Case Law
Netherlands, District Court of The Hague 5 February 2020, nr. C-09-550982 ("Syri" Case)
Country
Decision date
Deciding body
Deciding body (Original name)
ECLI
Type of Court (material scope)
Type of jurisdiction
Type of Court (territorial scope)
Instance
Status
Project area
Law area
Outcome
Full text of the decision
General Summary
The court ruling addresses the legality of the System Risk Indication (SyRI), a tool used by the government of the Netherlands to combat fraud related to benefits, allowances, and taxes. The court determined that the legislation governing SyRI is inconsistent with higher legal standards, particularly Article 8 of the European Convention on Human Rights (ECHR), which safeguards the right to privacy.
In its evaluation, the court examined whether the SyRI legislation adheres to Article 8(2) of the ECHR, which necessitates a “fair balance” between societal interests and the intrusion upon privacy caused by the legislation. Notably, under Article 8, member states such as the Netherlands bear a distinct responsibility in employing new technologies, requiring a careful consideration of the benefits versus the privacy implications.
The court found that the current SyRI legislation fails to meet the criteria set forth in Article 8(2) of the ECHR. It emphasized the legislation’s lack of transparency and accountability regarding the utilization of SyRI. Despite the legislation's aims to prevent and combat fraud for economic well-being, the court asserted that it does not strike a fair balance required by the ECHR, rendering it unlawful and non-binding.
The legal challenge against the state was initiated by several civil society organizations, including the Dutch Legal Committee for Human Rights, along with two citizens, supported by the FNV. The plaintiffs sought to halt the use of SyRI, arguing that it constitutes an unacceptable violation of human rights. Conversely, the state argued that the SyRI legislation contains adequate safeguards to protect privacy rights.
In summary, the court’s ruling highlights the importance of upholding privacy rights in the face of technological advancements and underscores the necessity for legislation to strike a fair balance between societal interests and individual rights.
Facts of the case
• The Risk Indication System (SyRI) is a legal instrument used by the Dutch government to combat fraud in social security, taxation, and labor laws.
• SyRI involves anonymous data linking and analysis to generate risk reports identifying potential fraud or non-compliance.
• It is deployed at the request of specific government agencies or bodies with public tasks, including municipalities, tax authorities, and immigration services.
• The aim of SyRI is to efficiently detect and prevent abuses by structurally linking data from different agencies.
• The technology behind SyRI builds upon previous practices established through national intervention teams, created to tackle various forms of fraud.
• These intervention teams operate under a Cooperation Agreement overseen by the National Steering Committee on Intervention Teams (LSI), comprising representatives from various governmental bodies.
• File linking for fraud detection purposes has been legally regulated since 2004 under the Work and Social Assistance Act.
• Earlier projects, such as Waterproof, involved linking data from water companies and residential data to verify benefit recipients' living situations.
• Between 2008 and 2014, several intervention team projects utilized SyRI or its predecessors, focusing mainly on specific neighborhoods to address benefit and tax fraud.
• Since the formal regulation of SyRI in 2015, projects targeting various areas for fraud prevention have been initiated, such as ‘GALOP II’ and others.
• These initiatives reflect the government’s commitment to combat fraud effectively while respecting individuals’ privacy rights.
Individual / Collective enforcement
Nature of the parties
- Private collective
- Public
Type of procedure
Reasoning of the deciding court
The court’s evaluation of the SyRI legislation under Article 8(2) of the ECHR involves several key principles deemed critical for assessing the degree of interference with individuals’ private lives.
It encompasses the legal framework, necessity, proportionality, and transparency of SyRI’s data processing operations. Data linking in SyRI involves processing various categories of data outlined in the SUWI Decree, sourced from different government data files. Although deep learning and data mining are not currently used, the legislation permits their potential application in developing risk models. The court emphasizes that interference with private life under SyRI must be legally provided for and necessary in a democratic society, emphasizing the need for clear and foreseeable legal basis and sufficient protection against arbitrariness. Despite acknowledging the legitimate goals of SyRI in addressing social security fraud, the court finds the legislation lacking in transparency, verification, and safeguards to adequately protect privacy rights. Moreover, it highlights concerns regarding the absence of independent oversight and the legislation's failure to address principles of transparency, purpose limitation, and data minimization.
