View source for GHSHE (Netherlands) - 200.270.589 01 and 200.270.589 02

{{COURTdecisionBOX

|Jurisdiction=Netherlands
|Court-BG-Color=background-color:#ffffff;
|Courtlogo=courtsNL.png
|Court_Abbrevation=GHSHE
|Court_With_Country=GHSHE (Netherlands)

|Case_Number_Name=200.270.589_01 and 200.270.589_02
|ECLI=ECLI:NL:GHSHE:2020:2536 

|Original_Source_Name_1=Rechtbank
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHSHE:2020:2536
|Original_Source_Language_1=Dutch
|Original_Source_Language__Code_1=NL

|Date_Decided=06.08.2020
|Date_Published=07.08.2020
|Year=2020

|GDPR_Article_1=Article 6(1)(c) GDPR
|GDPR_Article_Link_1=Article 6 GDPR#1c
|GDPR_Article_2=Article 6(1)(f) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1f
|GDPR_Article_3=Article 17(1) GDPR
|GDPR_Article_Link_3=Article 17 GDPR#1
|GDPR_Article_4=Article 21(1) GDPR
|GDPR_Article_Link_4=Article 21 GDPR#1



|Party_Name_1=ABN AMRO Bank N.V.
|Party_Link_1=
|Party_Name_2=Achmea Bank N.V.
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_From_Body=Rb. Zeeland-West-Brabant (Netherlands)
|Appeal_From_Case_Number_Name=C/02/358389 / HA RK 19-110
|Appeal_From_Status=
|Appeal_From_Link=https://gdprhub.eu/index.php?title=Rb._Zeeland-West-Brabant_-_C/02/358389/HA_RK_19-110
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=n/a
|
}}

The Court of Appeal of 's-Hertogenbosch disagreed with the interpretation of the Dutch DPA and ruled that the legal basis of the credit registration by banks is compliance with a legal obligation and not legitimate interest. The Court has also rejected the appellant's claim that such credit registration has disproportionately affected his rights and freedoms, therefore breaching the GDPR principles of necessity and proportionality.

== English Summary ==

=== Facts ===
The appellant has a complicated financial history with several debts and a record of payment delays, including a mortgage at Achmea bank and a private loan from ABN AMRO bank. Because of these debts he was registered in the Central Credit Information System (CKI) of the Credit Registration Office (BKR). Over the years, the appellant has tried to improve his financial situation and succeeded in some areas. He wanted to take an additional loan to support his business, lease a working car and move to a bigger house. The CKI registration prevented all of this from happening, which led to a (rejected) right to erasure request and a lawsuit before the Court of First Instance of Zeeland-West-Brabant which he lost. 

=== Dispute ===
The appeal is based on essentially two claims: 1) banks cannot use compliance with a legal obligation as a lawful basis for processing when it comes to credit register maintenance (a position seemingly shared by the Dutch DPA) and 2) in his particular case, such registration was disproportionate and thus was not compliant with the principles of necessity and proportionality. 
The banks are of the opinion that compliance with a legal obligation is the correct legal basis, that the appellant's financial situation is far from perfect and that the CKI record is therefore justified and necessary to protect the financial system and the appellant himself. 

=== Holding ===
The Court did not agree with a rather narrow interpretation of the scope of compliance with a legal obligation as a legal basis in this case. According to the Court, not every individual personal data processing operation requires specific legislation tailored to its purpose, a legislation can serve as a legal basis for several data processing operations.

According the the Court, the appellant also failed to demonstrate exactly how the credit registration breached the principles of necessity and proportionality. Although his financial situation has seemingly improved, the Court ruled that the interests of ABN AMRO and Achmea and the protection of the financial system prevailed in this case.


== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

<pre>

ECLI:NL:GHSHE:2020:2536 
Authority
Court of Appeal 's-Hertogenbosch
Date of pronunciation
06-08-2020
Date of publication
07-08-2020 
Case number
200.270.589_01 and 200.270.589_02
Formal relationships
First instance: ECLI:NL:RBZWB:2019:4846 
Jurisdictions
Civil Justice
Special features
Appeals
Content indication
Credit registration by banks and AVG - What legal basis ? - Recent opinion of the Authority for Personal Data - Applicability of Article 6(1)(c) of the AVG - No need to ask questions for a preliminary ruling - Santander test - Compensation for costs on account of the nature of the case
Sites
Rechtspraak.nl 
Enriched pronunciation 
Ruling
GERECHTSHOF 's-HERTOGENBOSCH
Commercial law team
Ruling: 6 August 2020
Case numbers: 200.270.589/01 and 200.270.589/02
Case number at first instance: C/02/358389/HA RK 19-110
in the appeal case of:
[appellant] , 
living at [residence] ,
appellant,
hereinafter referred to as: [appellant] , 
Attorney at law: Mr. R.A.J. Zomer at Oosterhout, 
by
1 Achmea Bank N.V., 
established at [place of business] , 
Lawyers: J.M. Brölmann and S.C.M.J.V.L. Kloppers in Utrecht,
and 
2 ABN AMRO Bank N.V, 
established at [place of business] ,
Attorney at law: Mr. C.M. Jakimowicz, Rotterdam,
internees,
hereinafter referred to collectively as: the banks, or each of them individually: Achmea and ABN AMRO respectively.
1 The proceedings at first instance
The Court of Appeal refers to the order of the District Court of Zeeland-West-Brabant, place of session 
Breda, from October 21, 2019. 
2 The appeal proceedings
2.1.
By appeal with productions, received at the Court Registry on 11 December 2019, [the appellant] requested that the order of which the appeal was lodged be set aside, that preliminary questions be referred to the Supreme Court for a preliminary ruling, that the (conditional) provisional claim be allowed (decommitment of the BKR) and that the banks be ordered to include the special coding(s) in the Central Credit Information System (hereinafter referred to as 'the Central Credit Information System'): CKI) of the Stichting Bureau Krediet Registratie (hereinafter referred to as: BKR) within five days of service of notice, to remove or to keep removed, on pain of a penalty of € 1.order the banks to pay the costs of the proceedings at first instance and of the appeal, including the costs of service. 
2.2.
By statement of defence with one production (record of first instance), received at the Registry on 22 January 2020, Achmea has requested, as far as possible provisionally enforceable, to confirm the order of the court, ordering [the appellant] to pay the costs of the proceedings including the costs of the proceedings, all this increased by the statutory interest as from a date to be determined by the court of justice.
Furthermore, Achmea opposes the reference for a preliminary ruling and the provisional request. If the court nevertheless intends to ask questions for a preliminary ruling, Achmea requests to be given the opportunity to comment on the content of those questions by further deed.
2.3.
By defence with one production (minutes of first instance), received at the Court Registry on 22 January 2020, ABN AMRO requested that the requests of [the appellant] on appeal be rejected (including those relating to the submission of preliminary questions) and thus - so the Court of Appeal understands - that the order of which appeal was made be upheld, with an order that [the appellant] be ordered to pay the costs of the appeal, including the after costs, increased by statutory interest and declared provisionally enforceable.
In its defence against the requested provisional claim, ABN AMRO requested not to do so. If and to the extent that the Court of Appeal does intend to put preliminary questions to the Supreme Court, ABN AMRO opposes the provisional provision requested by [the appellant].
2.4.
The oral hearing took place on 12 February 2020. Hearings were held on that occasion: 
* -
[appellant] ;
* -
Mr. R.A.J. and Mr. K.J. Summer, [appellant] lawyers;
* -
Mr. [Achmea Bank employee] of Achmea Bank;
* -
Mr. Brölmann and Mr. Kloppers, lawyers from Achmea;
* -
Mr. [employee ABN Amro 1] and Mr. [employee ABN Amro 2] of ABN Amro;
* -
Mr. Jakimowicz, attorney at ABN Amro.
2.4.
The court of appeal has also taken note of the contents of the judgment:
* -
the minutes of the oral procedure at first instance of 9 September 2019;
* -
the pleading of Ms Zomer and Zomer presented and proposed at the appeal hearing; 
* -
the written pleading submitted and proposed at the appeal hearing by Mrs Brölmann and Mr Kloppers
* -
the pleading of Mr Jakimowicz, presented and proposed at the appeal hearing.
2.5.
During the hearing in the period after the oral hearing, the court of appeal took cognizance from public sources of a number of documents relevant to this case. In response, the Court sent a letter dated 2 March 2020 to all parties with the following text (with the documents referred to by the Court as annexes):
In your cases 200.270.589/01 and /02, but after the oral hearing of 12 February 2020, the Court recently noted from public sources that the Personal Data Authority sent an opinion dated 14 November 2019 to the Minister of Finance. This advice addresses the position of the BKR in combination with the principles of the AVG. The Minister of Finance, for his part, then sent a letter dated 12 December 2019 to the Lower House of the States General, in which the Minister wrote that he would enter into consultations to see whether the current system could be improved. Both documents are attached to this letter. 
Now that these documents have not been discussed during the oral hearing, you will each be given the opportunity to respond to them (exclusively) at the same time (...). 
2.6.
After the Court of Achmea had only received a formal objection, the Court of Appeal sent a letter dated 31 March 2020 to all parties with, among other things, the following contents:
Now that the debate in the present proceedings also relates to the scope of Section 6 of the General Municipal Bye-Law in relation to credit registration, the Court of Appeal has given the parties the opportunity to comment on parliamentary documents that may be relevant in the assessment of the scope referred to above. This opportunity was given in particular in order to avoid a possible surprise decision, even though it concerns documents that the Court of Appeal is allowed to include in its judgment even if they have not been mentioned by the parties pursuant to Article 25 of the Rv.
In the meantime, the court has received a response from all parties. Achmea first of all lodged formal objections against the approach chosen by the Court of Appeal, but this objection as such was only submitted to the hearing chamber on 30 March this year. In the meantime Achmea has submitted a deed with a substantive response, just as ABN AMRO indicates in its response that it supports Achmea's formal objections. 
As appears from the foregoing, the Court does not share these objections, and has established that in the meantime all parties have responded.
Parties are now given the opportunity (...) to respond in writing and exclusively to what the other party has put forward.
2.7.
In addition, the Court of Appeal has taken note of the contents of the documents sent by the Court of Appeal:
- a letter dated 12 March 2020 objecting to the requested statement concerning the opinion of the AP of Mrs Brölmann and Kloppers on behalf of Achmea;
- a 'deed containing statements' dated 27 March 2020 from R.A.J. Zomer on behalf of [the appellant], submitted by letter and also a submission form dated (both) 30 March 2020;
- a letter dated 27 March 2020 from Jakimowicz on behalf of ABN AMRO;
 - a deed containing statements dated 30 March 2020 from Brölmann and Kloppers on behalf of Achmea;
- a deed from Zomer on behalf of [the appellant], dated 14 April 2020, submitted by letter and also the submission form of (both) 14 April 2020;
- an undated reply from Mr. Jakimowicz on behalf of ABN AMRO, received at the Court Registry on April 15, 2020;
- a deed received at the Court Registry on 14 April 2020 from Brölmann and Kloppers, acting on behalf of Achmea.
3 The assessment
3.1.
Together with the court of appeal, the court of appeal considers the following with respect to, on the one hand, facts that have not been established and, on the other hand, facts that have not been contradicted or have not been sufficiently substantiated:
- [appellant] has been married and has a daughter from 2003 and twins from 2005.
- Achmea granted a mortgage loan to [appellant] on 27 September 2005.
of € 271,000.
- In 2006, [the appellant] fell seriously ill, resulting in a long sickbed. His wife
didn't have a job, which created a difficult financial situation;
- On 16 January 2008, ABN AMRO sent to [appellant] , who had already been granted a
Private Limit Plus account had provided a loan of € 23.500,-;
- The divorce was filed in 2009. [appellant] had to leave the marital home, which led to double housing costs. 
In addition, he had high attorney fees, which caused him to run up debts.
- In 2009 and 2010 there were arrears in mortgage payments.
- After the sale of the house a residual debt of € 68,897.08 remained to Achmea on 18 July 2011.
- Payment arrears have also arisen at ABN AMRO, which have led to
led ABN AMRO to transfer its claims to a debt collection agency. The debt to ABN AMRO amounted to €24,835.09.
- After [the appellant] had already turned to debt assistance via the
municipal social service, he was admitted to the WSNP on 11 March 2013 with
a debt of over €100,000. On 9 March 2016, the debt rescheduling scheme was approved.
terminated with a clean slate.
- As a result of the clean slate declaration Achmea has the residual claim
written off and registered in the Central Credit Information System (hereinafter: CKI)
of the Stichting Bureau Krediet Registratie (hereinafter referred to as: BKR). As a result, [Appellant]
A(chterstand) 2 (claim) and 3 (write-off) coding in the CKI,
which encryption will be removed in March 2021. ABN AMRO has sent to
as a result of this clean slate declaration, its claim against [the appellant] also
written off and registered in the CKI, as a result of which [appellant] has a (A)chterstand
3 ( write-off) coding in the CKI. This coding will also be removed
in March 2021.
- [appellant] has been renting a three-room apartment since August 2011 for an amount of
€ 585 per month. His three daughters stay with him every other weekend. 
- Since March 2016, he has been paying €725 a month in alimony for his
children and makes a financial contribution to various costs.
- In September 2016, [appellant] , those previous years always have a permanent employment contract.
has had, resigned from the Environment Service [Environment Service 1], to
[place] . He then worked through three secondment agencies as
hiring power from municipalities and environmental services as Wabo case manager,
licensing authority and (construction) plan examiner. 
- In January 2018 he registered with the Chamber of Commerce as an independent entrepreneur and in April 2018 he started as a self-employed person. As an independent entrepreneur he carries out the same activities under the trade name ' [trade name]'.
work he previously carried out in the course of his employment.
- [Appellant] has, on behalf of [Groep BV] Groep BV, performed work for
Environment Service [Environment Service 2] . The contract of assignment has been entered into
for the period from 1 November 2018 to 1 April 2019. For this work
charged [the appellant] an average amount of € 10,000 per month.
- Subsequently, [Appellant] entered into a contract of engagement with [CV].
CV for the period from 1 April 2019 to 15 August 2019, to
to carry out work for the municipality [municipality 1] . The agreement
has been contracted for 36 hours per week at an hourly rate of € 70, = excluding VAT.
- However, at the end of March 2019, [the appellant] transferred to the municipality [municipality 2] where he
via client [client] on the basis of an assignment agreement dated 4 April
2019. The agreement has been entered into for the
period from 8 April 2019 to 31 December 2019 and is hereby closed for an
working week of (average) 36 hours for a fee of € 67.50 per hour.
[Appellant] started as a licensing authority on 8 April 2019. [Appellant] still works for the municipal council [Council 2] ;
