What happened
The Netherlands Court of Audit (Algemene Rekenkamer) reported on 20 May 2026 on the police’s use of iTrechter, an algorithm that analyses data from sensors, including cameras that recognise number plates. According to the report, iTrechter runs profiles based on different kinds of criminal behaviour. When it picks up a possible match, it produces a “hit” that the police can act on.
The audit examined how the Flexible Intervention Team uses iTrechter on main transport routes such as motorways. The report describes the process: cameras scan passing vehicles, the algorithm identifies possibly suspicious cars, and officers decide whether to stop them.
The Court of Audit tested 48 risks. It found that the police managed many of them well or partly, but identified gaps in monitoring, privacy, software maintenance and IT security.
What an auditable version would have shown
According to the report, officers use their own judgement to decide which hits to follow up, and a hit alone is not enough to use police powers.
The Court of Audit found that the police did not monitor what happened after a hit. It could not establish how many were followed up, or how many led to a positive result.
The report said profiles can lead to people being wrongly stopped, or to some groups being checked more often without reason, and that the police try to refine a profile when they notice this. It does not record a case where that happened.
A record of each hit, the officer’s decision and the result would have shown how many hits were followed up and what they led to.
Where the gap was
The Court of Audit found that the police had not carried out a data protection impact assessment for iTrechter. It said the law required one because the processing was large scale and potentially high risk. The minister disputes that the requirement applied, saying iTrechter was already in use when the relevant rules took effect.
For some profiles, the report found that the police had not adequately explained why the data were needed. Their working method did not address whether the data could be used for that purpose, or the risk of indirect discrimination.
The report described iTrechter’s availability as fragile and its software as outdated. The police had intended to replace it for five years. They could not show the auditors that every system involved was fully secured.
A ConductRecord keeps each hit, the officer’s decision and the outcome.
A MetricRecord is designed to hold aggregate figures, such as hits, stops and results by profile, bound to the underlying records so they can be checked.
ConductRecord and MetricRecord are Headlights designs.
What governance should have looked like
According to the report, several police departments assess each profile before it is used. A public prosecutor considers its ethical aspects and must approve it. Profiles may run for no longer than one year.
In response, the minister said the findings on privacy, lifecycle management and IT security were partly recognised, and that the police were working on a replacement.
Answering questions from the House of Representatives on 9 June 2026, the minister said that iTrechter had not previously been checked for possible discriminatory bias, that its functionality is being moved to the Generieke Sensingplatform, that an impact assessment will be carried out for that platform, and that measures against the risks the auditors rated medium or high will be built into it.
Where police use an algorithm to select vehicles for stops, best practice would be to record what each hit leads to and report stops and results by profile. The working method should address indirect discrimination, and an impact assessment should cover the system while it remains in use.
Failure Pattern: police ran a profiling algorithm on number plate camera data without tracking what its hits led to, leaving them unable to establish how many hits were followed up or led to a result, and without a data protection impact assessment, which the auditors said the law required and the minister said it did not.
Governance Principle: a police force using a profiling algorithm should be able to show what each hit led to, who was stopped as a result, and that a completed impact assessment covered the processing.
The reference implementation of ConductRecord and MetricRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Resultaten verantwoordingsonderzoek 2025 ministerie van Justitie en Veiligheid, section 6.1 (Algemene Rekenkamer, 20 May 2026)
- Reactie minister van JenV op Verantwoordingsonderzoek 2025 Justitie en Veiligheid, bijlage 1 (Ministry of Justice and Security, 29 April 2026)
- Lijst van vragen en antwoorden over het rapport Resultaten verantwoordingsonderzoek 2025 bij het Ministerie van Justitie en Veiligheid, Kamerstuk 36945-VI (9 June 2026)
- Inzet algoritmes niet altijd effectief en veilig (Algemene Rekenkamer, 20 May 2026)