GHAL - 200.266.445
From GDPRhub
| Hof Arnhem-Leeuwarden - 200.256.387 | |
|---|---|
 | |
| Court: | Hof Arnhem-Leeuwarden (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(c) GDPR |
| Decided: | 3. 12. 2019 |
| Published: | 9. 12. 2019 |
| Parties: | ING Bank N.V.
International Card Services B.V. |
| National Case Number: | 200.256.387 |
| European Case Law Identifier: | ECLI:NL:GHARL:2019:10345 |
| Appeal from: | Rb. Midden-Nederland (District Court of First Instance) |
| Language: | Dutch |
| Original Source: | de Rechtspraak (in NL) |
The Arnhem-Leeuwarden Court of Appeal confirmed the first instance decision regarding the balancing of interests under Article 21(1) GDPR. In particular, the Court also considered the subjective position of the data subject. At the time of the facts, she was a registered accountant, and this made her conduct even more serious.
English Summary
Facts
The Durch Stichting Bureau Kredietregistratie (BKR), a private entity founded by banks, runs a Central Credit Information System (CKI). Dutch law requires banks to be connected to the CKI.
The claimant wanted certain data to be delete. It brought a legal action based on Article 17 GDPR and Article 21 GDPR, read in conjunction with the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp). The Court of First Instance rejected the claims and dismissed the requests. Thus, the plaintiff appealed the decision before the Court of Appeal.
Holding
The Arnhem-Leeuwarden Court of Appeal found that the registration of personal data in the CKI of the BKR does constitute processing of personal data under Article 6(1)(c) GDPR. In this instance, this means that the processing at stake is necessary for the compliance with a legal financial obligation and leads to several consequences.
First, whenever the legal basis of the processing is necessary for compliance with a legal obligation each Member State may introduce more specific provisions according to Article 6(2) GDPR. In the present case, the processing is carried out under a national legal obligation and for the performance of a task carried out in the public interest since this system is the only credit registration system in the Netherlands. In addition, insofar the compliance with a legal obligation constitutes the primary the legal basis under Article 6(1)(c) GDPR, the Court found that the data subject cannot exercise his right to object pursuant to Article 21(1) GDPR.
Secondly, the right to erasure does not apply to the extent that the processing is necessary for the compliance with a legal obligation carried out in the public interest, by virtue of Article 17(3)(b) GDPR.
Indeed, it further is justified that the task carried out in the public interest under Article 6(1)(e) GDPR does not constitute an appropriate and adequate legal basis for all the personal data processed.
Lastly, the Court recalled that other GDPR principles apply as well. As a consequence, the data controller has to process the personal data to the extent this is necessary for and proportionate to the purpose of the compliance.
In this case, the Court found that the processing was lawful.
Comment
Share your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the Dutch original for more details.
DECISION 1 The further course of the proceedings on appeal 1.1 The court of appeal refers to its judgment of 9 July 2019 for the course of the proceedings in the first instance and the course of the proceedings on appeal up to that point. 1.2 The further course of the proceedings can be seen from the following: - the minutes of the multiple composition of the parties held on 10 September 2019. 1.3 Subsequently, the Court of Appeal issued a judgment. 2 The established facts The Court of Appeal bases its appeal on the facts as described in paragraphs 2.1 up to and including 2.9 of the judgment under appeal. 3 The dispute and the decision in first instance 3.1 In the first instance, [the appellant] claimed, in summary, that the Court in preliminary relief proceedings should order ING c.s. and Arrow Global Benelux Holdings B.V. (hereinafter referred to as: Arrow) to remove the codes from the CKI within 48 hours and to keep them removed, on pain of a penalty of € 1,000 per day with a maximum of € 100,000. 3.2 By judgment of 20 February 2019 the Court in preliminary relief proceedings declared [the appellant] inadmissible his claim against Arrow and dismissed the claims against ING et al., ordering [the appellant] to pay the costs of the proceedings and the follow-up costs. 