Skip to main content
Praxikon

Enforcement

Dutch Tax Administration fined 3.7 million euros for the FSV fraud blacklist

Date
Status
status not established
Body
Autoriteit Persoonsgegevens
Reference
AP, besluit tot boeteoplegging aan de minister van Financiën van 7 april 2022 (Fraude Signalering Voorziening), bekendgemaakt op 12 april 2022
Amount
€3,700,000

What it is about

From 4 November 2013 to 27 February 2020 the Tax Administration kept signals of possible fraud on around 270,000 people in the Fraud Signalling Facility (FSV). The Dutch DPA imposed six fines on the Minister of Finance as controller, 3.7 million euros in total: no legal basis (Article 5(1)(a) with Article 6(1), 1 million euros), no purpose specified in advance (Article 5(1)(b), 750,000 euros), inaccurate and outdated data (Article 5(1)(d), 750,000 euros), excessive retention (Article 5(1)(e), 250,000 euros), insufficient security (Article 32(1), 500,000 euros) and asking the data protection officer for advice on the DPIA too late (Article 35(2), 450,000 euros). According to the DPA, staff were also instructed to base the fraud risk partly on nationality and appearance.

What this means in practice

A public body that flags people as possible fraudsters through a list, score or risk model needs a specific legal basis, a purpose set in advance, accurate and current data, a retention period and a timely DPIA with advice from the DPO. Characteristics such as nationality do not belong in such a model as a risk factor.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, persbericht 12 april 2022 en boetebesluit 7 april 2022checked on 10 October 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 13

Guidelines8 of 17

Enforcement and fines8 of 13

Legislation in motion6 of 8