← Case Library

Dutch Government (SyRI)

Q3
Government · Spear · The Trust Breach
Researched as of October 2026
ShareLinkedInX
AdaptAugmentAssist
Q3Automator
Q6Optimiser
Q9Conductor
Q2Tactician
Q5Partner
Q8Explorer
Q1Operator
Q4Weaver
Q7Navigator
StructuredDynamicComplex
2/9 cells occupied
Shape Read

The Hague judgment says SyRI produced a risk report. That score was not itself the enforcement decision. Q3 on this card means the scoring system. The Dutch Ministry of Social Affairs and Employment built SyRI as a Q3 Automator: a cross-agency data-linking engine that pseudonymised up to seventeen categories of personal data, ran it against an undisclosed risk model, and generated "risk reports" and flagged addresses for intervention teams across five low-income, migrant-heavy neighbourhoods. The system worked technically — the linking ran, the reports were produced, the teams deployed — but the activity it replaced was legally a Q2 Tactician function under Article 8 ECHR, requiring case-level, transparent, contestable human judgement rather than population-wide algorithmic suspicion. Across every deployment SyRI detected zero prosecuted fraud cases, while producing high false-positive rates and profiling entire neighbourhoods without ever notifying the individuals inside them that they had been scored. The District Court of The Hague ruled in February 2020 that the opacity of the risk model, the absence of a notification duty, and the exclusive targeting of poor and migrant-heavy areas made the scheme impossible to justify under Article 8's proportionality test, and the state chose not to appeal. The case stands as the European counterpart to Robodebt: a technically functional system institutionally illegitimate because it moved a rights-bearing decision into an industrial-execution cell, stopped only by a court applying transnational human-rights law rather than by the agency's own governance.

Trajectory: The state did not appeal and shut SyRI down in April 2020, but a contested successor framework (the WGS, nicknamed "Super-SyRI") entered into force in March 2025 alongside an EU AI Act prohibition on social scoring that explicitly cites the SyRI judgment.

Inside the company · not a cell

Nothing quoted yet. A rate or a saving will sit here when it is on the record. It does not light the grid.

