How the Dutch Data Protection Authority consultant became a tax authority consultant

The Dutch Data Protection Authority (AP) is under scrutiny for its handling of the Belastingdienst, the Dutch Tax and Customs Administration, regarding its use of algorithms. Investigations revealed that over half of the Belastingdienst's algorithms, used for tasks like tax return verification, lack proper justification and may be discriminatory, raising serious concerns about compliance with the General Data Protection Regulation (GDPR). The AP has initiated a "supervisory arrangement" with the Belastingdienst, a five-year, €2 million per year program, to help improve GDPR compliance. Despite finding significant non-compliance, with algorithms potentially violating the GDPR, the AP's response has been criticized. Rather than enforcing corrective measures, such as imposing processing bans or fines, the AP has requested the Belastingdienst to develop a plan of action. This approach has sparked criticism, with concerns that the AP is acting more as a consultant than an independent regulator. Critics argue that this undermines the AP's role in protecting citizens' personal data and potentially exacerbates risks, particularly in light of the previous tax scandal, which led to significant injustices. The situation highlights broader implications for digital rights and data protection in the Netherlands.