ⒾMachine translations by Deepl
Appeal in the Privacy First v ANPR mass surveillance case
It is the established policy of the Privacy First Foundation to challenge mass privacy infringements in court and have them declared unlawful. In recent years, Privacy First has done so successfully (often in coalition) against the central storage of everyone’s fingerprints under the Passport Act, against the storage of everyone’s communications data under the Telecommunications Data Retention Act, and against mass risk profiling by the Risk Indication System (SyRI). One issue that is particularly well-suited to such a legal challenge concerns the controversial Dutch legislation on automatic number plate recognition (Automatic number plate recognition, ANPR) as it has stood since 2019. Since 2021, Privacy First has been pursuing legal action against the State to have the ANPR legislation declared unlawful on the grounds that it contravenes European privacy law. On 9 July, the Court of Appeal in The Hague will hear the appeal in this case.
Violation of European privacy law
Under the ANPR Act (Article 126jj of the Code of Criminal Procedure) , since 2019 the number plates and locations of millions of cars in the Netherlands (in other words, everyone’s travel movements) have been continuously stored for four weeks in a central police database for purposes including investigation and prosecution, regardless of whether anyone is under suspicion of any offence. This is entirely unnecessary, completely disproportionate and, moreover, ineffective, as various studies in recent years have shown. There is a lack of oversight and the system can easily be abused. The current ANPR legislation therefore constitutes a massive breach of privacy and, in our view, has no place in a free, democratic state governed by the rule of law.
A long-term endeavour
Following an earlier summary proceedings The District Court of The Hague ruled in favour of Privacy First in early 2024 admissible in the main proceedings. This interim judgment has since set an important precedent for similar cases, particularly now that there is a growing threat from Dutch politicians to increasingly restrict the ability of interest groups to bring legal proceedings. In substance, the court However, Privacy First was subsequently found to be in the wrong. Privacy First then an appeal lodged at the Court of The Hague. Privacy First has also submitted a series of Woo requests to various relevant government organisations. In June 2025, the Court of The Hague subsequently ruled that the appeal hearing would take place in July 2026.
Distinguishing between ANPR “hits” and “no hits”
The ANPR legislation at the heart of Privacy First’s legal case primarily concerns the mass collection and storage of everyone’s “historical” ANPR data, also known as “no hits”. This concerns almost exclusively innocent members of the public and should be distinguished from the long-standing police practice whereby the number plates of suspects (so-called “hits”) can be used for the investigation and prosecution of criminal offences.
Promising case
Via Pro Bono Connect Privacy First has engaged the law firm CMS has been engaged to conduct this legal case on a pro bono basis on our behalf. The case has also been supported for years by the European Digital Freedom Fund. If necessary, Privacy First will take the case all the way to the highest European courts. In view of recent European case law and the positions taken by the Dutch Data Protection Authority, Privacy First now considers the chances of a successful legal challenge to be higher than ever.
Date and venue
Our long-awaited appeal hearing will take place on Thursday 9 July at 1.30 pm at the Court in The Hague take place. This court hearing is open to the public: you are most welcome to attend. Case number: 200.347.782/01 (Privacy First Foundation v. the State).
