GHDHA - C/09/574422 / HA RK 19-368

Hof Den Haag - C / 09/574422 / HA RK 19-368
Court:	Hof Den Haag (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 1 GDPR
Decided:	10.11.2020
Published:	02.12.2020
Parties:	Hoist Finance AB
National Case Number/Name:	C / 09/574422 / HA RK 19-368
European Case Law Identifier:	ECLI:NL:GHDHA:2020:2068
Appeal from:	Rb. Den Haag
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The Court of Appeal of The Hague (Gerechtshof Den Haag) rejected an appeal and upheld the District Court of the Hague's (Rb. Den Haag) decision. There it was decided that the interest in keeping a data subject with a history of debt on the Central Credit Information System (CKI) overrides the data subject's interest, rights and freedoms, to be removed from that register.

English Summary

Facts

The appellant asked Hoist, the defendant,

The appellant had taken a loan out in 1998 for his house, which was increased various times. The appellant got divorced in 2009, he was the one that paid the interest charge on the loan and mortgage charge for the house. The appellant then sold the house with a residual debt which was eventually waived in 2016. The appellant was then admitted on a municipal debt relief program for 10 months. There was a backlog in the appellant's payment of credit (loan) recorded in the Central Credit Information System (CKI) of the Stichting Bureau Kredietregistratie (BKR). The appellant was admitted to the debt scheduling scheme for natural persons (WSNP) where Hoist was one of the listed creditors (debt of € 38244.74).

The debt rescheduling scheme ended with a clean slate in Febraury 2018. Hoist reported in the CKI that the credit ended in January 2018. CKI stated that the registration with regard to the credit will be removed in January 2023.

The appellant asked for Hoist to remove data concerning him from the Stichting Bureau Kredietregistratie (BKR) by July 2018, which Hoist refused to do. Hoist refused again after another request from the appellant in March 2019.

The appellant went to court to request that Hoist be ordered to remove the BKR registration in his name so that he would be able to buy his current rental home and replace his old car. Hoist refused.

Dispute

The appellant lodged an appeal against a decision of 13 December 2019 from the District Court of The Hague (Rb. Den Haag).

The District Court's judgement rejected the appellant's request to order Hoist to remove the appellant's name from the BKR. This was on the basis that there was a legitimate interest for processing the appellant's personal data in the BKR. The processing was necessary for BKR and its business customers, such as Hoist, and was therefore lawful under Article 6(1)(f) GDPR. This legitimate interest outweighed the appellant's interest in having his name removed from the register.

The District Court also considered that the appellant can object to processing of his personal data , as per Article 21(1) GDPR. However, Hoist, the data controller can provide compelling legitimate reasons which overrides the data subject's interests, rights and freedoms and refuse to comply with the objection. If no compelling reason is given, the data controller must delete the personal data without unreasonable delay as per Article 17(1)(c) GDPR.

The District Court clarified that the balancing exercise for conflicting interests must be done if the processing is based on Article 6(1)(c) GDPR. The balancing exercise in that case is the same as the one to be performed under Article 21(1).

The appellant appealed against this decision by the District Court.

Holding

Legal basis for processing.

The Court of Appeal of the Hague dismissed the appellant's claim that the processing of personal data was on the basis of Article 6(1)(c) instead of Article 6(1)(f) as the District Court held. The Court of Appeal ruled that the District Court's discussion of Article 6(1)(c) was superfluous and only aimed at explaining the law "for the sake of completeness".

The Court of Appeal found that the system of credit registration held by BKR is based on a legal obligation (Article 4:32 § 1 Wft). Therefore, Article 6(1)(c) GDPR was relevant. However, the Court highlighted that the phrase "at least on" in Article 6(1) GDPR indicated that the subsequent legal bases outlined in the Article are not mutually exclusive. Therefore, both Article 6(1)(c) and (f) GDPR can apply at once. As such, the Court held that Article 6(1)(f) is the legal basis which is relied upon for processing the appellant's personal data after the debt clearance (rather than a legal obligation under Article 6(1)(c)).

Proportionality and subsidiarity test.

The appellant asked whether the balancing exercise under Article 21 must be conducted in the same way as in the Santander Supreme Court decision issued under the Dutch Personal Data Protection Act (Wbp; transposition of the Directive 95/46/EC).

