How a fraud crackdown, a risk model and an unforgiving law harmed tens of thousands of families, and what boards and governments can take from it.
Terence KokExecutive Director, AI Governance & Assurance, Orion Five Engineering
About your speaker
Terence Kok
Executive Director, AI Governance & Assurance Practice, Orion Five Engineering
Former Chief AI and Innovation Officer, Meinhardt Group
Twenty-five years leading digital and AI transformation across Asia and the Middle East: national smart-city programmes, critical infrastructure and enterprise operations. Today I help leadership teams put AI into production with controls they can show a board, an auditor and a regulator.
BuiltA governed AI platform serving more than 6,000 engineers, with zero security incidents
CertifiedISO/IEC 42001 Lead Auditor Professional (BSI) · AIGP (SMU) · Registered Management Consultant
ServingCTCB CPSC Advisory Board · UN ESCAP AI for Developing Countries Forum
AwardsCDO Vision Award 2026 · Singapore's Most Influential Data & AI Leaders 2026 · Google Trailblazer Transformation Award 2024
Independent analysis from public sources. The views in this session are mine.
This session
Eight parts, from the design of the scheme to the controls it calls for.
The short versionWhat happened, in four numbers
How the scheme was builtPay first, check later, no hardship clause
The risk modelWhat it scored, who it picked, what it could not explain
The system around itFour routes to suspicion and the all-or-nothing rule
The warningsCourts and the Ombudsman, years before the change
The reckoningRegulator, parliament, cabinet, courts
People and recoveryFamilies, children, money and time
Lessons and controlsFor boards, executives and agencies
Case study · Dutch childcare benefits
At a glance
Tens of thousands of parents were treated as suspected fraudsters from about 2013 to 2019.
44,045
parents confirmed as affected by 30 June 2026
EUR 30,000
minimum paid to each affected parent
EUR 11.8bn
recovery budget in September 2026, not money spent
2,090
children of affected parents placed out of home, 2015 to June 2022. A count; causation is disputed.
Sources: 23rd progress report, September 2026 [13]; Hart van Nederland and NOS [22, 23]; Statistics Netherlands via the Youth Institute [25].
Case study · Dutch childcare benefits
The short version
Allowances were stopped and parents told to repay everything.
The benefits arm of the Dutch tax office stopped childcare allowances and demanded repayment, often for a missing document or a small unpaid contribution. Many families fell into debts they could not escape.
A self-learning risk model was part of it. It ranked applications for staff to check and used nationality as one signal. It did not decide who was a fraudster.
Most of the ruin came from an all-or-nothing rule, group treatment of parents and a law with no room for hardship.
Sources: [7], [12], [13].
Parliamentary interrogation committee, 17 December 2020
“Fundamental principles of the rule of law were violated.”
Ongekend onrecht (Unprecedented injustice). The committee found violations by the executive, by parliament as legislator and by the administrative courts. The cabinet resigned four weeks later.
Sources: Ongekend onrecht [7]; press conference after the cabinet meeting, 15 January 2021 [20].
Case study · Dutch childcare benefits
01
How the scheme was built.
2005 to 2013. Advance payments, a strict reading of the law and a political demand for fraud enforcement.
Case study · Dutch childcare benefits
The design, 2005 to 2006
Parents were paid in advance and checked afterwards.
Pay first
Advance payments
Allowances were paid before any check and settled later against actual costs and income. The data protection authority calls this "a political choice".
No relief
No hardship clause
The benefits framework law (Awir) had no general hardship clause, so officials had no legal room to soften a ruinous recovery. One was added only in July 2020.
2009
The strict reading
The State Attorney called the all-or-nothing reading only "arguable". The benefits office adopted it anyway, and the Council of State upheld it.
A risk model went live within days of a fraud story on television.
The triggerA television report on organised fraud by a group that registered people from Bulgaria at Dutch addresses.
The responseA self-learning risk model commissioned from Deloitte was built, tested and put into use within days, with no functional design and no privacy impact assessment.