- CoderingVrij, at the request of [appellant] on 14 August 2018, applied to
Achmea and ABN AMRO with a request to check whether the registration
has been notified according to the rules of the BKR. By letter dated 23 August 2018
ABN AMRO states that all codings are according to the rules of the BKR.
and Achmea has also notified on 4 September 2018 that all of its
coding is correct.
- On 14 September 2012018 CoderingVrij ABN AMRO requested the deletion of
of the coding. ABN AMRO rejected it by letter dated 18 October 2018.
responded to. On 26 March 2019 CoderingVrij submitted a new request to ABN
AMRO submitted. By letter dated 1 April 2019, ABN AMRO also submitted this request.
rejected.
- On 14 September 2018 CoderingVrij also requested Achmea to remove
of the coding. Achmea has hereby rejected the letter of 20 September 2018 on
reacted. On 17 April 2019 CoderingVrij submitted a new request to Achmea.
submitted.
- International Card Services BV did (ultimately) comply with the
Coding requestFree to use the special codes A(chterstand) and
2 (residual claim fully due and payable) in respect of an amount due and payable in October 2010 to
[Appellant] to remove any credit granted.
3.2.
In the first instance, [the appellant] requested the court to order Achmea and ABN AMRO to remove the negative registrations, because these registrations hinder him in obtaining a mortgage loan, a business loan and a business car lease, with reference to further provisions from the AVG, Constitution, Charter of Fundamental Rights of the European Union and the ECHR, as specified in the decision of which appeal. 
Achmea and ABN AMRO put forward a defence as set out in the decision of which appeal is further described. 
The court then ruled - briefly and concisely - that the processing of [appellant's] personal data in the CKI at the request of the banks was based on a statutory obligation as referred to in Article 6, clause 1, subsection c, of the AVG. After all, the processing of personal data arises from an obligation on the part of Achmea and ABN AMRO as credit providers, pursuant to Section 4:32 of the Wft, to participate in a system of credit registration, which necessarily entails the processing of personal data. This also applies to special codes such as those at issue here. This means that [the appellant] cannot invoke Article 21, clause 1, of the AVG or Article 17, clause 1, of the AVG. 
This is without prejudice to the fact that a balancing of interests may lead to the deletion of data, as the principles of proportionality and subsidiarity have to be respected. It is therefore necessary to assess whether the invasion of [appellant's] privacy is not disproportionate in relation to the purpose to be served by the registration. In doing so, the circumstances of the specific case must be taken into account. In view of [the appellant's] financial plans, the court ruled that there was still every reason to protect him against incurring new debts. Due to his problematic debt situation that had existed for many years, [the appellant] entered the statutory debt rescheduling scheme (wsnp), which ended in March 2016 with the granting of the clean slate. At the hearing, the [appellant] was unable to provide any information about the extent to which he was able to repay his debts in the three-year period. There is therefore reason for [the appellant] to exercise due care when entering into debts and to protect him against this. There is also reason to protect lenders against him. It is also important that he quit his permanent job shortly after obtaining a clean slate and that he started working through secondment agencies. After that he became self-employed. The documents submitted by [the appellant] did not show a stable income; the need to expand the business was in no way substantiated. The need for a business loan has not been substantiated in any way. The need to finance a car via financial lease has not been substantiated in any way. The need to take out a mortgage has not been demonstrated, according to the court. 
The reliance on Article 10 of the Constitution is rejected on the grounds that the Constitution must be interpreted in accordance with Union law. The reliance on Articles 7 and 8 of the Charter is unsuccessful as it is not clear to the court why [the appellant] is relying on it. Recourse to Article 8 of the ECHR is unsuccessful because the AVG is a statutory provision that permits an infringement of private life as referred to in paragraph 2 of Article 8 of the ECHR. The court therefore rejected [the appellant's] request and ordered him to pay the banks' legal costs.
3.3.
[Appellant] does not agree with this decision. To this end, [the appellant] put forward five grounds for appeal and asked the Supreme Court for a preliminary ruling. In addition, a provisional provision - therefore conditional - was also requested in the event that the Court of Appeal would indeed ask questions for a preliminary ruling. 
In ground 1, [the appellant] states that his request is based on Articles 1, 6 paragraph 1 (f) and 21 of the AVG and therefore not - at least that is how the Court of Appeal understands the ground - on Article 6 paragraph 1 (c) of the AVG. Article 6(1)(c) of the AVG is said to relate to public authorities (see paragraph 70 of the notice of appeal), or at least government bodies with a statutory task (see paragraph 59 of the notice of appeal). 
In grievance 2, [the appellant] states that the court wrongly considered that the processing of personal data by the BKR is covered by Article 6, clause 1 (c) of the AVG and not by Article 6, clause 6 (f) of the AVG. The BKR itself refers to Article 6, clause 1 (f) of the GCG. In addition, although Section 4:32 of the Wft requires credit institutions to be affiliated to a credit registration system, this Section says nothing about the processing of personal data itself. 
The registration period of five years has been determined by the BKR itself and has no legal basis. This five-year period is also not compulsory for the affiliated institutions. The [appellant] would like to be asked (also) a preliminary question on this subject (see also section 59 et seq.). 
In ground 3, the [appellant] challenges the balancing of interests made by the District Court in section 3.21 (protection of the [appellant] against new debts). The [appellant] argues that the credit registration is given a punitive character. The purpose of registration by the BKR is to warn consumers against excessive lending. Punishing consumers does not constitute a legitimate objective of the BKR and should be discontinued pursuant to Article 17, clause 1 (d) of the AVG. 
In grievance 4, [the appellant] again contests points 3.21 and 3.22. [the appellant] claims to be entitled to a family life and a decent family home (Article 8 of the ECHR). The court takes the place of the lender by ruling that [the appellant] may not make new debts 'too lightly'. It is not correct that the court ruled that [the appellant] should do with his current home, car and office inventory. 
In grievance 5, [the appellant] objected that he would have been obliged to show that he had an interest in a larger house, a better office inventory and a more common car for his business trips and for his family (section 3.23). 
The banks must demonstrate that they have conducted a thorough investigation pursuant to Article 12(3) of the AVG.
With regard to the letter from the Authority for Personal Data (hereinafter referred to as 'the AP') dated 14 November 2019, [the Appellant] stated - briefly summarised - that he shared the AP's view that data processing by the BKR pursuant to Article 6, clause 1 (f), of the AVG would take place. A statutory duty cannot be performed by a private party. There is no statutory obligation on the banks within the meaning of Article 6, clause 1 (c) of the AVG. 
[Appellant] still works for the Municipality of [Municipality 2] as a licensing authority and plan assessor. He also needs good office equipment. 
3.4.
The banks dispute [appellant's] assertions. In its statement of defence, ABN AMRO points out that it does not base the data processing on 'consent' - the a-ground of Section 6, subsection 1, of the AVG - but on its statutory obligation under the Wft and Section 6, subsection 1 (c) of the AVG and recital 45 to the AVG. It appears from the Explanatory Memorandum to the UAVG (p. 28) in relation to Article 6, paragraph 1 (c) of the AVG that private parties can also invoke this article. The AVG does not prescribe that 'specific legislation' is required for each separate processing. The fact that the regulations of the BKR itself refer to Article 6 paragraph 1 sub f of the AVG does not alter the fact that ABN AMRO processes the data on the basis of, among other things, Article 4:32 paragraph 1 Wft and 4:34 Wft. In addition, the processing of personal data must be assessed in the light of proportionality and subsidiarity ('Santander judgment')/
The need for the BKR to process [the appellant's] personal data stems from his payment problems in which he failed to meet his obligations and was compelled to follow a wsnp process. In the interests of the reliability and creditworthiness tests, a potential financier must be able to put questions to [the appellant], which is only possible if he is registered with the BKR. This is also in the interests of [the appellant] himself. There is therefore a need to include [appellant's] details in the credit registration pursuant to Article 6, clause 1 (c) of the AVG. The proportionality test should be in ABN AMRO's favour: the interests mentioned by [Appellant] (expansion of business, lease car and larger house) are not well-founded and do not outweigh the factual registration of his data to protect himself, the company and the lenders. 
There is a possibility to correct/correct the processing of personal data in the context of proportionality, which requires a balancing of interests. Here, too, the Santander judgment plays a role.
[the appellant] also invokes 'oblivion' within the meaning of Article 17 of the AVG, which is closely related to the processing of personal data on the internet. This plays no role in the BKR registration. After all, Article 17 (3) (b) of the AVG states that this right does not apply to the fulfilment of a statutory processing obligation incumbent on the controller, as in this case such an obligation is incumbent on the banks. 
The reliance on Article 21 of the AVG does not apply either if the processing of personal data takes place on the basis of a legal obligation, as is the case here. 
The five-year registration period is a reasonable and generally accepted period and is also in line with the statutory system of limitation periods and the average duration of a credit agreement. The AP has already stated in another context that such a period is not unreasonably onerous from a privacy perspective, namely with regard to the retention period of eight years of the Netherlands Association of Trade Information Offices (Nederlandse Vereniging voor Handelsinformatiebureaus). It was disputed that the BKR registration would serve no purpose because [the appellant] would be financially stable. Insufficient access and/or explanation was given to his alleged financial stability. 
The bank opposes the submission of preliminary questions to the Supreme Court and, for this reason, also the provisional claim under Section 223 of the Dutch Code of Civil Procedure. 
On behalf of Achmea, her statement of defence expressed the same point of view. The banks conclude to reject the grievances. 
With regard to the letter from the AP dated 14 November 2019, in addition to the formal objections to the Court of Appeal's decision as referred to above (in two rounds) and the Minister's response, the banks state the following - in brief - in addition to the formal objections already mentioned above, which give the Court of Appeal the opportunity to express its opinion (in two rounds) on the AP's advice and the Minister's response as referred to above. A distinction should be made between the processing of personal data by financial institutions on the one hand and the processing of personal data by the BKR on the other hand. Financial institutions base the processing of personal data primarily on the statutory obligation under Section 4:32(1) in conjunction with Section 4:34 of the Wft. The AP also acknowledges this with the words "other than the credit providers", according to the banks. 
3.5.
The court is considering the following. 
3.5.1.