The Court of Appeal of the Hague held that Santander must be read as meaning that the application of the principles of proportionality and subsidiarity do not change based on the legal basis for data processing. Therefore, under the GDPR, a proportionality and subsidiarity test must be carried out for lawful processing. This is in line with Article 8(1) and 52(1) of the Charter of Fundamental Rights of the EU. Additionally, those principles are reflected in Article 5(1)(c) GDPR (data minimisation). The Dutch legislator must also be assumed to have legislated in line with these principles in Article 4:32 Wft. Therefore, the proportionality and subsidiarity tests do not depend on a particular legal basis used. It applies to both Article 6(1)(c) and (f) GDPR.

Right to object.

The Court of Appeal confirmed that the data subject had a right to object to processing as per Article 21(1) GDPR since the data controller was processing his personal data by relying on Article 6(1)(f) as a legal basis. The Court held that a balancing of interest must be done.

The Court highlighted that, when a data controller is faced with a data subject's exercise of his right to object, it must perform another balancing test (in addition to the one performed when determining its legitimate interest for processing the personal data in the first place). The controller must show that it has compelling legitimate grounds for refusing to comply with the data subject's objection and thus continue processing the personal data (Article 21(2) GDPR). The data controller's interest must outweigh the interest, rights and freedoms of the data subject.

The Court held that the balancing of interest under Article 21(1) must also incorporate a proportionality and subsidiarity test as with the Santander decision.

Legitimate Interest.

Finally, the Court of Appeal held that the purpose of a credit registration system is to ensure "socially responsible financial services". It protect the consumer from over-lending or debt situations and it also helps lenders limit financial risk linked to lending credit and combat fraud. The latter reflect legitimate interests for the data processing in the register.

According to the Court of Appeal, Hoist provided sufficient evidence that it had a compelling interest in keeping the data subject's name of the register. The Court balanced Hoist's interest against the data subject's. On that basis, it held that Hoist's interest outweighed the data subject's interest, rights and freedoms. This is because the data subject's submission relevant to his interest was submitted too late to reach the conclusion that Hoist's interest were less important. In any case, the content of the submissions did not convince the Court.

Conclusions.

Therefore, the Court of Appeal upheld the decision of the District Court of the Hague. It also refused to send preliminary questions the the Supreme Court. The appellant was ordered to pay the costs of the appeal proceedings: € 760 in disbursements, € 2,148 for salary and € 157 for after-salary of the attorney;

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Authority
    The Hague Court of Appeal 
Date of judgment
    10-11-2020 
Date of publication
    02-12-2020 
Case number
    200.274.240/01
Jurisdictions
    Contract law
Special characteristics
    Appeal
Content indication

    General Data Protection Regulation ( AVG ), processing personal data in the BKR register. Basis for data processing, balancing of interests.
Locations
    Rechtspraak.nl
    Enriched pronunciation 

Statement
COURT OF THE HAGUE
Civil Law Department

Case number: 200.274.240 / 01

Court case number: C / 09/574422 / HA RK 19-368

decision of 10 November 2020

regarding

[appellant] ,
residing in [residence],
applicant on appeal,
hereinafter referred to as: [appellant],
lawyer: mr. RAJ Zomer in Oosterhout,

against

the legal entity under Swedish law Hoist Finance AB ,
with offices in Amsterdam,
defendant on appeal,
hereinafter referred to as: Hoist,
lawyer: mr. HAP Pijnacker in Tilburg. 


1 The course of the proceedings
1.1

By appeal of 17 February 2020 (received at the court of appeal on 18 February 2020), [appellant] lodged an appeal against a decision of 13 December 2019 given between the parties by the District Court of The Hague. [appellant] has put forward and explained seven complaints against the contested decision and has submitted exhibits. In the petition, [appellant] also made a request pursuant to art. 392 Rv made and a (conditional) provisional claim under art. 223 RV set.
1.2

By defense on appeal, Hoist put forward a defense and submitted exhibits.
1.3

An oral hearing took place on 29 September 2020, in which the parties had their case explained by their lawyers on the basis of pleadings submitted to the court. An official report was drawn up of the oral hearing and sent to the parties. The official report is part of the trial file.
1.4

Finally, judgment has been determined to date.
2 Introduction
2.1

The court has established a number of facts in the contested decision under 2.1 to 2.13. Those facts are not in dispute, so that the court will also proceed from those facts.
2.2

This case concerns the question of whether Hoist should honor [appellant] 's request to remove the codes in the BKR register in the name of [appellant]. The following facts are important here.