The climateAn anti-fraud team (CAF) was set up the same year. The 2024 inquiry describes an "overheated" political demand for enforcement and a staffing business case that had to pay for itself through money recovered.
Sources: Blind voor mens en recht [8]; Ongekend onrecht [7].
02
The risk model.
It ranked applications for staff to review. It made no entitlement decisions, and it shaped who was scrutinised.
Case study · Dutch childcare benefits
How the model worked
Every application got a score, and staff checked the highest.
Sources: data protection authority report, 2020 [1]; State Secretary's letter on the model, 8 December 2021 [12].
Case study · Dutch childcare benefits
Nationality
The model used Dutch nationality as yes or no. Dual nationality was a separate breach.
Inside the model
One indicator recorded whether the applicant held Dutch nationality. It appears in the model's scorecards from March 2016 and was removed in October 2018 for having "no predictive value".
Outside the model
The tax office kept the second nationality of 1.4 million people on file without a legal basis (still registered in May 2018). Fraud analysts pulled it in their own manual queries. It was never a model indicator.
Dual nationality is often reported as an algorithm input. The data protection authority found the model used only "Dutch: yes or no".
Sources: data protection authority report, 2020, sections 2.3.2 and 2.3.3 [1]; news release [2].
Case study · Dutch childcare benefits
What reviewers could see
“The case handler does not know why the system selects a case.”
The tax office's own description of the model, quoted by the data protection authority. A reviewer who sees only a score has nothing to challenge.
Source: data protection authority report, 2020 [1].
Case study · Dutch childcare benefits
Model risk
The indicators were never tested for validity, reliability or bias.
No validationThe 2024 inquiry found the indicators were never tested for validity or reliability.
Feedback loopWithout statistical correction for bias, the model fed on its own selections, for example around single parents.
No retrainingDeloitte warned in 2016 that the model was not retrained regularly.
Income as riskA separate rule, "high allowance, high risk", flagged anyone receiving large amounts. In childcare allowance that means the lowest earners.
Source: Blind voor mens en recht [8].
Case study · Dutch childcare benefits
Who the model picked, one month of 2019
The 1,000 highest scores were far more often non-Dutch and low-income.
Held Dutch nationality
Top 1,000 scores
78.8%
All other applicants
95.5%
Household income under EUR 20,000
Top 1,000 scores
82.3%
All other applicants
7.3%
The State Secretary wrote that "it cannot be ruled out that a certain bias occurred". This is one measured month, not the whole period.
Sources: Blind voor mens en recht, table 7.6 [8]; State Secretary's letter, 8 December 2021 [12].
Case study · Dutch childcare benefits
03
The system around the model.
Parents came under suspicion by several routes. What turned suspicion into ruin was the way the law was applied.
Case study · Dutch childcare benefits
Four routes to ruin
The model was one part of four.
Algorithmic
Risk model
Scored every application from 0 to 1. About 100 of the highest scores a month went to staff, who held back the advance and asked for documents.
Manual
Fraud team queries
An anti-fraud team pulled whole groups by nationality: all 6,047 applicants with Ghanaian nationality in January 2014. Allowances were stopped for groups at a time.
Database
Fraud signals list
A tax-office-wide list of about 270,000 people, filled with unchecked tips, used to justify intensive checks and refuse payment plans.
Policy and law
All-or-nothing rule
Any missing document or unpaid contribution cancelled the whole year and triggered recovery of everything paid, with no hardship clause.
Sources: [1], [5], [6], [7], [12], [14].
Case study · Dutch childcare benefits
The anti-fraud team
The fraud team worked on groups, not individuals.
6,047
applicants with Ghanaian nationality pulled in one January 2014 query, covering everyone since the start of 2013
The team did not use the model to choose its cases, though it used model scores to add to the signals it received.
Senior officials wrote in 2015 about the "dilemma" of a group approach that assumed 80 per cent of a group was wrong and 20 per cent right.
The parliamentary committee found that ratio had no quantitative basis, and that running allowances had been stopped for groups unlawfully.
Sources: data protection authority report [1]; Ongekend onrecht [7]; State Secretary's letter [12].
