Parliamentary letter to PWC reports

Return address P.O. Box 20201 2500 EE 's-gravenhage

The President of the House of Representatives General P.O. Box 200182500 EA The HagueDate March 29, 2022Subject PwC reports FSV - SMEs and port queries Dear Chairman, With this letter, I share PwC's latest two reports on the Tax Administration's Fraud Signaling Facility (FSV) with your House. This is a report on the effects of FSV registrations provided by the SME department and the report “queries at the Gate” to the detection at the Gate process. By offering these reports, all five PwC reports on the effects of FSV on citizens and businesses have been sent to your House. The conclusions of the last two reports are also serious. During the detection at de Poort process, income tax returns are checked for inaccuracies. According to PwC, this process lacked quality controls and guarantees. According to PwC, there is also a risk that returns with equal tax risks were not treated equally and that objectively justified characteristics did not play a role in analysis at de Poort. In addition, the process was not properly documented, so it is not possible to properly reconstruct the process and the use of queries (queries to filter returns) and analyses at de Poort. The report on the registrations of the SME Directorate confirms the view about FSV from the previous reports and also shows that registering in FSV could have consequences for a further assessment of sales tax number applications. Before I elaborate on PwC's conclusions in this letter, I would like to emphasize that the tax authorities should only use those data in its selection processes that are demonstrably relevant and objectively justified in order to verify that the correct tax laws and regulations way has been applied. As a government organization, the tax authorities have a high standard here. Selection can never take place on the basis of characteristics of the taxpayer that are not relevant. I am shocked by the findings by PwC. The fact that PwC found examples of mentions of nationality in manuals and a perpetrator profile is unacceptable and morally reprehensible. This should not have happened. PwC has not been able to trace or1 Previously, the reports on (effects of) registrations by Surcharges: Parliamentary Documents II 2021/22, 31 066, No. 935 and the external provision of information about FSV citizens and on registrations by the Private Directorate were shared: Parliamentary Documents II 2021/22, 31 066, No. 957.this was actually applied in the selection. However, I think that it should be possible to rule out the use of irrelevant attributes. It is serious that the tax authorities cannot provide documents that make it possible to confirm or disprove the method of working with regard to the decision rules when analyzed at the door of the past. I think it is very important that it can be clearly explained which selection rules are applied and why. And why a taxpayer ended up under intensive supervision. After all, we need to be able to explain this to the citizen and be able to justify it. That is why it is important that this is documented and that the appropriate safeguards are in place. This turned out not to be the case with the detection at de Poort process. It is the responsibility of the tax authorities to ensure that management and processes are in order so that employees can carry out their work professionally. This was not correct during the process of detection at the gate and that is also serious. It is the responsibility of everyone at the tax authorities to work within the limits of the laws and regulations and to appoint it if it appears that this does not happen. I therefore asked the tax authorities, as part of the “culture and leadership” program, to reflect on how this could happen, to enter into discussions with the relevant managers and employees and to take appropriate measures if necessary. The purpose of this approach is to prevent this from happening again in the future, based on “lessons learned”. To this end, a structure is being set up to closely monitor progress. I will report to your House on this periodically, in accordance with the principle of good employment that applies to the relationship between the tax authorities and its employees. Both the detection at the Gate process and the use of FSV should not have been used in this way. FSV has been turned off and intensive supervision of declarations with an AKI code 1043 (which can follow after the process detection at the gate) has come to a standstill. I'm currently working on designing a possible allowance for people who were registered in FSV. The conclusions of these reports will be included in their design. With regard to the process of detection at the Gate, further clarification is needed about the consequences. I also want to prevent this from happening in the future. The processes of the tax authorities must be in order. However, as my predecessor also indicated, it will take time to put all processes in order. That is why I have also taken measures to limit the risks as much as possible until this has been achieved. I will elaborate on the actions and measures taken below.In this letter, I will discuss:A. The research queries at the Gate 2014-2019B. The investigation of the effects of FSV registrations by the MKB Directorate 2014-2019C. Measures/actions. Closing A. Research queries at the Gate 2014-2019A.1 Process detection at the GateIn order to be able to explain the conclusions, I would first like to discuss the process of detection at the Gate. Every year, the tax authorities receive approximately 12 million final returns. From this, the detection at the Gate process selects approximately 20 thousand income tax returns annually for inspection. De Poort refers to where the provisional refund (VT) requests and IH returns arrive digitally. The registration of an estimated 78,000 citizens and entrepreneurs (with a total of 102,000 registrations) of the approximately 270,000 registered citizens and entrepreneurs results from the detection at the gate work process. This process consists of a number of steps:1. By means of queries - queries - income tax returns are detected that may involve filling