Pursuant to HR 19 December 2008, ECLI:NL:HR:2008: BG 1682, the judge (in this case the court of appeal) is generally free to deal with the points of dispute brought before him in the order that seems most appropriate to him. The court of appeal will therefore first address AP's letter and the question whether Article 6 paragraph 1 sub c of the AVG is applicable and the grievances 1 and 2 raised in that respect. It is
 already clear from the letter of 30 March 2020 that the court of appeal is of the opinion that it is competent to ask parties to comment on publicly accessible parliamentary documents of a recent date, which relate to the issue at least strongly related to the legal questions - including the interpretation of the invoked provisions of the AVG - that are at issue in the case at hand. 
3.5.2.
With the District Court the Court first of all established that Achmea and ABN AMRO are providers of credit within the meaning of Section 1:1 Wft. Pursuant to Section 4:2 Wft they are obliged to participate in a set of credit registration. 
This national ('Member State law') obligation ultimately derives from EU law, as evidenced by Bill 33339 to amend Book 7 of the Dutch Civil Code, the Financial Supervision Act and any other laws implementing Directive 2008/48/EC of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing Council Directive 87/102/EEC (OJEU L 133/66), as explained below.
3.5.3.
Credit registration had already been made compulsory nationally as part of the revision of the Consumer Credit Act. 
In parliamentary history the following has been included (layout, and in bold by the court) in the discussion of Bill 29507 Rules for Financial Services (Financial Services Act), being the predecessor of the Wft, and the related revision of the Consumer Credit Act:
Lower House session year 2003-2004, 29507, no. 3 
(p. 18) 
7 The revision of the Consumer Credit Act 
It was decided to integrate the revision of the Wck announced in a letter dated 7 July 2001 with the creation of this bill. 
This will ensure that the principles of conduct-of-business supervision of financial services are consistently applied to consumer credit as well. In addition to consumer protection, which has of course always been a major concern in consumer credit, confidence in the financial sector and the efficient functioning of financial markets play an essential role in policy making. 
Consumer protection when granting credit is aimed in particular at combating excessive lending and takes place by means of setting rules of conduct for lenders. The rules that are important here derive from the general quality characteristics for financial service providers referred to above. Adequate information in advertising and other types of offers can provide consumers with an insight into the different types of credit and the different providers. In addition to the transparency of product characteristics, insight into the consumer's credit position is an important part of a lender's duty of care towards the other party. This insight helps to fulfil his responsibility for advising the right product that suits the consumer's credit position. A credit registration system is important for this. 
(p.96) CHAPTER 4 
Paragraph 1 Credit 
Article 51 
In addition to the obligation to provide good information as laid down in Article 31, the supplier shall, in respect of credit, have an obligation to obtain information and to assess, on the basis of that information, whether the credit is responsible to the consumer in relation to the risk of over-indebtedness. This obligation will be laid down in subordinate legislation and, in certain cases, will lead to the obligation to consult the database of a credit registration system prior to the conclusion of a credit agreement. In order to make a proper assessment of the financial situation of the consumer, the supplier of credit must have insight into both the income, for example the source and amount of income of the consumer or relevant third parties, and certain fixed expenses of the consumer, for example the rental or mortgage, alimony and health insurance. A weak or uncertain financial position, for example in the case of young people on low incomes, is more likely to lead to the conclusion of a credit agreement being irresponsible in the context of preventing excessive lending to the consumer concerned. The second paragraph of Article 51 expressly states that no credit may be granted if this is irresponsible in terms of preventing the consumer from being overdrawn. In doing so, the credit provider shall base himself on the information gathered on the basis of the provisions of or pursuant to the first paragraph. 
Article 52 
The obligation from the first paragraph has been taken over from Section 14(2) of the Wck. Under that article, participation in a system of credit registration was a requirement attached to the licence. One of the tasks of a credit registration system is in any case the collection, recording, ordering and making available to participants of data that are important for the assessment of the financial capacity of the consumer, with due observance of the greatest possible protection of privacy. The Stichting Bureau Krediet Registratie currently complies with these requirements. However, it cannot be ruled out that in the future other credit registration agencies may also be regarded as a system of credit registration within the meaning of the bill. 
3.5.4. Credit registration was also discussed in Bill 29708 on the introduction of rules relating to the financial markets and their supervision (Financial Supervision Act): 
Lower House, session year 2005-2006, 29 708, no. 19
(p. 523)
Article 4:32
The obligation from this article is taken over from Article 52 of the Wfd. Under Section 14(2) of the Wck, participation in a system of credit registration was a requirement attached to the licence. In the explanatory notes to Section 52 of the Wfd it has been noted that the tasks of a credit registration system in any case include the collection, recording, ordering and making credit data available to participants and that the Stichting Bureau Krediet Registratie currently complies with these requirements. However, it cannot be excluded that in the future other credit registration agencies may also qualify as a system of credit registration within the meaning of this section.
(p. 524)
Article 4:34
In addition to the obligation to provide information as laid down in Article 4:20, the provider has an obligation, in respect of credit, to obtain information and to assess, on the basis of that information, whether the credit is responsible to the consumer in relation to the risk of over-indebtedness. This obligation is taken over from Article 51 of the Wfd and will be developed in subordinate legislation. In certain cases, the obligation will lead to the obligation to consult the database of a credit registration system prior to the conclusion of a credit agreement. The explanatory memorandum to Article 51 of the Wfd states that, in order to properly assess the consumer's financial position, the supplier of credit must have insight into both the income, for example the source and amount of the income of the consumer or relevant third parties, and certain fixed expenses of the consumer, such as the rent or mortgage charges, alimony and health insurance. (..). In doing so, the credit provider shall base himself on the information collected on the basis of the provisions of and pursuant to subsection 1. The rules that may be laid down by or pursuant to the Executive Order in Council may relate, among other things, to the information that must be collected pursuant to the first paragraph and to the answer to the question as to when excessive lending is involved.
Lower House, session year 2005-2006, 29 708, no. 37 
(p. 19)
Credit agreements
The members of the CDA group noted that in general consultations on 10 November 2005, agreements were reached on the maximum credit interest rate, registering credits from a certain amount and checking with the BKR Foundation before granting a credit. In the Wfd, which was dealt with in 2004, there were frameworks for this. Articles 4:34 and 4:35 do not mention anything more about this, except that further rules may be laid down in the AMvB. These members wanted to know whether the agreements made in this regard on 10 November 2005 would be laid down in an AMvB. If so, when can the House of Representatives expect this AMvB? When will these agreements come into effect, or have they already come into effect on 1 January 2006?
The agreements made on 10 November 2004 will all be implemented. As I indicated in my letter of 7 November 2004,
(p.20), the maximum credit remuneration has been reduced by amending the Credit Remuneration Decree. This amendment will take effect on 1 July 2006. Article 4:35 has been included in the bill to provide a basis for this Decree under the Financial Supervision Act as well.
As promised in my letter of 10 November 2004, the amount above which a lender is obliged to obtain information from a credit registration system has been reduced in the Bfd from € 1,000 to € 250. This amendment will enter into force on 1 May 2006 and will be taken over under the Wft.
3.5.5. In the context of Bill 33339 referred to above, parliamentary history subsequently reports the following:
Lower House, session year 2009-2010, 32 339, no. 3 (MvT), p. 4
In addition, the obligation on the lender to inform the creditor in advance of the repayment of the loan shall be waived.
(p.5) to assess the consumer's creditworthiness at the time the credit agreement is concluded, which is included in the Financial Supervision Act (Wft) (Article 8 of the directive). The Wft already regulates access to databases. Some changes are made to the existing provisions (Article 9 of the directive).
The exact content of the information obligations and the implementing rules on the creditworthiness test and access to databases will be further elaborated in the Financial Undertakings Supervision (Conduct Supervision) Decree (Bgfo), based on the Financial Undertakings Supervision Act (Wft).
(p.36) The supplier of credit has an obligation to obtain information and to assess, on the basis of that information, whether the granting of credit is responsible to the consumer in relation to the risk of over-indebtedness. In order to make a proper assessment of the consumer's financial position, the credit provider must have insight into both the income, e.g. the source and amount of income of the consumer or relevant third parties, and certain fixed expenses of the consumer, such as rent or mortgage charges, alimony and health insurance. Equity is also important for the assessment of the financial position of the consumer. A weak or uncertain position, for example that of young people on low incomes and low assets, is more likely to result in the conclusion of a credit agreement being irresponsible in the context of preventing the consumer in question from being overdrawn. 
Lower House, session year 2009-2010, 32 339, no. 6 (Memorandum following the Report), p. 4.
(p.2) For example, the directive will mean that all Member States will soon include in their legislation the obligation for credit providers to check, prior to granting credit, whether the credit is appropriate to the consumer's financial situation (creditworthiness test). Article 8 of the directive stipulates that each Member State must, in its national legislation, require creditors to carry out a creditworthiness assessment. Article 9 sets out how to deal with databases used to assess the creditworthiness (in the Netherlands, the Bureau Krediet Registratie performs this function). In addition, the directive also contains a number of transparency requirements, which can also help against excessive lending. This means that the duty of care against excessive lending, as currently laid down in the Wft in the Netherlands, will also apply in other Member States.
In response to the question of whether there may be a link between lending and debt problems, we note that irresponsible lending can of course lead to problematic debts. Part of the directive's provisions - in particular those concerning the assessment of creditworthiness - are intended precisely to prevent irresponsible lending. These provisions are very similar to the provisions we already know on the basis of the Wft. Practice has shown that these provisions are an effective means of preventing irresponsible lending.