Case study · Dutch childcare benefits
The fraud signals list (FSV)
A blacklist of about 270,000 people, often confused with the model.
270,000
people on the list, including anonymous tips that were never checked
FSV was a database used across the whole tax office, not only for benefits. It was in use from November 2013 and switched off in February 2020.
Being on it could mean intensive checks and a refused payment plan.
In April 2022 the data protection authority imposed a EUR 3.7 million fine for it, at the time its highest fine.
Sources: data protection authority news releases, 28 October 2021 and 12 April 2022 [5, 6].
Case study · Dutch childcare benefits
The rule
Any shortcoming cancelled the whole year.
Under the all-or-nothing practice, an unpaid part of the parent's own contribution or a missing document cancelled the year's entitlement and triggered recovery of everything paid.
The parliamentary committee found this "does not follow directly from the law". The Council of State upheld it until 23 October 2019, when it held that proportionality applies and partial entitlement is possible.
Sources: Ongekend onrecht [7]; Council of State, 23 October 2019 [14].
One parent, one year Illustrative figures
A EUR 400 shortfall became a EUR 12,000 debt.
Proportional assessment, after October 2019
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Owed: EUR 400. The rest of the year stands.
All-or-nothing, before
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Owed: EUR 12,000. Every month paid becomes a debt, and an intent label can block a payment plan.
Allowance keptReclaimed
Invented figures (EUR 1,000 a month, EUR 400 unpaid) to show the mechanism described in Ongekend onrecht [7] and the Council of State's rulings of 23 October 2019 [14].
Case study · Dutch childcare benefits
A second label
An intent label blocked the way out of the debt.
16,500
people who may be entitled to redress for being wrongly labelled
Parents judged to have acted with intent or gross negligence were refused a personal payment plan.
The parliamentary committee found the label was applied far too widely.
The Council of State reversed its own case law on 23 October 2019. By then the all-or-nothing practice had run for a decade.
Sources: Ongekend onrecht [7]; 23rd progress report [13]; Council of State [14].
Case study · Dutch childcare benefits
04
The warnings.
2014 to 2019. The signal arrived one case at a time, and the organisation treated each case as an exception.
Case study · Dutch childcare benefits
Five years of warnings
Courts and the Ombudsman raised the alarm years before the system changed.
2014
CAF 11
Allowances stopped for some 300 parents who used one childminding agency.
Mar 2017
Council of State
Rules the CAF 11 stoppage unlawful.
Aug 2017
National Ombudsman
Calls the treatment of 232 families "disproportionately harsh". Compensation is recommended and not adopted.
Oct 2019
Council of State
Abandons the all-or-nothing case law.
Nov 2019
Donner commission
Finds "institutional bias" and a "zero tolerance" approach. Use of the model ends the same month.
Sources: [9], [12], [14], [15], [16], [7].
Case study · Dutch childcare benefits
Oversight
Information to parliament was late, incomplete and incorrect.
The committee that reported in December 2020 found that information to parliament had been "late, incomplete and incorrect".
The Donner commission found in November 2019 that ordinary legal protection had not been adequate in the CAF 11 case.
Complaints, adverse rulings and an Ombudsman report were each handled as a single case. None was reported upward as a pattern.
Sources: Ongekend onrecht [7]; Omzien in verwondering [9].
Full timeline · 1 of 4
From the benefits law to the end of the model, 2005 to 2019.
When
Event
Sources
2005 to 2006
The childcare act and the benefits framework act (Awir) take effect. Allowances are paid in advance and checked later. The Awir has no general hardship clause.
8, 11
2009
The State Attorney calls the strict all-or-nothing reading only "arguable". The benefits office adopts it anyway, and the Council of State upholds it.
7
Apr 2013
After a television report on organised fraud using people registered from Bulgaria, a self-learning risk model built by Deloitte is put into use within days, with no privacy impact assessment. An anti-fraud team (CAF) is set up the same year.
8, 12
Jul 2013 to Feb 2014
Monthly queries of all applicants by nationality begin. A January 2014 query pulls all 6,047 applicants with Ghanaian nationality. The fraud signals list (FSV) is in use from November 2013.
