On 10 October 2026, we responded to the consultation on the Wbnv, the proposed new law for the Dutch intelligence and security services.
The bill expands surveillance and algorithmic powers while weakening oversight. Given the government’s track record with discriminatory algorithms, we warn this will increase ethnic profiling and discourage racialised groups and activists from using their fundamental rights. Read our full response below (translated from the Dutch with the help of AI):
Introduction
With this submission, we take the opportunity to respond to the consultation bill for the Wet bescherming nationale veiligheid door de inlichtingen- en veiligheidsdiensten [Act on the Protection of National Security by the Intelligence and Security Services] (Wbnv).
The Racism and Technology Center is seriously concerned about the proposed Wbnv. We regard this proposal as a direct infringement of (digital) human rights: the increased risk of ethnic profiling, privacy violations, a chilling effect, and the irresponsible use of algorithms.
With this submission, we express our full support for the consultation input submitted by Bits of Freedom on 17 September 2026. We fully endorse the substantive objections and the main conclusion set out therein: in its current form, this bill poses a serious threat to the democratic rule of law.
In addition, we set out a number of further points below.
1. The risk of discrimination
Concerns: The bill as a whole, in particular Section 5.7 and Chapter 8.
The bill facilitates a further scaling-up of automated data processing, data analysis and the use of algorithms and artificial intelligence. Analysing bulk data on a large scale carries inherent risks of (predictive) bias and discriminatory effects. However, the bill appears to take no account of this risk.
These risks must be viewed against the background of a series of recent government cases in which the use of automated systems and risk profiling has demonstrably led to discrimination against specific population groups:
- Education Executive Agency (DUO): the use of algorithms in checks for fraud involving the grant for students living away from home, in which students with a migration background were disproportionately often selected.
- Royal Netherlands Marechaussee: the structural use of ethnicity in border checks.
- Tax and Customs Administration (Belastingdienst): the automated selection processes in the context of the childcare benefits scandal (Toeslagenaffaire).
- Immigration and Naturalisation Service (IND): data analysis and automated profiles in the assessment of asylum applications.
- Employee Insurance Agency (UWV): discrimination and racism within the UWV enforcement department.
- Secret municipal investigations into mosques.
That the Dutch government has structural problems with discrimination and racism, in the form of institutional racism, was also explicitly acknowledged by the Prime Minister in December 2020. In May 2026, the State Commission against Discrimination and Racism (Staatscommissie tegen Discriminatie en Racisme) once again explicitly called on the government to stop using risk profiling systems.
The bill appears to take no account whatsoever of these structural problems and seems to place the surveillance services entirely outside the dynamics of institutionalised racism. As it stands, the bill reads as a reversal of government policy, as if institutionalised racism and combating discrimination were no longer relevant issues. Yet the secrecy in which the services operate, combined with the scaling back of oversight, is precisely a recipe for exacerbating this risk of discrimination.
Call to action: Explicitly account for how algorithmic systems have structurally led to discrimination in recent years, and for how the bill addresses this real risk through safeguards and oversight.
2. Lack of a bias or discrimination test
The general risk of discrimination set out above is aggravated by the absence of any bias or discrimination tests in the bill. The terms ‘discrimination’, ‘bias’, ‘racism’ and ‘profiling’ are not mentioned even once. Without sound equality principles, this makes it impossible to counter violations based on race, religion, sexual orientation and other personal characteristics.
Article 32(2) states that automation must have “no disproportionate consequences for the persons concerned or for society.” However, it does not specify what constitutes disproportionality: does this include forms of ethnic profiling or the systematic, unjustified surveillance of minorities? Because data on religion, race, trade union membership, health and sex life may be included in bulk data (Article 22), this discrimination-sensitive data can still end up with the services. Combined with automation, this can have serious discriminatory consequences.
Call to action: Develop and use a rigorous, independent discrimination monitor that assesses every request for further investigation, or for the deployment of an algorithm, for bias and potential discriminatory consequences. It must never be assumed that further investigation or the deployment of an algorithm will go ahead regardless. The outcome of the monitor must therefore also be capable of resulting in binding negative advice.
3. Chilling effect, particularly on racialised groups
Concerns: The bill as a whole, in particular the preventive hacking regime in Article 38.
The context and reality of institutional racism, combined with the build-up of large-scale data systems without adequate prior review, creates a climate of perceived omnipresent surveillance. This leads to a so-called chilling effect: people in the Netherlands, and in particular racialised groups and anti-racism activists, feel inhibited from exercising their fundamental rights, such as the right to protest and freedom of expression, for fear of unjustified profiling or inclusion in government databases. The European Court of Human Rights has explicitly recognised this chilling effect, holding that creating fear and hesitation can in itself constitute an impermissible interference with Article 10 ECHR, even without any actual enforcement or harm. See, for example, Yasar Kaplan v. Turkey, p. 35, or Margalev v. Russia.
A lack of trust in the Dutch state can therefore erode democracy, even in the absence of problematic surveillance. The clearly documented history of racism and discrimination in the use of automated systems (see point 1) means that such a significant expansion of surveillance powers will lead to fear and reticence among racialised groups and activists in exercising their fundamental rights.