3.5.6 In a letter dated 8 February 2011, the Minister of Finance discusses the system of credit registration as part of the amendment to the Financial Supervision Act (Financial Supervision Act) through bill 32339:
Lower House, session year 2010-2011, 32 339, no. 8 (Letter from the Minister 8 February 2011)
(p.1)
Lower regulation implementation of the Consumer Credit Directive

Ms Karabulut (SP) asked in particular about the interpretation of the creditworthiness test included in the Financial Supervision Act in the lower regulations. The aforementioned changes in subordinate legislation are the result of the implementation of the Consumer Credit Directive. With regard to the creditworthiness assessment, the directive contains a provision requiring Member States to carry out a creditworthiness assessment prior to the provision of credit to creditors. The Netherlands was already aware of this obligation. No new national policy is proposed for this implementation. According to research, a creditworthiness check is the most effective method. 
(p. 2)
against over-indebtedness. The test helps to predict (also for the group of risk consumers) whether the consumer will be able to meet the financial obligations associated with the loan. Incidentally, creditworthiness assessment does not only consist of regulations but also of self-regulation (codes of conduct for consumer credit, similar to the code of conduct for mortgage credit). (…)
As I answered parliamentary questions in November 2010, credit registration at BKR is an important means of completing the creditworthiness test. Credit registration that is as complete as possible is important for assessing whether a credit matches the consumer's financial position. For this reason, credit providers must be affiliated with a system of credit registration (BKR is currently the only system of credit registration that exists in the Netherlands). It should be noted that under the Financial Supervision Act (Wet op het financieel toezicht) only providers of credit are obliged to be affiliated to a system of credit registration. Until 1 January 2011, telecom companies were voluntarily affiliated with BKR. Registration of relevant arrears of payment is, in my opinion, useful for a thorough creditworthiness test. Of course, it is important to keep an eye on proportionality. In practice, registration does not mean that an application for a credit is rejected by definition. However, registration does mean that the arrears are taken into account in the decision as to whether the requested credit is justified in relation to the consumer's financial position.
Multiple registrations can also provide information about the payment morale of the consumer in question. In my view, years of exclusion from credit opportunities on the basis of a small registration, while the consumer's financial position otherwise offers scope for responsible credit, is not the intention and, according to what I have heard from credit providers, is not obvious either. It is up to credit providers to deal realistically with the information.
(p.3)
which they obtain on the basis of the BKR registration, as part of the overall creditworthiness test. Any amendments to the BKR regulations are for the participants of BKR. I have been informed that telecom providers are currently no longer registering with BKR but are exploring with BKR the possibilities of arriving at alternative registration. I applaud this, as the fullest possible picture of the consumer's financial position can ensure more appropriate lending".
3.5.7.1. In view of the above, the national obligation on lenders, if even necessary under EU law, to participate in a credit registration system is established.
3.5.7.2. The Stichting Bureau Kredietregistratie (hereinafter referred to as BKR) is the executor of the only credit registration system (CKI) in the Netherlands. As participants in BKR, Achmea and ABN AMRO are bound by the CKI General Regulations. The registration is carried out by BKR on the basis of the information provided by the participants. Pursuant to Section 4:34 of the Wft, providers of credit have an obligation to obtain information and, on the basis of that information, to assess whether the granting of credit is irresponsible for the consumer in connection with the risk of excessive lending. Information is also collected by consulting the CKI, and participants are obliged to report information to the CKI in relation to this information collection obligation. 
3.5.8 Then the question is how these obligations of Achmea and ABN AMRO relate to Article 6 paragraph 1 under c AVG, as also to be interpreted in the light of recitals 4 1 and 45 to the AVG.
3.5.9. The AP took the following position in its letter to the Minister of Finance dated 14 November 2019 (court: footnotes were omitted):
(…)
The social function of credit providers entails special duties of care towards (prospective) clients, both under civil law and under the Financial Supervision Act (Wft). One of the consequences of these duties of care is that, prior to granting a credit, a credit provider must in any event obtain sufficient information about the creditworthiness of (prospective) clients in order to prevent excessive lending. Executing these duty of care will
generally lead to processing of personal data. This always constitutes interference with the fundamental right to the protection of personal data of data subjects. An interference with this fundamental right is in principle unlawful, unless the presence of one of the foundations of Article 6 of the General Data Protection Regulation (AVG ) removes this unlawfulness.
Voluntary intervention can be based on the basis of 'consent' or on the basis of 'necessary for the execution of an agreement'. Processing that is necessary in the context of the duty of care applicable in contractual relationships can be based on this basis. Interference can also be involuntary, but must in principle be based on and elaborated in national legislation. Under the AVG, such legislation must be sufficiently clear and precise so that its application is predictable for the parties concerned. In the case of involuntary intrusion, it is
It is also up to the legislator to make the most important considerations from AVG's perspective in terms of collection, provision, storage, etc. The fact that it is the legislator who makes such considerations from the perspective of the public interest and not a private party is in itself an important guarantee from AVG's perspective.
The current legislation falls short on this point. The Wft does, in fact, contain specific obligations for credit providers: the obligation to participate in a system of credit registration, the obligation to consult data on credit that has already been granted for a credit to consumers above EUR 250, and - more generally - the obligation to obtain information before concluding a credit agreement or significantly increasing the credit limit in order to prevent the consumer's over-indebtedness. These obligations relate to the processing of
However, personal data are not further elaborated. Rules concerning the design, retention periods and guarantees of the register in which the appropriations are recorded in connection with the performance of that duty of care are lacking. Nor is it clear who - in addition to the lender who registers it and, of course, the client - may consult that register, when and under what conditions. It is also unclear whether - and, if so, for how long - credit data may still be stored once a credit has been terminated.
or redeemed and that data is in any case no longer relevant to the answer to the question whether there is overcrediting - the purpose of registration - is not answered in legislation. Even who may or must administer such a system of credit registration is not (deliberately) determined. In the history of the law, however, it is considered that one of the tasks of a credit registration system is in any case the collection, recording, organisation and making available to participants of data that are important for the assessment of the financial capacity of the consumer, taking into account such a large number of factors.
possible protection of privacy. However, this too has not yet been further elaborated in concrete legislation.
The fact that the current legislation falls short on the aforementioned points while credit providers must fulfil their duty of care means that the involuntary processing that is necessary in order to fulfil these duty of care can only be based on - in summary - f. Consequence of the lack of a general consideration by the legislator is that it must always be assessed per processing and per client whether the processing is and remains necessary and outweighs the protection of the personal data of the data subject.
In fulfilling these care obligations, the lenders make use of the services of the BKR Foundation, among other things. Because the duty of care rests with the lenders and not with Stichting BKR, the foundation may only do these processing for the legitimate interests of the lenders in fulfilling their duty of care. BKR itself cannot invoke this legal basis for these processing operations. After all, BKR - unlike the credit providers - cannot independently rely on an interest that is recognised in a
(written or unwritten) rule of law or principle of law such as a duty of care.
BKR registers sensitive personal data (credit, arrears) of - at the end of 2018 - almost 11 million people. In today's 'data-driven' society, the importance of this responsibility is of a different order than it was when BKR was set up in 1965. In view of the very large amount of sensitive data now available to the BKR, the AP considers it all the more important for the legislator to lay down safeguards and arrive at legislation in which the general interest of preventing excessive lending is explicitly weighed up by the legislator itself against the fundamental right.
on the protection of personal data of data subjects. Choices must then be made in that legislation with regard to those guarantees, third parties' rights of inspection, retention periods, etc.
Such legislation should also ensure that the continued existence of BKR is guaranteed, at least that these data are not lost or placed in the hands of unauthorised persons in the event of e.g. bankruptcy. Provisions on the method of financing BKR's activities and on the composition, appointment and required expertise of the board, amendments to the articles of association, adoption of the regulations and what to do in the event of loss of duties also seem appropriate. The design of credit registration as a well-defined statutory task or obligation, distinct from commercial activities, of a manager designated by (or pursuant to) law provides an unambiguous and uncontested basis for the AVG. More than one manager for such registration(s) is conceivable in itself; however, the added value of such registration(s) will have to be convincingly substantiated if it leads to extra processing of personal data between managers in order to arrive at a complete picture of a particular creditor. 
The AP recommends promoting legislation:
- where the breach of the fundamental rights of the persons concerned is explicitly weighed against the public interest at stake (avoidance of over-indebtedness);
-where the management of a credit registration system is assigned as a statutory task or obligation to a particular manager;
-which provides clear safeguards for those involved and for the proper performance of the tasks.
The AP intends to publish this advice after four weeks on the website 
www.autoriteitpersoonsgegevens.nl. Unless notified to the contrary, it assumes that there are no objections. (…)
3.5.10. In their book 'The General Data Protection Regulation in a European and Dutch perspective' (Wolters Kluwer, 2018), Kranenborg and Verhey write (among other things) the following about the scope of Article 6(1)(c) of the AVG and the requirements and preconditions applicable in that context (layout, bold and text is of the Court of Appeal):
(page 153 ff.)
7.3.6 Legal obligation
According to Article 6(1)(c) of the AVG, the data controller is authorised to process personal data if this is necessary for the performance of a legal obligation incumbent upon him/her. By 'legal obligation' is meant any obligation imposed by or pursuant to a generally binding regulation.
(...) It must be a legal obligation incumbent on the person responsible.
