) (and the General Data Protection Regulation (UAVG) Implementation Act) do not result in the irrelevance of this investigation, as the use of VAT identification numbers is continuous processing and the rules for processing BSNs have remained the same under the AVG and UAVG.
The Tax Administration has acknowledged the problems identified by the AP in its report. The Tax Administration states that the implementation of a different numbering system will take at least five years, because the IT landscape at the Tax Administration must be changed in a general sense. This process can be faster if it is given political priority and if more budget is made available for it. It does not follow from the AP's decision why the modification of the use of BSNs cannot be separated from the modification of the Tax Administration's IT landscape.
The AP has various enforcement options including taking corrective action. In this case, the AP chose to use its power to impose a processing ban under Article 58(2)(f) AVG. The processing ban imposed is to require the Tax Authorities to ensure that they no longer use BSNs in the VAT identification numbers of sole proprietorships by January 1, 2020. If the Tax Authority still does so after January 1, 2020, the AP may impose an administrative fine for failing to comply with the processing ban and/or for violating the AVG and the UAVG with this processing.
Thus, the AP gives the Internal Revenue Service just over one year to stop using BSNs. This is considerably shorter than the five-year period that the Tax Administration claims it needs to end this use. The AP justifies this deadline by arguing that the Inland Revenue could end this use more quickly if more budget were allocated for this purpose, which is a matter of political priority.
In this context, it is important to note that the use of BSNs is susceptible to identity fraud. In addition, it concerns a large number of data subjects. It is therefore understandable that the AP is putting some more pressure on the Tax Administration with this measure.
Imposing a processing ban is not the only enforcement measure the AP can impose. For example, the AP can also impose an order for periodic penalty payments. The effect of imposing a processing ban and then a possible fine if the Tax Administration does not comply with the processing ban has a similar effect to imposing an order under penalty. It does not follow from the decision why the AP chose this route instead of imposing an order under penalty.
This article can also be found in the AVG file.
