Automated decision-making and AI: what the Dutch DPA now expects

On 29 October 2026 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) published a report on how debt collectors use algorithms and AI. Its main worry is automated decision-making that the GDPR forbids, happening without the companies knowing it. The report is about one sector, but the same mistakes show up wherever software scores customers, applicants or leads.

What the AP found at debt collectors

The AP sent a questionnaire to 29 registered debt collection agencies and got usable answers from 22. Ten of them use at least one algorithmic system, and three of those also use AI. According to the report, the systems:

• choose the channel and frequency of contact (letter, email, phone, text);
• answer questions and agree payment plans through chatbots, voice bots and language models that read email;
• estimate the chance that a debt will be paid, from credit score, location and payment history;
• enrich debtor files with data from registers and the internet, including social media;
• try to detect vulnerable debtors.

When is an automated decision forbidden?

Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, when it has legal effects or similarly significant effects on them. There are three exceptions: the decision is necessary for a contract, it is allowed by law with safeguards, or the person gave explicit consent. In the first and last case you must still offer a way to get a human to look at the decision, to give their view and to contest it.

Three points from the report catch many companies out:

1. A positive outcome is still a decision. One agency automated only approvals of payment plans and left every rejection to a person. The AP says the intended outcome makes no difference to the prohibition.
2. A score can be the decision. In the SCHUFA case of December 2023, the EU Court of Justice held that a credit score is itself an automated decision when the party that uses it draws strongly on it. The AP applies this: intermediate steps, such as calculating a risk score, can count as a decision.
3. Simple rules are not automatically low risk. Several agencies rated their risk as low because they use rule-based algorithms or few personal data. The AP disagrees: even a simple algorithm can have large effects on people.

A human in the loop has to mean something

Several agencies said Article 22 doesn’t apply because an employee is involved in the decision. The AP doubts that this is always true. If the employee trusts the system too much, or the system steers the choice, the human step is a formality. The AP asks for enough time per case, clear instructions, and a system that doesn’t push the reviewer towards an answer. Its guidance on meaningful human intervention (July 2025) helps you test your own process.

Two more findings apply far outside debt collection. Some agencies thought the debt itself, or the output of their system, was not personal data. It is, when it says something about a person. And suppliers sometimes add an AI feature to existing software, or approach agencies to sell one, so personal data can end up in a system nobody chose. The AP wants clear written agreements with vendors.

The AI Act adds to this, later

The report also points to the EU AI Act. AI systems that assess the creditworthiness of natural persons, or their willingness to meet payment obligations, are high-risk. Agencies that develop such systems themselves must meet the high-risk requirements from 2 December 2027. The GDPR rules apply now.

What to do now

If your company uses software to score, rank or decide about people, whether that is customers, applicants, tenants or self-employed leads:

1. List every step where a system produces a score, a label or a choice about a person. Include features in purchased software.
2. For each step, ask: does a person really decide, with time, information and the authority to go against the system? Or do they confirm what the screen says?
3. If a step is solely automated and has significant effects, find out which Article 22 exception applies, and how people can ask for a human review.
4. Treat scores and model outputs as personal data in your records and privacy notice.
5. Tell people at first contact how the system works, in plain language, not only in a privacy statement on your website.
6. Check vendor contracts for AI features.

This is not legal advice. Ask your privacy officer or lawyer how the rules apply to your process. Debt collection companies can register until 11 November 2026 for the AP’s round table on 2 December.

How we approach this

For a car-lease company we built a first assessment of lease applications. The system reads the dossier, checks the registers and prepares a first assessment for the reviewer. The policy rules sit outside the language model, so an auditor can read them, and the model never sees who the applicant is. We explained that last part in using LLMs on personal data without sending personal data. More on this in privacy-safe AI.