4 The grounds of the decision on appeal Core of the case 4.1 Briefly summarised, the case at hand is as follows. The [appellant] was an entrepreneur between 1997 and 2014. He had transferred his entrepreneurial activities to companies associated with him and financed them mainly by means of loans from, inter alia, ING and Rabobank. For some of the business loans, [the appellant] had provided a declaration of joint and several liability or a guarantee. In addition, [the appellant] had borrowed money in a personal capacity from LaSer Lafayette Services Nederland B.V. (hereinafter: LaSer), ING and ICS. [Appellant] was in arrears with LaSer and ING c.s. LaSer, ING and ICS have at any time proceeded to claim their claims. As from mid-2015, [appellant] has gone through an extrajudicial process under the supervision of Kredietbank Limburg (hereinafter: the debt restructuring process). This debt restructuring process resulted in an (extrajudicial) agreement with the creditors that was signed on 16 August 2018. At the start of this process, the debts amounted to approximately € 1,464,567.26. During the debt restructuring process € 36,532.48 of this amount was paid to the creditors. At the end of the debt restructuring process, the remaining portion of the debts to [the appellant] was waived. In August 2018, LaSer, Arrow Global Limited (to whom LaSer had sold its loans to [the appellant]), ING and ICS had the Central Credit Information System (CKI) of the Stichting Bureau Krediet Registratie (hereinafter referred to as: BKR) register special asset codes 2 (the claim has been made payable) and 3 (an amount in excess of € 250 has been written off). Rabobank placed a code 3 in the BKR on 15 November 2018 - with retroactive effect to 16 August 2018. (All these codes by ING c.s. will hereinafter be referred to as: the codes). For five of the seven credits it is stated that the contract will be removed in August 2023, if no changes are made. On 20 September 2018, [Appellant] submitted a request to ING and ICS to remove the encryption registrations. That request was rejected by ING and ICS on 2 October 2018 and 28 September 2018, respectively. The claim of [Appellant] on appeal 4.2 The [Appellant] challenged the rejection by the Court in preliminary relief proceedings of its claims against ING et al. with eight grievances. In summary, he requests on appeal that the judgment of the Interim Injunction Judge of 20 February 2019 be set aside and that the claims brought in the first instance be allowed, with ING c.s. being ordered to pay the costs of the proceedings in both instances, the surcharges and statutory interest. The complaints lend themselves to joint handling. Urgent interest in the claimed provision 4.3 The court of appeal states first of all that when answering the question of whether a remedy sought in interim relief proceedings, either after granting or after refusing it, qualifies for grant on appeal, it must also be assessed, if necessary ex officio, whether the plaintiff had an urgent interest in that remedy at the time of the judgment of the court of appeal (HR 31 May 2002, ECLI:NL:HR:2002:AE3437). The question whether a plaintiff in preliminary relief proceedings has a sufficiently urgent interest in the requested remedy must be answered on the basis of a weighing of the interests of the parties, assessed according to the situation at the time of the judgment. 4.4 The court of appeal will first form a provisional opinion of the law to be applied and then assess whether, in view of the interests of the parties, the requested interim relief should be granted. The legal framework 4.5 [Appellant] based his claim primarily on Articles 17 and 21 in conjunction with Article 6 of the General Data Protection Regulation (hereinafter referred to as: AVG) and, in the alternative, on Articles 6:162 and/or 168 of the Dutch Civil Code (hereinafter referred to as: BW). In answering the question of whether the codings placed by ING c.s. should be removed, the following legal framework therefore applies. 4.6 Article 6 of the AVG contains an exhaustive list of the circumstances under which the processing of personal data is lawful. This is the case, among other things, if the processing is necessary in order to comply with a statutory obligation incumbent on the data controller (Article 6.1(c) AVG). It follows from recitals 41 and 45 of the AVG that this does not necessarily have to be a law in a formal sense, nor is it required that each individual processing is subject to specific legislation. Legislation that serves as a basis for several processing operations on the basis of a legal obligation incumbent on the controller, or for processing necessary for the performance of a task in the public interest, would suffice. 4.7 ING c.s. are providers of credit within the meaning of Section 1:1 of the Financial Supervision Act (Wft). Pursuant to Sections 4:32(1) and 4:34 of the Wft, they are obliged to participate in a system of credit registration. The Central Credit Information System (CKI), which is maintained by the Bureau for Credit Registration (BKR) in Tiel, is the (only) existing system of credit registration in the Netherlands. The CKI contains automated processing of personal data to which the GTC applies. ING c.s. are participants in the CKI and, as participants, are bound by the CKI General Regulations adopted by the BKR. 4.8 The [Appellant's] personal details have therefore been recorded on the basis of a statutory obligation as referred to in Article 6, clause 1 (c), of the GCG. 4.9 If the processing of personal data, as in this case, is based on a statutory duty, the