Furthermore, the court scrutinizes the State’s argument regarding data protection impact assessments (PIAs), deeming its defense inadequate due to the lack of clarity regarding GDPR compliance and the absence of PIAs for each SyRI project. Consequently, the court rules that the SyRI legislation fails to comply with Article 8(2) of the ECHR, leading to partial success for certain plaintiffs.
Conclusions of the Court
Declares that Article 65 of the SUWI Act and Chapter 5a of the SUWI Decree are not binding towards NJCM, the Platform for Civil Rights, Privacy First and the Association of DBC-Free Practices and those whose interests these parties represent due to a conflict with Article 8(2) of the ECHR.
Orders the State to pay the legal costs, on the part of the NJCM, the Platform for Civil Rights, Privacy First and the Koepel van DBC-Vrije Praktijken and the FNV, estimated to date at € 3,250.51, plus statutory interest from fourteen days from today until the day of full payment,
Declares this judgment to the extent provisionally enforceable
Other claims are rejected due to a lack of independent interest or insufficient explanation. As a result, the court orders the State to pay legal costs to the successful parties, highlighting the importance of accountability and transparency in the context of new technologies and underscoring the necessity for sufficient guarantees to prevent abuse and arbitrariness.
AI system(s) involved
- Specific intended purpose AI
Fundamental rights involved
- Right to data protection
- Right to privacy
Principles expressly applied
- Proportionality
Reference to supranational provisions
• ECtHR 27 October 1995, no. 20190/92 (CR v. the United Kingdom), paragraph 42.
• ECtHR 29 April 2002, no. 2346/02 (Pretty v. the United Kingdom), paragraph 65.
• ECHR 4 December 2008, nos. 30562/04 and 30566/04 (S. and Marper v. the United Kingdom), paragraph 66.
• ECHR 2 August 1984, no. 8691/79 (Malone v. the United Kingdom).
• ECtHR 26 April 1979, no. 6538/74, (Sunday Times v. United Kingdom), paragraph 48.
• ECHR 29 June 2006, no. 54934/00 (Weber and Saravia v. Germany)
• ECtHR 12 January 2016, no. 31718/14 (Szabó and Vissy v. Hungary).
• ECHR 4 December 2008, nos. 30562/04 and 30566/04 (S. and Marper v. the United Kingdom), paragraph 96, 99, 112.
Reference to national provisions
• Article 8 SUWI Act.
• Decree of 1 September 2014 amending the SUWI Decree in connection with rules for tackling fraud through data exchanges and the effective use of data known within the government with the use of SyRI, Stb. 2014, 320.
• Decree of 13 December 2001, containing further rules regarding the coordination and services provided by the Intelligence Bureau for the benefit of the municipalities in the provision of data under the SUWI Act, the Abw, the IOAW and the IOAZ, as well as regarding the financing of the Intelligence Bureau ( Municipal Information Bureau Decree), Stb. 2001, 686.
• Article 6 Implementation Act of the General Data Protection Regulation.
Balancing techniques and principles
The court emphasizes that interference with private life under SyRI must be legally provided for and necessary in a democratic society, emphasizing the need for clear and foreseeable legal basis and sufficient protection against arbitrariness. Despite acknowledging the legitimate goals of SyRI in addressing social security fraud, the court finds the legislation lacking in transparency, verification, and safeguards to adequately protect privacy rights. Moreover, it highlights concerns regarding the absence of independent oversight and the legislation's failure to address principles of transparency, purpose limitation, and data minimization.
Impact on legislation / policy
Implementation of The Fundamental Rights and Algorithm Impact Assessment (FRAIA), which was also included in the AI Act.