View source for Rb. Amsterdam - C/13/694440 / KG ZA 20-1118

{{COURTdecisionBOX

|Jurisdiction=Netherlands
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=Rb. Amsterdam
|Court_With_Country=Rb. Amsterdam (Netherlands)

|Case_Number_Name=C/13/694440 / KG ZA 20-1118
|ECLI=ECLI:NL:RBAMS:2021:174 

|Original_Source_Name_1=Rechtspraak
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2021:174
|Original_Source_Language_1=Dutch
|Original_Source_Language__Code_1=NL

|Date_Decided=21.01.2021
|Date_Published=29.01.2021
|Year=2021

|GDPR_Article_1=Article 6(1)(c) GDPR
|GDPR_Article_Link_1=Article 6 GDPR#1c
|GDPR_Article_2=Article 6(1)(f) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1f
|GDPR_Article_3=Article 17(1) GDPR
|GDPR_Article_Link_3=Article 17 GDPR#1
|GDPR_Article_4=Article 21(1) GDPR
|GDPR_Article_Link_4=Article 21 GDPR#1


|National_Law_Name_1=Article 35(2) Uitvoeringswet Algemene verordening gegevensbescherming
|National_Law_Link_1=https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=3&paragraaf=3.3&artikel=35&z=2020-01-01&g=2020-01-01

|Party_Name_1=HOIST FINANCE AB
|Party_Link_1=https://www.hoistfinance.nl
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_From_Body=
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=n/a
|
}}

The Amsterdam Court of First Instance referred multiple questions to the Supreme Court concerning the processing done by a credit institution and their legal bases. In particular, the court asked whether the  the person whose personal data have been recorded is entitled to invoke the right to erasure and  a right of objection as referred to in Article 17 and 21 of the GDPR. 
==English Summary==

===Facts===
Complainant’s debt at the predecessor of Hoist Finance was claimed by Hoist on 5 July 2006 because payment arrears. On 8 May 2006 a record of the payment irregularities was made in the Stichting Bureau Kredietregistratie (BKR register): code “A” was added to complainant’s name. On 28 June 2006 an additional code 2 was added to the registration, which mark the existence of a claimed debt. After the decision of the District Court of Groningen, the complainant agreed on a payment arrangement to pay the debt. On 1 June 2017 a code 3 was added to the complainant’s BKR registration to signify the payment agreement. The entire debt was paid on 27 June 2017.
On 17 July 2020 Hoist Finance notified the complainant that it would have the 3-code removed from his BKR registration in response to the complainant’s request. On 10 September 2020 another BKR registration deletion request was submitted, but Hoist Finance rejected it on 21 September 2020.


===Dispute===
Complainant claims that codes “A” and “2” must be removed from his registration because he is disproportionately affected by it. He is in the process of buying a house and he cannot get his mortgage approved. Complainant also points out that he hasn’t had any debts for 3 years. 
Hoist Finance disagrees: the complainant did not submit his objection to the rejection to Court within the legal term of 6 weeks (under Article 35(2) UAVG), which makes his request inadmissible. Heist Finance also argues that the complainant does not have an urgent interest, his A2 registration should remain for the term of 5 years and that the deletion request is not sufficiently substantiated. In particular, the reason for maintaining the registration is that the complainant has had financial problems for a long time, which means that lenders still require protection in this case.


===Holding===
The Court considered that there is doubt about whether Hoist Finance as a participant in the credit registration system makes credit registrations under Article 6(1)(c) or Article 6(1)(f) of the GDPR. If is also unclear whether the right to objection applies to BKR registrations and how Article 35(2) of the GDPR Implementation Act should be applied. The Court has mentioned three recent judgements.
Because of this uncertainty the Court is referring the following questions for the Supreme Court:

1. Should the processing of concrete personal data by a credit institution, by means of an individual registration in the system of the BKR, be assessed against the provisions of Article 6(1)(c) of the GDPR, or Article 6(1)(f) of the GDPR, or both provisions?

2. Does the answer to question 1 mean that

a. the person whose personal data have been recorded is not entitled to invoke the right to erasure referred to in Article 17 of the GDPR?

b. the person is not entitled to a right of objection as referred to in Article 21 of the GDPR?