1, 6
Jul to Oct 2014
In the case known as CAF 11, allowances are stopped for some 300 parents using one childminding agency.
9
2016
Deloitte warns that the model is not retrained regularly. The nationality indicator is documented in scorecards from March 2016.
1, 8
2017
The Council of State rules the CAF 11 stoppage unlawful (8 March). The National Ombudsman calls the treatment of 232 families "disproportionately harsh" (9 August).
15, 16
Oct 2018
The nationality indicator is removed from the model as having "no predictive value".
1
Oct to Nov 2019
The Council of State abandons its all-or-nothing case law (23 October). The Donner commission finds "institutional bias" (14 November). Use of the model ends in November.
9, 12, 14
Case study · Dutch childcare benefits
Full timeline · 2 of 4
Findings, a cabinet resignation and two fines, 2020 to 2022.
When
Event
Sources
Feb to Mar 2020
A recovery organisation is set up and the FSV list is switched off. The Donner commission gives its final advice.
6, 10, 27
Jul 2020
The data protection authority finds the processing of nationality unlawful and discriminatory (17 July). The State Secretary apologises the same day.
1, 2, 29
17 Dec 2020
The parliamentary interrogation committee reports, Ongekend onrecht: "fundamental principles of the rule of law were violated."
7
22 Dec 2020
The cabinet agrees to pay EUR 30,000 to each affected parent. The first 470 families are paid on 28 January 2021.
22, 23
15 Jan 2021
The Rutte III cabinet resigns.
20
Mar 2021
The government decides not to order the prosecution of ministers.
18
Oct 2021
The Venice Commission finds discriminatory practices were "systematised through algorithms". Amnesty International publishes Xenophobic machines.
11, 17
Dec 2021
The data protection authority fines the Minister of Finance EUR 2.75 million. The model is published with a letter explaining it.
3, 4, 12
Apr to May 2022
A EUR 3.7 million fine for the FSV list (12 April). The cabinet acknowledges "institutional racism" in the tax office’s intensive supervision (30 May).
6, 21
Case study · Dutch childcare benefits
Full timeline · 3 of 4
Recovery act, inquiry, AI Act and the children, 2022 to 2025.
When
Event
Sources
Nov 2022
Statistics Netherlands counts 2,090 children of affected parents placed out of home from 2015 to June 2022. The recovery act takes effect.
24, 25, 30
Dec 2022
The national algorithm register opens.
31
Feb 2024
The parliamentary inquiry into fraud policy reports, Blind voor mens en recht, with 19 recommendations. The Hague Court of Appeal rejects a complaint against individual officials as time-barred.
8, 19
Aug 2024
The EU AI Act enters into force. Public-benefits eligibility systems are listed as high-risk in Annex III.
32
Mar 2025
The Hamer commission finds the scandal played a large role in the removal of the children it examined.
26
Jun 2025
The cabinet acknowledges the extra harm done to children placed out of home and says it will apologise to them.
34
Case study · Dutch childcare benefits
Full timeline · 4 of 4
Unsearched files, disputed payouts and a reform on hold, 2026.
When
Event
Sources
Apr 2026
The government tells parliament that a closed tax-office file store, set up in 2019 and holding at least 64 million unsorted files, was not searched for the parliamentary inquiries.
36
Jun to Jul 2026
A press claim that about 20,000 parents were wrongly compensated is rejected by the State Secretary as incorrect or incomplete.
28, 40
Jul 2026
An amending regulation moves the AI Act’s Annex III high-risk obligations to 2 December 2027.
33
Jul to Aug 2026
An external report on the file store is published; it draws no conclusions about anyone’s conduct. The cabinet says parliament should have been told earlier, and an investigation committee is due to start in October.
37, 38
Sep 2026
The 23rd progress report: 44,045 parents confirmed as affected and a recovery budget of EUR 11.8 billion.
13
Sep 2026
The cabinet puts a wider proportionality test in administrative law on hold pending new cost checks (11 September), and says it will apologise in January 2027 to children placed out of home (25 September).
