For years, the tax authorities violated citizens' privacy with a widely used computer system

News

Through the RAM system, the tax authorities were able to combine highly sensitive data about citizens and share it with other government services, according to research by KPMG. The Secretary of State admits that the tax authorities should not have used the system.

• Derk Stokmans Stefan Vermeulen

• • Derk Stokmans
  • Stefan Vermeulen
• Published onMarch 6, 2025
• Reading time 2 minutes

From 1998 to 2018, the tax authorities made “intensive” use of a computer system that was already in conflict with privacy legislation at the time. The self-built RAM (“Risk Analysis Model”) system combined all kinds of highly sensitive citizens' information that was sometimes also shared with other government services, such as justice and social services. Using RAM, overviews were also made of citizens with a second nationality, who may have been subject to tax research based on this. This may include fundamental rights. geschonden.Dat is evident from a KPMG investigation into the use of RAM, which Secretary of State Tjebbe van Oostenbruggen (Tax Administration, NSC) brought to the House of Representatives on Thursday. steered. The investigation was launched after NRC had revealed the large-scale use of RAM and the tax authorities's careless handling of privacy-sensitive data.

Read also

For example, the tax authorities became a repeat offender in the misuse of personal data

Van Oostenbruggen is now writing to the House of Representatives that RAM did not meet the legal privacy, archiving and security requirements: “I note that the tax authorities should not and should not have used RAM and I regret that,” he writes. The cabinet is having additional research carried out into whether the use of RAM has violated individual citizens' fundamental rights. The results are expected in June.

Political pressure

Although there have been internal concerns about privacy violations for years, tax authorities were able to link hundreds of citizens' data from other service systems with RAM to search for possible tax violations. This happened intensively, as KPMG discovered. In 2017, around twenty thousand selections of citizens or companies were made from RAM. In an earlier year it involved 35,000 searches.In addition, all data available to the tax authorities could be drawn on. Not only personal data such as address and age, but also the details of the (tax) partner, the start date of the relationship, all information about income, assets and debt, how many cars, investments and real estate someone had, and hundreds of other data.According to Van Oostenbruggen, the “need for such a system as RAM” at the time was “reinforced by the social and political pressure felt to be able to carry out proper supervision and, where necessary, to combat fraud with information supervision..” Check which queries There was hardly any introduction of tax officials into the system, concludes KPMG. Around 200 employees had unlimited access to RAM and were also able to perform searches for colleagues. It was up to the users of the system themselves to ensure that they did not break any laws with their searches. There was also no control over what employees did with the requested data afterwards. For example, years after turning off RAM, KPMG found more than a thousand spreadsheets with RAM data on network drives owned by the tax authorities. It is unknown whether RAM data is roaming around outside the service. Employees were also able to “send information from RAM unsecurely via email or place it on USB sticks”.

Allowances scandal

During the investigation, KPMG found fourteen spreadsheets in which citizens were selected on the basis of their (second) nationality. This included people with Bulgarian, Romanian, Afghan and Albanian nationality. Those involved reported to KPMG that searches for people with the Chinese, Italian and Turkish second nationality were also carried out. “I do not think the presence of such data in RAM is correct, because that data could not simply be processed for other purposes and that processing should and should be surrounded by safeguards,” writes Secretary of State Van Oostenbruggen about this. Placing citizens on such a list is extremely sensitive, since the Benefits scandal showed that large numbers of citizens were unfairly placed on a fraud list by the tax authorities. According to KPMG, searches were also made by zip code via the RAM system. This may have made people the subject of tax research based on the neighborhood in which they lived. The KPMG study also shows that RAM was used “to provide data to projects that were carried out across the government”, writes Van Oostenbruggen to the House of Representatives. For example, the tax authorities shared citizens' data with the Financial Expertise Center (FEC), the Regional Information and Expertise Centers (RIECs) and the National Steering Committee on Intervention Teams (LSI).