in or scanning errors and other (conscious or unconscious) errors. This detection takes place, for example, by means of plausibility and correlation checks or by comparing it with a legal standard amount.2. The analysis at the gate. The analysts at the Gate get an overview of the declarations that meet the selection rules for these queries. They assess whether the returns contain obvious errors, for example when a period is placed where a comma should be placed. They also look at which returns contain an increased risk of (deliberate) errors and assign them an AKI code 1043. For this process, manuals have been drawn up for the years 2014-2019, but have not been formally approved.3. After the process detection, all declarations are presented at the gate to the selection module, the automated weighing module, in the Assessment Tax System (ABS). Returns affected by the selection rules are issued for supervision. The reports with an AKI code 1043 were forwarded to the Intensive Supervision team2. An FSV registration was then also created until 2018. Your House was previously informed about analysis at the Gate/Project Code 10433.A.2 Conclusions PwCPwC investigated the substantive motivation of the queries and explained the queries/selection rules and the analysis/working methods of the analysts at the Gate. PwC investigated this because many FSV registrations followed the process of detection at the Gate. PwC's main conclusions are:1. PwC concludes that quality controls and guarantees for careful selection of the “detection at the Gate” process were missing in the income tax return. 2. With regard to the substantive motivation, PwC concludes that the queries and analysis do not follow from a translation of the supervisory strategy.3. Decision rules and the way in which the tax authorities acted were not laid down, not archived, not traceable and not reproducible.4. According to PwC, a reconstruction of the selection grounds and motivation within queries and analysis at de Poort is impossible. In their effect, applied selection rules can no longer be conclusively reconstructed.5. PwC concludes that the queries used selected for tax risks, but that some of the guidelines for selection at de Poort focused more on the characteristics of the taxpayer than on the tax risks.6. According to PwC, there is a risk that returns with the same tax characteristics did not have an equal chance of being declared by de Poort.2 AKI stands for Assessment Tax System Customer Information.3 Parliamentary Documents II 2020/21, 31 066, No. 711, 803, 2021/22, 31 066, No. 920.to become like an increased risk of fraud, to end up under intensive supervision and thus to be registered in FSV.7. In manuals for analysts at de Poort, PwC found decision rules that base fraud risks on personal characteristics, such as nationality and age, or tax factors related to personal characteristics (such as donations to mosques). A document with an offender profile4 was also found. These examples were shared with your House on February 24, 5.8. PwC cannot actually determine whether the perpetrator profile and the decision rules were applied in the way described, nor can it find out why people were eligible for intensive supervision through the analysis at de Poort. PwC concludes that the tax authorities cannot provide documents that make it possible to confirm or disprove past practices.9. PwC found no systematic evaluations.10. According to PwC, the AO/IC (Administration, Organization and Internal Control) is also missing when detected at the gate.B. Research into the effects of FSV registrations by the SME Directorate 2014-2019As described earlier for registrations by Supplements6 or Individuals7, an FSV registration by SMEs could have consequences for recovery, for example when applying for amicable debt restructuring. As previously concluded in response to previous PwC reports, the privacy of FSV registrants was also violated by the SME Department and there was a risk of misinterpretation. In addition, registering in FSV could lead to an increased chance of an entrepreneur being audited. PwC's new findings with regard to registrations presented by the SME Directorate concern the following: 1. An FSV registration could result in an ejection for further review of applications for a sales tax number (OB number). The registration was also included in the assessment of the award itself. 2. The researchers also found that a significant number of registered entrepreneurs also included family members in FSV. This happened, for example, when a signal related to both entrepreneurs or citizens (a shared family business) or when the signal was relevant to the fiscal partner.PwC discusses the Risk Analysis Model (RAM) application in the report. FSV records were visible in RAM. This was an application that combined data from 72 sources, including FSV. The FSV data that was used within RAM included all registrations within FSV, i.e. from Surcharges, Individuals and SMEs. For the purpose of prioritizing both national and regional projects, RAM could request an overview of risk indicators. These RAM overviews include information about the company's turnover and the last time the company was investigated, but also whether the entrepreneur had an FSV registration. Based on4 This documentation describes the following perpetrator profile: low income according to the counterinformation, (above) average salary as reported, usually young (18-35), often no tax partner, mostly male and often of foreign origin. 