Processing of personal data in fulfilment of legal obligations of third parties
will have to find their basis elsewhere, e.g. under Article 6,
first paragraph, section f. For data processing in the public sector that are not
due to a legal obligation, a basis may in circumstances
are found in Article 6, paragraph 1, letter e. Furthermore, Article 6, paragraph 1 applies,
part c, can also be a basis for data processing in the private sector. This is
for example, the case if there is a legal obligation for a private party
to supply personal data to a public authority.
Parliamentary Papers II 2017/18, 34851, No 3, p. 34. The example of the
Statutory obligation for banks under Section 22 of the 2001 Income Tax Implementation Decree to provide annual data on their account holders to the Tax and Customs Administration for the purposes of taxation.
The legal obligation does not have to contain an explicit order to the
processing of certain personal data. Indeed, the situation may arise where the
data processing is an inseparable part of a more broadly formulated legal framework.
obligation. In that case, it is sufficient that the data processing is necessary for the execution of that legal obligation. In that case, however, the data controller has a greater personal responsibility in assessing the necessity of the data processing; he must demonstrate that without the processing of the data concerned it is not possible to fulfil the legal obligation properly. Parliamentary Papers II 2017/18, 34851, no. 3, p. 35. The AVG therefore does not prescribe that specific legislation is required for each individual processing operation. Legislation that serves as a basis for several processing operations is sufficient. See in this sense recital 45 of the AVG.
(…)
Further requirements are imposed on the statutory obligation. Pursuant to Article 6, third paragraph,
that legal obligation must be laid down by Union law or by Member State law which applies to the Member State in question.
person concerned applies. This means that Article 6(1)(c), as such
is not a separate legal basis for data processing but only determines
to which the effect in Union or Member State law required by Article 6(3) is given
must comply. Room documents II 2017/18, 34851, No 3, p. 36. The same applies to Section 6, first paragraph, under
e. See below point 7.3.8. Recital 41 of the AVG shows that the 'Member State law' created under Article 6(3) of the AVG does not necessarily have to be a law adopted or approved by a parliament. However, according to this recital, the legal basis or legislative measure must be clear and precise. In conjunction with this, its application must be predictable for those to whom it applies, as required by the case law of the Court of Justice and the ECHR.
By referring to this case law in recital 41 in the preamble to the AVG, the Member State should
as referred to in Article 6(3) of the AVG therefore meet the requirements of the ECHR
in the context of the condition that a restriction under Article 8(2) ECHR shall by law
must have been foreseen. According to the jurisprudence cited above, this means that such interference must
are based on a duly published legal regulation which provides that the citizen with
can draw up with sufficient precision the data relating to his private life
can be collected with a view to fulfilling a legal obligation, and
and under what conditions those data may be processed for that purpose,
preserved and used. A sufficiently precise legal basis is therefore required in that case.
This means that a general legal obligation cannot in all cases serve as
legal basis for data processing. In this sentence Parliamentary documents II 2017/18, 34851, No 3,
p. 36, with reference to ABRvS 3 February 2016, ECLI:NL:RVS:2016:253. See further on the legal requirement of Article 8(2) ECHR paragraph 2.4.4.
As noted above, according to recital 45, the AVG does not prescribe that each individual processing requires specific, tailored legislation. Legislation that serves as a basis for several processing operations on the basis of a legal obligation incumbent on the data controller is sufficient. However, according to Article 6(3), Union law or Member State law establishing the legal basis referred to in Article 6(1)(c) must meet an objective of general interest and be proportionate to the legitimate aim pursued.
The same conditions also apply to the basis for processing in Article 6(1).
member, section e, AVG. See section 7.3.8 below. The legal obligation must therefore also meet the necessity requirement itself.
(…)
Article 6(3) of the AVG provides that Union law or Member State law adopted on the basis thereof must determine the purpose of the processing. Furthermore, this provision
provided for the possibility of including in the relevant Union law or Member State law specific
include provisions to adapt the application of the rules of the AVG. The
national law may, as Recital 45 states, provide 'a more detailed description'.
of the following elements explicitly included in Article 6(3): general
conditions governing the lawfulness of processing by the controller; the types of data processed; the data subjects; the entities to which and the purposes for which the personal data may be disclosed; the purpose limitation; the storage periods; and the processing activities and procedures, including measures to ensure lawful and adequate processing, such as those for other specific processing situations referred to in Chapter IX.(...)
The precise scope of Article 6(2) and (3) AVG will have to be established. The
preamble gives little concrete explanation. In view of the material concordance
between the AVG and the former Directive 95/46 with regard to the legal basis of
The legal obligation under the AVG Implementation Act was the idea that the existing
laws and regulations in principle comply with the AVG (...)
3.5.11. A similar approach can be found in 'GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union',
Mariusz Krzysztofek ,(European Monographs, Wolter Kluwer 2019)
(p. 84)” Data may also be lawfully processed where this is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) of the GDPR). The
controller’s obligation justifying the processing of data must result directly from
applicable law but also, importantly, the processing of data in the specified scope must
be necessary to comply with that obligation. Legal obligation does not necessarily need to be provided for in a legislative act adopted by a parliament (recital 41 of the preamble to the GDPR). (…)
The requirement to specify a legal basis means that a general reference to a legal
act regulating the controller’s business, without invoking a specific provision imposing
the given legal obligation on the controller, is insufficient. This does not mean, though,
that every single operation of personal data processing must refer to a separate legal
basis. A legal regulation may serve as ‘a basis for several processing operations based
on a legal obligation to which the controller is subject’ (recital 45 of the preamble to the
GDPR).
(P. 85) (…)
The basis of processing data, referred to in Article 6(1)(c) of the GDPR, is the
processing being necessary for compliance with a legal obligation to which the
controller is subject. There is no reference to exercise of a legal right to which
the controller is entitled.
Indeed, legal provisions, as well as imposing obligations (such as to collect a
specified scope of legal data and other information and to notify any suspicions
resulting from these data for the prevention of money laundering, or to archive certain
categories of personal data for tax or pension purposes), also introduce rights whose
exercise requires the processing of personal data. Examples include an employer’s right
to use CCTV for security purposes or a bank’s right to use automated data processing,
including profiling, to assess a customer’s creditworthiness.
(…)
A natural solution to this problem would be to revise all national laws regulating
data processing in such a way as to provide for legal bases expressly allowing data to
be processed for specified purposes. Importantly, though, Article 6(1)(c) of the GDPR
requires that processing be necessary for compliance with a legal obligation, rather
than for the exercise of a legal right to which the controller is entitled. The use of CCTV
by an employer for security purposes or profiling by a bank for creditworthiness
assessment are their respective rights as controllers; there is no way data processing
can be seen as an obligation in these contexts. This, however, does not mean that the
use of CCTV is prohibited, either.
(…)
The circumstances of lawful data processing specified in Article 6(1) of the GDPR
are equivalent and alternative; however, if the lawfulness of data processing results
(p. 86) directly from a legal obligation of the controller, this basis of data processing should be invoked before the others.”
3.5.12. From the above it appears first of all that the ground for lawfulness as included in Article 6 clause 1 subsection c AVG - contrary to the arguments of [the appellant] - can indeed also be invoked by private parties, such as Achmea and ABN Amro.
3.5.13.1. From the system of credit registration as a clear legal basis under EU law and subsequently under national law, as set out in more detail above, it inevitably follows not only that there will be actual registration by lenders, but also that this will take place for a certain period of time. This also applies to the retention of the data concerned for a certain period of time. The latter is inherent in the prescribed system now that, in the context of (as far as possible) preventing excessive lending, the consumer's payment morale in respect of previously obtained credit also plays a role (see, after all, letter from the Minister dated 8 February 2011 in the context of Bill 32339 as shown above). 
Article 114 of the Financial Undertakings (Conduct Supervision) Decree (Besluit Gedragstoezicht Financiële Ondernemingen) refers to the obligation for 'a credit provider' to consult 'the data recorded in the credit registration system in which he participates on credits already granted to the consumer', with no limitation to credits still outstanding at that time.
3.5.13.2. The letter from the Minister of Finance dated 15 September 2017 (session year 2016-2017, 2715) discusses the retention period. In response to questions from the House of Representatives, the Minister is considering, among other things:
"(p. 3) When a backlog is repaid, it is also reflected in the CKI. The BKR has set the retention period at 5 years. At credit bureaus in neighbouring countries, arrears are generally kept for 7 years, but 
(p. 4) there are also countries where this is shorter (e.g. 3 years). In the Netherlands, there are various commercial trade information agencies that are united in the Netherlands Association of Trade Information Agencies (NVH). The NVH applies a retention period of 8 years in its code of conduct. At the moment I see insufficient reason to ask the BKR to include a shorter retention period in the general regulations. After all, a longer payment history gives the lender a more complete picture of a consumer's payment morale than a short period. If a lender is of the opinion that a (repaid) arrears of years ago should not stand in the way of a new credit application, then the lender is free to grant this credit. It is relevant in this respect that arrears for which registration has proved disproportionate can be removed by the lender'.
3.5.13.3. The Minister's response in 2011 as well as in 2017, at the time of the implementation of Directive 95/46/EC, indicates that BKR's approach to credit registration for the banks, and in any event the banks in the implementation of their obligations under the Financial Supervision Act (Wft), complies with the privacy rules of the Directive as formalised via the Personal Data Protection Act (hereinafter referred to as Wbpoud), which was repealed on 25 May 2018, while at the same time giving a correct interpretation to the credit registration system. That this has been the legislator's experience for years is also evident from the parliamentary documents quoted. 
The Court of Appeal also finds this approach at Kranenborg and Verhey, where they state
 'In view of the material similarity between the AVG and the former Directive 95/46 with regard to the legal basis of the legal obligation, the idea was in the AVG Implementation Act that existing legislation and regulations in principle comply with the AVG'.