3. If the answer to question 2.b. means that no right of objection as referred to in Article 21 of the GDPR exists in the case of a BKR registration, does that mean that Article 35 of the GDPR Implementation Act plays no role in the legal proceedings to delete that registration?


==Comment==

The cases considered by the Court 
Case ECLI:NL:GHSHE:2020:2536 Gerechtshof Den Bosch. The Court ruled that the bank could process personal data based on Article 6(1)(c) of the GDPR. Which means that the claimant does not have a GDPR right to object to the registration. This in turn means that Article 35(2) of the GDPR Implementation Act, which states that a request can be submitted to the civil court within six weeks after the decision, does not apply. 

Case ECLI:NL:GHDHA:2020:2068 Gerechtshof Den Haag. The Court ruled that Article 6(1)(f) provided for the legal basis for the BKR registration. According to the Court, there was a legal obligation to participate in a credit registration system, but not to make or maintain a concrete registration in an individual case. This means that the claimant has a right of objection based on Article 21(1) of the GDPR. In the event of a rejection of that objection the claimant must bring the matter before the civil courts in good time, within six weeks after the decision on the objection.

Case ECLI:NL:GHARL:2020:10564 Gerechtshof Arnhem-Leeuwarden. The Court ruled that the BKR registration was done under Article 6(1)(f) of the GDPR. 

==Further Resources==
''Share blogs or news articles here!''

==English Machine Translation of the Decision==
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

<pre>
Statement

verdict
COURT OF AMSTERDAM

Private law department, civil relief judge

case number / cause list number: C / 13/694440 / KG ZA 20-1118 MvW / JE

Interim injunction of 21 January 2021

in the case of

[claimant] ,

residing in [residence],

plaintiff by summons of December 16, 2020,

lawyer mr. RH Bouwman in Amsterdam,

against

the legal person under Swedish law

HOIST FINANCE AB ,

Located in Amsterdam,

defendant,

attorney mr. HAP Pijnacker in Tilburg.

The parties will hereinafter be referred to as [claimant] and Hoist Finance.
1 The procedure

At the hearing of December 24, 2020, [claimant] explained the claim as described in the summons. Hoist Finance has put up a defense. Both parties have submitted written documents and Hoist Finance also submitted a pleading note.

The following were present at the hearing:

    -

    [plaintiff] with mr. Bouwman;
    -

    on the side of Hoist Finance: mr. Pijnacker.

At the hearing, the preliminary relief judge provisionally ruled that [plaintiff] is inadmissible in his claim and expressed the intention to ask the Supreme Court for a preliminary ruling on the basis of BKR registrations. The questions to be asked were formulated on the same date and sent to the parties by e-mail. In accordance with article 392 paragraph 2 of the Code of Civil Procedure (Rv), the parties have been given the opportunity to comment on the intention to ask these questions, as well as the content thereof. To this end, the case has been stayed until January 7, 2021. The parties' attorneys responded to the intention in emails dated 29 December 2020 and 5 January 2021.

Mr. Pijnacker has taken the position that there is no need to refer questions for a preliminary ruling. Mr. Bouwman has reported that he can agree to ask preliminary questions, as formulated in draft by the preliminary relief judge. On January 11, 2021, mr. Bouwman reported that he wanted to propose an adjustment to the draft questions. Although submitted too late, mr. Bouwman's suggestion has been heeded. Verdict has been set to date.
2 The facts
2.1.

At some point [claimant] has taken out a credit with (a legal predecessor of) Hoist Finance. Due to a subsequent payment arrears, Hoist Finance claimed the credit on July 5, 2006.
2.2.

On 8 May 2006, [plaintiff] is with regard to the credit in the Central Credit Information System (hereinafter: the CKI) of the Credit Registration Office (hereinafter: the BKR) - a system in which payment arrears or other irregularities that arise during the term of a credit agreement with particularity codes are listed - under the name “[claimant]” with the particularity code “A”. This coding means that there is a backlog. On 28 June 2006, a 2-coding (together with the A-coding hereinafter: the BKR registration) was added to the listing in the CKI, which means that there is a claimed claim.
2.3.

In a judgment of the District Court of Groningen of December 12, 2006, [plaintiff] was ordered to pay (a legal predecessor of) Hoist Finance of € 5,000, plus the agreed credit compensation on this amount from November 7, 2006 until the day of the general satisfaction.
2.4.

