Dutch DPA fines the Tax Administration €2.75M for unlawful algorithmic nationality profiling

The problem

The Dutch Tax Administration (Belastingdienst) processed the (dual) nationality of childcare-benefit (kinderopvangtoeslag) applicants for years after it should have stopped. The Dutch Data Protection Authority (AP) found that “for many years the Tax Administration processed data on the (dual) nationality of childcare benefit applicants in an unlawful, discriminatory and therefore improper manner” source. The retained data was vast: “In May 2018, some 1.4 million people were still registered as dual nationals” in the Tax Administration’s systems, per the AP source. This is a regulator-origin, adjudicated public record — a national data-protection authority finding an automated risk system unlawful, not a vendor case study.

What was built

An automated fraud-detection and risk-classification system for benefit applications used nationality as a selection signal. The AP found the Tax Administration “used applicants’ nationality (Dutch/not Dutch) as an indicator in a system that automatically designated certain applications as risky. The data was not necessary for this purpose either” source. The GDPR-decisions tracker thedpo.eu records the mechanism and its legal characterisation: “The Allowances unit used a self-learning algorithm to automatically select benefit applications for manual review. The DPA qualified this as profiling within the meaning of Article 4(4) GDPR” source. The AP concluded that “unlawful processing by means of an algorithm led to a violation of the right to equality and non-discrimination” source. Clifford Chance’s Talking Tech independently described the same engine: in 2021 “the tax authorities were fined 2.75 million euros by the DPA for using a self-learning algorithm to create risk profiles” in benefit-fraud detection source.

The outcome

On 7 December 2021 the AP “imposed a €2.75 million fine on the Dutch Tax Administration” — at the time its highest source. Two independent newsrooms corroborate the figure firsthand: Pinsent Masons’ Out-Law reported “a record € 2.75 million fine on the nation’s Tax and Customs Administration … for its use of discriminatory data processing practices” source, and Compliance Week reported “a fine of €2.75 million (U.S. $3.1 million) against the government’s Tax and Customs Administration for violations of the EU’s … GDPR” source. The Tax Administration had already wound the practice down before the fine: per the AP it “has not used applicants’ nationality in determining risk since October 2018 … has not used the data to combat organised fraud since February 2019,” and “In the summer of 2020 the dual nationalities … were completely deleted” source. The unlawful profiling fed the childcare-benefits scandal (toeslagenaffaire): per Al Jazeera, “Some 10,000 families, some of whom were racially profiled, were forced to repay tens of thousands of euros of subsidies,” and on 15 January 2021 Dutch Prime Minister Mark Rutte “announced the resignation of his government” over the affair source.

A note on the weakest link

The critical claims — the €2.75M fine and the unlawful self-learning risk algorithm — rest on the strongest possible source, the AP’s own adjudication (Tier 1, regulator-origin), so the secondaries only corroborate rather than carry them. The downstream-harm context (roughly 10,000 families forced to repay; the government’s resignation) is a single-source, non-critical claim: it rests on one Tier-2 newsroom, Al Jazeera, not on the AP decision, and it is deliberately framed as scandal context, not as an adjudicated finding in this fine. The €2.75M total’s three sub-components (€750,000 / €1,000,000 / €1,000,000) are stated only by secondaries and by the 25-page Dutch boetebesluit PDF, which was not text-extractable in-session — so they are held in the path-to-green, not asserted here as cited claims.

How this was verified

• Method: Tier-1 regulator-origin adjudication — the Dutch DPA’s English press release of 7 December 2021 (“Tax Administration fined for discriminatory and unlawful data processing”), the primary for both critical claims. Every quoted line above was re-matched this session against the local capture of that release (Wayback 20240424124751) and the corroborating captures.
• Corroboration: the €2.75M fine is carried firsthand by two independent Tier-2 newsrooms (Pinsent Masons Out-Law; Compliance Week, “U.S. $3.1 million”); the self-learning risk-classification algorithm ruled unlawful profiling under Art. 4(4) GDPR is corroborated by thedpo.eu and Clifford Chance Talking Tech. Downstream scandal context is one independent (Al Jazeera).
• Date verified: checker round 1, 2026-08-10 (confidence 1.000; graduated to pending).
• What “verified” (green) would still require: a human confirming on the AP/Ministry of Finance record the €2.75M total and its three components (€750k unlawful storage of second nationality; €1M nationality as a risk-classification indicator; €1M nationality in organised-fraud detection), whether the Minister of Finance lodged an objection and its disposition, and the cessation dates. Green never depends on the fined body confirming its own numbers — it rests on the AP decision plus the independent public record. This page is pending (amber); no green badge is claimed.

Related case files

• Italy’s Garante fines Foodinho €2.6M for its rider-management algorithm — the closest sibling: another 2021 European DPA fine where an automated profiling/ranking algorithm was ruled an unlawful processing of personal data, not a vendor claim.
• Spain’s AEPD orders Worldcoin to halt biometric iris-scanning — a regulator-origin enforcement in the same family, where a European DPA stopped an automated data-processing system on GDPR grounds.
• ICO orders Serco Leisure to halt unlawful facial-recognition attendance monitoring — a UK data-protection authority striking down another automated system that processed people’s data without a lawful basis.

Sources

1. Autoriteit Persoonsgegevens (Dutch DPA) · “Tax Administration fined for discriminatory and unlawful data processing” · 2021-12-07 · https://www.autoriteitpersoonsgegevens.nl/en/current/tax-administration-fined-for-discriminatory-and-unlawful-data-processing — Tier 1 (regulator-origin primary; the adjudicating authority’s own press release; independent-origin, not counted toward corroboration; local capture, Wayback 20240424124751).
2. Pinsent Masons · Out-Law · “Dutch tax authority handed record fine for discriminatory data processing” · 2021-12-13 · https://www.pinsentmasons.com/out-law/news/dutch-tax-authority-record-fine-discriminatory-data-processing — Tier 2 (independent legal newsroom carrying the €2.75M fine firsthand; local capture, Wayback 20260314161948).
3. Compliance Week · “Dutch DPA fines government tax authority $3.1M under GDPR” · 2021-12-08 · https://www.complianceweek.com/europe/dutch-dpa-fines-government-tax-authority-31m-under-gdpr/ — Tier 2 (independent newsroom; states “€2.75 million (U.S. $3.1 million)” firsthand; local capture, Wayback 20260810092700).
4. thedpo.eu · GDPR decision summary (Belastingdienst, 7 Dec 2021) · 2021-12-07 · https://thedpo.eu/en/decisions/7bd0d509-ac6c-423d-a927-66dce2996b32 — Tier 2 (independent GDPR-decisions tracker; records the self-learning algorithm and Art. 4(4) profiling qualification; local capture, Wayback 20260810093032).
5. Clifford Chance · Talking Tech · “Dutch government fraud scandal leads to record-breaking GDPR fine” · 2022-04 · https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2022/04/dutch-government-fraud-scandal-leads-to-record-breaking-gdpr-fin.html — Tier 2 (independent legal commentary corroborating the self-learning risk-profiling algorithm; local capture, Wayback 20260316083317).
6. Al Jazeera · “Dutch PM Rutte and his government quit over child welfare scandal” · 2021-01-15 · https://www.aljazeera.com/news/2021/1/15/dutch-pm-rutte-and-his-government-quit-over-child-welfare-scandal — Tier 2 (independent newsroom; carries the non-critical downstream scandal context — ~10,000 families forced to repay; government resignation; local capture, Wayback 20251119114425).