Dutch Data Privacy investigation targets the Tax Authority for keeping mega database

The Dutch Data Protection Authority has launched an investigation into the Tax Authority’s use of the controversial Risk Analysis Model (RAM) - a data system built by the tax office in the 1990s with which employees could link and analyze information from all existing databases within the service. The government also previously announced that it would conduct an external investigation into RAM, NRC reports.

Through RAM, tax office workers could “connect almost everything to everything,” the Tax Authority wrote in an internal report in 2017. The system had large amounts of data on citizens, including personal information mined from social media or other parts of the internet. It allowed tax officials to gain virtually uncontrolled access to the sensitive data of millions of Dutch people.

Inspectors could also carry out discriminatory analyses because RAM listed taxpayers’ nationalities. The service linked that data to the ownership of houses, cars, and bank balances, for example. RAM was officially turned off when new privacy legislation took effect in 2018, despite massive concerns within the Tax Authority about the legality of the system in the years before.

In recent years, the AP has already imposed two massive fines on the Tax Authority for the unlawful handling of personal data. It fined the service 2.75 million euros for processing dual nationality of taxpayers who applied for the childcare allowance and 3.7 million euros for illegally processing personal data for years through the fraud signaling facility FSV, which played a big role in the benefits scandal.