data subject ([appellant]) is not entitled to the right to erasure of data laid down in Article 17 of the AVG, as follows from Article 17, clause 3 (b) of the AVG. Nor does the data subject in that case have the right of objection as referred to in Article 21 of the AVG, since that right is linked to data processing on the basis of Article 6 clause 1 under e or f of the AVG. 4.10 However, the protection of natural persons in the processing of personal data is a fundamental right, according to consideration 1 at the AVG. The fundamental right to the protection of personal data is further enshrined in Article 10 of the Constitution and in Article 8 of the Charter of Fundamental Rights of the European Union, while as part of private life it is also protected in Article 8 of the European Convention on Human Rights (ECHR) and Article 17 of the International Covenant on Civil and Political Rights (ICCPR). 4.11 Recital 39 of the AVG also states that the personal data being processed must be adequate, relevant and limited to what is necessary for the purposes for which they are processed. Personal data may only be processed if the purpose of the processing cannot reasonably be achieved in any other way. 4.12 In addition, recital 47 of the AVG states that the legitimate interests of a controller or of a third party may provide a legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject are not overridden, taking into account the reasonable expectations of the data subject based on his or her relationship with the controller. A careful assessment should be made to determine whether a legitimate interest exists, as well as to determine whether a data subject may reasonably expect processing to be carried out for that purpose at the time and in the context of the collection of the personal data. 4.13 The above implies that even if the processing of personal data is based on a statutory obligation (in this case the Wft), the task of carrying out that obligation does not automatically justify any data processing. As was the case under the Personal Data Protection Act (Wbp), any processing of personal data must meet the requirements of proportionality and subsidiarity and, in view of the nature of the invasion of privacy, a case-by-case weighing of interests is necessary. 4.14 In this context, it should be borne in mind that in its judgment of 9 September 2011 (ECLI:NL:HR:2011:BQ8097), the Supreme Court considered that the Wbp, which was still in force at the time, should be interpreted in accordance with the provisions of Article 8 of the European Convention on Human Rights and that it follows from the legislative history of the Wbp that any data processing must comply with the principles of proportionality and subsidiarity. In the opinion of the Supreme Court, this means that the interference with the interests of the data subject may not be disproportionate in relation to the purpose to be served by the processing, and that this purpose cannot reasonably be processed in another way that is less disadvantageous to the data subject. Since the purpose of the AVG is not to limit the rights of natural persons to the protection of their personal data (with respect to the Personal Data Protection Act), the aforementioned principles also apply to the processing of personal data pursuant to the AVG. 4.15 For the reasons stated above, the mere fact that Articles 17 and 21 of the AVG do not provide for the possibility of invoking the right to erasure of data and the possibility of objection in the event that the data processing is based on a statutory obligation, cannot lead to the conclusion that there is then no longer any place for review in the light of the principles of proportionality and subsidiarity and a balancing of interests. In the opinion of the Court of Appeal it also applies if, as has been brought forward here (by ING and ICS), a request for removal has been made outside the period of six weeks referred to in Section 79 of the AVG in connection with Section 35 of the AVG Implementation Act (UAVG). On this point, too, there is no reason to judge differently under the AVG than under the Wbp. 4.16 Data processing that conflicts with the aforementioned principles and in which the interests of the data subject outweigh the interests to be served with the processing must therefore be regarded as unlawful. Examination in the light of the principles of proportionality and subsidiarity and the balancing of interests 4.17 In answering the question of whether ING c.s. should remove the BKR registrations because their enforcement is unlawful, it is not so much a question of weighing up the interests between [the appellant] and ING c.s., but of verifying the purpose of the coding registrations against the principles of proportionality and subsidiarity. In this way, the interests of [the appellant] in the removal of the codes in question will be weighed against the underlying interests of (maintaining) the registration of the codes. 