Ten municipalities in the Netherlands have been fined a total of €250,000 by the Dutch Data Protection Authority for unlawfully collecting and processing sensitive personal data about Muslim residents. Each municipality was fined €25,000 for violations of Dutch privacy law and the EU’s General Data Protection Regulation (GDPR). The municipalities named in the ruling are Delft, Ede, Eindhoven, Haarlemmermeer, Hilversum, Huizen, Gooise Meren, Tilburg, Veenendaal, and Zoetermeer.

The data protection authority found that local governments had secretly commissioned external research agencies to gather information on Muslim communities, including individuals’ religious beliefs, political views, and social networks, without their knowledge or a valid legal basis. Investigators said reports were compiled on mosques and Muslim organisations, with some of the information shared with police and national authorities. The authority stated that the research was carried out in the context of counter-radicalisation efforts but ruled that the data collection methods were unlawful and disproportionate.

The covert investigations were first revealed in 2021 and subsequently examined by regulators. Following the ruling, Dutch Muslim organisations and mosque umbrella groups publicly responded, calling for formal apologies from the municipalities involved and the national government. Separately, surveys and research cited by advocacy groups indicate that a significant proportion of Dutch Muslims report experiencing discrimination, including in employment, housing, and public life, with concerns also raised about profiling and anti-Muslim rhetoric in political and public discourse.