[Claimant] has agreed a payment arrangement with NDA Incasso, to whom Hoist Finance had transferred the claim.
2.5.

On June 1, 2017, a 3-coding was added to the BKR registration, which means that an amount greater than € 250 had to be debited from the credit.
2.6.

In a letter dated 27 June 2017, NDA Incasso informed [claimant] that the entire claim had been paid.
2.7.

On July 17, 2020, Hoist Finance informed [claimant] that it would have the 3-coding in the CKI of the BKR removed, following a request made by [claimant].
2.8.

On September 10, 2020, mr. Bouwman on behalf of [claimant] again submitted a request for removal of the BKR registration to Hoist Finance. Hoist Finance rejected this request by email dated September 21, 2020.
3 The dispute
3.1.

[plaintiff] claims - in summary - to order Hoist Finance to have his BKR registration changed, in the sense that codes 2 and A will be removed after his name, with an order for Hoist Finance to pay the costs of the proceedings, plus interest. To this end, he states that he wants to buy a house, but that he cannot obtain a mortgage as a result of the registration. The deed of sale is scheduled to be executed on January 15, 2021. [Plaintiff] states that the registration will be disproportionately disadvantageous. He points out that he has been debt-free for three years.
3.2.

Hoist Finance argues against this - in short - that [plaintiff] responded too late to the negative decision of 21 September 2020 on his (second) removal request and is therefore inadmissible in his claim. Hoist Finance further disputes that [plaintiff] has an urgent interest in his claim. She also argues that the current registration will remain in place for five years, until June 1, 2022, and that [plaintiff] has not sufficiently substantiated why his interest in removal should outweigh the interest of maintaining the registration. The latter interest arises from the fact that there has been a bad financial situation at [plaintiff] for a longer period of time. Lenders must therefore still be protected in this case.
4 The assessment
4.1.

[Claimant] exercised his right to object to his BKR registration on 10 September 2020. He has that right on the basis of Article 21 of the GDPR, the General Data Protection Regulation (Reg. (EU) 2016/679). Article 12 (3) of the GDPR means that in principle Hoist had to respond to the objection of [claimant] within one month. It did so on 21 September 2020. Article 35 paragraph 2 of the General Data Protection Regulation Implementation Act (UAVG) stipulates that [plaintiff] had to apply to the court within six weeks thereafter. He did not. That is why the preliminary relief judge has provisionally ruled at the hearing that [plaintiff] is inadmissible in his claim.
4.2.

If [plaintiff] were admissible, the claim would have to be assessed in substance. It follows from the procedural documents that both parties assume that codes 2 and A were correctly included in the CKI of the BKR at the time. In case law, there is uncertainty as to whether Hoist, as a participant in this credit registration system, has thus complied with a statutory obligation, so that the registration is in principle lawful as referred to in Article 6 paragraph 1 preamble and under c of the GDPR. The courts of appeal have ruled differently on this. The following judgments can be cited as the most recent examples.

Den Bosch Court of Appeal 6 August 2020, ECLI: NL: GHSHE: 2020: 2536
4.3.

The court held that the defendant bank is obliged under Section 4:32 of the Financial Supervision Act (Wft) to participate in a system of credit registration. In the Netherlands, that is the CKI, of which Stichting BKR is the implementer. The court ruled that the bank was allowed to process the personal data of the petitioner pursuant to Article 6, paragraph 1, opening words and under c of the GDPR in order to fulfill its legal obligation. That is why the Court of Appeal did not get around to discussing the applicant's assertions based on Article 6 paragraph 1 opening lines and under f (the balancing of interests), 17 paragraph 1 and 21 paragraph 1 GDPR.
4.4.

The judgment of the court is thus understood that the applicant has no right under the GDPR to object to the registration. This means that Article 35 paragraph 2 UAVG, which states that an application - or claim - can be lodged with a civil court within six weeks of the decision on the objection, does not apply. If the term is exceeded, this will not result in inadmissibility.

Court of Appeal of The Hague 8 September 2020, ECLI: NL: GHDHA: 2020: 2068
4.5.

