Deloitte Built Risk Models with Nationality as Structural Data Input

Executive Summary

On 3 June 2013, Tax Authority officials met with Deloitte consultants to discuss progress on automated risk classification models for childcare allowance (KOT) and housing allowance (HT). The meeting record reveals that nationality (“BVR Nationaliteit”) was a standard structural data input in the SAS-based models, not an incidental criterion. The models were built with insufficient training data. Only 100 “correct” and 100 “incorrect” samples were used, yet a production run was scheduled for 2 August 2013 despite participants acknowledging the model’s unreliability. All personal data was stored on unsecured shared network drives.

What Happened

The Belastingdienst/Toeslagen engaged Deloitte to build automated risk classification models in SAS for childcare and housing allowances. These models scored benefit decisions on numerous indicators to flag potential fraud. Two Deloitte consultants worked on-site, building and managing the models while internal staff received only basic training in June-August 2013.

The 3 June 2013 meeting covered the pipeline toward a planned “run” on 2 August 2013. The models used a three-layer data architecture: raw source data (“brondata”), intermediate datasets (“halfproducten”) and the final scoring model, all stored on the VEPROW52 shared server.

BVR Nationaliteit (nationality from the Basic Facility for Travel Documents) was listed as standard source data feeding into the models. This confirms that discriminatory profiling was not ad-hoc but architecturally embedded.

Evidence

• BVR Nationaliteit listed as standard brondata: Nationality was a fixed data field in the model pipeline alongside postal codes, BAG registrations and blacklist entries
• Additional discriminatory sources: BVR NAW (name/address/city), BVR 07/09, BVR Bewoning and BVR BSN Leeftijd all fed into the models
• Planned addition of IP addresses as risk indicators, a profiling technique prone to massive false positives
• Insufficient training data: Only 100 random decisions scored as “100% correct” and “100% incorrect”, statistically inadequate for reliable prediction
• Awareness of unreliability: The meeting record explicitly states “insufficient dossiers for training will impact scoring”
• Unsecured storage: Personal data on VEPROW52 shared drive with unclear access controls; mandatory monthly cleanup not structurally applied
• External dependency: Deloitte built, trained and managed the models; internal ownership only transferred weeks before the production run

Analysis

This document provides the technical proof that the discriminatory practices documented elsewhere were not isolated incidents but the product of consciously designed systems. The structural embedding of nationality in the data pipeline means every decision processed through these models was potentially influenced by nationality-based scoring.

The use of only 200 training samples for a model affecting thousands of citizens represents a failure of scientific rigor. The combination of biased input data (including nationality) with insufficient training creates a compounding bias effect that systematically disadvantaged certain populations.

Deloitte’s role raises accountability questions. As the designer and operator of these models, Deloitte had a duty of care to flag discriminatory data inputs and inadequate training regimes. The transition from full-time Deloitte support to internal ownership just weeks before the production run suggests the Tax Authority was never truly capable of independent oversight of these systems.

Frequently asked questions

What role did Deloitte play in the Belastingdienst’s risk models?

Deloitte built, trained and managed automated risk classification models for childcare and housing benefit in SAS. Two Deloitte consultants worked on site at the Belastingdienst/Toeslagen. Internal ownership was transferred only weeks before the production run of 2 August 2013. The minutes of the 3 June 2013 meeting survive under case number 1871530.

Was nationality part of the Deloitte risk models?

BVR Nationaliteit was a standard data field in the source data of the SAS-based models for childcare and housing benefit. The source data comprised more than twenty data sources, including postcodes, BAG registrations and blacklists. Discrimination therefore did not occur ad hoc but was technically embedded in the data pipeline.

How much data were the models trained on?

The models were trained on only 200 examples: one hundred labelled good and one hundred labelled bad cases. Statistically that is insufficient for reliable predictions in models affecting thousands of citizens. The report itself acknowledges that insufficient files affect the scoring, as recorded at the 3 June 2013 meeting.

Where were the personal data of the models stored?

All source data, intermediate products and the final model sat on the VEPROW52 server, with unclear access rights. Personal data resided on unsecured shared network drives. A mandatory monthly clean-up was not structurally carried out, so the data remained in place longer than intended.

Read also

• Why justice is kept out — why the cabinet keeps the prosecution service out
• Who knew what about the data vault — who knew what about the data vault, and who is still there
• The corrupt agenda: a reconstruction — the full timeline, 2019-2026
• Data Vault: 64 Million Hidden Files — the discovery and the nine-month delay

Sources

• Belastingdienst/Toeslagen, zaaknummer 1871530, document 00281, Meeting report risk classification 3 June 2013
• Rapport 9, Onderzoek Toeslagenaffaire in het Algemeen Belang, 19 april 2026
• Cross-references: Rapport 4 (Inspectierapport 2021), Rapport 6 (FSV Stuurgroep), Rapport 8 (PwC Werkdocument FSV-Effecten)