Rb. Gelderland - C/05/400739 / KG ZA 22-54
From GDPRhub
| Rb. Gelderland - C/05/400739 / KG ZA 22-54 | |
|---|---|
 | |
| Court: | Rb. Gelderland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5 GDPR Article 5(1)(a) GDPR Article 14 GDPR Article 17(1)(d) GDPR |
| Decided: | 11.04.2022 |
| Published: | 21.04.2022 |
| Parties: | Stichting Bureau Krediet Registratie |
| National Case Number/Name: | C/05/400739 / KG ZA 22-54 |
| European Case Law Identifier: | ECLI:NL:RBGEL:2022:1882 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Giel Ritzen |
The District Court Gelderland ordered a credit scoring company to delete an entry in a data subject's credit history pursuant to Article 17(1)(d) GDPR. The court held that the entity had not adhered to its transparency and information obligations, rendering the registration unlawful.
English Summary
Facts
The controller is Stichting Bureau Krediet Registratie (BKR), which manages the credit information register (CKI). This register provides an overview of the creditworthiness of people since credit providers (banks etc.) can register (severe) debts of individuals. There were three registrations related to the data subject in the CKI, with special codes that indicated that there had been several payment arrears. In 2021, the data subject requested the BKR to have these registrations and/or these special codes erased, but the controller refused. The data subject then brought the issue before Court, which granted his claim and ordered BKR to erase the codes. The controller then appealed this decision.
After some initial hesitations, the controller removed the codes from the registrations, but added a new code “9 Dispute”. The data subject then requested the controller to remove this new code because he claimed that it also negatively affected his creditworthiness (even more than with the previous codes), but the controller refused and explained that this code had been added to explain that the removal of the special codes is still disputed in court (namely: the appeal).
After the data subject was refused credit from a credit provider because of this new special code, he brought the issue before court to have this code “9 Dispute” erased pursuant to Article 17(1)(d) GDPR, and to keep having this code erased.
Holding
The Court decided that the registration was unlawful and ordered the controller to remove the special code “9 Dispute” from the registration pursuant to Article 17(1)(d) GDPR.
First, it considered that the data subject did not explain what the legal basis was to have the actual registrations removed (rather than only the special codes that are linked to the registrations), or why this should follow from the circumstances of the case. Hence, it rejected the claim to have the actual registrations removed.
Second, it considered that the claim to have the special codes (linked to the registrations) erased and to keep having these codes erased. The Court also rejected this claim since it could not assess any potential future registrations in advance. The Court stipulated that every registration must be assessed on the merits of that specific case.
Third, the Court assessed the lawfulness of the registration of special code “9 Dispute”, and whether it should be erased pursuant to Article 17(1)(d) GDPR. The Court stipulated the controller has the duty to prove adherence to the principle of lawfulness and transparency pursuant to Article 5(1)(a) GDPR. Moreover, it considered that the BKR added this code on its own behalf (and not on the behalf of credit providers), that BKR did not inform the data subject of this registration pursuant to Article 14 GDPR, and that this special code is not mentioned on their webpage which provides explanation on the different special codes. The Court concluded that the controller violated its duty to be transparent and to inform data subjects pursuant to Article 5 in combination with Article 14 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
verdict GELDERLAND COURT Team canton and commercial law Arnhem seat case number / roll number: C/05/400739 / KG ZA 22-54 Judgment in summary proceedings of 11 April 2022 in the case of [plaintiff] , residing at [residence] , plaintiff, lawyer mr. M. de Boorder in The Hague, against the foundation CREDIT REGISTRATION OFFICE, with its registered office and principal place of business in Tiel, defendant, lawyers mr. H.H. de Vries and mr. C.R.F. de Plaizier in Amsterdam. The parties will hereinafter be referred to as [claimant] and BKR. 1 The procedure 1.1. The course of the procedure is apparent from: † the summons with exhibits 1 to 6 of March 14, 2022, † the oral hearing, held on March 28, 2022, † the pleading note on behalf of [plaintiff], † the pleading note on behalf of BKR. 1.2. Finally, verdict has been determined. 