The court ruled that article 6, paragraph 1, opening lines and under f GDPR, in any case provided a basis for the BKR registration. According to this court, it is unlikely that the registration is also necessary to comply with a legal obligation of the participating bank. According to the court of appeal, there is a legal obligation to participate in a system of credit registration, but not to perform a concrete registration in an individual case, nor to maintain data of the person concerned in the system of the BKR. That is why, according to this court, the registration does not also fall under Article 6 paragraph 1 opening lines and under c GDPR. This means that the applicant has the right to object on the basis of Article 21 (1) GDPR, but also that, if that objection is rejected, he / she will be notified in good time, within six weeks of the decision on the objection,should bring the case to a civil court. If this is not done in time, an inadmissibility must follow.

Arnhem-Leeuwarden Court of Appeal December 17, 2020, ECLI: NL: GHARL: 2020: 10564
4.6.

The court joins the court of Den Bosch and not the court of The Hague.
4.7.

The following can also be noted here. If the basis of the obligation to process personal data in the present case were a 'legal obligation' (Article 6, paragraph 1, opening words and under c GDPR), then the question is whether, as a defense against this, the right to be forgotten. (Article 17 GDPR) can be invoked. If this is not the case, the person who wishes to remove a registration can apply to a court, which must then apply the Santander assessment criterion (Supreme Court, 9 September 2011, ECLI: NL: HR: 2011: BQ8097). The Den Bosch Court of Appeal also ruled in the above judgment. It can be argued that this test is less favorable for those whose personal data have been processed (see the note of CEF van Waesberge in JOR 2020/10 at the Amsterdam District Court, 9 May 2019, ECLI: NL: RBAMS: 2019: 3857).
4.8.

The preliminary relief judge is of the opinion that the line of the Court of Appeal of The Hague must be followed. The legal obligation as referred to in Article 6, paragraph 1, opening words and under c of the GDPR does not mean for banks that participate in the credit registration system of the BKR by virtue of Article 4:32 Wft, that every concrete registration must also be considered as' necessary to comply with a legal obligation '. The concrete registration is done for the implementation of the legal obligation, which implementation is based on the General Regulations CKI of the BKR. These regulations cannot be regarded as a 'legal' regulation as referred to in Article 6 paragraph 1 opening lines and under c GDPR.
4.9.

This judgment means that the BKR registration of [claimant] can be tested against Article 6 paragraph 1 opening lines and under f GDPR. But it also means, in the opinion of the preliminary relief judge, that [plaintiff] is too late with his claim and must be declared inadmissible (compare also the cited decision of the court of appeal in The Hague).
4.10.

Because the courts are divided, it is uncertain whether this provisional judgment is correct. That is why the Preliminary Relief Judge of its own motion is of the opinion that it is necessary to request the Supreme Court for a preliminary ruling that is important for the settlement or termination of numerous other disputes arising from similar facts, in which the same question arises (see article 392, paragraph 1, opening words). and under b, Rv). After all, cases in which it is requested or (in summary proceedings) claimed to have a BKR registration removed, occur frequently.
4.11.

The registrar will be instructed to send the case file to the Supreme Court, simultaneously with this judgment.
4.12.

After the answer of the Supreme Court has been received, the preliminary relief judge will give the parties the opportunity to comment on this in writing, after which a final judgment will be rendered.
5 The decision

The preliminary relief judge
5.1.

the Supreme Court asks the following questions:

1. Must the processing of concrete personal data by a credit institution, by means of an individual registration in the BKR system, be assessed against the provisions of Article 6, paragraph 1, opening words and under c, GDPR, or against Article 6, paragraph 1, opening words? and under f GDPR, or both provisions?

2. Means the answer to question 1

a.that the person whose personal data has been registered cannot invoke the right to erasure as referred to in Article 17 GDPR?

b. that the person has no right of objection as referred to in Article 21 GDPR?

3. If the answer to question 2.b. means that there is no right to objection as referred to in Article 21 of the GDPR in the case of a BKR registration, does this mean that Article 35 of the UAVG does not play a role in the legal proceedings for the removal of that registration?
5.2.

orders the registrar to forward the case file to the Supreme Court,
5.3.

suspends any further decision.

This judgment was rendered by mr. M. van Walraven, preliminary relief judge, assisted by mr. JM Eisenhardt, registrar, and pronounced in public on January 21, 2021. 1
</pre>