    -

    i) In 1998 [appellant] took out a loan of approximately NLG 2,000. This loan was subsequently increased a number of times, including for the costs of the renovation of the house of [appellant] and his then wife. At one point, [appellant] transferred the loan to the Nederlandse Voorschotbank (hereinafter: the Voorschotbank). On March 12, 2007, this bank provided a joint and several revolving credit facility of € 35,000 to [appellant] and his then spouse.
    -

    ii) [appellant] got divorced in 2009. [appellant] paid a total of approximately € 17,000 to his lawyer in connection with the divorce proceedings. After the divorce, he took care of the interest charges on the loan with the Voorschotbank and the mortgage charges for the marital home at the time.
    -

    iii) From March 2012, [appellant] has rented out the house for some time. In 2016, the house was sold with a residual debt. This residual debt was waived on October 25, 2016 on the basis of the waiver scheme of the National Mortgage Guarantee.
    -

    iv) On 1 November 2012, [appellant] rented a house in Waddinxveen together with his current partner. The rent was € 814 at the time and has been gradually increased since then. As of July 1, 2019, the rent was € 1,114.47.
    -

    v) On 14 February 2014, [appellant] was admitted to a municipal debt relief program for a period of ten months. The Voorschotbank has registered its claim for debt mediation. In a letter dated 20 May 2014, she informed [appellant] that he had to continue to pay the installments of the loan and that the total loan amount could be claimed if [appellant] did not pay.
    -

    vi) On 8 July 2014, the Voorschotbank recorded in the Central Credit Information System (CKI) of the Stichting Bureau Kredietregistratie (BKR) that a backlog had arisen in the payment of the credit. It concerns the registration of a Code A, a code that means that a backlog in the payment of a loan has arisen.
    -

    vii) On August 25, 2014, it was recorded in the CKI that the credit was claimed as of that date. This is a Code 2, a code that means that a lender has claimed the loan in one go.
    -

    viii) The loan receivable from the Voorschotbank was taken over by Hoist at some point in 2014.
    -

    ix) At the end of 2014, [appellant] was admitted to the debt rescheduling scheme for natural persons (WSNP). On the list of creditors of November 3, 2014, Hoist is listed as a creditor with a total recognized claim of € 38,244.74 (including VAT). In addition, [appellant] 's lawyer is also listed as a creditor, with an acknowledged claim of € 881.03.
    -

    x) [appellant] saved an amount of approximately € 16,000 during the debt restructuring process to pay off the debt to Hoist. On 5 February 2018, the debt rescheduling scheme ended with a clean slate. After payment of the administrator's fee, Hoist received an amount of € 12,254.43 as a final payment. Hoist therefore had to deduct an amount of € 25,990.31 from the submitted claim.
    -

    xi) Hoist has stated in the CKI that the credit ended on January 2, 2018. In addition, Hoist has placed a Code 3, which means that an amount of € 250 or more has been debited. The CKI also states that the registration with regard to the credit will be removed in January 2023.
    -

    xii) [appellant] requested the removal of the BKR registration by letter of 27 July 2018. He requested this again by letter of 11 March 2019. Hoist declined both requests. 

2.3

In these proceedings, [appellant] has requested that the court order Hoist to remove the BKR registrations in the name of [appellant], on pain of a penalty. He has stated that Hoist - based on the current situation - has not demonstrated that legitimate interests exist on her part in maintaining the BKR registration, let alone that these outweigh the interests of [appellant] in the removal of the registration. To this end, [appellant] has argued that he wants to buy his current rental home in order to reduce the monthly housing costs. He also wants to replace his old car (dating from 2001); He says he cannot receive financing for both transactions due to the BKR registration.
2.4

Hoist has contradicted the request of [appellant].
2.5

The court rejected [appellant] 's request. To this end, it considered the following:

 The processing by the BKR - and therefore also by the credit providers - of personal data has in any case its lawful basis in Art. 6 paragraph 1 under f GDPR , because the processing is necessary for the representation of the legitimate interests of the BKR and its business customers, such as Hoist (legal ground 4.7).

 [appellant] can on the basis of art. 21 para.1 GDPR to object to the processing of personal data concerning him. Hoist, as controller, must honor the objection unless it provides compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject or that are related to the establishment, exercise or defense of legal claims. If the objection is granted, the controller must under Art. 17 paragraph 1 under c GDPR delete the personal data without unreasonable delay (legal ground 4.9).