2 The facts 2.1. [claimant] was registered in the Central Credit Information System (hereinafter: the CKI) of BKR. Insofar as relevant for the assessment, the registrations concerned were the following, namely: International Card Services B.V. (hereinafter: ICS) with the following registrations: 19 May 2015 special code A1, 12 March 2018 special code A2, and 23 December 2019 end date credit; Santander Consumer Finance B.V. (hereinafter: Santander) with the following registrations: December 17, 2015 special code A2, December 19, 2019 code A3, and December 19, 2019 end date of credit; ABN AMRO Bank N.V. (hereinafter: ABN ARMRO Bank N.V. (hereinafter: ABN AMRO) with the following registrations: 13 October 2017 special code A1, 5 December 2015 special code A2, 27 December 2019 code A3, and 27 December 2019 credit end date. (hereinafter: the credit registrations). 2.2. [claimant] requested BKR on May 3, 2021 to remove the credit registrations in the CKI. In a letter dated 10 May 2021, BKR rejected that request and informed [claimant] that he should address his request to the individual credit providers that took care of the registration in the CKI. 2.3. [claimant] subsequently instituted proceedings against BKR with this court in which he claimed, among other things, to order BKR to remove the credit registrations or the special codes from the credit registrations in the CKI. BKR has argued against this. 2.4. By order of this court dated January 14, 2022 (ECLI:NL:RBGEL:2022:126), BKR was ordered to (do) within five days of the date of service of the order the special codes registered by it belonging to the credit registrations in the CKI. remove. 2.5. The lawyer of BKR informed [claimant] on January 28, 2022 that BKR will appeal against the decision of January 14, 2022. 2.6. By e-mail of 8 February 2022, Mr [name 1] van Dynamiet.nl (hereinafter: [name 1]) requested or summoned BKR on behalf of [claimant] to remove the special codes for the credit registrations from the CKI. By e-mail of February 15, 2022, BKR's lawyer [name 1] informed that BKR is not willing to voluntarily do so and that BKR will carry out that removal within five days after service of the decision to BKR. [claimant] subsequently had the decision of 14 January 2022 served on BKR, after which BKR proceeded to remove the special codes from [claimant]'s credit registrations in the CKI. 2.7. On February 24, 2022, BKR placed the code "9 Dispute" in the credit registrations of [claimant] in the CKI. 2.8. In an e-mail of 24 February 2022, [name 1] the lawyer of BKR on behalf of [claimant] has the following message: “Your client has now deleted the relevant negative codes from the CKI. However, the BKR has registered new special codes instead. This concerns the special code 9. See the appendix. In practice (when applying for financing), a code 3 is heavier than a code 4, and so on. I hope you understand that the new codes mean my client is worse off than before. There are also indications that your client has created code 9 especially for this specific case. It is a pity that your client chooses this special approach. Be that as it may, my client cannot accept the current state of affairs. I therefore request that you remove all new special codes from the CKI before 25 February at 5 p.m. at the latest. Failing this, the client will take you to court.” 2.9. By e-mail of February 25, 2022, the lawyer of BKR replied to [name 1]: “You request to “remove all new special codes from the CKI before 25 February at 5 p.m. at the latest”. Should the client understand your request as a removal request from your client within the meaning of Article 17 of the GDPR? The client cannot follow your argument properly. You mention that one particular coding outweighs the other, and that your client suspects that code 9 was created especially for his case. Client wishes to explain that the code 9 is not a special code. This existing code concerns a temporary notification that a registration is the subject of an ongoing dispute. That is the case in your client's situation.” 2.10. On February 26, 2022, [name 2] informed [claimant] that it will no longer process his loan application because of three negative BKR registrations with the coding "ongoing dispute". 3 The Dispute 3.1. [claimant] claims that the preliminary relief judge, by judgment, as far as possible provisionally enforceable, I. BKR orders without delay, but within one day after this judgment, the registration of the credits in his name in the CKI (contracted with ICS, Santander and ABN AMRO), or separately all (special) coding(s), including in particular to remove or have removed the currently placed special code 9, in the registrations in the name of [claimant] and to keep it removed; alternatively to make a decision if the preliminary relief judge deems it correct in good justice; II. determines that BKR will comply with the primary or (more) subsidiary conviction referred to under I. on pain of a penalty ad € 5,000.00 for each day that BKR does not comply with this conviction, with a maximum of € 100,000.00; III. BKR orders the payment of the costs of this lawsuit, including the salary of the authorized representative and nasalaris, plus the statutory interest. 