Rb. Midden-Nederland - C/16/486566 / HA RK 19-238
| Rb. Midden-Nederland - C/16/486566 / HA RK 19-238 | |
|---|---|
 | |
| Court: | Rb. Midden-Nederland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 4(6) GDPR Article 17 GDPR Article 79 GDPR Article 35 Uitvoeringswet Algemene verordening gegevensbescherming |
| Decided: | 03.12.2020 |
| Published: | 02.07.2024 |
| Parties: | ING |
| National Case Number/Name: | C/16/486566 / HA RK 19-238 |
| European Case Law Identifier: | ECLI:NL:RBMNE:2020:3304 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | ec |
The court held that registration for late payment at the Central Credit Registration Office by a bank was automatic processing of personal data, which was done unlawfully by the bank. Therefore, the bank needed to comply with the request to erasure.
English Summary
Facts
The data subject had a bank account at a Dutch bank, ING (the controller). The account had a limit of €250. The data subject made use of internet banking to check their account and make transactions. The data subject also downloaded the controller’s mobile app. The website and the mobile app of the controller have an electronic message box that the controller uses to communicate with account holders.
The controller sent multiple messages to the electronic message box of the data subject that the account exceeded the €250 limit. The controller also stated that if the balance is not replenished to a positive amount within the given deadline, the controller was obligated to report the late payment to the Central Credit Registration Office (“Bureau Krediet Registratie – BKR”) under Article 13 of the Dutch General Regulations CKI (“Algemeen Reglement CKI – AR”).
Two months later, on 10 January 2019, the controller reported the late payment to the BKR. The data subject's BKR statement showed a so-called 2-code in the BKR's Central Credit Information System (“Centraal Krediet Informatiesysteem – CKI”). This special code entailed that the controller demanded payment of balance.
On 18 February 2019, the data subject supplemented the balance deficit.
The data subject initiated proceedings by application at the District Court Midden-Nederland (“Rechtbank Midden-Nederland”). The data subject requested the court to rule that the controller did not notify the registration at the BKR to the data subject, which is obligated under the GDPR. He was therefore unable to prevent the balance deficit. The data subject argued it had never seen the messages in the electronic message box as he had not logged in for a while, and he also did not receive push notifications on the app that there were new messages. The data subject argued that the controller should have notified him via a different way. The data subject therefore requested the court to order the controller to erase the registration of the data subject at the BKR under Article 17 GDPR.
The controller argued that under the Dutch General Regulations CKI, it is not obligated to notify the data subject of the registration of the special code. The controller also argued it had done everything to notify the data subject it had a balance deficit. According to the controller, placing a message in the electronic message box is sufficient because the account holder can be expected to read those messages. The controller also argued that its interest in enforcing the lawfully registrations prevails over the data subject’s interest in having them removed.
Holding
The court held that the CKI entails automatic processing of personal data. The court further held that the CKI is a filing system under Article 4(6) GDPR and that ING is a controller under Article 4(7) GDPR for the recording of the data subject’s personal data in the CKI. Therefore, Articles 15-22 GDPR apply and the data subject can request amongst other, rectification or erasure of their personal data.
The court further held that by refusal of these requests, the data subject can go to the court under Article 79 GDPR in relation to Article 35(1) of the Dutch GDPR Implementation Act and ask the court to order the controller to comply with requests under Articles 15-22 GDPR.
The court held that it can then review whether the controller’s compelling legitimate interests outweigh the interests or fundamental rights and freedoms of data subjects. In this case, it meant reviewing whether the dual purpose of credit registration (protecting consumers from over-indebtedness and alerting other credit institutions) overrides the interests or fundamental rights and freedoms of the data subject.
The court first reviewed whether the controller was right to report the special code to the BKR. Although the controller is obligated to report late payment to the BKR, the court held that the controller did not comply with the legal requirements of reporting this. The sending of a message to the electronic message box is insufficient, as the court held that it must also be established that the notification was received by the data subject. The court held that it cannot be expected from an account holder when it enters into an internet banking agreement, to know that all mail will only be sent electronically via a message box. Moreover, it cannot be established that the data subject expressly consented to the sending of important communications via the message box. The court therefore held that it was up to the controller to make sure that the messages/messages sent to the data subject actually reached him. Thus, the court held that the controller did not comply with the legal requirements by only communicating via the electronic message box.
The court then concluded that the registration of the special code in the CKI of the data subject was unlawful and that therefore ordered the controller to comply with the request to erasure under Article 17 GDPR. As the processing was unlawful, the court did not see the need to balance the interests of the controller and the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