4.18 The purpose of (the registrations pursuant to) the CKI is to promote socially responsible financial services. BKR wants to protect consumers from excessive lending and other financial problems (problematic debt situations). In addition, BKR makes a contribution for its business affiliates to limiting the financial risks in lending by informing these lenders of relevant peculiarities that have occurred in the recent past. To this end, late payments or other irregularities that arise during the term of a loan are reflected in the CKI by means of a special-purpose code. Once the claim has been settled, a maturity date shall be recorded with the contract and a period of five years shall run, after which the speciality code shall be removed. 4.19 In view of the objectives of the CKI's system, the registration of the specialty codes relating to [the appellant] is therefore proportional. Registration is also in line with the subsidiarity principle, as there is no other means for lenders to learn about the [appellant's] financial past other than by consulting the CKI. 4.20 In view of these objectives of the CKI system, the importance of continuing the BKR registrations is also given. After all, deleting or amending the BKR registrations would result in an incorrect representation in the CKI of [the appellant's] payment transactions and their history, thus undermining the purpose of the BKR. 4.21 4.21 [Appellant] has taken the position that he has a legitimate interest in removing the encodings because they impede him in obtaining a mortgage loan. He argues that he needs this loan, because otherwise he will not be able to obtain housing for him, his girlfriend and his girlfriend's children. In addition, he argues that he has been in permanent employment for a long time, so that he is financially stable. He now earns modal wages twice, while his girlfriend also has a fixed income. He argues that he has taken over the debts of the companies on the basis of a high payment morale and that he had a net disposable income of € 580 per month for many years during the debt restructuring process. 4.22 ING c.s. substantiated that these were only business debts, which [the appellant] would have taken over for noble reasons. Subsequently, [the appellant] did not substantiate its claims on this point, nor did it address any grievances against the fact established by the Court in preliminary relief proceedings under 2.1 of the contested judgment that [the appellant] had borrowed money from ICS and LaSer in a personal capacity and that he was liable in person for part of the business loans. Therefore, for the time being, the Court of Appeal assumes that the registrations of the codings are related to substantial debts arising not only from business credits for which [the appellant] had assumed personal liability, but also from private credits. 4.23 The mere fact that, as a result of the (enforcement of the) codings, [the appellant] encounters difficulties in obtaining a mortgage loan and for this reason finds it difficult or virtually impossible to buy a home - however annoying for [the appellant] - does not outweigh the interest of potential lenders in being able to weigh up whether or not to enter into a (mortgage) credit agreement with [the appellant] on the basis of full information. This is all the more compelling in the present case in view of the high level of indebtedness, most of which was only recently written off after only a small proportion of the total debt had been repaid. Potential lenders have a legitimate interest in learning about this credit history, so that they can see the details of the credit granted to [the appellant]. The fact that [the appellant] had been in permanent employment for a long time and is now earning considerable income from it does not make this any different. 4.24 Moreover, contrary to the [appellant's] assertion, it has become insufficiently plausible that [the appellant] would be unable to live anywhere as a result of the credit registrations. After all, it has been pointed out by ING et al. that [the appellant] is currently renting a dwelling under an open-ended tenancy agreement. The fact that, for personal reasons, [the appellant] would prefer not to invoke rent protection against the landlord and may therefore have to leave this property in the event of a possible sale thereof - as he stated during the appeal before the court of appeal - constitutes a circumstance that he cannot invoke against ING et al. The circumstance that the rent of the home is considerably higher than the amount that [the appellant] would have to pay in mortgage interest and redemption for a comparable owner-occupied home does not weigh sufficiently heavily either, against the background of the circumstances referred to under 4.23 above. 