A Lawyer Switches Sides
Geert Potjewijd took office August 1, 2026 as chairman of the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, succeeding Aleid Wolfsen after his ten-year tenure. The Dutch cabinet approved the appointment on the proposal of State Secretary for Justice and Security Van Bruggen, for a five-year term. Potjewijd spent 27 years at De Brauw Blackstone Westbroek, where he co-headed the firm's Data Protection and Cybersecurity practice and, among other clients, represented ByteDance, TikTok's parent company, in a privacy dispute — a career Netkwesties summarized as "vaak verdediger van big tech" (often a defender of Big Tech). AP vice-chair Monique Verdier framed the hire as a strength: he "brings the outside world in" and understands the industry's operating logic from the inside. Digital-rights academic Geert Lovink called it a "rechtse benoeming" — a rightward-tilting appointment reflecting the current government's posture.
He did not get a honeymoon. On August 3, Bits of Freedom and Amnesty International published a public letter pressing him on two specific failures they say his predecessor left unaddressed: police use of facial recognition technology they argue lacks a proper legal basis, and government algorithms that keep producing discriminatory profiling outcomes despite repeated evidence of the problem.
The Complaint Already on His Desk
This isn't a new grievance. Bits of Freedom formally asked the AP back on March 27, 2024 to investigate the police's internal oversight of CATCH, its facial-recognition matching system, arguing there was "never a democratic debate" preceding its use and thus no specific statutory basis for it. Rather than seek that basis through Parliament, police created their own internal framework — the "Inzetkamer gezichtsherkenning" — to self-authorize deployments. The Netherlands' Police Data Act (Wet politiegegevens) governs how police may process personal data generally, but was not written with real-time biometric matching in mind, which is precisely the gap Bits of Freedom is pointing at. Amnesty International has run a parallel campaign against using facial recognition to identify protesters, monitoring demonstrations through 2022–2024 and warning of arbitrary application; police respond that they apply the technology retrospectively only, against footage of individuals already convicted or suspected of crimes carrying at least a four-year sentence — not live, during protests.
That request has now sat with the AP for close to two and a half years without a public resolution, spanning almost the entirety of Wolfsen's final term.
Steelmanning the Complaint
Civil society's underlying point deserves to be taken seriously rather than waved off as reflexive activism. The Netherlands has direct, painful precedent for algorithmic government overreach: in 2020 a Hague court struck down SyRI, the government's fraud-detection risk-profiling system, as a human-rights violation, and the cabinet later apologized for related discriminatory practices in benefits-fraud algorithms. A regulator that lists "facial recognition in public spaces" and "algorithms in public decision-making" as strategic priorities in its own 2024–2027 plan, yet leaves a specific, well-documented complaint against its own government's police force unresolved for years, invites exactly the asymmetry critique Bits of Freedom is making. And the optics of a former corporate-defense lawyer taking the chair while that complaint is still pending are a legitimate thing to flag, even if unfair to Potjewijd personally before he's acted.
Where the Skepticism Overreaches
But the AP's actual enforcement record cuts against the "he'll go soft" narrative civil society groups are implicitly worried about. In August 2024, under Wolfsen, the AP fined Uber €290 million — the largest penalty it has ever imposed — for transferring European drivers' location, payment, and in some cases criminal-record data to the US without adequate safeguards. That is not the track record of a regulator captured by industry interests, and it undercuts the assumption that hiring a lawyer who once worked for tech companies automatically means weaker enforcement against them. Understanding how a regulated industry actually operates is an asset for a regulator, not a disqualification — the same logic that justifies hiring engineers to help write AI rules.
The more useful diagnosis is structural, not personal: an independent regulator is institutionally readier to swing hard at a private multinational than at a fellow arm of its own government, where enforcement runs into ministries, budgets, and coalition politics rather than a single company's balance sheet. That's a real design problem worth fixing — through clearer legislative authorization for tools like facial recognition, and through the AP actually opening the formal investigation its own multi-year plan promises — not a reason to prejudge Potjewijd's chairmanship before he's issued a single ruling. Facial recognition used narrowly, with statutory limits and judicial oversight, has demonstrated real value in solving serious crime; the proportionate fix is Parliament giving it an explicit legal basis, not treating every deployment as inherently illegitimate. The test of this appointment won't be Potjewijd's CV — it will be whether the March 2024 complaint finally gets a ruling.