39, 35
Case study · Dutch childcare benefits
05
The reckoning.
2020 to 2024. A regulator, parliament, the cabinet and the courts each reached a view.
Case study · Dutch childcare benefits
Data protection authority, July 2020
The regulator found the use of nationality unlawful and discriminatory in three places.
1
In the risk model
The Dutch yes/no indicator, documented from March 2016 to October 2018.
2
In the fraud team's queries
Manual queries that pulled applicants by nationality.
3
In the files
Keeping dual nationality on file without a legal basis.
Its chair was careful about what the report could show: "what concrete consequences this had for individual applicants, we cannot see in this investigation". The State Secretary apologised the same day.
Sources: data protection authority report and release [1, 2]; NOS, 17 July 2020 [29].
Case study · Dutch childcare benefits
Fines and an international view
Two fines followed, and the Venice Commission named the algorithms.
EUR 2.75m
December 2021
Fine on the Minister of Finance. Basis: GDPR Art. 5(1)(a), lawful and fair processing, with 6(1)(e). Discrimination was treated as a breach of fairness.
EUR 3.7m
April 2022
Fine for the fraud signals list, at the time the authority's highest.
Oct 2021
Venice Commission
Described the model as "based on Artificial Intelligence" and found "discriminatory practices were systematised through algorithms".
Sources: fine decision and release [3, 4]; FSV fine [6]; Venice Commission opinion CDL-AD(2021)031 [11].
Case study · Dutch childcare benefits
15 January 2021 · The Rutte III cabinet resigns
“The rule of law must protect citizens against an all-powerful state, and here that went terribly wrong.”
Prime Minister Mark Rutte, announcing the cabinet's resignation four weeks after Ongekend onrecht.
Source: press conference transcript, 15 January 2021 [20].
Case study · Dutch childcare benefits
Accountability
Six bodies reached a view, and no one has been prosecuted.
Regulator, 2020 to 2022Unlawful and discriminatory; fines of EUR 2.75m and EUR 3.7m.
Parliament, December 2020The rule of law was violated by the executive, legislature and courts.
Cabinet, January 2021Rutte III resigned.
Criminal law, 2021 to 2024No order to prosecute ministers; a complaint against officials time-barred.
Cabinet, May 2022Acknowledged institutional racism in intensive supervision.
Inquiry, February 2024The state was "blind to people and to rights"; 19 recommendations.
The recovery figures count parents and money. The hardest question is about children.
Case study · Dutch childcare benefits
The human cost
2,090 children of affected parents were placed out of home.
2,090
children placed out of home, 2015 to June 2022 (Statistics Netherlands). A count, not a measure of cause.
What the count saysThe statisticians could not say how many of those placements the scandal caused.
2022 group-level studyFound no direct effect, while warning this did not rule out individual cases.
Hamer commission, March 2025Found that, for the children it examined, the scandal played a large role.
Sources: Minister for Legal Protection, 1 November 2022 [24]; Youth Institute [25]; NOS on Erfenis van onrecht [26].
Case study · Dutch childcare benefits
The recovery operation at 30 June 2026
69,679 parents registered and 44,045 were confirmed as affected.
69,679
parents registered with the recovery operation
44,045
confirmed as affected
43,363
received at least EUR 30,000
EUR 40,664
average award
123,951
children known to the children's scheme
7,650
objections still open
Source: 23rd progress report, 18 September 2026 [13].
Case study · Dutch childcare benefits
From registration to payment
Six in ten registered parents have been confirmed as affected.
RegisteredParents who came forward
69,679
Confirmed as affectedAfter assessment
44,045
Paid at least EUR 30,000The flat payment
43,363
Objections openStill in dispute
7,650
Bars are scaled to the 69,679 registrations. Counts of affected parents have changed over time, from an early estimate of about 26,000 to 44,045 confirmed in June 2026.
Source: 23rd progress report [13].
Case study · Dutch childcare benefits
Cost and time
A recovery meant to last through 2021 now has a EUR 11.8 billion budget.
December 2020Cabinet agrees EUR 30,000 per affected parent. The first 470 families are paid on 28 January 2021.
