The Dutch Data Protection Authority (AP) has fined the Municipality of Tilburg for violating privacy regulations in a study conducted during 2020/2021.
The study was a so-called power field analysis within the Islamic community in Tilburg. The Municipality of Tilburg agreed to the imposed fine and regrets the mistake made. Nine other municipalities have also been fined by the Data Protection Authority.
Reason for the study
The aim of the Municipality of Tilburgs study was to gain insight into the Islamic infrastructure: organizations, their cooperation, vulnerabilities, and resilience. The study focused on organizations that identify themselves as Islamic. The reason for the study was that in the period before 2020 many (inter)national developments affected the Islamic community. This increased the municipalitys need for more knowledge about what lived and played in the local Islamic community.
Engaging a research agency
This led to the decision to have an independent study conducted by research agency Nuance through Training and Advice (NTA). The Municipality of Tilburg was not unique in this; several Dutch municipalities commissioned studies from a similar need.
Before the study, the Municipality of Tilburg informed 19 involved Islamic organizations in our municipality by letter and asked for cooperation with the study. Slightly more than half of the organizations cooperated. This distinguishes the Municipality of Tilburg from other municipalities that conducted studies without informing the involved organizations.
Following the request for cooperation, the Municipality of Tilburg held discussions with three organizations at the time about their concerns.
Report
In spring 2021, the municipality received a draft report from the research agency about their findings. This contained personal data of board members of the organizations (Chamber of Commerce data) and of preachers/speakers. These findings were presented about two weeks after receipt to the municipalitys partners in the so-called local triangle: the police and the Public Prosecution Service. After this presentation in the local triangle, it became clear that the draft report was not usable in this form. The municipality therefore immediately deleted the report and asked its partners to do the same. They complied.
The municipality then asked the research agency to provide a new report, but without personal data. We received that report but did not share or use it further.
Publication NRC Newspaper
In October 2021, NRC Newspaper reported (‘Undercover to the mosque’) that several municipalities had conducted studies into Islamic communities without informing them. The Municipality of Tilburg was not mentioned, but this reporting did lead to questions from seven local Islamic organizations. The then mayor held open and constructive discussions with them about this.
Data Protection Authority investigation
In 2022, the Data Protection Authority (AP) started a nationwide investigation into the power field analyses conducted by municipalities. The Municipality of Tilburg was approached by the AP in 2023 and provided the requested information, except for the already deleted draft report. In December 2025, we received notification that mistakes were also made in Tilburg. For the processing of personal data in the 2021 draft report, there was insufficient legal basis. This violation concerned only a few weeks between receipt of the draft report and the moment it was deleted.
Mayor Fleur Gräper – van Koolwijk: “We regret that we ended up in this situation as a municipality. We did not act properly upon receipt of the draft report and the privacy-sensitive information. We should have deleted it immediately and not only weeks later, after the presentation in the local triangle. We have previously stated that this should not have happened. We sincerely regret this. We notice that the study and the reporting about it have stirred much in the Tilburg Islamic communities. We want to learn from this and find it important to look ahead together and continue to build trust step by step. We are happy to engage again with the involved organizations about this.”
The municipality accepted the APs settlement proposal of 25,000 euros at the end of January because we acknowledge that we made a mistake then. The AP indicated that the municipality acted correctly in commissioning the studies, that Tilburg conducted the study openly, and also acted correctly by deleting the report immediately.
Informing involved organizations
In December 2025, the Municipality of Tilburg already informed the 19 involved organizations in writing about the mistake and expressed regret. Since 2020, the Municipality of Tilburg has had more knowledge, expertise, and support regarding the General Data Protection Regulation (GDPR) and privacy issues. We monitor this better to prevent mistakes in the future.