5 Parliamentary Documents II 2021/22, 31 066, No. 935.7 Parliamentary Documents II 2021/22, 31 066, No. 935.7 Parliamentary Documents II 2021/22, 31 066, No. 957.this risk indication, a selection was made of which companies were investigated within the project in question. In 2016, there were an estimated 125 authorized users, 31 of whom used RAM daily. In May 2018, it was decided to turn off RAM. In January 2021, it was discovered that (part of) the RAM data was still available in an analysis environment after being turned off. This environment was accessible to at least twenty employees from various directors. Even outside this environment, RAM databases were (limited) used after May 2018. This should not have happened and the authorizations to use the environment were revoked in January 2021. PwC observed two examples at one of the regional SME information counters of still (February 2022) sharing risk signals that were also in FSV. This explicitly states that the request is made as an alternative to consulting FSV. For the sake of completeness, PwC notes that other SME information counters (mailboxes) explicitly reject such requests.C. Actions and MeasuresFirst of all, there are a number of actions focused on the past.FSV allowanceOn December 6, 20218, the contours of an allowance scheme for the unjustified consequences of FSV registration were shared with your House. Now that the five PwC studies have been completed, these contours can be further filled in. I include all findings from the various reports in their design. I do this in consultation with your House and in compliance with parliament's budget law. I expect to be able to further explain my proposals in April, and not as previously promised in the first quarter of 2022. In addition, I will also discuss the overall picture with regard to the various PwC reports.Advice from a State Attorney with regard to possible consequencesI asked the tax authorities what possible irregularities in the selection of individual returns, taking into account the framework formulated by the Supreme Court on December 10, 20219, mean for subsequent actions based thereon (such as a correction to the return). The State Attorney was asked for advice about this. In the promised letter in April about the contours of the compensation scheme, I will further inform your House about the implications of this report and share the findings of the State Attorney with you.Find out more about the recording of the IKB/relationship SurchargesIn the report on the effects of SMEs, PwC observed the interaction between increasing FSV registration among SMEs and accessing these signals by other directors. FSV registrations could be listed by the SME Department in the Customer Treatment Information System (IKB) and Customer Relationship Management Taxes (KRB) systems. PWC sees that the allowance has been stopped for approximately 4,300 entrepreneurs or family members of entrepreneurs who were also in IKB or KRB. According to PwC, this does not indicate a causal relationship, but they do see8 Parliamentary Documents II 2021/22, 31 066, no. 937.9 ECLI:NL:HR: 2021:1748.that IKB or KRB have sometimes been consulted when making assessments under Surcharges. In line with PwC's advice about this, I will investigate this further with the Secretary of State for Finance - Surcharges and Customs. The Secretary of State for Finance - Surcharges and Customs will inform your House about this in more detail. In addition, there are a number of actions aimed at the present.Instructions: use objectively justified criteria when selectingIn response to the “queries at the gate” report, the tax authorities gave instructions to employees on how to use objectively justified criteria and their documentation in the selection processes. The tax authorities will monitor this more closely and enforce this.Attention: unauthorized use of information outside of authorizationsRequesting information outside of authorizations, as the report on the registrations made by SMEs shows, should not and should not happen again. The tax authorities have therefore once again emphasized in internal communication that this is not allowed and is not possible. This will also be addressed in the awareness game.Post-detection surveillance at the GateYour House was previously informed about analysis at the gate/Project Code 104310. In October 202011, the process of analysis at the gate was temporarily stopped. On March 31, 202112, your House was informed about the introduction of additional guarantees for the process: 1. New, established manuals have been created; 2. The maximum duration of an AKI code 1043 has been reduced from six to one year; 3. A four-eye principle on the assignment of an AKI code 1043 before the relevant declaration is subject to intensive supervision. 4. If intensive supervision of returns with an AKI code 1043 is resumed, the treatment of one out of six additional tax specialists will be tested for the correct application of laws and regulations; 5. The tax authorities have analyzed complaints and other signs that may indicate an incorrect use of project code 1043. This analysis was shared with your House on November 25, 202113. The presence of these guarantees was investigated by the State Audit Service (ADR). The report on this matter was shared with your House on March 31, 202114. The ADR has also investigated the effect of the (reinforced) guarantees in practice. That report was sent to your House on November 25, 202115. With the new guarantees, the queries at the Gate have now been resumed and the process of correcting returns with writing and/or other errors is running again. However, intensive supervision of declarations with an AKI code 1043 is still at a standstill.10 Parliamentary Documents II 2020/21, 31 066, No. 711, 803, 2021/22, 31 066, No. 920.11 Parliamentary Documents II 2020/21, 31 066, No. 711.12 Parliamentary Documents II 2020/21, 31 066, No. 803.13 Parliamentary Documents II 2021/22, 31 066, No. 920.14 Parliamentary Documents II 2020/21, 31 066, No. 803.15 Parliamentary Papers II 2021/22, 31 066, No. 920.14 Parliamentary Documents II 2020/21, 31 066, No. 803.15 Parliamentary Documents II 2021/22, 31 066, No. 920.Internal dialogueAs I wrote in my letter dated February 24,16, I met the employees of the tax authorities as dedicated colleagues who reject any form of discrimination. I want citizens to have the same confidence in their tax authorities, and that is why it is essential that these kinds of examples can no longer occur. I am convinced that this feeling is widely shared within the tax authorities. The ongoing discussions within the tax authorities about acting under the rule of law and applying the human dimension are being intensified. PwC's findings are included in these discussions and, as I announced earlier in this letter, I asked the tax authorities to reflect on the culture in which the examples found by PwC could have arisen. I