April 2020 expectationThe operation would run "at least through 2021".
September 2026Budget EUR 11.8 billion over several years. EUR 5.5 billion spent from 2020 to 2024. 3,973 of 20,314 parents who applied for additional damage had been paid by June 2026. The 2025 aim was to settle all such claims by the end of 2027.
Disputed, June 2026NRC's claim that at least 20,000 parents were wrongly compensated was rejected by the State Secretary as incorrect or incomplete. Money paid is not reclaimed.
Sources: [13], [22], [23], [27], [28], [40].
07
Lessons and controls.
Governing an AI system means governing what is done with its output.
Case study · Dutch childcare benefits
Why it matters for AI
The model had four features common in AI deployments today.
Ranks people by risk
Limited staff focus on the highest scores, as in fraud, credit, claims and hiring triage.
Learns from past decisions
Trained on earlier correct and incorrect claims, so past enforcement shapes future selection.
Weighs many signals at once
Several dozen indicators that no one could separate or test one by one.
Gives a score without a reason
Reviewers saw that a case was picked, not why it was picked.
Sources: [1], [8], [12]. Framing is my reading of the findings.
Case study · Dutch childcare benefits
The limit of blaming the model My call
The same score produces checks or debts, depending on the process around it.
Proportionate process
Extra checks on high scores
Some wrong suspicions, corrected
Partial entitlement where partly wrong
A payment plan for any debt
Same model
A ranking only becomes harm when the organisation acts on it.
This process
A query becomes the loss of a year's income
Groups treated alike
An intent label blocks a payment plan
No hardship route
Reading of Ongekend onrecht [7] and Blind voor mens en recht [8].
Case study · Dutch childcare benefits
The law since
A system like this would likely be high-risk under the EU AI Act.
Annex III, point 5(a)AI used by public authorities to evaluate eligibility for public benefits, or to reduce, revoke or reclaim them, is high-risk.
What it bringsA fundamental rights impact assessment before use, human oversight, registration and a right to an explanation of the system's role.
WhenIn force August 2024. After the 2026 amendment, Annex III obligations apply from 2 December 2027.
Algorithm registerThe Netherlands opened a public algorithm register in December 2022. It listed 1,587 entries on 11 October 2026.
What the law does not reachThe all-or-nothing rule sat in law and practice. The AI Act would not have touched it.
Status of this reading My callNo court or regulator has ruled on whether this model would be high-risk.
Sources: Regulation (EU) 2024/1689 [32]; White & Case on Regulation (EU) 2026/1744 [33]; Algoritmeregister [31].
Case study · Dutch childcare benefits
Blind voor mens en recht, February 2024
The 2024 inquiry set out six safeguards for risk models.
Use them sparingly
Risk models should be used sparingly.
Selecting is giving reasons
A person selected for checks must be told why.
Never fully risk-driven
Keep checks that do not depend on a risk score, such as random samples.
Safeguards scale with intrusion
The greater the potential intrusion, the greater the safeguard.
Knowledge at every level
Build knowledge of the risks of data "from top civil servant to programmer".
Test and correct
Test risk indicators for validity and reliability, and correct for bias.
Also recommended: a general proportionality clause in administrative law and a right to personal contact. The Venice Commission added that anonymised training data should be kept so bias can be found later.
Sources: [8], [11]. The inquiry's recommendations are bullets, not numbered.
Case study · Dutch childcare benefits
For boards and agencies · 1 to 4 My call
Four controls on how a score is used.
01
Govern the decision the score feeds
Before deploying any risk score, write down what action each score band triggers and whether that action is proportionate to an error.
02
Give reviewers the reason for every selection
A reviewer who sees only a score will usually defer to it.
03
Test indicators before and during use
Review every input for what it stands in for, and drop any that act as a proxy for a protected group.
04
Keep a random sample beside the risk sample
A model that only checks the cases it selects confirms its own assumptions. Random checks give the error rate it cannot see.
Case study · Dutch childcare benefits
For boards and agencies · 5 to 8 My call
Four controls on oversight and redress.
