Sounds good, doesn't work: the GDPR principle of transparency and data-driven welfare fraud detection

This contribution focuses on the interaction between social law and privacy- and data protection law. It investigates the impact of technological innovations in social security on fundamental rights and constitutional principles. The investigation is narrowed down to one such innovative practice in social security, and to one such fundamental principle of data protection law. This contribution analyses the (lack of) safeguards offered by the principle of transparency in the domain of ‘data-driven’ welfare fraud detection systems. The Dutch Syri and Toeslagenaffaire (Childcare Benefit Scandal) cases serve as illustrations for the functioning of the transparency principle in this context.

Under pressure to increase efficiency, governments continuously attempt to innovate their public services. Great results are expected from digitization, automation, and the application of A.I. Although digital government has undeniably made many services more efficient and accessible, the effects that the datafication of society have on core principles of liberal democracy have also been vocally criticized. The 21st Century has seen the birth of a new breed of capitalism monetizing the annihilation of privacy and screen addiction, of platform economies eroding social security, and of racially discriminatory algorithms. The administration of social security in Europe is built on top of similar foundations: the continuous, digitized processing of citizens’ personal data. Attempts to innovate in social security using this data, threaten to have similar detrimental effects to core values of liberal democracy, especially when attempting to reap the benefits of automation, ‘big data’, and A.I. The true value of innovations in this field depends on their respect for fundamental principles of liberal democracy, such as the right to privacy, equality before the law, and transparency in the execution of public powers. This is highlighted by recent ‘innovations’ in social security in Indiana, Michigan and Colorado (USA), and the Netherlands, which—each in their own ways—have led to extreme forms of harm. At the moment, it is unclear how abstract principles translate into concrete rights and obligations at this new frontier of social security. This contribution seeks to clarify one particular application, by investigating the conflict between the secrecy of digital fraud detection systems and the principle of transparency, as codified in privacy and data protection law. The legal toolkit of the GDPR principle of transparency is brought to bear, to see to what extent it really impacts the use of data-driven technologies for welfare fraud detection, using two Dutch case studies as an illustration (the Syri case and the Childcare Benefit Scandal, or “Toeslagenaffaire” in Dutch).