On July 1, 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) began its first enforcement sweep of a deceptively simple requirement: that municipalities register their automated parking scan car systems in the national Algorithm Register at algoritmes.overheid.nl. The trigger was a thematic study the AP published in April 2026, titled Inzet van scanauto's voor parkeerhandhaving, which found that fewer than half of the municipalities it examined had complied — even as those same unregistered systems were collectively issuing an estimated 500,000 unjustified parking fines every year.
This is not a story about banning a technology. It is a story about what happens when public authorities deploy automated decision-making without basic transparency infrastructure in place.
How Scan Cars Work — and Where They Fail
Scan cars are camera-equipped vehicles that patrol streets, photographing licence plates and cross-referencing them against municipal permit databases to identify parking violations. They are faster, cheaper, and more consistent than human parking wardens — genuine advantages that explain why the technology has spread to dozens of Dutch municipalities. The cars collectively perform between 250 and 375 million scans annually, generating 3 to 5 million fines per year.
The problem is that photographic snapshots cannot capture context. A scan car cannot verify that a driver is in the middle of loading or unloading — a legally exempt activity. It cannot reliably detect disability parking permits displayed as paper cards inside windshields, which are not electronically linked to licence plates in many municipal databases. And it cannot account for licence plate misreads: in one documented case in the Rotterdam area, a resident received unjustified fines for two consecutive years because a screw on a different vehicle's plate caused the system to persistently misidentify it.
The result is an appeal overturn rate of 40 to 62 percent, confirmed by the AP's thematic study and reported by NOS. In Amsterdam, municipal data shows roughly 75,000 contested fines per year, of which approximately 45,000 are approved — a 60 percent success rate for appellants. The Amsterdam municipal ombudsman noted that a well-functioning system should not require such extensive corrective procedures. That is a precise and fair diagnosis.
The Strongest Case for Automated Enforcement
Before condemning the municipalities, their operational logic deserves a fair hearing. Parking enforcement is a genuine public good: it reduces congestion, ensures turnover in commercial areas, and funds public infrastructure. Scan cars allow small municipalities to enforce parking rules on dozens of streets simultaneously without proportional staffing costs. Human wardens are not infallible — they miss violations, apply rules inconsistently, and are vulnerable to appeals based on subjective judgment. For municipalities facing budget pressure and rising traffic density, automated enforcement was a rational operational choice.
The error rate, while alarming, also reflects something important about the appellate channel: most motorists do not appeal even valid fines. The 40–62 percent overturn rate applies to those who formally contest — a self-selected group more likely to have a genuine case. The AP's own estimate puts the baseline error rate across all fines at roughly 10 percent, meaning 90 percent of fines are accurately issued. That is not a vindication, but it is context.
What the Algorithm Register Actually Requires
The Dutch national Algorithm Register, launched in December 2022 at algoritmes.overheid.nl, is a transparency mechanism — not a licensing regime. Registering a system does not require municipalities to stop using it; it requires them to document what the system does, what legal basis governs it, whether a Data Protection Impact Assessment (DPIA) has been completed, and who is responsible. The AP's thematic study found that municipalities were relying on their parking service providers' DPIAs rather than conducting their own — a material gap, since the municipality is the data controller and bears independent accountability obligations under the AVG, the Dutch implementation of GDPR.
The AP's three requirements for compliance are proportionate: register the system in the national register, complete a municipal-level DPIA independently of any supplier assessment, and reassess if the technology is repurposed beyond parking enforcement. None of these steps require significant investment. They require institutional attention.
What Compliance Looks Like
Two municipalities demonstrate the requirement is achievable. Amsterdam registered its parking control system in September 2025, documenting its Impactful Algorithms classification, a completed DPIA and Privacy Quickscan, and a human review step that must occur before any enforcement action. Haarlem registered its scan car system in July 2024, identifying its provider (Sigmax/ACI SCANACAR), the specific legal basis under Articles 156 and 225 of the Gemeentewet, and the completion of an Ethical Guide assessment.
These entries are not bureaucratic box-ticking. They are the minimum information a citizen needs to understand how automated decisions about their vehicle are being made — and to mount an informed appeal when they believe a fine is wrong.
An Accountability Gap With Real Victims
The broader picture is troubling. According to Binnenlands Bestuur, over half of all Dutch municipalities have registered zero algorithms — not just scan cars. Over 75 percent of independent administrative bodies have no registrations at all. Only 5 percent of existing entries include fundamental rights assessments.
This is not a technical failure; it is a governance failure. Automated systems are making consequential decisions about citizens — issuing fines, allocating permits, flagging fraud — without the basic transparency that would allow effective oversight or meaningful redress. The AP's enforcement action on scan cars is a sensible, proportionate place to start, but it is a floor, not a ceiling. The Netherlands has enacted strong data protection law, built a functioning algorithm register, and developed a thematic enforcement model. What has been missing is consistent follow-through.
The July 1 enforcement date is a start. The next question is whether municipalities treat it as a compliance deadline — or as a genuine reckoning with how automated enforcement affects the people it touches.