05
Monitor outcomes by group
The over-selection was measurable. Someone should look at the distribution every month and report it upward.
06
Assess impact before go-live
An impact assessment should be a condition of launch, whatever the political pressure.
07
Build in a hardship route
Any process that can take money or services from people needs a named person who can override it.
08
Treat rulings and complaints as a pattern
Report them in aggregate to the board or the minister, with what they imply about error rates.
Case study · Dutch childcare benefits
Controls checklist My call
Eight controls to ask for before a risk score goes live.
Control
Evidence to ask for
What failed here
Action map
Written action per score band, with a proportionality test
A query could end in full-year recovery
Reason codes
Top factors shown to the reviewer for each selection
"The case handler does not know why"
Indicator review
Validity, reliability and proxy tests, signed off
Nationality in the scorecards for two and a half years
Random control sample
Share of checks chosen at random, and its error rate
Model fed on its own selections
Group outcome report
Monthly selection rates by group, sent upward
Skew measurable, not acted on
Impact assessment
Rights or algorithmic impact assessment before launch
Live within days, no assessment
Hardship override
Named owner with authority to stop a recovery
No legal room to soften a recovery
Complaint pattern report
Rulings and complaints in aggregate to the board
Each warning treated as an exception
Case study · Dutch childcare benefits
For discussion
Six questions to take back to your organisation.
InventoryWhere do we rank customers, citizens or staff by risk today, and who acts on the ranking?
ActionFor each score band, what happens to the person, and could we defend it if the score were wrong?
ReasonsCan the reviewer see why a case was picked, and can the person affected?
ProxiesWhich of our inputs could stand in for nationality, income or another protected trait?
OverrideWho has the authority to stop a harmful outcome, and have they ever used it?
SignalsHow do complaints, appeals and adverse rulings reach this board, and how often?
Case study · Dutch childcare benefits
Evidence & methodology
Each claim in this deck is graded by what it rests on.
Claim
Source
Grade
Fundamental principles of the rule of law were violated
Ongekend onrecht, 17 December 2020
Finding of a parliamentary committee
The risk model ranked cases for review and made no entitlement decisions
State Secretary’s letter of 8 December 2021; data protection authority report, 2020
Official statement, consistent with regulator
Nationality (Dutch yes/no) was a model indicator; dual nationality was not
Data protection authority report, 2020, sections 2.3.2 and 2.3.3
Finding of a regulator
The processing of nationality was unlawful and discriminatory
Data protection authority fine decision, 25 November 2021 (GDPR Art. 5(1)(a) with 6(1)(e))
Finding of a regulator
Top-scored applicants were far more often non-Dutch and low-income
Blind voor mens en recht, table 7.6, one 2019 month
Measured, single month
44,045 parents confirmed as affected; EUR 11.8 billion recovery budget
23rd progress report, figures at 30 June 2026
Measured, government figures
2,090 children placed out of home, 2015 to June 2022
Statistics Netherlands, via the Youth Institute. Causation is disputed.
Measured count; cause not established
The scandal played a large role in removals
Hamer commission, 2025, via NOS
Finding of an advisory commission, read via press
At least 64 million files in a closed store were not searched for the parliamentary inquiries
Cabinet letter, 15 April 2026; BDO report, July 2026, which draws no conclusions about conduct
Official statement
About 20,000 parents were wrongly compensated
NRC, 15 June 2026, via Hart van Nederland; rejected by the State Secretary, 10 July 2026
Disputed press claim
A wider proportionality test is on hold pending cost checks
Interior Minister’s letter, 11 September 2026
Official statement
A system like this would likely be high-risk under the AI Act
AI Act Annex III point 5(a); no court or regulator has ruled
My call
The all-or-nothing illustration
Mechanism as described by the parliamentary committee; figures invented to show it
Illustrative
The lessons for boards and agencies
My reading of the findings and recommendations cited against each
Full case study with 33 sources: terencekok.com/research/case-studies/dutch-childcare-benefits/
Connect on LinkedIn
Sources · 1 to 14
1Autoriteit Persoonsgegevens. (2020, 17 July). Belastingdienst/Toeslagen: De verwerking van de nationaliteit van aanvragers van kinderopvangtoeslag (investigation report z2018-22445).
