Dutch data protection watchdog shows power against use of unlawful algorithm

The case concerns the unlawful collection and analysis of data by the Dutch Employee Insurance Agency (UWV) as part of the algorithm it used to detect benefit fraud by people residing abroad while receiving unemployment benefits. 

According to the AP’s publication, the UWV secretly placed cookies to track users of UWV’s websites. This allowed logged-in users to be identified and linked to their IP addresses. In addition, it kept track of how long people were logged in. The users were not informed that they were being tracked.  

Following the AP’s action, the UWV has acknowledged that it had been in breach of the GDPR and has committed to take several remedial measures. Specific steps to be taken by the UWV include informing every unemployment benefits recipient whose personal data has been unlawfully used in this case; determining whether the affected unemployment benefits recipients have suffered damages and compensating them; and creating a plan of action for these measures and reporting regularly to the AP on progress.  

AP board member Katja Mur noted that “just following people online is obviously not allowed in the Netherlands”.  

“That understanding is now hopefully shared by the UWV. The AP trusts that the UWV will put things right. If not, that could be grounds for heightened supervision or a monitoring investigation and enforcement by the AP,” said Mur.  

Nienke Kingma of Pinsent Masons in Amsterdam, who specialises in data protection law, said the case is remarkable because it is a clear example of AP’s role with regard to the supervision of algorithms in the Netherlands. 

At the beginning of 2023, the Dutch government announced the introduction of a supervisor of algorithms, which is referred to as the ‘algorithm watchdog’. Following that the AP set up a new internal unit, called ‘the Algorithms Coordination Directorate (DCA)’. This unit was meant to boost oversight of algorithm development and use. 

“Another interesting aspect about this case is that it involves ‘commitments’ being made by the UWV to the AP, including a public acknowledgement of their unlawful behaviour. In return for that acknowledgement and making commitments to take remedial measures, the AP did not yet proceed with further investigations and enforcement,” said Kingma. 

“However, if the UWV will not put things right as agreed, the AP warns about further investigations or enforcement after all. This form of commitments procedures is not yet very common in the Netherlands, contrary to some other EU jurisdictions. That’s absolutely a space to watch,” she said. 

Kingma also pointed to the upcoming EU AI Act as another relevant development in this area. The AI Act also prescribes the appointment of a national supervisory authority that will coordinate the tasks of the new law. Although not formally appointed yet, the AP has stated that appointing the AP as national regulator under the AI Act would ensure a more harmonised regulatory approach, contributing to consistent interpretation of the provisions and helping avoid any inconsistencies in the enforcement of the regulation.