 The court adds “for the sake of completeness” that the assessment framework does not change insofar as the processing of personal data is based on Art. 6 para.1 lit.c GDPR . In that case, too, interests must be weighed up. This follows from art. 14 paragraph 10 under b of the CKI General Regulations (hereinafter: AR). The weighing of interests prescribed by this provision essentially amounts to the same weighing of interests as that of art. 21 para. 1 GDPR (legal ground 4.15).

 The court is of the opinion that the appeal to removal of the BKR registration on the basis of art. 17 para.1 lit.c GDPR and art. 21 paragraph 1 GDPR must be rejected because there are compelling legitimate grounds for maintaining the BKR registration that currently outweigh the interests of [appellant] in the removal of the registration (legal ground 4.24).
2.6

On appeal, [appellant] concluded that the contested decision should be set aside. [appellant] requests Hoist to order the removal of the codes in the CKI in the name of [appellant], on pain of a penalty. He also requests that a number of preliminary questions be put to the Supreme Court and that, by way of provisional provision, order Hoist to delete the codes during the preliminary ruling procedure.
2.7

Hoist has contradicted the complaints and requests of [appellant] and has concluded that the contested decision be upheld.
3 Review on appeal
3.1

Grounds 1 to 4 are directed against para. 4.15 of the contested decision. [appellant] complains that the court wrongly ruled therein that the processing of the personal data by the BKR falls under the basis of art. 6 para.1 lit.c GDPR . Furthermore, according to him, the court wrongly considered that the assessment framework of art. 14 paragraph 10 sub b AR applies instead of Articles 17 and 21 GDPR . Finally, [appellant] is of the opinion that the court wrongly considered that the Santander judgment (HR 9 September 2011, ECLI: NL: HR: 2011: BQ8097) has the same test as art. 21 GDPR .
3.2

These grievances fail because they are based on an incorrect reading of the court decision. The court has ruled that the processing of personal data is in any case based on Art. 6 paragraph 1 f GDPR (legal ground 4.7) and that art. 21 para. 1 GDPR forms the assessment framework for [appellant] request for removal (legal ground 4.9). In para. 4.24, the court concludes that the appeal to removal of the BKR registration on the basis of art. 17 para.1 lit.c GDPR and art. 21 paragraph 1 GDPR must be rejected because there are compelling legitimate grounds for maintaining the BKR registration that currently outweigh the interests of [appellant] in the removal of the registration. Rov. 4.15 can be regarded as a superfluous consideration, in which the court explains that where the processing of personal data is also based on art. 6 para.1 lit.c GDPR , the assessment framework for deletion of this personal data is essentially the same as the assessment framework of Art. 21 para.1 GDPR .
3.3

The grounds of appeal 5 and 6 are intended to argue that the court wrongly rejected [appellant] 's request. According to [appellant], the court places too much emphasis on the damage that Hoist suffered because she had to write off part of the credit. Furthermore, [appellant] is of the opinion that he does have legitimate interests in the cancellation of the BKR registration and that his interests outweigh the interests of Hoist. [appellant] has raised the following decision points:

A) the basis for processing the personal data of [appellant]; this is important for the answer to the question whether [appellant] pursuant to art. 21 para.1 GDPR can object to the processing;

B) the relationship between art. 21 para. 1 GDPR and the Santander decision of the Supreme Court, as well as the way in which the proportionality and subsidiarity test must be carried out;

C) the question whether Hoist (still) has a legitimate interest in the processing of the personal data of [appellant];

D) whether the interests of [appellant] in the case of removal from the BKR register outweigh the interests of Hoist in enforcing the BKR registration.

A. Art. 6 paragraph 1 sub f GDPR in this case forms the basis for the processing of the personal data of [appellant]; [appellant] can under art. 21 GDPR objection
3.4

The parties argue about the answer to the question on what basis the processing of personal data is based in this case: Art. 6 GDPR para.1 lit.c (Hoist) or art. 6 para. 1 sub f GDPR ([appellant]). The court finds as follows. A provider of credit is based on art. 4:32 paragraph 1 Wft is obliged to participate in a system of credit registration. The CKI is such a system of credit registration that is maintained by the BKR. Hoist is a participant in the CKI and as a participant bound to the AR, which has been established by the BKR. The AR mentions the aim of the credit registration to promote socially responsible financial services. Specifically, this involves protecting consumers from over-lending and other financial problems (problematic debt situations) and limiting the financial risks of credit providers for creditors and preventing and combating abuse and fraud.
3.5

