Tax Authority data mining: Fraud database filled with taxpayers' social media posts

For years, the Tax Authority collected taxpayers' personal data, including their social media posts and other online presence, and stored it in a database used for supervision and combating fraud. That happened despite internal doubts about the legality of this data mining, NRC reports based on a 2017 internal report about this Risk Analysis Model (RAM) that state Secretary Marnix van Rij (Taxes) sent to parliament.

The Tax Authority started using RAM around the turn of the century. It contained “data of a highly confidential nature given the tax, financial, and/or personal nature of the data,” according to the internal report. “A lot of sensitive data from many people is brought together.” The tax office collected data from dozens of sources, registering not only personal data like address and age but also information about someone’s partner, the start date of the relationship, the partner’s nationality, and how often someone logged into the tax system to submit objections. The database also registered information about income, assets, debt, how many cars someone owns, investments, etc.

The Tax Authority used RAM for “profiling,” including based on nationality, according to the report. In addition to the tax office’s fraud hunters, Customs and the FIOD [the fiscal intelligence and investigation service] also used the database for “investigation purposes.” The Tax Authority also used it to monitor its own employees, according to the newspaper.

In 2016, there were already concerns within the Tax Authority about the legality of this data mining, NRC wrote based on internal email correspondence. There had been frequent attempts to shut the system down or replace it because it didn’t comply with privacy laws. However, the attempts failed due to the RAM’s popularity. According to a confidential report from that time, “at least 2,000” people within the tax service used the system. The tax office did not register who used the system or what they did with the data.

The Tax Authority officially shut RAM down after new privacy legislation took effect in May 2018. But, according to NRC, internal documents show that at least part of the database remained available to employees until January 2021.

The Ministry has launched an external investigation into the use of RAM and its consequences for citizens.