3.2. BKR puts forward a reasoned defense and concludes that it should be rejected, with the [claimant] being ordered to pay the costs of these proceedings. 3.3. Insofar as relevant, the parties' arguments are discussed in more detail below. 4 The assessment 4.1. Contrary to what BKR believes, [claimant] has a sufficient urgent interest in his claims, since that interest already follows from the nature of the claim. 4.2. The claims of [claimant] serve to order BKR to remove the credit registrations, or separately all (special) codes in the registrations, including in particular the recently placed special code 9. [claimant] bases his claims that BKR has acted unlawfully towards him by registering a special code that, in his opinion, does not exist, while the court has already ruled in a judgment of 14 January 2022 that his personal interests may no longer be hindered by negative registrations in the CKI and that he is also in conflict has not been informed by BKR in accordance with the applicable legal regulations about the placement of special code 9 in the credit registrations. However, now that BKR does not wish to remove the special code, [claimant] is forced to turn to the preliminary relief judge with the present claims. BKR defends this and takes the position that it considers the so-called temporary administrative marking that has existed since 2018, not being a special code, on the basis of which credit providers can take cognizance of the fact that, during the appeal proceedings to be initiated by BKR, there is an ongoing dispute about the removal of a registration in the CKI from a contract, arrears and/or details, after careful consideration of interests has placed on good grounds. In the opinion of BKR, the marking is lawful and the claims of [claimant] should therefore be rejected, according to BKR. 4.3. The judge considers the following in this regard. [claimant] claims in the most far-reaching sense the removal of the credit registrations in his name in the CKI. With regard to this part of the claim, [claimant] has not stated, or at least insufficiently, the basis for it, nor has it stated facts and circumstances that should lead to the conclusion that the credit records themselves must be removed, so that that part of the claim is therefore rejected. 4.4. The claim to remove or have removed all special codes in the registrations in the name of [claimant] and to have them removed, in fact means that BKR is prohibited from using special codes in the CKI in the future with the credit registrations of [claimant]. places. This prohibition is too broad to be allowed. In this procedure it is not possible to check a possible future registration in advance against the General Data Protection Regulation (GDPR). Each registration will have to be assessed on its own merits. That assessment is not possible if it is not yet known which precise processing of personal data of [claimant] takes place, on what grounds and on the basis of which balancing of interests. This part of the claim will therefore be dismissed. 4.5. Then the claim for removal of code 9 (hereinafter the code) remains. According to [claimant], the registration of this code with the credit registers is illegal, because it is in violation of the GDPR. Pursuant to Article 17(1)(d) of the GDPR, the controller is obliged to delete personal data if it has been unlawfully processed. This means that the question is before the placement of the coding in the credit records of [claimant] is lawful. 4.6. It is provided that, pursuant to the provisions of Article 5, paragraph 1, sub a GDPR, personal data must be processed in a manner that is lawful, fair and transparent with regard to the data subject. It must be transparent for every natural person that the personal data in question are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. Information and communication about the processing of personal data should be easily accessible and understandable. If the data does not come from the data subject himself, this principle is elaborated in Article 14 of the GDPR. It follows from Article 14(1)(d) of the GDPR that the controller must inform the data subject about the categories of personal data that it processes. Pursuant to Article 5(2) of the GDPR, the controller is responsible for compliance with the basic principles set out in paragraph 1 and must be able to demonstrate them. 4.7. It is not in dispute between the parties that BKR (also) is the controller with regard to the processing of the personal data of [claimant] in