What the AP found
Starting July 1, 2026, the Autoriteit Persoonsgegevens — the Dutch data protection authority — began checking whether municipalities have logged their use of parking "scan cars" in the national algorithm register, the public catalogue at algoritmes.overheid.nl where government bodies are supposed to describe automated systems they use to make decisions about citizens. The AP's own announcement is blunt about why: a thematic study found that "fewer than half of the municipalities surveyed" had registered the systems at all, despite years of the register existing and scan cars being in routine use across the country.
That compliance gap sits next to a more serious finding from the same review. Scan cars — vehicles fitted with cameras that run automated license-plate recognition against the national parking registry as they drive down a street — carry out an estimated 250 to 375 million scans a year, generating 3 to 5 million parking fines. The AP calculates that more than 10 percent of those fines are wrongful, roughly 500,000 a year, a figure corroborated by an appeal-success rate of 40 to 62 percent among people who bother to formally object. The AP also found that not every municipality it examined could produce its own Data Protection Impact Assessment (DPIA); several simply pointed to a DPIA done by their parking-enforcement vendor, which the regulator correctly says does not discharge the municipality's own GDPR Article 35 obligation, since the municipality remains the data controller.
The case for the audit
The steelman here is straightforward, and the AP is right to make it. A scan car is not a neutral sensor: it's an algorithmic decision system that assigns fault to a specific license plate, often without human review at the point of detection, and the record shows it gets that assignment wrong at a rate — one in ten — that would be treated as a serious quality failure in almost any other regulated context. The people most likely to be caught by the errors the AP flagged, such as vehicles engaged in loading/unloading or displaying disability permits that the camera doesn't reliably parse, are disproportionately people with the least capacity to contest a fine within a short payment window. Registering the system publicly is a low-cost way to let residents, journalists, and courts know that an algorithm — not just an inspector — is doing the fault-finding, and it is a reasonable precondition to the harder work of actually fixing the error rate.
Where the audit misses the target
But it's worth being precise about what this specific enforcement action actually accomplishes, which is less than the headline suggests. The algorithm register is not, today, a statutory obligation. It was launched at the end of 2022 as a cabinet commitment, and — as the AP itself has separately noted while calling for a legal footing — participation across Dutch government remains patchy, with the total number of registered algorithms nationally still only in the low thousands and barely 5 percent of entries including any fundamental-rights assessment. A binding version, the Kaderwet Toetsing Algoritmen, is still in internet consultation, not in force. That means the July check is, functionally, a compliance nudge with no fine or corrective order attached if a municipality simply keeps not registering — the AP is checking a form, not the false-positive rate.
That matters because the two problems the AP surfaced are not the same problem. A municipality can register its scan car in full, publish the exact license-plate-recognition vendor and legal basis (as Groningen has, citing articles 149 and 225 of the Gemeentewet and article 2a of the Wegenverkeerswet 1994), and still run a system that wrongly fines one driver in ten. Transparency about which algorithm is running is not the same as evidence that the algorithm works. If the AP wants the accuracy problem solved, the more proportionate lever is the one GDPR already gives it: use Article 35/36 DPIA enforcement — where a vendor-supplied DPIA is legally insufficient and the AP can compel a municipality's own risk assessment — to force disclosure of actual false-positive rates and require periodic accuracy audits as a condition of continued deployment, rather than treating a missing register entry as the headline violation.
The proportionate path
None of this argues against enforcement. It argues for sequencing it correctly, and for recognizing that many of the municipalities lagging on registration are small ones without in-house legal or technical staff to interpret a voluntary instrument competing for attention with hundreds of other compliance obligations. A statutory Kaderwet, paired with model DPIA templates and a mandatory published error-rate disclosure for any impactful algorithm — not just a registry checkbox — would close both gaps the AP itself identified, instead of fixing the one that's easiest to audit.