also want continuous attention to be paid to the way in which the tax authorities work. Finally, there are a number of actions aimed at the future.Use of nationalityMy predecessor has instructed me to stop using nationality in supervision, except where there is an explicit legal basis for this. Data about the second nationality (in addition to Dutch nationality) does not play a role in legislation and should therefore not play a role in implementation. Management of relationships (BVR) is the basic registration system of the tax authorities, in which personal data from the Personal Records Database (BRP) is registered. Nationality is one of the personal data included in BVR. As stated above, this personal data may only be used by me for supervision in cases where there is an explicit legal basis and the use of this information is necessary. By letter dated 27 January 202117, an overview of all explicit legal provisions known up to that time that require the use of nationality was sent to your House. This shows that it is no longer possible to no longer register or use personal data nationality in its entirety in supervision.Improving compliance processes and documentationAs part of the Repair, Improvement, Guarantee (HVB) program, the tax authorities have started to eliminate the backlog with regard to compliance with the AVG, the Archives Act and the Government Information Security Baseline (BIO). As my predecessor indicated earlier, putting all processes in order will take up to and including next year. The goal is to have the most risky processes in place for citizens by the end of this year. I will discuss progress in the next HVB progress report. I expect to be able to send it to your House in April.Resume surveillance after detection at the GateI will only resume processing returns with an AKI code 1043 when it is fully clear that the process analysis at De Poort meets all requirements in terms of legality, privacy and traceability. First, the data protection impact assessment (GEB) will need to show whether privacy is surrounded by sufficient safeguards. This DPO has been submitted to the Data Protection Officer (DPO), who has one16 Parliamentary Documents II 2021/22, 31 066, No. 977.17Parliamentary Documents II 2020/21, 31066, No. 807.has drawn up an independent appreciation about it. In response to the advice, the GEB will be adjusted where possible. In addition to the test, the tax authorities will also pay specific attention to PwC's findings before I decide to resume intensive supervision after detection at de Poort.Ensuring risk selectionIn the first half of 2022, the safeguards framework for risk selection will be completed. After that, all forms of risk selection will be tested against this framework. As previously indicated18, the tax authorities are investigating guarantees that must be present when selecting the risks by the Tax Administration, Surcharges and Customs and, in response, is drawing up a guarantee framework. These safeguards should mean that the legality and transparency of risk selection can be (better) guaranteed. These safeguards include legal principles such as proportionality and purpose limitation, but also a transparent and explainable risk selection. In addition, this guarantee framework includes the standard that various choices and considerations with regard to risk selection must be defined in an unambiguous manner. The ADR has advised on one of the first concepts of the guarantees framework.Data Processing Act (Tax Administration, Surcharges and Customs)In line with the foregoing, we are working on a bill: the Data Processing Act, the Tax Administration, Surcharges and Customs. This bill aims to strengthen and future-proof the principles for processing data by the tax authorities, surcharges and Customs, and to create a general legal framework for ensuring the lawful, fair and transparent processing of data by these three implementing organizations. Your House has been informed about this earlier.19 The bill is currently being prepared. The aim is to consult the bill via the internet by the end of this year, then apply for advice to the Data Protection Authority in early 2023, then submit the request for advice to the Council of State and submit the bill to your House before the summer recess.AVG technical lineThe tax authorities are setting up a technical structure with regard to data protection. A draft advisory report has now been drawn up, aimed at executive directors, on strengthening legal advice in the field of privacy law. This report focuses on improving the decision-making line, the escalation line, and making it easier for employees to ask their questions in the field of privacy law. The structure is aimed at providing easy access to knowledge to the offices and also proactively providing colleagues with information. The advice will be finalized soon. In the second quarter, we will examine how and in what period the implementation of this technical line can be achieved. I will inform your House about this via the HVB reporting cycle.18 Parliamentary Documents II 2019/20, 31 066, No. 709.19 Last in Answering factual questions about response to the FSV report, Parliamentary Documents II 2021/22, 31066, No. 930.D. ClosingAs I said, the conclusions of the last two PwC reports are serious. This should not have happened and should not happen again in the future. As I have indicated, I expect to be able to further explain my proposals on compensation in April, and I will also discuss the overall picture of the various PwC reports. After that, I would also like to discuss these reports with your House during a plenary debate on FSV that you still want to schedule. Of course, I am also willing to (have) a technical briefing provided prior to the debate about the conclusions from the PwC reports and the design of the FSV allowance. With the HVB reports, I will inform your House about the progress of the other actions mentioned in this letter. I will therefore come back to the total of the measures taken and whether this is sufficient. I expect to be able to send your House the next progress report in April as well. Sincerely, Secretary of State for Finance - Taxation and Tax ServiceMarnix L.A. van Ri