#
Biometric and profiling rules are well established under GDPR/UAVG; AI Act competent-authority designation and NL-specific AI risk-assessment interplay is still maturing as of the 2 August 2026 application date.
Sub-modules (6)
Profiling RestrictionsGreen
Profiling restrictions follow GDPR Article 22 directly; the EDPB has issued an opinion confirming GDPR principles govern personal data use in AI model development and deployment.
Claims (1):
- The EDPB adopted an opinion on the use of personal data for the development and deployment of AI models, confirming that GDPR principles apply to and support responsible AI governance.
Automated Decision Making TransparencyGreen
ADM transparency follows GDPR Articles 13-15/22 directly; no NL-specific derogation identified.
Ai Risk AssessmentsAmber
The EU AI Act applies from 2 August 2026, with governance, sanctions, and GPAI-provider obligations already in force since August 2025 and AI-literacy obligations since February 2025; national competent authority designation interacts with the AP's data-protection remit.
Claims (1):
- The EU AI Act applies from 2 August 2026, with certain provisions (prohibitions, definitions, AI-literacy obligations) already effective since 2 February 2025 and governance-structure, sanctions, and GPAI-provider rules effective since 2 August 2025.
Biometric RegimeGreen
Biometric data processing for unique identification is prohibited absent strict necessity for authentication/security, per UAVG Article 29; the AP's DPIA list separately mandates DPIAs for large-scale biometric identification and flexible camera surveillance.
Claims (2):
- UAVG Article 29 permits processing of biometric data for unique identification purposes only where strictly necessary for authentication or security, subject to additional conditions in Dutch implementing law.
- The AP's DPIA list identifies large-scale and/or systematic use of flexible camera surveillance (e.g., body-worn cameras, dash cams) and large-scale processing enabling unique identification of individuals as mandatory-DPIA processing categories.
Genetic DataAmber
Genetic data is a GDPR Article 9 special category; no NL-specific overlay beyond UAVG's general special-category exceptions was surfaced.
Absence provenance: unavailable. Searched: UAVG genetic data specific exception Netherlands.
State Surveillance CarveoutsAmber
Law-enforcement and state-security processing is carved out of GDPR and governed instead by the Law Enforcement Directive (2016/680), implemented in Dutch law via police-data legislation and royal decrees.
Claims (1):
- Processing of personal data by competent authorities for the prevention, investigation, detection or prosecution of criminal offences is subject to the Law Enforcement Directive (2016/680) rather than the GDPR, and has been implemented in Dutch law and royal decrees governing investigation and prosecuting authorities.
Algorithmic, Biometric & Surveillance Governance
The Autoriteit Persoonsgegevens fined Uber EUR824,990,000 on 21 August 2026 for breaching Article 22 of the GDPR, which prohibits decisions based solely on automated processing that produce a significant effect on the data subject, absent a lawful basis and adequate safeguards. The breach arose from Uber's automated deactivation of driver accounts between 2018 and 2022 without what the AP found to be meaningful human review, compounded by inadequate information given to affected drivers about the basis for deactivation. This is the AP's fourth fine against Uber and the second-largest GDPR fine issued anywhere in the EU, behind only Meta's EUR1.2 billion penalty. Uber has announced it will appeal the decision.
Separately, and at an earlier stage of development, the Dutch government published a draft Uitvoeringswet AI-verordening (Uvai) for consultation on 20 April 2026, with the consultation period closing 1 June 2026. The draft designates the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur as joint coordinators of a decentralised, sector-based market-surveillance model for AI Act supervision in the Netherlands, with anticipated entry into force on 2 August 2027. The Netherlands had missed the EU's own August 2025 deadline for designating AI Act supervisory authorities, so this draft represents a belated structural response rather than an early-adopter position.
Outlook
Whether the Uber appeal proceeds, and on what grounds, will test the durability of the AP's Article 22 theory of automated decision-making without meaningful human review. Separately, whether the draft Uvai has progressed from the closed consultation toward formal introduction before the Tweede Kamer since 1 June 2026 has not been independently verified and remains open, as does the draft's anticipated 2 August 2027 entry-into-force date.
1 earlier distinct update(s)
Algorithmic, Biometric & Surveillance Governance
The AP is reported to have fined Uber EUR824,990,000 on 21 August 2026 for operating automated systems that deactivated driver accounts without human review, a decision reported to breach the GDPR's Article 22 prohibition on solely automated decision-making that produces significant effects on individuals. This fine is described as the second-largest GDPR fine on record, reflecting the scale of exposure the AP is prepared to impose for automated-decision-making violations affecting a large population of gig-economy workers.
The scale of this fine signals that the AP treats unlawful automated decision-making, specifically decisions taken without meaningful human review that carry significant consequences for affected individuals such as loss of livelihood through account deactivation, as among the most serious categories of GDPR violation it currently enforces. The AP has separately been reported to enforce EU AI Act prohibited-practices provisions since February 2025, indicating an emerging institutional focus on algorithmic-system oversight that extends beyond GDPR Article 22 into the newer AI-specific regulatory framework.
Outlook
Whether Uber challenges the AP's decision, and how any appeal addresses the automated-decision-making findings, is the clearest item to watch. More broadly, the AP's parallel enforcement role under both GDPR Article 22 and the AI Act's prohibited-practices provisions positions it as an increasingly significant algorithmic-governance enforcer, worth monitoring as its supervisory focus areas for 2026 become clearer.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (5)
- ConfirmedEDPB — The EDPB adopted an opinion on the use of personal data for the development and deployment of AI models, confirming that GDPR principles apply to and support responsible AI governance.observed
- ConfirmedEUR-Lex — The EU AI Act applies from 2 August 2026, with certain provisions (prohibitions, definitions, AI-literacy obligations) already effective since 2 February 2025 and governance-structure, sanctions, and GPAI-provider rules effective since 2 August 2025.observed
- ConfirmedAP/EDPB — UAVG Article 29 permits processing of biometric data for unique identification purposes only where strictly necessary for authentication or security, subject to additional conditions in Dutch implementing law.observed
- ConfirmedAP/EDPB — The AP's DPIA list identifies large-scale and/or systematic use of flexible camera surveillance (e.g., body-worn cameras, dash cams) and large-scale processing enabling unique identification of individuals as mandatory-DPIA processing categories.observed
- ConfirmedIAPP — Processing of personal data by competent authorities for the prevention, investigation, detection or prosecution of criminal offences is subject to the Law Enforcement Directive (2016/680) rather than the GDPR, and has been implemented in Dutch law and royal decrees governing investigation and prosecuting authorities.observed