Already in 2014, I sent a message to the national newspapers about SyRI (System Risk Indication), considering the risks of and objections to systems for mass surveillance such as SyRI. It was too progressive to place critical notes on the use of SyRI in 2014: several media did not find the subject sufficiently urgent.
I also sensed this lack of interest within the Public Law section. Oddly, the Department gave me permission to investigate the compatibility of SyRI with the legal principles of the prohibition of détournement de pouvoir, the presumption of innocence and the principle of equality of arms. In addition to these administrative and criminal notions and most importantly, I would investigate the compatibility of SyRI with the right to respect for private life. The Research Supervisor stated that SyRI as a 'small law' was not interesting and significant enough. The interests affected by the deployment of SyRI were judged with a sense of disdain. I strongly disagree with the dismissal of the deployment of SyRI as if this phenomenon were socially insignificant!
SyRI has now become a topic of discussion and its social influence is being recognized. On October 29, 2019, the Court of The Hague examined the matter at the first session of the substantive proceedings in the SyRI case. I expect that the court will consider the deployment of SyRI to be lawful. Should the SyRI case be brought before the Court of Human Rights (ECHR), the ECHR is expected to issue a quite different judgment.
The legal basis of SyRI
SyRI is provided by the SUWI Act upon the amendment of the SUWI (Work and Income Implementation Structure) Act. Chapter 5a of the SUWI Decree contains the provisions on the use of SyRI by government agencies. Article 5a.1 of the SUWI Decree gives the impression that the systematic collection and processing of data is only within the framework of administrative action by government bodies and only within the exhaustive summary of data as referred to in Article 5a.1 paragraph 3 under aq of the Decree SUWI occurs; however, the citizen's details are provided in full by all government agencies on the basis of Articles 64 and 65 of the SUWI Act. Large-scale and systematic analysis and processing of data is therefore facilitated by the linking of registers of government bodies. The aim of SyRI is to promote the integral cooperation of government bodies in combating social security and tax fraud (Article 65, paragraph 2 in conjunction with 64, paragraph 1 of the SUWI Act).
The data subject is not informed of the processing of his data in SyRI (Article 5a.5, paragraphs 1 and 4 of the SUWI Decree). With 'consent of the persons' to the request for systematic surveillance and processing (Article 5a.1 paragraph 4 sub a SUWI Decree) is therefore not meant the consent of the data subject, but the consent of persons who supervise compliance with other regulations from the Minister of Social Affairs and Employment (Article 64, paragraph 1 of the SUWI Act).
Black box: hidden predictive algorithms
A risk profile is drawn with the use of SyRI. SyRI assesses the risk of social security fraud and tax fraud on the basis of, among other aspects, data on education, housing data, environmental factors, study debt, other debt charges and data on reintegration. The composition of the risk factors is shrouded (Article 5a.1, paragraph 7, SUWI Decree). The SUWI Decree contains the requirements of proportionality and subsidiarity (Article 5a.1 paragraph 4 SUWI Decree). The predictive algorithms behind SyRI are applied regardless of a concrete suspicion of fraud.
The deployment of SyRI cannot be controlled by the citizen, because the government applies the 'black box method'. The 'black box' refers to the hidden input of predictive algorithms in Big Data processes. I have drawn attention to the objections to the black box in my investigation into the use of Big Data analyzes for criminal purposes.
Data subjects cannot effectively check whether a governmental body meets the requirements of proportionality and subsidiarity with regard to large-scale data surveillance and processing of personal data. The purpose limitation requirement, the principle of data minimization and the possibility of requiring rectification, laid down in the General Data Protection Regulation (AVG), will thereby be devoid of significance. Also, the proportionality and subsidiarity provisions of Article 5a.1 paragraph 4 of the SUWI Decree will be devoid of significance, since citizens cannot find out whether they are being investigated or not.
The prognosis: the court finds that the application of SyRI is lawful ....
My expectation is that The Hague District Court, which dealt with the first session in the SyRI case on 29 October 2019 and will issue a judgment on the substantive proceedings on 29 January 2020, will consider the application of SyRI to be lawful. That judgment can be based on the formal requirement of a legal basis for the systematic collection and processing of data in the SUWI Act.
I also sensed this lack of interest within the Public Law section. Oddly, the Department gave me permission to investigate the compatibility of SyRI with the legal principles of the prohibition of détournement de pouvoir, the presumption of innocence and the principle of equality of arms. In addition to these administrative and criminal notions and most importantly, I would investigate the compatibility of SyRI with the right to respect for private life. The Research Supervisor stated that SyRI as a 'small law' was not interesting and significant enough. The interests affected by the deployment of SyRI were judged with a sense of disdain. I strongly disagree with the dismissal of the deployment of SyRI as if this phenomenon were socially insignificant!