Initiative Map
CellInitiativeConfidenceEvidence
Q2TacticianPre-2014 manual fraud-investigation framework (Black Box / Waterproof / Internal-Affairs investigations)Welfare fraud investigation, pre-automation🔶Multi-agency teams convened on identified-suspect basis with documented evidentiary thresholds; selective use of personal data with proportionality assessments per matter.As of April 2026
Q3AutomatorArticle 65 SUWI Act + Chapter 5a SUWI Decree (1 September 2014)Statutory cross-agency data-linking framework for welfare, tax, healthcare, housing and education datasets✅Statute permitted joining 17 categories of personal data including income, debts, education, pensions, business ownership, integration, compliance with labour-laws, fiscal data, health-insurance data, identifying data, property, vehicles, residence permit data, data on rights to public services, commercial data, social benefit and reintegration data (Stb. 2014, 320; Stcrt. 2014, 26306); risk-indication register held two years; no notification duty to risk-flagged individuals.As of April 2026
Q3AutomatorFive neighbourhood deployments (2014–2019): Capelle aan den IJssel, Eindhoven, Schalkwijk (Haarlem), Hillesluis & Bloemhof (Rotterdam)Neighbourhood-level risk-profiling pilots✅All five neighbourhoods were low-income; Schalkwijk, Hillesluis and Bloemhof had above-average non-Western migrant populations; deployment selection produced de facto neighbourhood-level targeting that the court characterised as carrying "the risk that use of SyRI will inadvertently make connections based on bias" (paragraph 6.93 of judgment).As of April 2026
Q3AutomatorCapelle aan den IJssel project (one of five)Municipal pilot deployment🔶137 risk reports generated; 41 risk addresses flagged; zero follow-ups conducted; 62 of 113 risk reports characterised as false positives in a parallel project per Volkskrant reporting; Inspectie SZW evaluation acknowledged failure to use the outputs.As of April 2026
Q3AutomatorAcross all SyRI deployments cumulatively (2014–2020)Multi-agency fraud-detection enforcement✅Zero confirmed cases of fraud detected and successfully prosecuted on the basis of a SyRI risk indication across the lifetime of the system; risk-indication register held two years; State Secretary Tamara van Ark refused audit and refused disclosure of the model.As of April 2026
Q3AutomatorRisk model — opaque scoring methodologyAlgorithmic risk scoring✅Court found the model not disclosed during proceedings; risk indicators not subject to public scrutiny; pseudonymisation insufficient because re-identification by named address was the operating purpose; State Secretary Tamara van Ark refused audit and disclosure.As of April 2026
Q3AutomatorPre-deployment governance gates (DPA / CBP and Council of State opinions, 2014)Advisory oversight of statutory rollout✅DPA (CBP) and Council of State (Raad van State) issued critical opinions in 2014 raising privacy and proportionality concerns; both opinions ignored by the Minister; 2018 D66 motion not filed; State Secretary Tamara van Ark refused subsequent audit.As of April 2026
Q2TacticianNJCM / PILP / Privacy First / FNV coalition lawsuit (filed March 2018; hearing 29 October 2019; judgment 5 February 2020)Strategic civil-society litigation✅NJCM, Platform Bescherming Burgerrechten, Privacy First, Stichting KDVP, FNV, and Landelijke Cliëntenraad established standing as civil-society organisations; private plaintiffs Tommy Wieringa and Maxim Februari held to lack individual standing; lawsuit financed and coordinated by PILP-NJCM.As of April 2026
Q2TacticianUN Special Rapporteur Philip Alston amicus brief (filed September 2019)International human-rights intervention✅Alston filed an amicus brief warning that SyRI represented a "digital welfare state" pattern; subsequent characterisation in the OHCHR landmark-ruling press release that the Dutch government had attempted to "spy on the poor"; later academic synthesis in Alston's NYU Law work on digital welfare dystopia.As of April 2026
Q2TacticianDistrict Court of The Hague judgment, 5 February 2020 (ECLI:NL:RBDHA:2020:1878 / Case nr. C-09-550982)Judicial ruling on lawfulness of SyRI✅Court ruled SUWI Article 65 + Chapter 5a SUWI Decree did not satisfy the fair-balance test under Article 8(2) ECHR on three grounds: (i) opacity of the risk model preventing affected individuals from contesting outcomes; (ii) absence of any duty to notify risk-flagged individuals; (iii) discriminatory neighbourhood-targeting risk per paragraph 6.93; rejected one-size privacy-impact-assessment defence; ordered State to pay EUR 3,250.51 in legal costs.As of April 2026
Q2TacticianState decision not to appeal; SyRI shutdown April 2020Post-judgment institutional response✅State did not appeal the ruling; SyRI deactivated April 2020; legislative repeal followed; SUWI Article 65 / Chapter 5a SUWI Decree withdrawn.As of April 2026
Q3AutomatorToeslagenaffaire (childcare-benefits scandal) — parallel discriminatory algorithmic enforcementTax administration fraud-risk classification✅More than 20,000 parents falsely accused of childcare-benefit fraud, disproportionately Dutch nationals of non-Western descent; algorithmic risk classifications used to target families; over 1,000 children placed in foster care; Rutte III cabinet resigned 15 January 2021.As of April 2026
Q3AutomatorLighthouse Reports investigation (2023) — continued useInvestigative journalism follow-up🔶Lighthouse Reports identified a "slightly adapted SyRI" operating in Utrecht's Overvecht district post-2020; the framing of "discontinued" SyRI did not match operational reality at the municipal level.As of April 2026
Q3AutomatorWet Gegevensverwerking door Samenwerkingsverbanden ("Super-SyRI" / WGS) — entered into force 1 March 2025Successor cross-agency data-processing framework🔶WGS authorises four named partnerships — Care and Safety Houses (ZVHs), Regional Information and Expertise Centres (RIECs), the Financial Expertise Centre (FEC), and iCOV — to share personal data for risk-signalling; the framework has been subjected to extensive critical review by Privacy First, Bits of Freedom and academic commentators (the Super-SyRI paper).As of April 2026
Q3AutomatorEU AI Act Article 5(1)(c) — prohibition on social scoring effective 2 February 2025EU-wide regulatory ceiling✅Article 5(1)(c) prohibits AI systems that evaluate or classify natural persons over time based on social behaviour producing detrimental treatment in unrelated contexts or unjustified treatment disproportionate to behaviour; SyRI-style cross-domain risk scoring is treated as a paradigm case of the prohibited practice.As of April 2026
Published record

The lines this reading rests on. A date is the source date, when the page or the line names one.

Yesterday, a Netherlands court ordered the Dutch government to halt its use of SyRI, an automated program that analyzes a wide range of personal and sensitive data to predict how likely people are to commit tax or benefits fraud.

February 2020hrw.org ↗

During the hearing, the government refused to disclose meaningful information about how SyRI uses personal data to draw inferences about possible fraud.

February 2020hrw.org ↗

This order in council was published today in Bulletin of Acts and Decrees 2024, 380 and also regulates entry into force from 1 March 2025.

December 2024government.nl ↗
Strength
SyRI's core mechanics worked as designed — cross-agency data linking, pseudonymisation, and risk-report generation executed reliably across five municipal deployments.
Fragility
It was deployed as a population-wide dragnet against every resident of designated poor, migrant-heavy neighbourhoods, using a permanently undisclosed risk model with no individual notification duty.
Failure mode
The District Court of The Hague found SyRI's opacity, lack of notification, and neighbourhood-level targeting made it impossible to satisfy Article 8 ECHR's proportionality test, and the system detected zero prosecuted fraud cases across its lifetime while producing large numbers of false positives.
Governance ceiling
Critical 2014 warnings from the Dutch Data Protection Authority and the Council of State were ignored, a single privacy impact assessment was treated as sufficient for every subsequent project, no independent oversight body ever reviewed a live deployment, and only external civil-society litigation and a court ruling forced a stop.
← Back to the Case Library