Heidi: The Logging System Behind the Benefits Website

Summary

From mid-2013, the Belastingdienst/Toeslagen operated Heidi, a logging system that collected portal data from the benefits website. The system tracked user behavior — visits, clicks, form interactions — for approximately four years until its log files were deleted or transferred in September 2017. Heidi was deployed in the same period as Deloitte’s risk classification models that used nationality as fixed source data, forming part of a pattern of covert digital surveillance on citizens applying for benefits.

Context

What was Heidi?

According to parliamentary documents (Kamervragen kst-31066-1330), Heidi was a logging system deployed by the Belastingdienst/Toeslagen from mid-2013. It collected portal data — information about how users interacted with the benefits website, including navigation patterns, form completion behavior, and click data.

The broader surveillance landscape

Heidi did not operate in isolation. In the same period:

• Deloitte’s risk models (from June 2013): SAS-based classification models for childcare and housing allowances using “BVR Nationaliteit” as fixed source data, trained on only 200 examples.
• RAM (1998-2018): The Risk Assessment Model profiling virtually all taxpayers, including scraped internet data from 2015.
• FSV (2007-2020): The Fraud Signalling Facility registering ~180,000 citizens as fraud suspects.
• SyRI’s predecessor “Black Box”: Operated for years without a separate legal basis until Wet SUWI art. 64-65 took effect on 1 January 2014.

Note on “Heide2”

The verified system name is “Heidi” as documented in parliamentary questions. The term “Heide2” has not been confirmed in official sources and may refer to an internal name, a successor system, or a misunderstanding. This distinction is important for accuracy.

What happened

1. Mid-2013: Heidi is deployed on the benefits website, logging portal data from visitors.
2. 2013-2017: For approximately four years, user behavior data is collected from citizens interacting with the benefits website.
3. September 2017: Heidi log files are deleted or transferred. The reason and destination are not publicly documented.
4. 2018 onwards: No public disclosure of Heidi’s existence or scope until parliamentary questions.

The timing is significant: Heidi was deployed in the same period as the Deloitte risk models and the intensification of fraud detection under the Ministerial Commission on Fraud Approach (2013-2015).

Evidence

Analysis

Legal concerns

• AVG/GDPR art. 5(1)(b) (purpose limitation): Portal data collected for service delivery may have been repurposed for risk profiling without a separate legal basis.
• AVG/GDPR art. 13/14 (information obligation): Citizens visiting the benefits website were likely not informed that their behavior was being logged and potentially used for fraud detection.
• AVG/GDPR art. 22 (automated decision-making): If Heidi data fed into risk scores that influenced benefit decisions without human intervention, this constitutes automated decision-making with legal effects.
• ECHR art. 8 (private life): Covert collection of behavioral data from government website visitors.

Unanswered questions

1. What specific data points did Heidi collect? (clicks, mouse movements, time on page, form field interactions?)
2. Was Heidi data linked to individual BSNs or used for risk scoring?
3. Was Heidi data fed into Deloitte’s risk models or other decision systems?
4. Why were the logs deleted in September 2017 — was this related to the upcoming GDPR?
5. Did Heidi have a DPIA (Data Protection Impact Assessment)?
6. Is there a “Heide2” successor system currently operational?

Sources

• Kamervragen kst-31066-1330 — Toeslagenaffaire, vergaderjaar 2021-2022
• PwC, Onderzoek effecten FSV MKB, 17 maart 2022
• KPMG, Rapport onderzoek RAM, 25 februari 2025
• Autoriteit Persoonsgegevens, Onderzoek RAM en vergelijkbare systemen, 9 juli 2025
• WRR Working Paper 021, april 2016 (ISBN 978-94-90186-30-2)
• Belastingdienst Algoritmeregister, april 2026