Autoriteit Persoonsgegevens — Dutch Tax and Customs Administration (Belastingdienst)
The Dutch DPA fined the Tax and Customs Administration for unlawfully processing nationality data and using a self-learning algorithm that disproportionately flagged families with dual nationality as suspected fraud cases in childcare-benefit claims, violating GDPR.
Key takeaway — how to prevent this
AI that denies insurance claims or benefits must preserve meaningful human review of medical necessity; automated mass denials draw bad-faith, breach-of-contract and class-action liability.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text.
- Decided by
- Dutch Data Protection Authority (DPA)
- Parties
- Dutch Data Protection Authority (DPA) v. Dutch Tax Administration
- Decision date
- December 7, 2021
- Remedy
- The Dutch Data Protection Authority imposed a €2.75 million fine on the Dutch Tax Administration for unlawful, discriminatory, and improper processing of dual nationality data.
- Amount
- €2,750,000
- Appeal
- Appeal status not stated
Key holdings
The Dutch Tax Administration unlawfully and discriminatorily processed dual nationality data of childcare benefit applicants over many years.
“The fine was imposed because for many years the Tax Administration processed data on the (dual) nationality of childcare benefit applicants in an unlawful, discriminatory and therefore improper manner.”
Processing applicant nationality data to combat fraud was unnecessary and unlawful.
“The Tax Administration also processed the nationality data of childcare benefit applicants for the purpose of combating organised fraud, even though this data was not necessary for this purpose.”
Using nationality as an automated risk indicator infringed on personal data rights and fundamental rights to non-discrimination.
“Lastly, it used applicants’ nationality (Dutch/not Dutch) as an indicator in a system that automatically designated certain applications as risky.”
In plain English
The Dutch Data Protection Authority imposed a fine of 2.75 million euros on the Dutch Tax Administration for unlawfully processing personal data regarding the dual nationality of childcare benefit applicants. The Tax Administration retained and used data on dual nationality, which should have been deleted in January 2014. By May 2018, around 1.4 million people remained registered as dual nationals in the agency's systems. The regulator found that entitlement to childcare benefits depends on lawful residence rather than nationality. The Tax Administration improperly processed nationality data to combat organized fraud and used nationality status as an indicator in an automated system designed to flag risky applications. These practices violated fundamental rights, including the right to equality and non-discrimination protected under the General Data Protection Regulation. Following the regulator's investigation, the Tax Administration halted these practices. It stopped using nationality data for risk assessments in October 2018 and for combating organized fraud in February 2019. In the summer of 2020, it deleted dual nationality records of Dutch nationals from its systems. The fine was formally assigned to the Minister of Finance, who bears responsibility for personal data processing within the Tax Administration. The decision notes that affected individuals retain the right to seek compensation or damages. The Tax Administration retains the right to lodge an objection to the fine.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.