The KPMG study on the former operation of the Risk Analysis Model (RAM) has been sent to the House of Representatives today. The study reviews the functioning of this so-called data combination system within the Tax Authority, which was intensively used between 1998 and 2018. The study finds that RAM did not sufficiently meet the requirements that were in place at the time regarding privacy legislation, security regulations, and archiving. This confirms the findings of earlier investigations into data usage by the Tax Authority at that time. Since 2018, improvements have been made by the agency that lead to a better balance between oversight and data protection. This is reported by Secretary of State Van Oostenbruggen in the policy response to the report ahead of the committee debate on the Tax Authority on March 13, 2025.

The study shows that RAM emerged in the late 1990s due to a lack of practical support for oversight. The unlocking of data from systems at that time was still limited. With the use of RAM, employees no longer had to search for information per taxpayer in different source systems, but could consult data from various sources in one go in RAM. The need for a search system like RAM grew at that time due to perceived societal and political pressure to combat fraud. Thus, RAM could grow from a local application to a widely used national system. In that growth, not enough account was taken of the applicable safeguards.

The Tax Authority of today works differently than the Tax Authority of then. For example, it is now checked in advance whether selections make distinctions between groups on undesirable grounds, and there is a team working on the ethical issues surrounding the use of algorithms.

Secretary of State Van Oostenbruggen (Taxation, Tax Authority, and Customs): “Although I understand how RAM could emerge based on the spirit of the times then, it is clear to me that the Tax Authority should not and could not have used RAM in that way. I cannot change the past, so I want to focus on what we must do in the present. This means I want to be clear whether the use of RAM at that time may have violated fundamental rights by using nationality in the selection. I want to provide clarity on this by June 2025 at the latest.” The minister continues: “And I want existing laws and regulations to be properly adhered to. Therefore, the Tax Authority will continue unabated with the approach to comply with the GDPR and continue with support and training for employees in the area of data processing and information security.”

KPMG has mapped out twelve systems that may be comparable to RAM as part of the investigation based on criteria. Five of these systems are still in use at the Tax Authority. The agency has examined whether these systems meet legal requirements and frameworks for privacy and information security. This analysis shows that there are no automated selections and profiling taking place. It has also not been shown that special personal data occur in these systems, as intended in the GDPR. However, to limit access to tax data, a large number of employee authorizations will be revoked for one system for which they do not need direct access for their work. Furthermore, active monitoring of the use of the system will be implemented immediately. This is in line with the Resilience approach, of which the House was informed in April 2024.

The Customs and Benefits Services also used RAM at that time. For these services, the report shows that a few employees per service had access to RAM, but it is not clear whether and how they actually used RAM. Additionally, for Customs, it has one system in use that is comparable to the RAM criteria. This concerns a system to make selections on the goods declarations of entrepreneurs that Customs receives through various declaration systems – a legal task under the Customs Code of the Union. More information can be found in the letter to the House about RAM and the KPMG investigation.