Registration in the CKI constitutes processing of personal data within the meaning of the GDPR . The parties differ on the answer to the question on what basis Hoist is entitled to process the personal data of [appellant]. In that context, Art. 6 para.1 GDPR relevant. This provision reads, where relevant:

“1. The processing is only lawful if and insofar as at least one of the following conditions is met:

(…)

c) the processing is necessary to comply with a legal obligation on the

controller rests;

(…)

e) processing is necessary for the performance of a task carried out in the public interest or a task in the exercise of official authority vested in the controller;

f) processing is necessary for the pursuit of the legitimate interests of the controller or of a third party, except where the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, outweigh those interests, in particular when the person concerned is a child. "
3.6

The words “at least one” in the preamble of Article 6 (1) GDPR indicate that the various parts thereof do not form mutually exclusive categories. The basis for the lawful processing of personal data can therefore, for example, lie in both Art. 6 paragraph 1 under c as in art. 6 para.1 lit.f GDPR . In the opinion of the court, art. 6 paragraph 1 under f GDPR, in any case, provides a basis for the data processing by the BKR of the data of [appellant]. The Court of Appeal does not find that the data processing is also necessary to comply with a legal obligation that rests on Hoist as controller. After all, the obligation mentioned by Hoist in this context is the obligation to participate in a system of credit registration. It cannot be said that Hoist does not comply with that obligation to participate if it ceases to process the data of [appellant] in the CKI. The court therefore assumes that the data processing falls under art. 6 para.1 lit.f GDPR and not also Art. 6 paragraph 1 under c GDPR , and that [appellant] has the right to object on the basis of art. 21 para.1 GDPR.
3.7

Pursuant to art. 21 para.1 GDPR , the data subject has the right at any time to object to the processing of data concerning him on the basis of Article 6 para. 1 lit.e or f on grounds relating to his specific situation GDPR . The

If the data subject objects, the controller must cease processing the personal data, unless the controller submits compelling legitimate grounds for the processing that outweigh the interests of the data subject.
3.8

The bottom line is that it must be investigated whether the interests or the fundamental rights and freedoms of [appellant] that require the protection of personal data outweigh Hoist's legitimate interests that require the processing of personal data. Now that [appellant] objects to the processing of his personal data, Hoist must cease this processing unless it submits compelling legitimate grounds for the processing that outweigh the interests of [appellant].

B. Relationship between art. 21 para.1 GDPR and the Santander decision: no double assessment framework; the proportionality and subsidiarity test always apply
3.9

[appellant] has raised the question how the assessment framework of art. 21 AVG relates to the so-called Santander decision of 9 September 2011 (ECLI: NL: HR: 2011: BQ8097), which the Supreme Court issued under the (then) Personal Data Protection Act (Wbp). Insofar as relevant here, the Wbp corresponds in terms of content to the GDPR . The law implemented Directive 95/46 / EC on the protection of natural persons with regard to the processing of personal data and on the free movement of goods (PbEG L281, hereinafter: the Personal Data Protection Directive). This guideline is the predecessor of the GDPR .
3.9.1

Art. 7 Wbp stipulated that personal data is collected for specific, explicitly described and justified purposes. This provision corresponds (insofar as relevant here) substantively with art. 5 para.1 lit.b GDPR . Art. 8 Wbp mentioned the six principles for processing personal data. This provision corresponds (insofar as relevant here) substantively with art. 6 AVG (partially cited above under legal ground 3.5).
3.9.2

In the Santander case, the data subject had objected to Bank Santander's processing of personal data in the CKI. The parties disputed the answer to the question on what basis the processing was based. According to the bank, that was Art. 8 paragraph 1 sub a, b or c Wbp, according to the person concerned art. 8 paragraph 1 sub f Wbp the basis for the processing. The bank further argued that if the processing of personal data under Art. 8 paragraph 1 sub a, b or c of the Wbp would fall, there would no longer be a weighing up of interests. According to the bank, the obligation to weigh interests only applied if art. 8 paragraph 1 sub f would be the basis for the processing of personal data. The court has ruled against the bank on this last point.
3.9.3

In cassation, the bank argued that when processing personal data on the basis of art. 8 paragraph 1 under a, b and c Wbp, no weighing of interests is required, at least that with such processing of personal data always, or in principle, the outcome of the weighing of interests is that processing of personal data is justified.
3.9.4

In assessing the remedy, the Supreme Court has assumed the following - insofar as relevant.

