The Intelligence Bureau, which passes on potential "signals of illegality" to municipalities, is under fire in the national media. The bureau is said to operate as a "secret service" and to be "legally shadowy. A new government manhunt for citizens is said to be lurking. But are these claims true?
The Intelligence Bureau was established in 2001 by the Ministry of Social Affairs and Employment (SZW) and the Association of Netherlands Municipalities (VNG) with the aim of supporting municipalities in determining entitlement to benefits and identifying potential illegality. In doing so, the Intelligence Bureau acts merely as an "information hub" in the exchange of citizen data between municipalities and other agencies.
For example, the agency receives data from the RDW in the case of the purchase of a car, and forwards it to the municipality. In this way, municipalities do not have to knock on the doors of various agencies to request data themselves.
In early February, SP MP Jasper van Dijk already asked Parliamentary questions to the State Secretary for Social Affairs and Employment, Tamara van Ark, about the agency's work. (1) In her answers, the State Secretary states that the intervention of the Intelligence Bureau prevents all municipalities from having to consult the data sources separately. This makes the provision of information to municipalities 'safer and more efficient'. Van Ark also says that municipalities are not obliged to use the services of the Intelligence Bureau, that the organization has no investigative powers and is not involved in the enforcement of possible benefit fraud.
However, how such a potential signal of illegality comes about is still unclear. New MP Don Ceder (CU) said he already wants to ask questions about the creation of those signals and who is responsible for that data. If you want to know who is responsible for that processing, you might want to grab the Intelligence Bureau's privacy protocol, which was drafted in 2018. It states that the bureau acts as a processor of data on behalf of the college of B&W. (2) In it, the college of B&W is the processing controller.
That only a handful of experts and citizens seem familiar with the Intelligence Bureau and their methods since its inception 20 years ago is remarkable. Anyone looking at the Work and Assistance Act (2005) and its successor the Participation Act (2015) will see that the Intelligence Bureau is mentioned nine times in both acts. (3)(4) Information about the work and legal bases of the Intelligence Bureau can be obtained from public sources for anyone who wants it.
Suzanne Bezemer, a lawyer at law firm Loyens & Loeff, reveals that the Intelligence Bureau's field of activity can be divided into four policy areas: Wmo 2015/Justice Act, Work and Income, Education and Local Taxation. Each policy area in which the bureau operates as a data processor has a legal basis for the processing of data by the Intelligence Bureau, shown in the box below.
|
Wmo 2015/Justice Act |
Employment and income |
Education |
Local taxes |
|
Connection/ Staffing Agreement Municipal Data Exchange with municipality and CIZ. |
The Participation Act, the IOAW, the IOAZ and the SUWI Act. (5) |
Agreement Connection Provision Early Enrollment. |
Section 5.24 paragraph 1 Decree SUWI and Section 6.17 paragraph 2 Water Board Decree |
It was these legal provisions in particular that created much confusion and ambiguity. In consultation with the Personal Data Authority (AP), an amendment to the SUWI Decree was therefore drafted to clarify the situation and bring it more in line with the role of the Intelligence Agency. This is regulated by an amendment to the SUWI Decree. (6)
Despite the fact that all legal and statutory bases can be found in public sources, the Intelligence Bureau was repeatedly accused of being "legally shadowy" in Trouw, De Volkskrant and De Groene Amsterdammer . But to know whether that is true, it is important to know exactly what is meant by shadowy, argues Dennis van Tilborg, a lawyer at AKD. Van Tilborg's work includes fraud prevention in the social domain and he specializes in open and digital government cases. "Where this claim of shadowy comes from is not immediately clear to me. It can mean different things. Moldy can be explained as something that cannot bear the light of day, but that seems out of place in this case. The status of processor can be traced to public sources. These show that the Intelligence Bureau, for some of its tasks, has a legal basis and that there is an agreement between the participants in the foundation and the foundation itself in which the role of processor is further elaborated. I don't think that is shadowy. You can also explain shadowiness as opacity. I can imagine something about that. It is not crystal clear to a citizen what the Intelligence Bureau does."