3.5.14. Therefore, the Court of Appeal does not share the apparent view of the Personal Data Authority as quoted above that now certain aspects of the further elaboration of the mandatory system of credit registration are not explicitly regulated by law, only the so-called f-ground is or would be the processing ground. After all, this would mean that on the one hand there is a mandatory system of consultation of credit registration and therefore an obligation to cooperate in maintaining that system, which fully complies with the c-ground as a clear and precise legal basis. This while, on the other hand, even the most obvious implementing acts within this system such as the recording of credits and payment behaviour, sharing and keeping for some time (see above) would not fall under the 'necessary (processing) for the execution of a legal obligation'. 
Such a distinction does not only seem to the Court of Appeal to be unworkable for the time being in the context of an adequate and legally required credit registration, but is also not necessary to adequately protect the interests of the person concerned in accordance with the AVG. The Court of Appeal finds support for this approach with Kranenborg and Verhey, where they write (see above quote) that not every individual processing requires specific legislation tailored to that purpose, but that legislation that serves as a basis for several processing operations on the basis of a legal obligation incumbent on the controller - in this case the banks - is sufficient. 
3.5.15. In any event, the proportionality and subsidiarity test contained in the Supreme Court's ruling in the so-called 'Santander case' (ECLI:NL:HR:2011:BQ8097) is always applicable (see also below). 
3.5.16. In the opinion of the Court of Appeal, the obvious advantages of an extensive statutory regulation as evidently advocated by the AP do not affect the foregoing. 
3.5.17. The Court of Appeal therefore came to the conclusion that in order to fulfil their statutory duty to participate in a credit registration system (and everything that goes with it) the banks may have personal data such as those at issue here (such as that of [the appellant]) processed by/registered with BKR on the basis of Article 6, clause 1 (c) of the AVG. For this reason, the Court of Appeal is not in a position to discuss [the appellant's] assertions as based on Articles 6 clause 1 (f), 17 clause 1 and 21 clause 1 of the AVG, as has already been considered and decided by the court. 
The fact that these are fundamental rights does not detract from this, since - contrary to what [the appellant] seems to have argued - they are not absolute rights. 
This is not only fully evident from the case law of the Court of Justice of the EU, but also from Recital 4 to the AVG, which reads:
 "(4) The processing of personal data must be at the service of mankind. The right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society and weighed against other fundamental rights in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised by the Charter as enshrined in the Treaties, notably respect for private and family life, home and communications, protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial and the right to cultural, religious and linguistic diversity. 
The court rejects grievances 1 and 2.
3.5.18.1. Contrary to what was requested by [the appellant], the Court of Appeal does not consider it necessary to put preliminary questions to the Supreme Court in this case since the Court of Appeal is of the opinion that the parliamentary history and literature referred to above provide sufficient guidance to make a decision now. Furthermore, as indicated by [the appellant] himself, other Courts in similar case positions also rely on the applicability of Section 6, subsection 1 (c), of the AVG to credit registration, so that there is also no question of changing insights that could justify preliminary questions as such.
3.5.18.2. Since the Court is not entitled to ask preliminary questions, the condition to assess the provisional claim is not met. For the sake of completeness, the Court will understand in the operative part of the judgment that the condition under which the provisional claim has been brought has not been met. 
3.6.1. This does not detract from the fact - as indicated above - that the processing of personal data must comply with the so-called 'Santander rules' (ECLI:NL:HR:2011:BQ8097). This means that any data processing must comply with the principles of proportionality and subsidiarity. This implies that the interference with the interests of the data subject must not be disproportionate in relation to the purpose to be served by the processing, and that this purpose cannot reasonably be processed in another way that is less harmful to the data subject.
The same judgment also considers that, even if data processing is allowed in principle, the requirement that the processing must be necessary in the specific case in view of the defined purpose of the processing remains. Therefore, the presence of a legal justification does not make a balancing of interests on the basis of the above mentioned principles superfluous. This balancing must take into account all the circumstances of the case. 
The Court of Appeal sees no reason why the requirement of this balancing of interests, in this case with due observance of the statutory duty as described in detail above, as adopted by the Supreme Court under Section 8 of the Wbp-oud would not now apply under the AVG in a general sense and more specifically with respect to Section 6 of the AVG. This has not been argued by any of the parties to these proceedings. The banks have also referred to the Santander rules that they consider applicable. 
3.6.2. This assessment is in line with the [appellant's] grievances 3, 4 and 5, in which he argues - succinctly and concisely - that there are reasons and circumstances why the (customary) five-year registration period following termination of the credit relationship is not reasonable in his specific case. The appellant also submits that the credit registration system is punitive in nature. 
3.6.3. 3.6.3. [Appellant] did not or insufficiently explain why the credit registration system used by the banks in general, and the five-year period used in particular, was not lawful or correct. Nor did [the appellant] argue that a registered person cannot, broadly speaking, arrange his or her life as that person wishes. 
Item 60 of the notice of appeal states, on behalf of [the appellant], that the public interest of the credit registration system in general is explicitly not at issue in these proceedings. 
This leaves the question whether the five-year period, which is not prescribed as such by law but is used by the BKR itself, in this case 
1/ would not generally meet the requirements of proportionality and subsidiarity 
and/or 
2/ that period, if generally acceptable, would not be necessary for the processing of personal data in the specific case for the stated purpose. 
3.6.4. The court is unable to see why that five-year term would not generally meet the requirements of proportionality and subsidiarity. As noted by the banks, this period is equal to short-term limitation periods (compare Articles 3: 308, 309 and 310(1) of the Dutch Civil Code) and is equal to the duration of most financing agreements. This term is also used in the Natural Persons Debt Rescheduling Act (Wet schuldsaneringsregeling natuurlijke personen, Wnsp). In addition, a term must have a certain minimum duration in order to work. In addition, various trade information agencies that are united in the Netherlands Association of Trade Information Agencies even apply a term of eight years (see TK meeting year 2016-2017, Appendix to this document, 2715, questions to the Minister of Finance, Dijsselbloem), with which the AP has no problems. Therefore, the Court of Appeal comes to the opinion that the processing of personal data by financial institutions at the BKR and the five-year period used for that purpose meet the 'general' requirements of the processing pursuant to the Santander judgment.
3.6.5. Nevertheless, in individual cases, there may be circumstances which require a shorter registration period. In grievances 3, 4 and 5 and in general, [the appellant] has argued that he lives in a 'beep' small house, where his three daughters also stay regularly. In addition, he drives a small, overpriced Volkswagen Polo in which he has to carry computers and other equipment. He also sometimes has to pre-finance auxiliaries. According to the appellant, he had an income of € 10,000 (assumed by the Court of Appeal: per month) and his financial situation had been stable since 2010. 
The banks, on the other hand, argued that [the appellant] had accumulated arrears in the payment of mortgage charges in 2009 and 2010. Achmea has often tried to contact while, once contact had been made, [appellant] and his then wife did not show up at several appointments. At that time [appellant] also cooperated poorly with the sale of the marital home. After having received the clean slate in the wsnp trajectory by [appellant], Achmea had to write off the remaining debt of € 68.897,08. ABN AMRO also argued that it was difficult to reach agreements with [the appellant] at the time and that the financial situation of [the appellant] in 2010 was far from stable. In 2013, too, the financial situation was not yet stable.
3.6.6. Although [the appellant] rightly indicated that the court of appeal should assess 'ex nunc', the court of appeal is of the opinion that his earlier payment behaviour or the 'failure to remain in contact with creditors' or his payment morale is a relevant circumstance.
3.6.7. In addition to what the Court has already extensively considered and decided with respect to the balancing of interests that the Court takes over as its own, the Court further considered that - in contrast to the interests of financial institutions not to go into business with a possibly unreliable creditor and the interest of [the appellant] itself to be protected against excessive lending - insufficiently weighty reasons have been put forward to have the banks that have early delisted BKR. 
The wish of [the appellant] - without coding at the BKR - to enter into new financial obligations for the purposes set by him (larger living space, different car, different office furnishings) was considered by the Court of Appeal in itself to be of insufficient weight to have the 'BKR listing' (data processing), which did not prove to be based on incorrect principles, cancelled prematurely by the banks. In other words, before the usual five-year period has expired.
3.6.8. With regard to the lack of proportionality of the infringement of his interests as a data subject alleged by the [Appellant] in relation to the purpose to be served by the processing (adequate system of credit registration and protection of the [Appellant] and new lenders from excessive lending), the following can be noted.
3.6.8.1. At the time of the appeal hearing, [the appellant] was still unable to indicate what percentage of his (unsecured) creditors ultimately received in the context of the settlement of the statutory debt rescheduling he was going through. The [appellant] suspects a payment in excess of 50% but has not contested the substantial write-downs mentioned by the respective banks on their claims after the settlement of the debt restructuring. 
Contrary to [the appellant]'s own assumptions, the situation can be said to be definitively - in terms of debt burden - stable as of 2016 at the earliest, the date on which the clean slate was obtained. It was not until 2016 that the debts to the respective banks were also partially repaid.
3.6.8.2. If so requested, [the appellant] indicated that he wishes to keep the savings currently available as a pension accrual/ old-age reserve and as a reserve for incapacity for work, so that this cannot be used for the expansion of his business (including a better laptop and large(er) car, with or without increased boarding) and for the other expenses he wishes to incur in that connection. 
The Court of Appeal is of the opinion that [the appellant] is free to make these choices, but that this is a compelling reason to nevertheless wish to amend the usual term of storage of data in the CKI in
 this context. There is no presumption on the part of the banks in this respect. Furthermore, the fact that, in concrete talks with lenders, the [appellant's] bright prospects of his business, as he said, do not seem to carry sufficient weight in relation to BKR's information, so that there is not enough thorough investigation, is something which - apart from that - cannot be settled in these proceedings. 
3.6.8.3. With regard to the living space available to [the appellant], it appeared that this was a three-room flat instead of the two-room flat that the court had assumed. Without further explanation - which is lacking - it is not clear to the Court of Appeal why this living accommodation would be insufficient to receive his daughters from time to time, to work at home and to start living with his new partner. In any case, the [appellant] has not sufficiently substantiated why, now that he, according to his own words, earns € 10,000 per month - even if this is a gross amount - he cannot rent a larger house, whether or not financially assisted by his partner, and thus realize his wishes for more living space. Again, there is no compelling reason.
3.6.8.4. 3.6.8.4 Finally, it should be noted that, contrary to the arguments put forward by the [Appellant], credit registration also contains information on payment morals and, because of the registration of data relating to the past, it also provides a definitive answer to the question of whether - in the case of the [Appellant] - new creditors will be able to avoid excessive lending and overfunding. This has nothing to do with wanting to punish [the appellant], but everything to do with a sound system of credit registration and the prevention of financing problems among private individuals. 
3.6.8.5. In short, in the case of desired financing of the expansion of the company, the court of appeal is of the opinion that this argument has not been elaborated and substantiated sufficiently. The Court of Appeal is also unable to see why [the appellant], with a stated income of € 10,000 per month and his stated savings balance of € 40,000, cannot already rent a larger house or buy or lease another car. 
The court rejects grievances 3, 4 and 5. 
Legal costs
3.7.1. Both Achmea and ABN AMRO wish to order [the appellant] to pay the costs of the proceedings.
3.7.2. In this regard, the Court considers it appropriate to first consider the assessment framework as further outlined in ECJ EU 27 September 2017 C-73/16 on Peter Puškár v Finan?né riadite?stvo Slovenskej republiky, Kriminálny úrad finan?nej správy, ECLI:EU:C:2017:725. 

