The Autoriteit Persoonsgegevens wants clarification from the Intelligence Bureau on the data it processes from citizens. If it appears that the agency is processing data for which it is not authorized or for which there is no legal basis, it must stop immediately. In this way, the supervisor wants to prevent a second benefits affair, says the Autoriteit Persoonsgegevens to newspaper Trouw.
The Intelligence Bureau is a body established in 2001 by the Ministry of Social Affairs and Employment. The purpose of the agency is to help municipalities assess applications for benefits. Based on a large number of data streams from municipalities, the Tax and Customs Administration and the UWV, among others, the Intelligence Bureau must pick up signals of fraud from this mountain of information and pass them on to municipalities. They may then decide to launch a fraud investigation. The Intelligence Bureau also processes data on self-employed people receiving government assistance (TOZO, NOW) and school dropouts.
In short, the Intelligence Bureau is an organization that collects a great deal of sensitive data from citizens. The Autoriteit Persoonsgegevens does not know whether the Intelligence Bureau is authorized to process and combine this data. What the consequences of such large-scale data processing can be, we have seen with the childcare allowance affair. More than twenty thousand households were wrongly labeled fraudsters and told to pay tens of thousands of euros back to the Tax Administration. As a result, they ended up in financial hell. The parliamentary interrogation committee childcare allowance -the Van Dam committee- spoke of "unprecedented injustice.
The supervisor requires the Intelligence Bureau to clarify within four weeks what data it collects, how it does so, and what legal basis exists for doing so. If the answers show that the agency is not authorized for certain data processing, it must stop doing so immediately. Executive chairman of the Autoriteit Persoonsgegevens Aleid Wolfsen speaks of a "data ocean that many agencies use, but of which nobody knows what exactly is happening."
This is not the first time the privacy watchdog has warned the Intelligence Agency. In 2018, the Autoriteit Persoonsgegevens alerted the Ministry of Social Affairs and Employment, the Interior and Kingdom Relations and Health, Welfare and Sport that the Intelligence Bureau may not have met legal requirements.
Wolfsen told Trouw that the organization recognized itself in the criticism and said it was going to work on it. However, that has not happened yet, the Intelligence Bureau writes in its 2020 annual plan.
Today the Autoriteit Persoonsgegevens will give an explanation in the House of Representatives about the investigation it presented last July about the Tax Authority. In that report, the regulator wrote that the tax authority's methods were "unlawful and discriminatory. The Tax Authority processed, stored and used the (dual) nationality of more than 1.4 million people who applied for childcare benefits.
"By unnecessarily including data about nationality in all kinds of systems, the Tax Administration acted in a discriminatory manner. For the right to childcare benefit it does not matter what nationality someone has, only whether they are lawfully residing in the Netherlands," the supervisor wrote at the time. Processing someone's (dual) nationality to combat fraud violates the General Data Protection Regulation (GDPR).
Wolfsen fears that there are parallels these between this affair and the work of the Intelligence Bureau. "The benefits affair also started with people saying, 'I feel like I'm on the wrong list, but I can't put my finger on it.' That's the risk of self-learning algorithms and ever-larger databases: you should always be able to check who has your data and why. In the messaging and their own annual reports, that doesn't always seem to be the case here."
The Intelligence Agency is aware of the requirement of the Autoriteit Persoonsgegevens to provide openness. A spokesperson tells newspaper Trouw the matter is "being handled very carefully. The organization has four weeks to reassure the regulator.
