The Dutch Autoriteit Persoonsgegevens AP) has raised critical comments on a bill for the Dutch implementation of new European anti-money laundering rules. The bill concerns the introduction of new European rules against money laundering and terrorist financing in the Netherlands. Although the legislation offers many opportunities to improve the fight against financial crime, the new rules also lead to the collection and sharing of more sensitive personal data and to a far-reaching expansion of powers. The AP therefore advocates a mandatory evaluation and sufficient safeguards.
Anti-money laundering legislation requiresgatekeepers, such as banks, notaries, and real estate agents, to collect customer data, conduct customer due diligence, monitor transactions, and report unusual transactions to the Financial Intelligence Unit (FIU). The law allows the FIU and supervisory authorities to share confidential data with other government agencies, such as the police, the Openbaar Ministerie the Tax and Customs Administration.
Thebillimplements anew European package of rulesthat better harmonizes and expands national rules for gatekeepers. New gatekeepers will be added, such as crowdfunding platforms, luxury goods traders, and soccer clubs. In addition, a new European anti-money laundering supervisor will be established and the powers of, for example, the FIU will be expanded. There will also be more opportunities for cooperation and information sharing between public and private parties.
The new European rules aim to make the approach to money laundering more targeted. As a result, fewer transactions will need to be reported and more attention can be paid to higher-risk situations. This will enable supervisors and other relevant authorities to make better use of their time and resources.
"Money laundering and terrorist financing must be tackled. There is no doubt about that," says AP chairman Aleid Wolfsen. "This new law offers opportunities to make the approach to financial crime more effective and efficient. This is also being worked on jointly at the national level. At the same time, more data will be collected from citizens and possibly shared, such as nationalities, possible refugee status, and social security numbers. Powers for information sharing will also be expanded. These far-reaching measures can only be justified if they are demonstrably effective, do not go beyond what is necessary, and people are properly protected."
According to the AP, it is not yet clear whether this extensive system will actually lead to less money laundering and terrorist financing. Meanwhile, the consequences for innocent people could be significant. In addition, there is a risk that certain groups of people will be more frequently classified as high-risk, for example through automated analyses. This can lead to additional checks, exclusion, or unjustified suspicions, while it is often unclear to these people why this is happening and what they can do about it. The so-called "risk-based approach" to money laundering must therefore be implemented with care.
Wolfsen: "The government must be able to demonstrate that it is truly necessary and effective to intervene so deeply in people's private lives. And that people are protected against mistakes, exclusion, and discrimination. That is why the AP considers a mandatory evaluation of this new law to be necessary. The introduction of this new law can only be justified if it is clear in advance that the law will be implemented seriously and in a verifiable manner. Without that guarantee, people's trust in the government will also come under pressure.'
The AP therefore calls on the legislator to stipulate in law that the effectiveness of the anti-money laundering system be evaluated at the national level, with specific attention to effectiveness, proportionality, and risks of exclusion and discrimination.
The AP points out that the bill for the FIU is based on a different privacy regime than the General Data Protection Regulation (GDPR). According to the AP, the FIU's activities require organization and assessment in accordance with the GDPR. The European legislator has also indicated this in the new rules.
In addition, the AP considers it important that the FIU is able to operate independently. Given the nature and sensitivity of the information with which the FIU works, it is essential that it remains free from political influence.
Finally, the AP warns that the new rules will lead to more work for the AP. This is because the AP will be assigned additional tasks. More (special) personal data will be processed and shared, including through information-sharing partnerships. However, no additional resources have yet been allocated for this extra work.