The bill also fails to account for the negative impact it will have on the rights to freedom of expression and freedom of association. The bill claims to protect the rule of law, and by extension the national interest, but by scaling up powers while scaling back oversight it throws the baby out with the bathwater, in the most charitable interpretation, and effectively hollows out democracy from within.
Call to action: Strengthen the position of the oversight body to give people in the Netherlands, and racialised groups in particular, a reason to trust the government. We strongly advise against dismantling the oversight body.
4. Evident adversaries and preventive hacking
Concerns: Article 38 and Section 8.5.
The bill introduces a differentiated oversight regime under which safeguards are lowered for investigations into ’evident threats’ or defensive and offensive foreign actors. In addition, it broadens the scope for processing data and taking preventive action in support of the performance of the services’ tasks.
The statutory definition of what constitutes a threat is so vague that there is a risk of overreach and discrimination. This may lead to the direct or indirect surveillance of legitimate civil society organisations and human rights activists.
International examples from Germany, the United Kingdom and the United States show how quickly organisations that seek to change the status quo are placed on terrorism or watch lists. Examples include climate groups, organisations that stand up for the rights of the Palestinian people (Palestine Action, the Ulm 5), and anti-fascist networks (Autistici/Inventati).
Lowering the thresholds for the use of intrusive powers (such as hacking and data analysis) increases the likelihood that legitimate protest in the Netherlands will similarly be politicised and framed as a threat to national security.
It has also been extensively documented that these terrorism and watch lists focus predominantly on Muslims and lead to Islamophobia. See, for example, Amnesty’s How to combat counter-terror discrimination.
Call to action: Tighten oversight of the regime for evident adversaries and of preventive hacking.
5. Cooperation with parties that violate human rights
Concerns: Articles 139–141 and 144–146.
The bill makes it possible to share personal data, including data from bulk datasets, with foreign partners and private parties. The safeguards for this are insufficient, and human rights are missing from the assessment. When cooperating with foreign services, the service must weigh human rights and democratic embedding (Article 138(3)(a) and (b)), but these criteria are absent in the case of private parties. There, the assessment considers the country of establishment, the objective, the professionalism and the usefulness to the service (Articles 144(4) and 145(4)), yet nothing in the proposal rules out cooperation with companies such as Palantir, not even if they are involved in human rights violations.
In addition, bulk data held by private parties is not given separate protection. Providing bulk data to foreign partners requires ministerial approval (Article 140(2)), but Articles 144–146 again contain no comparable safeguard for private parties, and the assessment is only mandatory to a limited extent. It is only required for structural cooperation in which the service provides personal data (Articles 139(3) and 144(3)). One-off disclosures fall outside its scope. Moreover, Article 141 permits disclosure to foreign parties in cases of ‘compelling necessity’, even without a cooperative relationship, or where the assessment has concluded that the data should not be disclosed.
Oversight and access are lacking on the recipient’s side. According to the Explanatory Memorandum (MvT), processing by private parties is governed by the framework to which they themselves are subject, such as the GDPR (AVG) (p. 141). The closed access regime (Articles 147–149) only gives citizens access to their own data. As a result, citizens and researchers cannot verify which data has been provided to whom, and therefore cannot effectively challenge such disclosures.
Call to action: Make human rights and democratic embedding a mandatory assessment criterion in Articles 139, 144, 145 and 146; make the registration of disclosures mandatory, with independent oversight and retrospective access for the persons concerned and for researchers.
6. Distortion of the balance of power and the assumption of government infallibility
Concerns: The oversight regime.
The bill shifts the centre of gravity of decision-making to the ministry and the services themselves. The position of the College van Toetsing en Toezicht [Review and Oversight Board] is altered, prior oversight is relaxed, the minister is given more avenues to appeal against decisions of the oversight body, and the duration of authorisations for the use of powers is extended from 3 to 6 months.
These choices appear to rest on the assumption that the government and the security services will, as a matter of principle, act lawfully of their own accord. This assumption is incorrect, both constitutionally and historically. A healthy democratic state under the rule of law requires precisely a system of checks and balances in which the power of the government is limited by a strong, independent oversight body with binding ex ante powers.
Call to action: Strengthen the oversight regime and ground the bill in healthy distrust and scrutiny.
Conclusion
The bill for the Wet bescherming nationale veiligheid door de inlichtingen- en veiligheidsdiensten expands the operational scope and technological powers of the services, while at the same time dismantling the oversight that is meant to protect citizens against arbitrariness and violations of their fundamental rights. Citizens’ trust in the government has been seriously damaged in recent years by the ill-considered use of surveillance and data tools. The present bill threatens to entrench and exacerbate these patterns.
We urge the legislator not to proceed with this bill in its current form, to restore the fundamental safeguards of the rule of law, to take our calls to action fully into account in this decision, and to heed the objections raised by Bits of Freedom.
Image: Jamillah Knowles & We and AI / People and Ivory Tower AI 2 / Licenced by CC-BY 4.0