Rb. Amsterdam - ECLI:NL:RBAMS:2023:7218
| Rb. Amsterdam - ECLI:NL:RBAMS:2023:7218 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(f) GDPR |
| Decided: | 15.11.2023 |
| Published: | 01.12.2023 |
| Parties: | Rabobank |
| National Case Number/Name: | ECLI:NL:RBAMS:2023:7218 |
| European Case Law Identifier: | ECLI:NL:RBAMS:2023:7218 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
A Court refused to enforce a data subject's objection to processing (Article 21(1) GDPR), which requested that their negative credit registration be removed from the Netherlands' national Credit Information System, as the data subject had no overriding interests, rights or freedoms against the legitimate interests of the controller.
English Summary
Facts
Rabobank (the controller) provided a business loan of €86,000 to the data subject in 2008. In 2014, the controller terminated their financial relationship with the data subject, as the data subject was unable to meet payments on time and had exceeded their credit limit.
In 2015, the data subject negotiated a new payment plan with the controller, but they were unable to maintain this. In September 2022, the data subject reached a new agreement with the controller, where the data subject paid €27,375 to the controller and the controller wrote off the remaining debt. On 6 October 2022, the controller formally waived their remaining claim against the data subject and the data subject was negatively registered in the national Credit Information System (CKI). Under domestic regulations, the data subject's negative registration could only be removed after five years, on 6 October 2027.
On 6 February 2023 and 27 February 2023, the data subject requested the controller to remove his negative registration from the system so that he could purchase a commercial property. In response to both requests, the controller refused, noting that there were no compelling grounds to shorten the five year registration period.
Following the controller's refusals, the data subject filed a claim with the District Court of Amsterdam, requesting that his negative registration be removed. As part of this request, the data subject made an objection to the processing of his personal data under Article 21(1) GDPR.
Holding
The Court refused to enforce the data subject's request, as they found that the data subject had no overriding interests, rights or freedoms against the legitimate interests of the controller under Article 21(1) GDPR.
The controller used Article 6(1)(f) GDPR as a legal basis for processing the data subject's personal data. In determining whether the data subject's interests, rights or freedoms could outweigh the legitimate interests of the controller, the Court took into account the following factors as part of its balancing exercise:
- the size of the debt and/or arrears;
- whether any payment arrangement has been properly fulfilled;
- the reason for (the occurrence and persistence of) the arrears and the degree of culpability;
- the current financial situation of the person concerned (including income) and if it is stable again: for how long;
- whether the person concerned has other debts;
- whether there has been serious default (structural or otherwise);
- the circumstance that the person concerned cannot wait with the loan (e.g. to buy a house) until the five-year period has expired (e.g. because of family and housing situation);
- the passage of time since repayment of the debt;
- the extent of the write-off.
The Court noted that in this case, there was a substantial debt (€86,000.00), which the controller eventually wrote off more than half of (over €51,000.00), and the data subject had failed to meet its repayment obligations multiple times. Moreover, only one year of the five-year registration term had elapsed, therefore, the threshold for deletion of the registration was still high.
As a result, the Court held that the data subject had no overriding interests, rights or freedoms against the controller, who had a legitimate interest in maintaining the negative registration and was entitled to reject the data subject's request.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
