Last week, the Autoriteit Persoonsgegevens ("AP") published a report on the processing of personal data in the context of the provision of childcare benefits by the Tax and Customs Administration.
By Sophie Hendriks & Martin Hemmer
The report addresses the lawfulness and propriety of the processing of applicants' nationalities. In its assessment, the AP also looks at the qualification of the data "nationality": should it be classified as regular personal data or as special personal data? In its answer, the AP discusses the relevant facts and circumstances of the case, confirming once again that such a qualification is not strictly black and white and must also be interpreted practically.
This blog will address the context-dependent qualification of a special personal data that the AP appears to be adopting here and what this means for you. After all, this method entails that the qualification of personal data should consider not only the information in itself, but also the circumstances of the processing.
In particular, the AP examined the extent to which the processing of applicants' (dual) nationality was lawful. The AP concluded that this was not the case with respect to three processing operations:
The first violation relates to the processing of possible dual nationalities of Dutch applicants. According to the AP, the processing of this information was not necessary for the performance of the Tax Administration's statutory task;
The Tax Office also used the data "nationality" as an indicator in a system that automatically selects high-risk applications. In this case, a less far-reaching route was open, the AP said, so the processing also proved unnecessary;
Third, the Inland Revenue used nationality as a lead in the detection of organized fraud. Here too, the AP argues, there was no necessity.
In addition to the above, the AP concludes that in cases of (2) and (3) there has been discrimination - the processing operations are therefore not only unlawful but also improper. "There is no objective justification because there is no reasonable and proportionate relationship between the distinction by nationality and its intended purpose," the AP said.
The implications for the Internal Revenue Service of this outcome will become apparent later this year.
Article 9 of the AVG designates the following information as special personal data: racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, or data relating to a person's sexual behavior or sexual orientation.
The concept of nationality does not appear here. On the other hand, the concepts of race or ethnicity, which are not further defined in the AVG, may include information about skin color, ancestry and national or ethnic alignment. Thus, nationality may in certain cases be an indication of a person's race or ethnicity. This is only the case if such information is directly related to the sensitive characteristic. An indirect connection may also result in special personal data, the AP argues. However, if data only give an indication that a sensitive characteristic might be involved, this is not sufficient to establish such a connection.
In addition to the fact that nationality in combination with other personal data could qualify as data revealing racial or ethnic origin, the context of the processing could also result in nationality by itself qualifying as special personal data.
"The AP considers nationality to be special personal data if the purpose of the processing is to distinguish by race or ethnic origin, or if it is reasonably foreseeable to the controller that the processing will lead to the making of a distinction by race or ethnic origin," it states. With this approach, the AP wants to prevent the prohibition of Article 9 AVG from being circumvented by using only information about nationality, even though the processing has the purpose of distinguishing between race and ethnicity.
Thus, the following requirements can be distilled from the foregoing:
The use of nationality information is for the purpose of racial or ethnic discrimination; and
The use foreseeably results in discrimination by race or ethnicity.
Such an approach is consistent with the AP's 2016 opinion regarding camera images; after all, here too the AP concluded that camera images and/or photographs cannot by definition be designated as special personal data simply because in some cases the race of the person in the photo can be determined. The purposes and consequences of the processing must also be taken into account. This principle is now also reflected in the AVG (Rev 51).
Despite the AP's opinion that discrimination and improper conduct by distinguishing on the basis of the applicants' nationality have (been) involved, it concludes that there is no (in)direct link between nationality and race or ethnic origin in the processing operations under investigation. Therefore, there is no processing of any special personal data.
This seems to be a contradictory conclusion, since it seems from the facts that it did distinguish between applicants with (only) Dutch nationality and those with dual or other nationality. On the other hand, the study reflects the distinction between race and nationality.
After all, nationality an sich does not qualify as a fact that reveals - without further context - a person's race or ethnicity. After all, nationality does not say what a person's ethnic background is, especially since nationality can be acquired in different ways. If data such as the country of birth were linked to it, this could be different.
It is in itself to be welcomed that nationality is not by definition seen as special personal data. After all, the term 'race' was previously interpreted very broadly, by including, for example, photographs or nationality and country of birth (parents). This leads to (too) little flexibility for processors of personal data. The AP's approach, however, can be called striking in view of previous case law.
However, we do not consider the AP's conclusion regarding special personal data in this context to be entirely consistent. Indeed, although it does not appear that one specific ethnicity was treated differently, it does appear that applicants with a nationality other than Dutch, and thus perhaps a different ethnic background, were treated differently than applicants with Dutch nationality. As a result, the AP's context-related criteria for qualifying personal data do appear to have been met. Why this is nevertheless different with respect to the Tax Administration is not clear to me.
In any case, the research shows that interrelationships and the background of a processing are also relevant in the qualification question and that it is therefore not enough to simply check off the list of Article 9 AVG. For now, it remains to be seen whether and, if so, what steps the AP will take against the Tax Office. We will keep you informed.
More from AKD