SyRI has now become a topic of discussion and its social influence is being recognized. On October 29, 2019, the Court of The Hague examined the matter at the first session of the substantive proceedings in the SyRI case. I expect that the court will consider the deployment of SyRI to be lawful. Should the SyRI case be brought before the Court of Human Rights (ECHR), the ECHR is expected to issue a quite different judgment.
The legal basis of SyRI
SyRI is provided by the SUWI Act upon the amendment of the SUWI (Work and Income Implementation Structure) Act. Chapter 5a of the SUWI Decree contains the provisions on the use of SyRI by government agencies. Article 5a.1 of the SUWI Decree gives the impression that the systematic collection and processing of data is only within the framework of administrative action by government bodies and only within the exhaustive summary of data as referred to in Article 5a.1 paragraph 3 under aq of the Decree SUWI occurs; however, the citizen's details are provided in full by all government agencies on the basis of Articles 64 and 65 of the SUWI Act. Large-scale and systematic analysis and processing of data is therefore facilitated by the linking of registers of government bodies. The aim of SyRI is to promote the integral cooperation of government bodies in combating social security and tax fraud (Article 65, paragraph 2 in conjunction with 64, paragraph 1 of the SUWI Act).
The data subject is not informed of the processing of his data in SyRI (Article 5a.5, paragraphs 1 and 4 of the SUWI Decree). With 'consent of the persons' to the request for systematic surveillance and processing (Article 5a.1 paragraph 4 sub a SUWI Decree) is therefore not meant the consent of the data subject, but the consent of persons who supervise compliance with other regulations from the Minister of Social Affairs and Employment (Article 64, paragraph 1 of the SUWI Act).
Black box: hidden predictive algorithms
A risk profile is drawn with the use of SyRI. SyRI assesses the risk of social security fraud and tax fraud on the basis of, among other aspects, data on education, housing data, environmental factors, study debt, other debt charges and data on reintegration. The composition of the risk factors is shrouded (Article 5a.1, paragraph 7, SUWI Decree). The SUWI Decree contains the requirements of proportionality and subsidiarity (Article 5a.1 paragraph 4 SUWI Decree). The predictive algorithms behind SyRI are applied regardless of a concrete suspicion of fraud.
The deployment of SyRI cannot be controlled by the citizen, because the government applies the 'black box method'. The 'black box' refers to the hidden input of predictive algorithms in Big Data processes. I have drawn attention to the objections to the black box in my investigation into the use of Big Data analyzes for criminal purposes.
Data subjects cannot effectively check whether a governmental body meets the requirements of proportionality and subsidiarity with regard to large-scale data surveillance and processing of personal data. The purpose limitation requirement, the principle of data minimization and the possibility of requiring rectification, laid down in the General Data Protection Regulation (AVG), will thereby be devoid of significance. Also, the proportionality and subsidiarity provisions of Article 5a.1 paragraph 4 of the SUWI Decree will be devoid of significance, since citizens cannot find out whether they are being investigated or not.
The prognosis: the court finds that the application of SyRI is lawful ....
My expectation is that The Hague District Court, which dealt with the first session in the SyRI case on 29 October 2019 and will issue a judgment on the substantive proceedings on 29 January 2020, will consider the application of SyRI to be lawful. That judgment can be based on the formal requirement of a legal basis for the systematic collection and processing of data in the SUWI Act.
The right to respect for privacy, enshrined in Article 10 of the Constitution, is generally soon met with if government bodies base their activities on the provisions of a formal law.
.... the ECtHR will issue a jugdment stating that the deployment of SyRI constitutes a breach of Article 8 of the ECHR
The European Court of Human Rights (ECHR) will judge the admissibility of SyRI differently. The use of SyRI does not meet the requirements set by the ECtHR for the compatibility of this method of data surveillance with the right to respect for private life (Article 8 ECHR). The extensive case law of the ECtHR on systematic data surveillance leaves no doubt about this. SyRI fails on the criterion of the foreseeability of the use of the authority of the government body. There are no legal safeguards to compensate for the violation of Article 8 of the ECHR through the deployment of SyRI. The law should lay down clear and detailed rules for the application of SyRI, so that the person concerned knows under what circumstances and under what conditions the government is authorized to deploy SyRI (ECHR 21 June 2011, 30194/09 (Shimovolos v. Russia), paragraph 68).
The nature and maximum duration of the deployment of SyRI must be specified in the law, as well as the procedures followed by government bodies to investigate, use and store personal data in SyRI (ECHR 29 June 2006, 54934/00 (Weber and Saravia v. Germany), paragraph 95). The law must also state the means that can be brought by the citizen against SyRI (ECHR 28 June 2007 (Ekimdzhiev v. Bulgaria), pp. 71-77).
Due to the 'black box' character of SyRI, implying the subjection to research and the operation of predictive algorithms remain hidden for citizens, it is unclear to the citizen under what circumstances and conditions a governmental body is authorized to deploy SyRI. The SUWI Act and the SUWI Decree do not set clear, detailed rules for the deployment of SyRI. The mere fact of exercising the right to receive benefits under the Unemployment Insurance Act, WIA or Participation Act is not a specific condition for being subject to SyRI.