4.25 Needless to say, the Court of Appeal also noted that ING and Rabobank have initiated a preliminary hearing of witnesses, because they claim that they may have erred in entering into and/or the course of the debt rescheduling process. In this respect they explained that a debt to the father of [the appellant] may not have been remitted. In addition, they pointed out that it appeared to them that [the appellant's] salary increased substantially almost immediately after the debt restructuring process was completed, while it is not clear why [the appellant] would not have been able to receive this higher salary during the debt restructuring process and would therefore have been able to pay a larger proportion of his debts. It is true that the Court of Appeal cannot at this moment form an opinion on the question whether [the appellant] was guilty of facts that put ING and Rabobank on the wrong foot during the debt rescheduling process, but the circumstance that there is still uncertainty as to whether the debts of [the appellant] to ING and Rabobank have actually been discharged, is also a circumstance that weighs up in the balancing of interests. 4.26 The above leads to the conclusion that, for the time being, the weighing of interests to be carried out should be to the disadvantage of [the appellant]. Now that it has not emerged for the time being that the consequences of the BKR registrations for [the appellant] are so disproportionate that the interest in continuing to do so should give way and that the principle of subsidiarity has also been complied with, the processing (or retention) of [the appellant's] personal data in the CKI does not conflict with the fundamental rights referred to under 4.10 and is not unlawful. 4.27 The grievances therefore fail. The other points raised by the parties in the context of the grievances put forward do not require further discussion, as this could not lead to a different conclusion. Evidence on offer 4.28 As a starting point, given the nature of the preliminary relief proceedings, there is generally no place in these proceedings for comprehensive proof. It has not been sufficiently stated or shown that in this case there are reasons to deviate from this principle. The Court of Appeal therefore disregarded the offer of evidence made by [the appellant]. Requests made in the responses of ING and Rabobank 4.29 ING has asked the court of appeal, when ratifying the judgment and the order to pay the costs of the proceedings, to redefine the salary of the lawyer at first instance. However, ING did not make this request in a ground of appeal that was recognisable as such, let alone that ING lodged an incidental appeal and formulated a petition in it. The Court of Appeal therefore disregarded ING's request. 4.30 The request made by Rabobank to order [the appellant] to pay the costs of the proceedings of Rabobank cannot be granted for the same reason, if and insofar as this would have allowed Rabobank to pay the costs of the proceedings in the first instance. 5 The Conclusion 5.1 The grievances fail. The contested judgment will be ratified. 5.2 As the unsuccessful party, the Court shall order [the appellant] to pay the costs of the appeal. The costs of the proceedings on appeal on the part of both ING, ICS and Rabobank are estimated at € 741 in disbursements and at € 2,148 for salary in accordance with the liquidation rate (2 points x rate II). If not contested, the court will also award the claimed statutory interest on the litigation costs to be paid to ING and the after costs as mentioned below. 6 The decision The Court of Appeal, on appeal in interim relief proceedings: Ratifies the judgment of the Interim Injunction Judge in the District Court of Midden-Nederland of 20 February 2019; orders [the appellant] to pay the costs of the appeal, until such time as this decision is rendered, on the part of ING fixed at € 741 in out-of-pocket expenses and at € 2,148 for salary in accordance with the liquidation rate, within fourteen days of the date of this decision, and - in the event that payment is not made within the said period - to be increased by statutory interest calculated as from the said period for payment; Condemns the [Appellant] to pay the surcharges payable by ING, estimated at € 157, stipulating that this amount will be increased by € 82, in the event that the [Appellant] has not complied with this ruling within fourteen days of being notified of this ruling and has been served and paid within fourteen days of the date of this ruling, and - in the event that payment is not made within the said period - to be increased by the statutory interest as from the said period for payment; orders [the appellant] to pay the costs of the appeal, until this judgment has been delivered, on the part of ICS, fixed at € 741 in out-of-pocket expenses and at € 2,148 for salary in accordance with the liquidation rate; orders [the appellant] to pay the costs of the appeal, until such time as this judgment is delivered, set on the part of Rabobank at € 741 in respect of disbursements and at € 2,148 in respect of salary in accordance with the liquidation rate; declares this judgment to be provisionally enforceable in so far as the orders to pay the costs referred to herein are concerned. This judgment was rendered by mrs. S.B. Boorsma, H.C. Frankena and C.J.H.G. Bronzwaer and was pronounced publicly on 3 December 2019 in the presence of the Registrar.
