Sanction RGPD Dutch Supervisory Authority for Data Protection (AP) — Municipality of Veenendaal : 25 k€ (2026)
- Autorité de contrôle
- Dutch Supervisory Authority for Data Protection (AP)
- Pays
- Pays-Bas
- Entreprise / secteur
- Municipality of Veenendaal
- Montant de l'amende
- 25 k€
- Date de la décision
- 3 février 2026
- Fondement juridique
- Art. 6 (1), Art. 9
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.