Deloitte Built Risk Models with Nationality as Structural Data Input

Executive Summary

On 3 June 2013, Tax Authority officials met with Deloitte consultants to discuss progress on automated risk classification models for childcare allowance (KOT) and housing allowance (HT). The meeting record reveals that nationality (“BVR Nationaliteit”) was a standard structural data input in the SAS-based models, not an incidental criterion. The models were built with dangerously insufficient training data — only 100 “correct” and 100 “incorrect” samples — yet a production run was scheduled for 2 August 2013 despite participants acknowledging the model’s unreliability. All personal data was stored on unsecured shared network drives.

What Happened

The Belastingdienst/Toeslagen engaged Deloitte to build automated risk classification models in SAS for childcare and housing allowances. These models scored benefit decisions on numerous indicators to flag potential fraud. Two Deloitte consultants worked on-site, building and managing the models while internal staff received only basic training in June-August 2013.

The 3 June 2013 meeting covered the pipeline toward a planned “run” on 2 August 2013. The models used a three-layer data architecture: raw source data (“brondata”), intermediate datasets (“halfproducten”), and the final scoring model — all stored on the VEPROW52 shared server.

Critically, “BVR Nationaliteit” (nationality from the Basic Facility for Travel Documents) was listed as standard source data feeding into the models. This confirms that discriminatory profiling was not ad-hoc but architecturally embedded.

Evidence

• BVR Nationaliteit listed as standard brondata: Nationality was a fixed data field in the model pipeline alongside postal codes, BAG registrations, and blacklist entries
• Additional discriminatory sources: BVR NAW (name/address/city), BVR 07/09, BVR Bewoning, and BVR BSN Leeftijd all fed into the models
• Planned addition of IP addresses as risk indicators — a profiling technique prone to massive false positives
• Insufficient training data: Only 100 random decisions scored as “100% correct” and “100% incorrect” — statistically inadequate for reliable prediction
• Awareness of unreliability: The meeting record explicitly states “insufficient dossiers for training will impact scoring”
• Unsecured storage: Personal data on VEPROW52 shared drive with unclear access controls; mandatory monthly cleanup not structurally applied
• External dependency: Deloitte built, trained, and managed the models; internal ownership only transferred weeks before the production run

Analysis

This document provides the technical proof that the discriminatory practices documented elsewhere were not isolated incidents but the product of consciously designed systems. The structural embedding of nationality in the data pipeline means every decision processed through these models was potentially influenced by nationality-based scoring.

The use of only 200 training samples for a model affecting thousands of citizens represents a fundamental failure of scientific rigor. The combination of biased input data (including nationality) with insufficient training creates a compounding bias effect that systematically disadvantaged certain populations.

Deloitte’s role raises serious accountability questions. As the designer and operator of these models, Deloitte had a duty of care to flag discriminatory data inputs and inadequate training regimes. The transition from full-time Deloitte support to internal ownership just weeks before the production run suggests the Tax Authority was never truly capable of independent oversight of these systems.

Sources

• Belastingdienst/Toeslagen, zaaknummer 1871530, document 00281 — Meeting report risk classification 3 June 2013
• Rapport 9 — Onderzoek Toeslagenaffaire in het Algemeen Belang, 19 april 2026
• Cross-references: Rapport 4 (Inspectierapport 2021), Rapport 6 (FSV Stuurgroep), Rapport 8 (PwC Werkdocument FSV-Effecten)