the CKI. In the light of the legal framework outlined above, BKR as the controller is obliged to demonstrate that it complies with the obligations under Article 5(1) of the GDPR, including the aforementioned transparency obligation. BKR has acknowledged that the coding in the credit registrations has been carried out by itself in the CKI. It is not disputed that BKR did not inform [claimant] about (the intention of) the placement of the coding in the credit registrations in his name in the CKI. It is also established that the coding is not mentioned in the General Regulations of BKR and that the special coding does not appear in the explanation of the special coding. Although BKR has indicated that in its Privacy statement it provides information in a general sense about the processing in the CKI and the categories of personal data, BKR has not stated exactly what is included in the Privacy statement about this processing. The Privacy statement has not been submitted either. BKR has further stated that the coding has been in existence since 2018. Quite apart from the fact that this has been disputed by [claimant] and has not been substantiated by BKR, the mere fact that a coding already existed does not in itself mean that they are thereby has fulfilled the obligation to provide information to [the claimant]. Although BKR has argued that it offers a low-threshold, free, online access option where the data subject can obtain explanations about the processing of their personal data, this relates to the obligation to provide access under Article 15 of the GDPR. The stated possibility of inspection does not affect the obligation of BKR to inform [claimant] about the processing of his personal data in accordance with Article 14 of the GDPR. [claimant] does not have to investigate the processing by BKR himself. All of the foregoing leads to the conclusion that BKR has not demonstrated in the context of these preliminary relief proceedings that it has complied with its transparency and information obligation with regard to the placement of the coding in the credit registrations of [claimant] in the CKI. pursuant to Article 5 GDPR in conjunction with Article 14 GDPR. For this reason, it is likely that the registration of the coding is unlawful. The claimed deletion can therefore be granted on the basis of Article 17(1)(d) GDPR. What the parties have otherwise argued cannot therefore be discussed. 4.8. In view of BKR's defense against the term claimed by [claimant] within which it must remove the coding from the credit registrations, this term will be set at three days after service of the judgment. 4.9. The claimed penalty will be awarded in the manner stated below. 4.10. The part of the claim relating to the removal of the coding from the credit registers of [claimant] will be rejected, since [claimant] has provided insufficient evidence to be able to assess within the scope of these preliminary relief proceedings whether such a far-reaching prohibition is justified. . 4.11. BKR will be ordered to pay the costs of the proceedings as the largely unsuccessful party. The costs on the part of [claimant] are estimated at: - notification of notice € 131.18 - court fee 314.00 - lawyer salary 1,016.00 Total € 1,461.18 4.12. The claimed subsequent costs and statutory interest will be awarded as to be reported. 5 The decision The preliminary relief judge 5.1. orders BKR to remove the coding (code 9) from the credit registrations in the name of [claimant] in the CKI within three working days after service of this judgment, 5.2. orders BKR to pay [claimant] a penalty of € 1,000.00 for each day or part thereof that they do not comply with the provisions in 5.1. the pronounced main conviction complies, until a maximum of € 25,000.00 has been reached, 5.3. orders BKR to pay the costs of the proceedings, estimated on the part of [claimant] to date at € 1,461.18, including € 1,016.00 in lawyer's salary, plus the statutory interest on these costs from the fifteenth day after the date of this verdict, 5.4. orders BKR to pay the costs incurred by the [claimant] after this judgment, estimated at € 157.00 in lawyer's salary, if this judgment is not complied with within fourteen days of notification, plus the statutory interest if referred to in art. 6:119 of the Dutch Civil Code with effect from the fifteenth day after that notice until the day of payment and € 82.00 in lawyer's salary and the writ costs of service of this judgment, if service has subsequently taken place, plus the statutory interest as referred to in art. 6:119 BW with effect from the fifteenth day after the service of this judgment until the day of payment, 5.5. declares this judgment provisionally enforceable so far, 5.6. rejects the more or otherwise advanced. This judgment was rendered by mr. D.T. Boxed and pronounced in public on April 11, 2022.