Moreover, the law and the Decree do not provide any, nor do they mention legal remedies that can be used by the citizen against the application of SyRI. If the SUWI law did mention the legal remedies that could be used, the 'black box' would still not allow the citizen to effectively exercise his right to an effective legal remedy, for citizens will not be informed on being subject to SyRI.
As far as I am concerned, the following issues need further investigation:
- to what extent results of criminal analysis, including those based on Hansken, iColumbo and the Refinery, can be linked within the framework of 'integral cooperation between government bodies'. Although the starting point is not to process judicial data in the SyRI projects, the SUWI Act and the SUWI Decree do not exclude the processing of such data;
- whether the legal retention period of two years (Article 65, paragraphs 5-7 of the SUWI Act) can be exceeded by reopening a SyRI investigation before the expiry of the deadline or adding new data to the risk assessment.
Conclusion
Due to the lack of clear, detailed rules that inform the citizen about the conditions and circumstances for applying SyRI and the lack of legal safeguards to compensate for the infringement of Article 8 ECHR, the ECtHR is expected to judge the deployment of SyRI by the government unlawful. Before the ECtHR processes a petition, national remedies must be exhausted. It can therefore take years before the case brings it to the ECtHR. In the meantime, the government most likely will have introduced a new appraisal tool driven by predictive algorithms, to avoid the SyRI controversy, or a legislative change to meet the minimum requirements for proportional and subsidiary application of SyRI will be adopted.
Mercedes Bouter LL.M.
.... the ECtHR will issue a jugdment stating that the deployment of SyRI constitutes a breach of Article 8 of the ECHR
The European Court of Human Rights (ECHR) will judge the admissibility of SyRI differently. The use of SyRI does not meet the requirements set by the ECtHR for the compatibility of this method of data surveillance with the right to respect for private life (Article 8 ECHR). The extensive case law of the ECtHR on systematic data surveillance leaves no doubt about this. SyRI fails on the criterion of the foreseeability of the use of the authority of the government body. There are no legal safeguards to compensate for the violation of Article 8 of the ECHR through the deployment of SyRI. The law should lay down clear and detailed rules for the application of SyRI, so that the person concerned knows under what circumstances and under what conditions the government is authorized to deploy SyRI (ECHR 21 June 2011, 30194/09 (Shimovolos v. Russia), paragraph 68).
The nature and maximum duration of the deployment of SyRI must be specified in the law, as well as the procedures followed by government bodies to investigate, use and store personal data in SyRI (ECHR 29 June 2006, 54934/00 (Weber and Saravia v. Germany), paragraph 95). The law must also state the means that can be brought by the citizen against SyRI (ECHR 28 June 2007 (Ekimdzhiev v. Bulgaria), pp. 71-77).
Due to the 'black box' character of SyRI, implying the subjection to research and the operation of predictive algorithms remain hidden for citizens, it is unclear to the citizen under what circumstances and conditions a governmental body is authorized to deploy SyRI. The SUWI Act and the SUWI Decree do not set clear, detailed rules for the deployment of SyRI. The mere fact of exercising the right to receive benefits under the Unemployment Insurance Act, WIA or Participation Act is not a specific condition for being subject to SyRI.
Moreover, the law and the Decree do not provide any, nor do they mention legal remedies that can be used by the citizen against the application of SyRI. If the SUWI law did mention the legal remedies that could be used, the 'black box' would still not allow the citizen to effectively exercise his right to an effective legal remedy, for citizens will not be informed on being subject to SyRI.
As far as I am concerned, the following issues need further investigation:
- to what extent results of criminal analysis, including those based on Hansken, iColumbo and the Refinery, can be linked within the framework of 'integral cooperation between government bodies'. Although the starting point is not to process judicial data in the SyRI projects, the SUWI Act and the SUWI Decree do not exclude the processing of such data;
- whether the legal retention period of two years (Article 65, paragraphs 5-7 of the SUWI Act) can be exceeded by reopening a SyRI investigation before the expiry of the deadline or adding new data to the risk assessment.
Conclusion
Due to the lack of clear, detailed rules that inform the citizen about the conditions and circumstances for applying SyRI and the lack of legal safeguards to compensate for the infringement of Article 8 ECHR, the ECtHR is expected to judge the deployment of SyRI by the government unlawful. Before the ECtHR processes a petition, national remedies must be exhausted. It can therefore take years before the case brings it to the ECtHR. In the meantime, the government most likely will have introduced a new appraisal tool driven by predictive algorithms, to avoid the SyRI controversy, or a legislative change to meet the minimum requirements for proportional and subsidiary application of SyRI will be adopted.
Mercedes Bouter LL.M.