(a) The Wbp must be interpreted in accordance with the provisions of art. 8 ECHR. The legislator's intention was that any data processing must comply with the principles of proportionality and subsidiarity. All this entails that the infringement of the interests of the data subjects may not be disproportionate in relation to the purpose to be served with the processing and that purpose cannot reasonably be achieved in another way that is less disadvantageous for the data subjects.

(b) Art. 7 Wbp provides - agreement art. 6 of Directive 95/46 / EC - that personal data must be collected for specified, explicit and legitimate purposes. Justified can only be those purposes which are pursued with data processing in one of the art. 8 Wbp exhaustively listed cases.

(c) Even if the data processing is in principle permitted on one of the areas referred to in Art. 8 Wbp exhaustively listed grounds, the requirement continues to apply that the processing must be necessary in the specific case with a view to the described purpose of the processing. The presence of a legal justification therefore does not make a balancing of interests on the basis of the principles mentioned above under (a) superfluous. In this balancing act, the circumstances of the case must be taken into account.

(d) In connection with the practical manageability of the Wbp, it is important that the processor may only be required to weigh up the interests on the basis of the available data. If the data subject provides further information, this may lead to a new, more complete assessment.
3.10

It follows from the Santander decision that under the Wbp it made no difference for the application of the proportionality and subsidiarity test on which basis the data processing was based. In all cases it had to be investigated whether the infringement of the interests of the data subjects was not disproportionate in relation to the purpose to be served with the processing (proportionality test) and whether that purpose could reasonably not be achieved in another way that is less disadvantageous for the data subjects be achieved (subsidiarity test).
3.11

It must be assumed that also under the GDPR - which builds on the Personal Data Protection Directive (preamble GDPR , no. 6 paragraph 1 GDPR , a proportionality and a subsidiarity test must be carried out for lawful processing of personal data. This is in accordance with the provisions of art. 8 par.1 jo. art. 52 para.1 of the Charter of Fundamental Rights of the European Union, to which the GDPR refers (preamble GDPR , No. 1). Furthermore, art. 5 paragraph 1, opening words and under c GDPR : “Personal data must: (...) be adequate, relevant and limited to what is necessary for the purposes for which they are processed (“ minimum data processing ”)”. This provision is one of the principles governing the processing of personal data. More specifically, the legal basis of Art. 6 paragraph 1 under c GDPR that the proportionality test is enshrined in Art. 6 par.3 GDPR . Finally, the provisions referred to in art. 4:32 Wft laid down obligation for credit providers to participate in a system of credit registration, which must be assumed that the legislator could not have intended to oblige data processing other than in accordance with what arises from art. 8 ECHR. In short, it makes no essential difference to the applicability of the proportionality and subsidiarity test whether the basis for the processing of the personal data of [appellant] can be found in art. 6 para.1 lit.c GDPR or in Art. 6 para.1 lit.f GDPR .
3.12

For the answer to the question of how this test in the context of art. 21 para.1 GDPR , a comparison between the Wbp and the GDPR is instructive.

Pursuant to art. 40 paragraph 1 Wbp, a data subject could lodge an objection with the controller against the processing of his personal data in connection with his personal circumstances. This possibility of objection only applied if the basis for the processing lay in art. 8 salutation under e or f Wbp. Art. 21 para. 1 sentence 1 GDPR contains (as stated) a similar possibility: a data subject can object to the processing of his personal data because of his specific situation; this option only applies if the basis for the processing lies in art. 6 paragraph 1 under e or f GDPR .
3.13

From the legal history of art. 40 paragraph 1 of the Wbp shows the following. The processing bases mentioned under e and f are the most indeterminate and general. More than with the other bases, they leave a controller a certain amount of discretion in which the principles of proportionality and subsidiarity play an important role. When deciding whether to process personal data, the controller can only take into account the normal circumstances of the case known to him. Considering these circumstances, he can come to the decision that the data processing is justified. However, it is possible that the special personal circumstances of a data subject tip the balance in the other direction. For this reason, these principles provide for the possibility for the data subject to object to the processing on account of his or her specific circumstances (Parliamentary Papers II 1997/98, 25892, 3, p. 163). From this it follows that the right to object (Article 40 paragraph 1 Wbp) and the right to object (Article 21 paragraph 1, first sentence, GDPR ) have the purpose of balancing the interests of the controller if the data subject so requests. due to personal circumstances or his or her specific situation. The controller must then in any case also assess (again) whether proportionality and / or subsidiarity stand in the way of the processing of the personal data of the data subject.
3.14

