When the Central Contact Point (PCC/CAP) for Accounts and Financial Contracts was introduced in 2011, the objective was clear: it would help combat tax fraud by creating a central database of Belgian bank accounts. But the initiative did not stop there. In 2013, it was extended to foreign accounts held by Belgian residents.

In 2022, an important step was taken: financial institutions became required to report not only the existence of accounts, but also periodic balances and globalised contract amounts. This raised many questions among people who are fond of the rule of law. However, the Constitutional Court ruled this scope extension as proportionate, despite objections regarding privacy and mass data processing without individual suspicion of fraud.

Once again, we find ourselves at a tipping point. A government amendment to the bill “containing various provisions” paves the way for data mining on the PCC/CAP register by linking it to the data warehouse of the FPS Finance, which contains the taxpayer’s complete tax file: history of returns, records and relational data. By connecting both databases, the aim is to perform data mining, data matching and profiling processes to detect fraud risks. Technically, this is achieved through a deviation from the current rule: while, up to now, it was possible to check the PCC/CAP only when there were indications of tax evasion, it will now also be proactively accessible to data miners. If a risk is identified based on predefined risk factors, pseudonymisation may be reversed and the file transferred to the audit services.

This evolution raises a fundamental question: when does a legitimate check become a prohibited fishing expedition? In legal terms, “fishing” refers to an untargeted search for evidence, i.e. by gathering as much information as possible without any concrete suspicion, in the hope of finding something incriminating. Belgian law prohibits such practices in criminal matters as well as in civil and tax proceedings. Fishing violates privacy, is disproportionate and undermines the right to defend oneself.

The Sky ECC case illustrates how heated this debate can become. Starting in 2021, Belgian, French, and Dutch authorities intercepted millions of encrypted messages from Sky ECC users. Defence teams called it a fishing expedition: no individual suspicion, massive data collection, and the use of messages against individuals who had not previously been identified as suspects. However, the Court of Cassation ruled that the operation was not fishing, because there was concrete evidence beforehand that Sky ECC devices were used on a large scale by organised crime. According to case law, digital infiltration is not an untargeted data capture operation, but a necessary method in the fight against serious crime.

What does this mean for tax audits? The PCC/CAP and the data warehouse create a similar tension. On the one hand, there is a legitimate purpose: combat fraud and ensure tax fairness. On the other hand, a shift from targeted checks to broad data mining without individual suspicion may happen. When officials are given access to balance histories and contract details to detect “risks”, one must wonder whether this still falls within the scope of necessity and proportionality. The Constitutional Court may have to rule again, and international courts such as the European Court of Human Rights and the Court of Justice of the EU will also have to outline a normative framework. Their judgement on bulk interception and privacy in Sky ECC can provide guidance for tax data collection.

On a philosophical level, the question we should ask is whether we will create a new divine judgement. Are computers the new gods of our society? In our data-driven world, should we allow digital systems and algorithms to acquire an almost transcendental authority? Increasingly, this technology is being described in terms reminiscent of theology. The first to be presented with this question will be the Constitutional Court.