Van Tilborg is referring to the technical language in the privacy protocol, which is difficult to fathom even for him as a lawyer. On top of that, in the SUWI Act, the Wmo 2015 and the Youth Act, the provisions on data processing are broad and generally defined. The Intelligence Agency could therefore take more account of the public they serve in their accountability. "If you as a citizen want to know what data the Intelligence Bureau processes for what purpose, it requires quite a search. In that sense, they are not very transparent. The information obligation of the General Data Protection Regulation (AVG) states that you have to explain not only what your status is and what basis you have, but also that the information is accessible."
Is it desirable for a private-law body to collect data from citizens? "When the Intelligence Bureau was established, a private foundation was chosen because of the separation of policy, implementation and supervision. In principle, it should be possible to entrust public tasks to a private-law body," says Suzanne Bezemer. "What is important, however, are sufficient possibilities to control and supervise the execution of their tasks, and sufficient possibilities to control compliance with the Wmo 2015, Youth Act and Participation Act. For example, you could look at whether the minister makes sufficient use of designation possibilities, and whether this is done in the right way. There is also the possibility of transferring the tasks to another organization if the data protection fails."
Citizens' data should be safe with a municipality. Openness, transparency and obtaining access are essential for citizens in determining whether processing sensitive data is perceived to be lawful. This is precisely why the questions posed by the AP (7) are of great importance, according to Bezemer: "I look forward with interest to the clarification from the Intelligence Bureau on exactly what data it processes and in what way."
By now we are well past the four weeks mark but whether the Intelligence Bureau is able to reassure the regulator remains to be seen. In a response to Data&Privacyweb, an AP spokesperson let it be known that "the AP is studying the information it received from the Intelligence Bureau" and "no further information is available.
In early 2020, the court declared the System Risk Inventory (SyRI) unlawful. This system allowed government agencies to share and analyze data to predict which individuals have a higher risk of benefit fraud. The comparison between SyRI and the Intelligence Bureau is often made in the national media, mainly because both involve algorithm use.
This does not mean that the two cases can be compared one-to-one. According to the court, SyRi is a form of profiling. Its deployment involves searching for links between personal data and using predictive analysis. The Intelligence Bureau is merely a data hub that, while using an algorithm, does not attach predictions or analyses to the results. This is a big difference, Dennis van Tilborg also says: "Despite the legal basis, with SyRI it was clear that a lot of data was being collected through an almost inexhaustible list, and that added information was also being sought to make a risk inventory. You couldn't look under the hood with SyRI, but you knew it was a car that was potentially speeding. The Intelligence Bureau seems primarily an information hub, turning data from party A into a small package and forwarding it to party B."
The separate legal basis of SyRI suggests that it is something other than the Intelligence Bureau, says Van Tilborg. According to him, the main problem is whether it is clear what the bureau does: "If I look at what they do specifically with the law in hand and a glance at the website, it is not clear enough. The focus should therefore be on greater transparency. But to place the Intelligence Bureau in the SyRI corner at this point is going too far for me."
The discussion about the Intelligence Bureau can hardly be seen separately from the Benefits Affair, in which thousands of families were wrongly labeled as fraudsters and thus became victims of a government manhunt. To prevent such situations in the future, it is important that citizens gain insight into who is processing what data and why. Algorithms are important to identify risks, but cannot replace human action, says Suzanne Bezemer. "Given the policy areas in which the Intelligence Bureau operates, citizens are in a dependent position in relation to the municipality. This is precisely why it is necessary that sufficient checks and balances are built into the system so that the citizen's situation is also taken into account."
Gerrit Dijkstra, associate professor of Public Administration at Leiden University, argued in both De Volkskrant and De Groene Amsterdammer that the bureau's lack of that transparency and accountability, in part, goes against the rule of law. But Van Tilborg does not think that is enough to call the Intelligence Bureau not rule of law: "The meaning people give to the term 'rule of law' can vary quite a bit. In the current times, of course, transparency is important, partly because of the Benefits Affair. Looking at the legal status and the 2018 privacy protocol, there is still a world to be gained there, but for the conclusion that the Intelligence Bureau is contrary to the rule of law, I think some more evidence is needed. I see contravening the rule of law primarily as acting in such a way that the freedom of citizens, the functioning of democracy or the protection of law is compromised, that does not apply to every violation of the AVG."
