Privacy is important to FIU-the Netherlands. We therefore wish to inform you about how this FIU processes personal data. By means of this privacy statement, FIU-the Netherlands complies with the obligation to provide information laid down in Section 14(3) of the Money Laundering and Terrorist Financing (Prevention) Act (Wet ter voorkoming van witwassen en financiering van terrorisme, Wwft) in conjunction with Section 24b of the Police Data Act (Wet politiegegevens, Wpg).
 
1. Where does the responsibility lie for the processing of your personal data?
 
On the basis of Section 14(3) of the Wwft), the ultimate responsibility for the processing of personal data by FIU-the Netherlands lies with the Minister of Justice and Security. To contact the FIU directly, email frontoffice.financial-intelligence.lx@politie.nl.
 
2. What statutory framework applies to the processing of personal data by FIU-the Netherlands?
 
The legislature has decreed that several sections of the Wpg[1] also apply, mutatis mutandis, to the processing of personal data by FIU-the Netherlands for the purposes of its tasks. This processing of personal data is not subject to the General Data Protection Regulation (GDPR).
 
3. For what purposes may FIU-the Netherlands process your personal data?
 
FIU-the Netherlands processes personal data for the purpose of the prevention and detection of money laundering and underlying predicate offences, as well as of the financing of terrorism (Section 13 Wwft). More concretely, FIU-the Netherlands processes personal data for the purposes of the following tasks:
 
a) Gathering, registering, modifying, and analysing the data it obtains, for the purpose of establishing whether these data could be of importance for the prevention and detection of serious offences;
b) Providing personal data and other data in accordance with this Act and with the provisions laid down by or pursuant to the Wpg;
c) Informing an organization of the receipt of a report from that organization, the receipt of further details or intelligence provided by that organization, or trends or phenomena that emerge from any reports received, and, should the case arise, through the mediation of the Public Prosecution Service, of the significance of a report made by that organization for the prosecution of criminal offences;
d) Conducting research into developments in the field of money laundering and terrorism financing and into how to improve the methods for the prevention and detection of money laundering and the financing of terrorism;
e) Issuing recommendations to relevant sectors of industry concerning the introduction of suitable procedures for internal auditing and communication and other measures to be taken to prevent these sectors being used for money laundering and the financing of terrorism.
f) Providing awareness-raising sessions about the prevention and detection of money laundering and the financing of terrorism to: 1. the relevant sectors of industry and professional groups; 2. the relevant supervisory authorities; 3. the Public Prosecution Service and other public officials responsible for the detection of criminal offences; and 4. the general public;
g) Furnishing intelligence concerning the reporting behaviour of organizations to the supervisory authorities and the Public Prosecution Service and other public officials responsible for the detection of criminal offences;
h) Maintaining contacts with organizations abroad that have been appointed by the authorities to exercise a task similar to that of the financial intelligence unit;
i) Issuing an annual report concerning the execution of its tasks and its activities in the preceding year and its intentions for the coming year, to be presented to the Minister of Justice and Security and brought to the notice of the Minister of Finance.
 
4. Where can I find further information about how FIU-the Netherlands gathers, modifies, and analyses personal data with a view to the prevention and detection of money laundering and underlying predicate offences, as well as of the financing of terrorism?[2]
 
As regards the gathering, registering, modifying, and analysing of the data and/or personal data (see Section 13(1)(a) of the Wwft), the following applies:
 
On the basis of the obligation to report laid down in the Wwft (Section 16 Wwft), organizations with a duty to report submit their reports of unusual transactions to FIU-the Netherlands; as a result, personal data will also be provided to FIU-the Netherlands. FIU-the Netherlands investigates these unusual transactions. This is done using algorithms, for example to select reported transactions for further investigation in relation to certain themes or trends. For this purpose, FIU-the Netherlands also makes use of automatized file comparison (matching). This means that the unusual transactions reported are compared, using automatized tools, with files containing the data of suspects from criminal investigations (provided by the police and the Dutch Fiscal Intelligence and Investigation Service, FIOD). If it emerges that unusual transactions may be of importance for the prevention and detection of serious offences, these unusual transactions are designated suspicious by the Head of the FIU and are shared within the domain specified by the Wpg (Section 15 Wpg).
 