Art. 21 para. 1 sentence 2 GDPR further provides (insofar as relevant here) that the controller ceases to process personal data, unless he can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject. The controller must demonstrate that his compelling legitimate interests (or those of a third party) may outweigh the interests or the fundamental rights and freedoms of the data subject (preamble GDPR , No. 69).
3.15

It follows from the foregoing that the balancing of interests based on art. 21 para.1 GDPR must also take place including the proportionality and subsidiarity test as referred to in the Santander decision. This test must be carried out every time a data subject requests that the processing of personal data be stopped because of his specific situation.

C. Hoist has a compelling legitimate interest in the processing of the personal data of [appellant]
3.16

[appellant] has raised the point that in this case there are no (compelling) legitimate interests of Hoist, so that no weighing of interests has to be carried out, or at least that the weighing of interests is in his favor. The court finds as follows. The purpose of the credit registration is to promote socially responsible financial services (see above, legal ground 3.4). On the one hand, it is about the interests of consumers to protect them from over-lending and other financial problems (problematic debt situations). On the other hand, it concerns the interest for lenders to limit the financial risks involved in lending and to prevent and combat abuse and fraud. These interests are served with the credit registration system created by the BKR.
3.17

The coding that [appellant] wants to be removed is a so-called Code 3, which means that a lender has had to write off an amount of € 250 or more; this coding will (in any case) be removed after five years (cf. art. 14 AR). With regard to the duration of this coding, the BKR has made a (general) assessment between the importance of a socially responsible financial service on the one hand and the interests of persons with a BKR registration on the other. In its capacity as 'business customer' of the BKR, Hoist is in principle bound by the rules of art. 14 AR, unless this proves to be disproportionate after a careful weighing of interests based on available data about individual circumstances (art. 14 paragraph 10 AR).
3.18

Hoist has argued that the length of the five-year term is explained by the fact that a Code 3 registration involved a problematic debt situation that had negative consequences for the lender. This justifies a bridging period to give the borrower the opportunity to get and keep his financial situation in order in a sustainable manner, without burdening it by taking out new loans. The five-year term includes a policy decision by the representative organizations that jointly manage the BKR foundation and as such has authority, says Hoist.
3.19

In the opinion of the court of appeal, Hoist has provided sufficient evidence to be able to assume that in principle it has a compelling legitimate interest in the continuation of a Code 3 registration for a period of five years. In addition, the court takes into account that this coding, as stated, means that a lender has had to write off an amount of € 250 or more on the credit. And Code 3 registration therefore does not mean that the credit has been fully paid off, but (in this case) means that the creditor has written off the debt in whole or in part. In principle, this justifies a bridging period in which the borrower is given the opportunity to get and keep his financial situation in order on a lasting basis, without burdening it by taking out new loans.

D. The interests of [appellant] in this case do not outweigh the interests of Hoist
3.20

The fact that Hoist has a compelling legitimate interest in the processing of the personal data of [appellant] in the BKR register does not alter the fact that [appellant] can at any time submit a request for the coding to be canceled. When [appellant] puts forward specific circumstances that have not yet been included in the (general) weighing of interests (as described above), Hoist must make a new weighing of interests and demonstrate that its compelling legitimate interests outweigh the interests of [appellant ]. The more specific [appellant] is in the description of his interests, the more Hoist can be expected to provide reasons for its decision. Hoist has also argued that only after three years can it be expected of her to impose stricter requirements with regard to her interests in the context of the balancing of interests (statement of defense at first instance, no.14), but this three-year period cannot be reconciled. with the assessment framework that on the basis of the GDPR applies if a data subject objects to the processing of his personal data.
3.21

[appellant] has put forward the following specific circumstances:

    Between the end of 2014 and the beginning of 2018, he went through a WSNP trajectory that ended with a clean slate. During that period, he saved a considerable amount with which the credit at Hoist was partly repaid.

    He has his finances in order. [appellant] and his partner both have permanent jobs. [appellant] has been working for the same employer for 22 years and earns a net wage of € 1,868.88 per month. His partner earns € 1,903.44 net. The financial problems in which [appellant] has found himself, and which ultimately led to the WSNP process, are to a large extent due to a very difficult divorce, which cost him a lot of money and which for some time led to higher fixed costs.

