The Tax Administrations (TAs) of the world use multiple data and various sources of information to fulfill their objective of increasing the levels of voluntary compliance with tax obligations.

Among these sources, today, social networks obviously provide a lot of information, and TAs frequently use them, with the help of technologies such as artificial intelligence or big data.

One aspect to consider at this point is whether such use could not violate fundamental rights of citizens, such as data privacy and privacy rights, among others.

That is why I thought it important to share with you this important judgment from France, where this issue was discussed, that is, to what extent the TAs can use such information, without violating fundamental rights established in each country[1].

JURISPRUDENCE IN FRANCE

The French Constitution, since 2020 with the Finance Law, more precisely in its article 154[2], may, on an experimental basis, “collect and exploit through computer and automated processing…  the content of online platform operators freely accessible on the websites […] manifestly public” to detect fraud or breaches of tax obligations.

In this regard, an association from that country “Quadrature du Net” considered this law as disproportionate and harmful to the right to privacy and accused it of implementing a system of generalized and undifferentiated surveillance.

Therefore, they judicially filed an appeal to cancel the decree of its application.

The Supreme Administrative Court of France analyzed the case and on July 22 rejected the presentation made by Quadrature du Net.

In its most important points, the judgment stated that Article 154 of the Finance Act of December 28, 2019 for 2020 authorized on an experimental basis the tax administration and the customs and excise administration, for a period of three years, to implement a system of automated collection and use of freely accessible content on the websites of the operators of online platforms.

This, in order to investigate certain criminal offenses and certain infractions that may give rise to the imposition of administrative tax or customs sanctions.

The Court said that the processing of personal data conducted on behalf of the State for the purpose of the prevention, investigation, observation or prosecution of criminal offences, within the meaning of French law, and which relate to sensitive data referred to in section I of Article 6 of the law, must be authorized by decree of the Council of State adopted after motivated and published opinion of the National Commission on Informatics and Freedoms.

At this point, the Court said that all the questioned processing operations are covered by these provisions, given their purpose.

Regarding the external legality of the contested decree, they confirmed that it did not require any regulatory or individual enforcement measures by the Minister of the Interior, who therefore did not have to endorse it.

In accordance with article 4 of the law of January 6, 1978, personal data must be collected for specific, explicit and legitimate purposes, and must be adequate, relevant and, in relation to the purposes for which they are processed, limited to what is necessary or, for the treatment provided for in Title III of said law, not excessive.

As for the plaintiff association’s allegation that the contested decree would authorize a generalized and undifferentiated collection of the information available on platforms and social networks, prior to the determination of the only relevant data for the purposes pursued by the treatment, the Court said that the law also specifies that the collection of data through assumed identities or accounts specially used for this purpose by the administration is prohibited, without prejudice to accounts intended to be used through the programming made available by the operators of the platform.

In addition, any exploitation of comments and other forms of interaction that may appear on a user’s personal page is prohibited.

Finally, article 154 of the law of December 28, 2019 prevents the use of a facial recognition device.

For this reason, the French Court remarked that “it follows that the collection authorized by the contested decree does not refer to all the contents put online by a user, but is subject to several restrictions, or indications of dates and places, which are likely to characterize one of the infractions or one of the offenses mentioned in point 6, without being themselves personal data.”

Thus, Articles 4 and 5 in no way authorize, contrary to what is claimed, a generalized and undifferentiated collection of personal data during the learning and design phase.

Articles 6, 7 and 8 of the contested decree define the categories of data collected during the exploitation phase.

They are, on the one hand, data that allow the identification of the persons to whom they refer, which may include marital status, profile identifier, pseudonym, contact data and the link to other pages that may be linked to the same user and, on the other hand, data that may characterize the commission of one of the crimes or one of the aforementioned infractions.

These data are collected on the basis of the only indicators and relevance criteria that were validated during the learning and design phase, and that have been analyzed at this stage by administration agents in order to exclude those that involve the collection of sensitive data within the meaning of Article 6 I of the law of January 6, 1978.

These indicators and criteria of relevance thus make it possible, in the exploitation phase, to lead to results that identify individuals or legal entities with respect to whom there may be a reasonable suspicion of the commission of an infraction or a crime and limit the collection on online platforms to the most relevant data for the search of these infractions and crimes.

This implies, in particular, for the search of hidden activities, identifying the typologies, keywords and expressions that characterize the user accounts opened in a sector of activity and detecting suspicious behavior such as, for example, the publication online by a non-professional user, during the same day, of a number of ads of a certain category above a certain threshold.

For the search of non-compliance with the residence rules, the system consists of defining indicators of geographical locations from content such as writings, images, photographs, sounds, signs or videos, crossed with databases of geographical locations and on this basis, to collect only, on the platforms, data that can characterize a geographical location associated with an identified individual, among the persons listed in a list previously determined by the tax authorities as susceptible to infringing these rules.

Finally, for the search for customs violations, it involves collecting content data such as photographs of the products sold, shipping data of the goods, as well as data to measure the page’s audience, age and profile activity, which is likely to reveal suspicious business activity and transactions, using fraudulent activity detection models designed during the learning and design phase.

When the processing carried out makes it possible to establish that there are indications that a person may have committed any of the infractions or crimes mentioned in article 154 of the Law, the processed information is transmitted in a secure and controlled manner only by agents of the departments of the general public finance directorate or the general customs directorate in charge of investigation and control that are territorially competent.

The Court says that all of the above implies its legality, in view, in particular, of the restrictions imposed on the scope of the data collected and the guarantees governing the development of indicators, relevance criteria and models resulting from the learning and design phase and the rapid deletion of sensitive or irrelevant data.

Therefore, the Court rejected the submission made by Quadrature du Net, since it concluded that it is not justified to maintain that the contested decree authorizes, both in the learning and design phase and in the operation phase, a generalized and undifferentiated collection of personal data.

FINAL COMMENTS

I understand that the judgment is truly relevant, since as I said at the beginning, the TAs use various sources of information such as social networks  to obtain indications of tax evasion and fraud.

It is essential that the TAs respect the rights and guarantees of taxpayers in force in each country, in the different processes of using the information of social networks, from the collection of data, its treatment and the subsequent use of the information.

Taxpayers’ rights are subject to a variety of formal legal sources for their protection and are part of national legislations and constitutions, as well as international treaties and conventions.

Aspects such as confidentiality, availability and integrity are some of the most important characteristics of information and the responsible use of technology by the TAs implies preserving them.

The collection, storage and analysis of big data on citizens’ transactions, as well as algorithmic risk assessment and decision-making pose challenges to the effective protection of taxpayers’ rights.

The judicial bodies of each country are called upon to exercise a primary function in this regard, which is to analyze in each specific case whether the use of information from social networks may violate the rights of citizens.

As a final idea, I believe that the technology that is incorporated into the TAs and the use of information sources such as social networks should effectively serve to improve their efficiency and effectiveness in the fight against fraud, providing better services to citizens, reducing compliance costs and promoting transparency and trust in institutions, for which it is vital to respect the rights and guarantees.

[1] From this link you can access the complete sentence https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-07-22/451653
[2] https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000039793153/

2,163 total views, 2 views today