The Court of Justice is considering, inter alia:
"“54
Article 22 of Directive 95/46 expressly requires Member States to provide that every person may bring an action before the courts if the rights guaranteed to him by the national law applicable to the processing of personal data in question are infringed.
55
However, that Directive, which does not contain a provision regulating specifically the conditions under which such an appeal may be lodged, does not preclude national law also laying down the possibilities of appeal to the administrative authorities. On the contrary, the abovementioned Article 22 expressly states that the Member States are to '[u]nder the administrative remedy available, in particular to the supervisory authority referred to in Article 28 [of Directive 95/46], before the case is brought before the courts' provide that any person may bring an action before the courts.
(… )
57 
The Court of Justice has consistently held, in accordance with the case-law referred to in Article 4(3),
TEU lays down the principle of sincere cooperation with the courts and tribunals of the Member States.
Member States to ensure the judicial protection of the rights which individuals derive from Union law, while Article 19(1) TEU further requires Member States to provide for the necessary legal remedies to ensure effective judicial protection in the areas covered by Union law (see inter alia judgments of 8 November 2016, Lesoochranárske zoskupenie VLK, C 243/15, EU:C:2016:838, paragraph 50, and of 26 July 2017, Sacko, C 348/16, EU:C:2017:591, paragraph 29).
58 
This obligation imposed on the Member States is in accordance with the law laid down in
Article 47 of the Charter, entitled 'Right to an effective remedy and to a fair trial', according to which everyone whose rights and freedoms guaranteed by Union law have been violated has the right to an effective remedy before a tribunal.
Appeal (see to that effect judgments of 16 May 2017, Berlioz Investment Fund, C
682/15, EU:C:2017:373, point 44, and of 26 July 2017, Sacko, C 348/16, EU:C:2017:591, point 30).
59 
It follows that when Member States lay down the procedural provisions for legal actions brought to safeguard the rights granted by Directive 95/46/EC, they must ensure respect for the right to an effective remedy and to a fair trial enshrined in Article 47 of the Charter, which constitutes a reaffirmation of the principle of effective judicial protection (see to this effect judgments of 15 September 2016, Star Storage and others, C 439/14 and C 488/14, EU:C:2016:688, paragraph 46, and of 26 July 2017, Sacko, C 348/16, EU:C:2017:591, paragraph 31)
60
Consequently, the characteristics of the profession referred to in Article 22 of Directive 95/46/EC should be
be determined in accordance with Article 47 of the Charter (see by analogy
Judgments of 17 December 2015, Tall, C 239/14, EU:C:2015:824, paragraph 51, and of 26 July 2017, Sacko, C 348/16, EU:C:2017:591, paragraph 31). (…)
70
In this regard, the Court has already held that the - in Article 47 of the Charter
reaffirmed - principle of effective judicial protection does not preclude
national legal provisions governing the conduct of out-of-court procedures of
to make mediation a precondition for judicial appeal in the field of
to be able to bring electronic communications and consumer services if those proceedings do not result in a decision which is binding on the parties, if they do not cause a substantial delay in bringing an appeal, if they suspend the limitation period for the rights in question and if they do not entail any, or very limited, costs for the parties, provided that electronic means are not the only means of access to those proceedings and that interim measures may be ordered in exceptional cases where the urgency of the situation so requires (see to that effect judgments of 18 March 2010, Alassini and Others, C 317/08-C 320/08, EU:C:2010:146, paragraph 67, and of 14 June 2017, Menini and Rampanelli, C 75/16, EU:C:2017:457, paragraph 61.)
(…)
75
As the Advocate General has also pointed out in points 68 and 69 of her Opinion with regard to the costs of prior administrative appeals, although Member States are in principle free to fix an appropriate fee for bringing an appeal before an administrative authority, that fee may not be set at a level which could impede the exercise of the right to an effective remedy guaranteed by Article 47 of the Charter [vet, GHSHE] It must be borne in mind that that charge generates costs in addition to the costs of the appeal. [bold, GHSHE]
76 
In the light of all the foregoing, the answer to the first question referred for a preliminary ruling is that
Article 47 of the Charter must be interpreted as not precluding
provisions of national law under which a person who claims that his right to the protection of personal data guaranteed by Directive 95/46 has been infringed may bring an action before the courts only after exhausting the administrative remedies available to him, provided that the means of redress available to him in no way adversely affects in a disproportionate manner the right to an effective remedy provided for in that provision. In particular, prior exhaustion of the available administrative remedies must not significantly delay recourse to the courts, it must suspend the limitation period for the rights in question and it must not involve excessive costs [bold,
[GHSHE] attached to it."
3.7.3. The assessment of the applicability of Directive 95/46/EC, as superseded by the AVG as of 25 May 2018, is fully applicable to the AVG, as can also be seen from recital 9 of the AVG and from the judgment itself, since the Court of Justice bases its decision on the scope of Article 47 of the Charter of Fundamental Rights of the European Union (hereinafter also HEU) in relation to Article 22 of Directive 95/46/EC. Article 22 as intended has been seamlessly followed by Article 79 of the AVG, which explicitly refers to 'an effective remedy'. 
3.7.4. The above considerations of the Court of Justice were applied by the Court in GHSHE 1 February 2018, ECLI:NL:GHSHE:2018:363 that in the context of requests and appeals related to the Personal Data Protection Act (hereinafter also referred to as Wbpoud, as implemented in implementation of the Directive), there is in principle reason not to order the applicant/natural person who makes use of his rights under the Wbp/Directive and initiates legal proceedings in that context, even if he is found to be in the wrong, not to pay the costs of the proceedings of the data processor of his personal data. This applies in any case, irrespective of the outcome of the substantive side of the appeal, if a difference of opinion with regard to the implementation of the Wbp actually (has) arisen. 
3.7.5. Furthermore, in its judgment of 1 February 2018, the Court of Appeal considered that in so far as the rule is derived, inter alia, from HR 4 December 2015, ECLI:NL:HR: 2015:3477 - to the effect that rejection of the original applicant's appeal must lead to confirmation and an order for costs - in the case decided at the time also applies, the Court of Appeal took the view that this rule must be regarded as contrary to Article 47 of the Charter of Fundamental Rights of the European Union in this respect, also in view of the customary size of the costs of legal aid both at first instance and on appeal, as well as being an obstacle to the above position of the applicant and therefore in respect of applications covered by the Directive (now: the AVG). For this reason, the Court of Appeal did not apply the national rule referred to in that judgment.
3.7.6. The court of appeal sees no reason under the applicability of article 79 of the AVG, also in view of the requirement of effectiveness expressed therein, to rule otherwise with regard to the legal costs of the defendants on appeal in the context of an application for correction based on the AVG. In this case, it should be borne in mind that the [appellant] himself also had to incur legal assistance costs, or at least that this would not have been stated or proved otherwise. 
The costs of the appeal (both substantive and provisional) will therefore be compensated, so that each of the parties bears its own costs.
This entails - as covered by article 289 Rv - the nature of the procedure, as to be further explained in the key of what the Court of Justice is considering according to the aforementioned judgment of this Court of Appeal of 2018 and in view of the text of article 79 AVG. 
3.7.7. No grievances were formulated by [the appellant] against the order for costs in the first instance, in the sense that [the appellant] also specifically objected to the order for costs in the first instance as such, irrespective of the outcome of the substantive part of the appeal. 
3.7.8. 3.7.8. [Appellant] requested 'only' after the proposed - but rejected above - annulment of the decision of which appeal Achmea and ABN were ordered to pay the costs of both first instance and appeal.
3.7.9. This was explicitly different in the case from 2018, where moreover the natural person/applicant acted himself, without a lawyer. In that case, there was an express grievance against the order for costs at first instance as such, to the effect that an order for costs against the data subject in such cases was contrary to the Privacy Directive (95/46) and Article 47 HGEU.
3.7.10. The order for costs at first instance as such - irrespective of the substantive outcome of the appeal - does not form part of the appeal proceedings in the present case. Unlike in 2018, the court of appeal will therefore maintain the order for costs in the first instance in the present case. 
4 The decision
The court:
In 200,270,589/01:
ratifies the order of the District Court of Zeeland-West-Brabant, place of session 
Breda, of 21 October 2019, of which an appeal;
In 200,270,589/02
understands that the condition under which the provisional application was made is not fulfilled;
In 200,270,589/01 and 200,270,589/02
set off the costs between the parties on appeal in such a way that each party is ordered to bear its own costs;
rejects that which is different or more advanced.
This order was issued by R.R.M. de Moor, A.J. Henzen and M.W.M. Souren and publicly announced on 6 August 2020.


</pre>