Privacy / AI Governance / Data Quality
Dutch AP warns debt collectors that AI scoring and file enrichment may breach GDPR automated decision rules
A survey of 29 registered Dutch collection agencies found algorithmic tools in core processes, weak transparency and a narrow view of personal data. The AP says profiling such as file enrichment should stop.
The Dutch data protection authority (AP) has published a report on algorithms and AI at private debt collection agencies. It sent a questionnaire to 29 registered agencies, and 22 gave usable answers. Ten said they use at least one algorithmic system, three of them AI.
Uses include choosing contact channels, automated payment arrangements, collection-probability scoring, enriching debtor files from registers and social media, vulnerability detection and call analysis. The AP considers it plausible that Article 22 GDPR automated decision-making occurs without agencies realising it. It notes that intermediate steps such as a risk score can count as a decision, citing the CJEU SCHUFA ruling.
The AP makes recommendations in five areas: data awareness, transparency, meaningful human intervention, supplier management and risk mitigation. It will hold a sector roundtable on 2 December 2026.
Why it matters
The report treats debt amounts and system outputs that say something about a person as personal data, which many agencies had excluded from their inventories. Organisations that score, prioritise or enrich customer records should check whether their records of processing cover these outputs. They should also check whether automated first-contact or approval steps fall under Article 22, and whether human review genuinely changes outcomes. The supplier findings matter beyond collections: AI features added to bought-in software can process personal data that the buyer never chose to process.
Status: Published. Recommendations, not a binding decision; sector roundtable to follow
What to check
- Confirm that your inventory of personal data includes debt or balance data and the scores or outputs your algorithms generate about individuals.
- Review fully automated steps, including approvals that favour the customer, to decide whether Article 22 applies and whether an exception covers them.
- Check supplier contracts for AI features and processing terms, especially where a vendor has added AI functions to existing software.
Key dates
- Deadline for collection-sector organisations to register for the AP roundtable
- AP roundtable with the debt collection sector on the report's findings
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- AI governance lead
- Data stewards
- Legal & compliance