Government Algorithms and Rights Violations at the Belastingdienst

Executive Summary

The Belastingdienst runs 68 registered algorithms, 65 classified as “impactful,” affecting millions of citizens and businesses. The Autoriteit Persoonsgegevens (AP) concluded that more than 50 of these algorithms are discriminatory and unlawful. The historical Risico Analyse Model (RAM) made distinctions based on nationality, a violation of the prohibition on discrimination. Despite government claims of compliance, 67 of 68 algorithms have no completed Data Protection Impact Assessments (DPIAs).

What Happened

The Dutch government’s Algorithm Register (algoritmes.overheid.nl) lists 1,416 algorithms across all government organizations. The Belastingdienst alone accounts for 68, in active use. In October 2025, the AP found that over 50 of these algorithms discriminate on prohibited grounds, potentially invalidating millions of tax assessments. The Rekenkamer’s May 2025 audit of the carousel fraud algorithm confirmed it failed AVG requirements for DPIA, bias testing and change management. The Dienst Toeslagen scored “insufficient” on eight of sixteen audit criteria.

Evidence

Key findings from the AP ruling on RAM: the Belastingdienst unlawfully processed special category personal data and criminal records, made distinctions based on nationality without objective justification, failed to implement adequate security measures and evaded oversight for years. The Rekenkamer confirmed both the Belastingdienst and Dienst Toeslagen fail to meet AVG standards. The SyRI system was ruled in violation of Article 8 ECHR by the District Court of The Hague in February 2020. The Belastingdienst’s own website claims compliance with AVG and transparency, yet 67 of 68 algorithms lack completed impact assessments.

Analysis

The pattern is structural, not incidental. The Belastingdienst operates a “toezichtarrangement” with the AP, indicating ongoing regulatory concern. When an algorithm is unlawful, decisions based on it are voidable under Article 8:72 AwB and the State may face liability under Article 6:98 BW. The “impactful” label has been applied to 65 of 68 algorithms, rendering it meaningless as a risk classification. The Algorithm Register relies on self-registration with no legal obligation to comply, meaning the actual number of algorithms in use is higher. The chain effect through the Schuldenknooppunt and municipal systems extends Belastingdienst data without adequate safeguards.

Frequently asked questions

How many algorithms does the Belastingdienst operate and how many are unlawful?

The Belastingdienst operates 68 registered algorithms, 65 of which carry the impactful label. In October 2025 the Autoriteit Persoonsgegevens concluded that more than 50 of these algorithms are discriminatory and unlawful. As a result, millions of tax assessments may have been issued unlawfully.

What fine did the Autoriteit Persoonsgegevens impose on the Belastingdienst?

In July 2020 the AP imposed a fine of 2.75 million euros, specifically for the FSV violations. Across all Belastingdienst privacy violations the total fine came to 3.7 million euros. Among other things, the authority unlawfully processed special category personal data and criminal records through the Risico Analyse Model.

What did the court rule about the SyRI system?

In February 2020 the District Court of The Hague ruled that the SyRI system violated Article 8 of the ECHR, the right to respect for private life. Combined with the AP findings on RAM, which made distinctions based on nationality, the ruling shows that these rights violations came to light years ago.

How many Belastingdienst algorithms have a completed DPIA?

67 of the 68 algorithms lack a completed Data Protection Impact Assessment (DPIA), even though the Belastingdienst’s own website claims AVG compliance. In May 2025 the Algemene Rekenkamer also confirmed that the carousel fraud algorithm fails the AVG requirements for DPIA, bias testing and change management.

Read also

• The butcher as gatekeeper: the debate — why the cabinet keeps the prosecution service out
• The accountability matrix 2017-2026 — who knew what about the data vault, and who is still there
• The full data vault timeline — the full timeline, 2019-2026
• Data Vault: 64 Million Hidden Files — the discovery and the nine-month delay

Sources

• algoritmes.overheid.nl (April 2026, 1,416 registered algorithms)
• AP ruling on RAM and 50+ discriminatory algorithms (2025)
• Algemene Rekenkamer audit of Belastingdienst, Dienst Toeslagen, UWV algorithms (21-05-2025)
• Follow the Money: “Meer dan 50 algoritmes van de Belastingdienst zijn onrechtmatig” (11-10-2025)
• Rechtbank Den Haag SyRI ruling (EVRM Art. 8 violation, February 2020)
• KPMG report on RAM (7 February 2025)
• over-ons.belastingdienst.nl/onderwerpen/omgaan-met-gegevens/algoritmeregister/
• NOS: Belastingdienst op de vingers getikt (2025)