Netherlands: Court Prohibits Government’s Use of AI Software to Detect Welfare Fraud
(Mar. 13, 2020) On February 5, 2020, the District Court of The Hague (Rechtbank Den Haag) held that the System Risk Indication (SyRI) algorithm system, a legal instrument that the Dutch government uses to detect fraud in areas such as benefits, allowances, and taxes, violates article 8 of the European Convention on Human Rights (ECHR) (right to respect for private and family life).
Facts of the Case
The case was brought by several civil rights organizations, including the Netherlands Committee of Jurists for Human Rights (Nederlands Juristen Comité voor de Mensenrechten, NJCM), and two natural persons against the Dutch government. The Federation of Trade Unions in the Netherlands (Federatie Nederlandse Vakbeweging, FNV) intervened on behalf of the plaintiffs. The NJCM works to protect and strengthen fundamental human rights and freedoms. The FNV is a trade union that acts in the interests of its members and “is guided in part by the fundamental values of equality of all people, of freedom, justice and solidarity.” (District Court, paras. 2.2, 2.4 & 2.5.) The UN special rapporteur on extreme poverty and human rights, Philip Alston, submitted an amicus brief.
Decision
The Court first stated that social security is one of the pillars of Dutch society and contributes significantly to prosperity in the Netherlands. The fight against fraud, which is the stated aim of the SyRI legislation, is therefore crucial. It agreed with the government that new technologies such as the SyRI, which offer more possibilities to prevent and combat fraud, should be utilized and generally serve a legitimate purpose. However, the Court pointed out that the development of new technologies means that the right to respect for private life, which includes the right to the protection of personal data, is increasingly important and that the absence of sufficient and transparent protection of it might have a “chilling effect” among the population. (Paras. 6.3–6.5.)
The Court reiterated that the Netherlands has an obligation under article 8 of the ECHR to strike a fair balance between the interference with the right to respect for private life and the benefits of the use of new technologies to prevent and combat fraud. It held that the SyRI legislation fails to comply with that requirement because it is “insufficiently clear and verifiable.” It therefore declared article 65 of the SUWI Act and chapter 5a of the SUWI Decree incompatible with article 8, paragraph 2 of the ECHR. (Paras. 6.6 & 6.7.)
The Court focused its remarks on article 8 of the ECHR, but took the general principles of data protection codified in the EU Charter and the GDPR into account, because they offer the same level of protection. (Para. 6.41; EU Charter art. 52, para. 3.) According to the Court, it is undisputed that the SyRI legislation interferes with the right to respect for private life and that the Court must decide whether it is justified. The Court held that it cannot determine what exactly the SyRI is because the government has neither publicized the risk model and the indicators that make up the risk model nor submitted them to the Court. (District Court para. 6.49.) It ruled that the implementation of the SyRI legislation currently does not involve deep learning, data mining, and risk profile development but that it might in the future. (Para. 6.63.) Even though there is no random data collection, a large amount of data is collected, in the opinion of the Court. (Para. 6.50.) Finally, the Court stated that people whose data is collected and included in a risk report are not automatically informed. There is only a legal requirement to announce the start of a SyRI project. (Paras. 6.54 & 6.65.)
The Court reiterated the case-law of the European Court of Human Rights that states that any interference with the right to respect for private life must be provided for by law. It explained that it does not have to be a law in the formal sense, but that “some basis in domestic law” is sufficient. The legal basis must be sufficiently accessible and foreseeable, meaning it must be so clear that it is possible for an individual to adjust his or her behavior accordingly. In the case at issue, the Court left open the question whether the SyRI legislation is sufficiently accessible and foreseeable and concentrated on whether it was necessary in a democratic society. (Paras. 6.66–6.72.)
msdogfood@hotmail.com
