Dutch DPA to monitor municipal registration of scan cars in algorithm registers from July 1
The Autoriteit Persoonsgegevens (AP) will check from 1 July 2026 whether municipalities have included scan car deployment in their algorithm register. Less than half of the surveyed municipalities had registered scan car deployment in their algorithm registers according to a recent thematic study by the AP. This initiative aims to enhance transparency regarding government algorithm use and personal data processing.
Municipalities must ensure their own data protection impact assessments (DPIAs) are completed for scan car operations. Relying on a parking service provider's DPIA is insufficient because the municipality remains the data controller and must comprehensively assess privacy risks. This assessment includes considering the types of personal data processed, the scale of processing, associated risks, and how residents are informed about scan car use. Data protection officers (DPOs) play a vital role in assessing DPIA completeness and the adequacy of risk balancing.
Furthermore, municipalities must prevent purpose creep. If scan car technology is used for new purposes beyond parking control, such as detecting illegally placed waste or defective street lighting, the municipality must reevaluate lawfulness and necessary safeguards for each new purpose. New applications introduce new privacy risks requiring fresh assessments. DPOs can assist municipalities in making these timely assessments and ensuring new applications comply with privacy rules.
The increasing use of automated systems by public bodies, particularly for surveillance and enforcement, consistently raises questions about transparency and accountability, as evidenced by the APs thematic study.
Original title: AP controleert vanaf 1 juli registratie scanauto’s in algoritmeregister | Autoriteit Persoonsgegevens
AP to check registration of scan cars in the algorithm register from 1 July
- Who this binds
- Dutch municipalities are bound by the General Data Protection Regulation (GDPR) regarding their processing of personal data, and this AP announcement clarifies expectations for compliance.
- What changed
- The Autoriteit Persoonsgegevens (AP) announced it will begin actively monitoring municipalities' registration of scan car use in their algorithm registers from 1 July 2026.
- What to check
- Organisations should check their algorithm registers for completeness and ensure all relevant algorithmic systems, including scan cars, are properly documented by 1 July 2026.
- What this does not mean
- This does not mean that municipalities are prohibited from using scan cars for parking enforcement, but rather that their use must be transparent and compliant with data protection principles.
Send this to your team
The Dutch Autoriteit Persoonsgegevens will monitor from 1 July 2026 whether municipalities have registered scan car deployment in their algorithm registers, following a study finding less than half had done so.