That leaves the question of why the Intelligence Bureau is getting such a swipe. Who has an interest in it? Certainly not the bureau itself; after all, as a foundation they operate on a non-profit basis. For them, there is nothing to be gained from unlawful data processing. Besides, they work with a legal basis.
However, this does not always happen. One example is the government project launched in 2014 that every citizen in the Netherlands has to deal with. The National Approach to Address Quality (LAA), which aims to "increase the quality of address data in the Basic Registration of Persons (BRP) and combat address-related fraud. This project has been operating for years without a legal basis. LAA's modus operandi is a form of profiling by the government. LAA involves "risk-oriented address research. In trials and pilots, patterns are examined that may indicate incorrect address registration. This involves looking at patterns that indicate improper use of facilities - conscious or unconscious - linked to that address. (8)
In this approach, besides 280 municipalities, five different ministries (OCW, BZK, SZW, Finances, VenJ) cooperate. No Dutch citizen escapes the LAA, after all, in principle everyone is registered at an address. Questions can be raised about the Intelligence Bureau, but also the risk profiling of the LAA is anything but transparent. It is not possible to find out what signals and profiles are involved. That information on the knowledge base is not accessible. However, an animated video can be found on the website. (9) This partnership of municipalities and implementing organizations has been operating for seven years without supporting legislation.
Unlike the Intelligence Bureau, the bill to legitimize the LAA's data exchange is still in preparation. From April 10 to May 22 last year, the Internet consultation of the bill amending the BRP Act in connection with the National Approach to Address Quality took place. However, this amendment has still not been implemented today. In a parliamentary letter on March 15, 2021, State Secretary Knops writes that "a proposal to amend the BRP Act for the purpose of LAA is in preparation." (10) With a brp decree (11) and a brp regulation (12), under consultation from May 4 to June 1, Knops now wants to still provide a place for LAA in the law. The method of LAA is a form of profiling by the government, and the government may only do that if there is legislation for it.
Back to the Intelligence Bureau: if, according to some, the organization would not be able to process data lawfully, who is allowed to do so? For example, the municipality of Nissewaard enlisted the help of a commercial party to detect welfare fraud. Totta Data Lab' s algorithms processed the data of 2,300 Nissewaard welfare recipients without being allowed to know what the data was. The municipality was not willing to disclose in order to "not make fraudsters any wiser. (13) That method was enough for the FNV to file a lawsuit against the municipality early this year. (14) The precise work of the Intelligence Bureau can certainly be explained more transparently, but at least the methodology of the Intelligence Bureau is more open than the methods of some commercial data analysts. Therefore, a concluding question to the AP for follow-up research: how many municipalities actually engage with (non-transparent) commercial parties in the field of data processing in the social domain?
Footnotes
https://wetten.overheid.nl/BWBR0015703/2021-01-01
https://wetten.overheid.nl/BWBR0015703/2005-04-15#Hoofdstuk6_Paragraaf6.6_Artikel63
(i)Legality check: section 64(3) Participation Act and section 67(2) Participation Act, section 45(2) Income Support for Older and Partially Disabled Unemployed Workers Act (IOAW) and section 48(2) IOAW, section 45(2) Income Support for Older and Partially Disabled Former Self-Employed Workers Act (IOAZ) and section 48(2) IOAZ.
(ii) Reintegration: Article 63 of the Work and Income Implementation Structure Act (SUWI Act), Article 64 paragraph 3 and Article 67 paragraph 2 of the Participation Act, Article 45 paragraph 2 of the IOAW and Article 45 paragraph 2 of the IOAZ.
(iii) Special assistance: article 64 paragraph 3 Participation Act and article 67 paragraph 2 Participation Act, article 45 paragraph 2 IOAW and article 48 paragraph 2 IOAW, article 45 paragraph 2 IOAZ and article 48 paragraph 2 IOAZ.
(iv) Assistance debtors: article 64 paragraph 3 Participation Act and article 67 paragraph 2 Participation Act, article 45 paragraph 2 IOAW and article 48 paragraph 2 IOAW, article 45 paragraph 2 IOAZ and article 48 paragraph 2 IOAZ.
(v) Municipal Digital Customer File Facility: article 5:24 paragraph 1 Decree SUWI.
https://www.ictu.nl/projecten/landelijke-aanpak-adreskwaliteit
