Facts
SyRI (Systeem Risico Indicatie) was a legal instrument the Dutch government used to detect fraud involving social benefits, allowances and taxes. It linked personal data held in the databases of various public bodies through a risk model and generated risk reports on people assessed as presenting a fraud risk. Its legal basis was section 65 of the SUWI Act and Chapter 5a of the SUWI Decree. The Dutch Section of the International Commission of Jurists (NJCM), Privacy First, other civil society organisations and two individuals sued the State, arguing that SyRI violated human rights. The Netherlands Trade Union Confederation (FNV) joined on the claimants' side.
Question
The court examined whether the SyRI legislation complied with binding international law, in particular Article 8(2) of the European Convention on Human Rights (ECHR), which requires a fair balance between the interests of the community served by the legislation and the right of those affected to respect for their private life. The claimants also argued that the risk reports amounted to automated individual decision-making prohibited by Article 22 GDPR.
Decision
The court stressed that, under Article 8 ECHR, a State introducing new technologies has a special responsibility to strike the right balance between their benefits and the interference with private life. While accepting that combating fraud is a legitimate aim, it concluded that the SyRI legislation did not strike the required fair balance and that the use of SyRI was insufficiently transparent and verifiable. It therefore held that section 65 of the SUWI Act and Chapter 5a of the SUWI Decree were contrary to Article 8(2) ECHR and had no binding effect. The binding effect of that declaration is limited to the claimants and those they represent. The claims of some claimants were held inadmissible, and the State was ordered to pay costs.
Why it matters
SyRI is one of the first significant judgments to review algorithmic risk profiling by a public administration against human rights standards. The court treated the lack of transparency about the risk model and indicators as decisive, because the people concerned could neither understand nor check how the system worked. The judgment is widely cited in debates on systems used by public bodies to assess benefit eligibility and detect fraud, and in the background to the EU AI Act's treatment of such systems as high-risk.
Related stages
On 23 April 2020 the Dutch government announced that it would not appeal. Because the State did not appeal, the judgment became final.