    [appellant] and his partner occupy a rental home in the private sector, the rent of which is increased sharply every year. [appellant] was given the opportunity and also intends to buy the rental property, but does not receive financing due to the BKR listing. The rent increases are related to the housing association's wish to sell the homes.

    [appellant] has an old car with almost 250,000 kilometers on the clock. Due to the BKR listing, he cannot conclude a lease or take out a loan to purchase a new car, although the maintenance costs of the current car add up. [appellant] needs a (reliable) car for commuting. 

3.22

In the opinion of the court of appeal, [appellant] has submitted too little to be able to reach the conclusion that the interests of Hoist in maintaining the BKR listing in this case weigh less heavily than the interests of [appellant] in the removal of that listing. The following is important here:

    At the time that he was admitted to the WSNP in 2014, [appellant] had an outstanding credit of € 38,244.74 with Hoist. He paid part of this during the debt restructuring, but Hoist had to write off an amount of € 25,990.31 on the submitted claim at the beginning of 2018. When admitted to the debt rescheduling, [appellant] in fact had only one major creditor: Hoist. Hoist argued in the first instance that [appellant] could have opted to pay off this debt in full over a period of several years. It is not clear to her why debt restructuring in 2014 was the only or the best option for [appellant] (defense, p. 3). [appellant] has not clarified this in these proceedings.

    Although the income of [appellant] and his partner is stable, they were also before the debt restructuring process. [appellant] has gone through a difficult period because of his divorce, but he has not provided sufficient insight into the exact extent to which his financial problems were caused by the divorce or whether the cause of the problems must also be sought in (for example) overspending. It is currently only clear to the court that [appellant] had to incur significant costs for his divorce lawyer. The home at the time was sold with a residual debt, but this was waived on the basis of the waiver scheme of the National Mortgage Guarantee. All this is important for the assessment of the question to what extent [appellant] has his financial situation in order in the long term. In the latter case, it may also be important that [appellant] has gone through a debt restructuring process for a period of three years, that he (as the Court of Appeal understands) has complied with all obligations that rested on him in this regard during this period and that he has closed the debt restructuring with a clean slate.

    [appellant] was not very specific about the benefits of buying his current rental home. The court would like to assume that with the current BKR listing it is (virtually) impossible to obtain a mortgage loan, but that does not yet indicate the interest of [appellant] in buying the house. In this context, [appellant] only argued that the rent for the house is high and that it is increased sharply every year. However, he has not explained in concrete terms how much he can save on a monthly basis if he buys the house, taking into account not only the mortgage costs, but also other costs such as maintenance and insurance. Nor is it clear whether there is a specific period within which [appellant] should proceed to purchase the rental home.

    With regard to the purchase of a new car, [appellant] has insufficiently explained why this purchase is necessary at this time. Nor has he clarified why it is necessary to lease a car or to take out a loan for another car. 

3.23

The conclusion is that on the basis of the currently available information it cannot be established that Hoist's legitimate interests for the processing of personal data outweigh the interests of [appellant].
3.24

[appellant] has also asked the Court of Appeal to submit a number of preliminary questions to the Supreme Court. The Court of Appeal sees insufficient reason for this in the given circumstances. The provisional claim of [appellant] therefore does not require discussion either.
3.25

The court will ratify the contested decision. As the unsuccessful party, [appellant] will be ordered, provisionally enforceable as requested, to pay the costs of the appeal.
4 Decision

The Council:

- ratifies the contested decision;

- orders [appellant] to pay the costs of the appeal proceedings, determined on the part of Hoist until this judgment at € 760 in disbursements, € 2,148 for salary and € 157 for after-salary of the attorney;

- stipulates that the post-salary for the lawyer will be increased by € 82 if this decision has not been complied with within fourteen days after the registration and this decision has subsequently been served,

- stipulates that the amounts of the cost order must be paid within fourteen days after the day of the judgment or, in the case of the amount of € 82, after the date of service, failing which these amounts must be increased by the statutory interest as referred to in Article 6: 119 of the Dutch Civil Code from the end of the said period of fourteen days.

- declares this decision provisionally enforceable with regard to the payment and costs order;

- rejects the more or otherwise requested.

This decision was given by mrs. CA Joustra, FR Salomons and AJ Swelheim and was signed and pronounced by mr. JEHM Pinckaers, role judge, in open court on 10 November 2020 in the presence of the registrar.