5. What is the statutory basis for the processing of personal data by FIU-the Netherlands?
 
The statutory basis for the processing of personal data is as follows:

• For one of the tasks of FIU-the Netherlands described in Section 13 Wwft (see Item 3 of the present privacy statement), the statutory basis is Section 14(1) Wwft;
• For the provision of personal data by FIU-the Netherlands to other parties responsible for data processing authorized to process police data, the statutory basis is Section 15 Wpg in conjunction with Section 2:13(2) of the Police Data Decree (Besluit politiegegevens, Bpg);
• For the provision of reports to FIUs abroad, the statutory basis is Section 16a Wwft;
• For the requesting of further details or intelligence from an organization as referred to in Section 17(1) Wwft, the statutory basis is Section 17 Wwft;

 
6. About what categories of persons does FIU-the Netherlands process personal data?
 
FIU-the Netherlands processes personal data about the following categories of persons[3]:
 
a) Persons with respect to whom a report has been made concerning an unusual transaction made or planned;
b) Persons involved in an unusual transaction made or planned, in the capacity of client, advisor, intermediary, beneficiary, or principal;
c) Persons with respect to whom a reasonable suspicion exists that they have committed a serious offence and persons convicted of a serious offence, if the processing of their personal data is necessary for the purpose of FIU-the Netherlands;
d) Persons, involved in an unusual transaction made or planned, with respect to whom a report has been made on the basis of the Money Laundering and Terrorist Financing (Prevention) Act of the BES islands (Bonaire, Sint Eustatius, and Saba) or to a reporting point in a country within the Kingdom of the Netherlands or in another country;
e) Persons involved in a suspicious transaction;
f) Persons, employed by FIU-the Netherlands, the police, the judicial authorities, an organization charged with the supervision of persons and organizations subject to the legal obligation to report or with any public-law task, or an organization or reporting point abroad, who serve as a contact for the provision of data by or to the reporting point;
g) Persons with respect to whom a relation with a reported unusual transaction has become known or will probably become known, where this relation is relevant to the purpose of the reporting centre and is other than that referred to in the previous items.
 
7. With whom may FIU-the Netherlands share your personal data?
 
FIU-the Netherlands provides personal data insofar as this is necessary for the execution of its tasks or insofar as it is under a legal obligation to do so. This may include the provision of personal data to:

• Persons who, in accordance with the Wpg, are authorized to process police data, insofar as they require these data to be able to execute their tasks;
• FIUs abroad;
• Organizations that are obliged on the basis of the Wwft to report unusual transactions (also known as: ‘organizations with an obligation to report’), in the specific case that one of the unusual transactions they have reported has been designated suspicious and they are informed of this;
• Supervisory authorities and the persons referred to in Section 13(f) (3°) Wwft, in the case that they are provided with intelligence concerning the reporting behaviour of organizations with an obligation to report.

8. For how long do we retain your personal data?
 
Unusual transactions, including the personal data they contain, are retained for five years, in accordance with Section 6:6 of the Bpg. Transactions that have been designated suspicious, including the personal data they contain, are retained for ten years.
 
9. What are your rights?
 
If we process your personal data, you have the following rights:

• Right of inspection (Section 14(3) Wwft in conjunction with Section 25(1) Wpg)
• Right to rectification and destruction (Section 14(3) Wwft in conjunction with Section 28(1) and (2) Wpg);
• Right to masking (Section 28(2) Wpg).

FIU-the Netherlands is not always obliged to comply with a request for inspection, rectification, destruction, or masking. Your request may be refused if this is necessary and proportionate in light of one of the purposes stated in Section 27 Wpg, namely:
 
a) To avoid the obstruction of judicial investigations or proceedings;
b) To avoid detrimental consequences for the prevention, detection, investigation, and prosecution of criminal offences or the enforcement of sentences;
c) To protect public safety and security;
d) To protect the rights and liberties of third parties;
e) To protect national security;
f) In the case of an obviously unfounded or disproportionate request.
 
In order to arrive at a careful assessment of your request, it is necessary for the FIU to have insight into the concrete background of your request and your individual interest in inspection, rectification, destruction, or masking. FIU-the Netherlands will therefore ask you to describe in your request the concrete circumstances and interests pertaining to it, so that FIU-the Netherlands can take these circumstances and interests into account when weighing up the interests concerned.
 
You can submit a request for inspection, rectification, destruction, or masking to:

• frontoffice.financial-intelligence.lx@politie.nl (email address)
• FIU-Nederland, Postbus 10638, 2501 HP Den Haag, the Netherlands (postal address)

If you submit a request for inspection, rectification, destruction, or masking, FIU-the Netherlands must be in a position to establish your identity. FIU-the Netherlands therefore also asks you to refer in your request to any identifying data concerning you that FIU-the Netherlands already has, or to send a copy of a valid ID document for identification purposes. For this, you may use the Dutch authorities’ KopieID app to create a secure copy of your ID document.
 
Within six weeks of receiving a response to your request for inspection, rectification, destruction, or masking, you can turn to the Autoriteit Persoonsgegevens (the Dutch data protection authority) to request them to mediate or advise (see Section 29(2) Wpg).
 
10. Complaints to the Data Protection Officer or the Autoriteit Persoonsgegevens
 
If you wish to submit a complaint about the processing of your personal data or you believe that a request about this has not been correctly processed by FIU-the Netherlands, you can contact the FIU-the Netherlands Data Protection Officer or the Autoriteit Persoonsgegevens.
 
The Data Protection Officer is independent. They advise concerning the processing of personal data and supervise this process. The Data Protection Officer can be reached by e-mail at gegevensbescherming.financial-intelligence.lx@politie.nl.