Council of State: Tax Authority adequately fulfilled GDPR access request on FSV

The personal data of [appellant] were contained in the Fraud Signaling Provision (FSV) of the Tax and Customs Administration. The FSV was an application used by the Tax and Customs Administration from 2012 to February 27, 2020, for the purpose of recording potential indicators of tax fraud. [Appellant] has requested access to her personal data. Furthermore, [appellant] wishes to know the purpose for which the data were used, to whom the data were disclosed, the origin of the data, how long they were stored by the Tax and Customs Administration, and the significance, underlying logic, and consequences of any automated decision-making by the Tax and Customs Administration. Decision-Making

In the decision of August 5, 2022, the Minister responded to the questions posed by [appellant] and provided an overview of her personal data in the FSV. [appellant] objected to that decision. During the hearing regarding the objection, it became clear that [appellant] wished to be registered for the so-called securities investigation and wanted to know whether she was eligible for compensation. For this purpose, procedures other than those under the GDPR are available. The Minister therefore declared [appellant]’s objection unfounded. Court Ruling

The court has determined that the assessment of the decision concerns the application of the GDPR, and that the assessment does not pertain to the legality of the inclusion in the FSV. The court has not found that, in this case, the Minister failed to apply the GDPR properly. [Appellant] has not raised any specific grounds against the decision regarding her request for access. The court has no reason to assume that the list of personal data is incomplete. As for [appellant]’s claim that she has been disadvantaged by her inclusion in the FSV, the court notes that she has not been classified as a fraudster. She did not substantiate her claims. To apply for compensation, another procedure is available to the Minister. The court has declared [appellant’s] appeal unfounded. The Appeal 4. [Appellant] argues that she was not provided with all the information regarding her registration in the FSV. According to [appellant], she was registered in the FSV after it came to light in 2015 that she had attempted to deduct €50.00 too much in study costs from her income on her 2014 income tax return. She suspects that the Minister has additional information regarding her registration in the FSV, as this is a very severe measure and her FSV registration cannot be based solely on the wrongful deduction of a small amount of study costs. Furthermore, the consequences of the FSV registration for [appellant] are significant. For example, she is experiencing problems with healthcare providers, her training institution, her former employer, and the UWV. She also had to repay unexpected care allowance and housing allowance. She suspects that these problems stem from her registration with the FSV.

At the meeting with the division, the Minister stated, upon request, that [appellant] had been selected for a manual review of her tax return under Project 1043. That project was initially intended to detect systemic fraud involving educational expenses. Later, under that project code, tax returns with a high risk of inaccuracies were also reviewed to identify, where possible, errors in the return. Because [appellant] was selected for Project 1043, she is also registered in the FSV. Subsequently, the irregularity in the income tax return was discovered. According to the Minister, this was not the reason for the registration in the FSV. The Minister further stated during the hearing that only officials working at the Tax and Customs Administration had access to the registered personal data, and that this data had not been shared with other organizations.

The Section agrees with the court that it has not been established that the Minister incorrectly applied the GDPR in the decision of August 5, 2022. The Minister has provided an overview of all of [appellant]’s personal data that were processed in the FSV and the purposes for which they were processed. The Minister explained the meaning of Project 1043. As stated, [appellant] suspects that more personal data exists than the Minister has disclosed, but the Department sees no concrete evidence to support this. The overview provided by the Minister does not show that [appellant] has been identified as a fraudster and would therefore be registered in the FSV. The Department also has no concrete indications that the personal data has been shared with other organizations.

At the hearing before the Section, [appellant] also stated that she no longer wishes to be registered in the FSV. This case does not concern that matter. The Section notes, in a general sense, that the Minister pointed out at the hearing that the data from the FSV should not yet be deleted because it is necessary for investigations and the processing of claims for damages. Furthermore, the Minister has stated that the data is accessible only to a very limited group of employees and should not play a role in tasks to be carried out by the Tax and Customs Administration.

The argument is unsuccessful. Conclusion

The appeal is unfounded. The court’s ruling must be upheld.

The Minister is not required to reimburse any litigation costs. Decision The Administrative Law Division of the Council of State: Upholds the contested ruling. So decided by Mr. E.J. Daalder, President, and Mr. G.O. van Veldhuizen and Mr. J.A.W. Huijben, members, in the presence of Mr. A.E. Camperman, Registrar. signed Daalder President signed Camperman Registrar Pronounced in public on August 5, 2026 1000