2Autoriteit Persoonsgegevens. (2020, 17 July). Methods used by Dutch Tax Administration unlawful and discriminatory [News release].
3Autoriteit Persoonsgegevens. (2021, 25 November). Besluit tot boeteoplegging, Minister van Financiën (EUR 2,750,000).
4Autoriteit Persoonsgegevens. (2021, 7 December). Tax Administration fined for discriminatory and unlawful data processing [News release].
5Autoriteit Persoonsgegevens. (2021, 28 October). Zwarte lijst FSV van Belastingdienst in strijd met de wet [News release].
6Autoriteit Persoonsgegevens. (2022, 12 April). Boete Belastingdienst voor zwarte lijst FSV [News release; decision of 7 April 2022].
11European Commission for Democracy through Law (Venice Commission). (2021, 18 October). Netherlands: Opinion on the legal protection of citizens, CDL-AD(2021)031.
12Staatssecretaris van Financiën. (2021, 8 December). Letter to the House on the risk-classification model (Kamerstuk 31 066, nr. 938).
13Staatssecretaris van Financiën. (2026, 18 September). Voortgangsrapportage hersteloperatie toeslagen, januari tot juni 2026 (23e VGR).
14Afdeling bestuursrechtspraak van de Raad van State. (2019, 23 October). ECLI:NL:RVS:2019:3535 and ECLI:NL:RVS:2019:3536.
Case study · Dutch childcare benefits
Sources · 15 to 27
15Afdeling bestuursrechtspraak van de Raad van State. (2017, 8 March). ECLI:NL:RVS:2017:589.
16Nationale ombudsman. (2017, 9 August). Geen powerplay maar fair play: Onevenredig harde aanpak van 232 gezinnen met kinderopvangtoeslag (Report 2017/095).
17Amnesty International. (2021, 25 October). Xenophobic machines: Discrimination through unregulated use of algorithms in the Dutch childcare benefits scandal (EUR 35/4686/2021).
18Minister van Justitie en Veiligheid. (2021, 5 March). Letter on the complaints against ministers (Kamerstuk 31 066, nr. 799).
19Gerechtshof Den Haag. (2024, 20 February). ECLI:NL:GHDHA:2024:329.
20Rijksoverheid. (2021, 15 January). Letterlijke tekst persconferentie na ministerraad 15 januari 2021.
21Rijksoverheid. (2022, 30 May). Aandacht voor institutioneel racisme binnen toezicht Belastingdienst en Toeslagen [News release].
31Algoritmeregister van de Nederlandse overheid (1,587 entries on 11 October 2026).
32Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024.
33White & Case. (2026, July). EU AI Omnibus enters into force, amending the AI Act [on Regulation (EU) 2026/1744].
34Rijksoverheid. (2025, 30 June). Kabinet erkent extra leed uithuisgeplaatste kinderen [News release; cabinet response to Erfenis van onrecht].
35Reformatorisch Dagblad (ANP). (2026, 25 September). Excuses aan uithuisgeplaatste kinderen toeslagen in januari [on a letter to parliament from the State Secretaries for Justice and for Benefits and the Minister for Youth].
36Staatssecretarissen van Financiën. (2026, 15 April). Kamerbrief met update over datakluis.
37BDO, for the Ministerie van Financiën. (2026, 6 July; published 10 July). Datakluis: report on the set-up, use and governance of the file store.
38NOS. (2026, 18 August). Kabinet: spijtig dat Kamer te laat hoorde van "verborgen" toeslagenbestanden.
39Minister van Binnenlandse Zaken en Koninkrijksrelaties. (2026, 11 September). Stand van zaken wetsvoorstel Wet versterking waarborgfunctie Awb (Kamerstuk 36 800 VII, nr. 102).
40Hart van Nederland. (2026, 15 June). Duizenden toeslagenouders kregen onterecht compensatie, hoeven niets terug te betalen [on the NRC report of the same day].
