Rb. Amsterdam - ECLI:NL:RBAMS:2023:6456
| Rb. Amsterdam - ECLI:NL:RBAMS:2023:6456 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 17 GDPR Article 21 GDPR |
| Decided: | 26.10.2023 |
| Published: | 02.11.2023 |
| Parties: | ING Bank |
| National Case Number/Name: | ECLI:NL:RBAMS:2023:6456 |
| European Case Law Identifier: | ECLI:NL:RBAMS:2023:6456 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The District Court of Amsterdam held that a data subject’s right to be forgotten (Article 17 GDPR) overrode the interests of a credit ranking agency in holding the data subject’s financial records.
English Summary
Facts
In December 2005, the data subject took out a mortgage for a house for €202,500 with ING Bank (the controller). In 2008, the data subject faced financial hardship and could no longer pay the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest on the mortgage). The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and had to write off its claim against them.
Despite having written off its claim, ING Bank still had the data subject registered negatively in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands.
On 6 December 2022, the data subject made an objection under Article 21 GDPR and an erasure request (Article 17 GDPR) to ING Bank to remove their negative registration from CKI and BKR, as they wished to apply for a new mortgage to buy a house. ING Bank refused the requests.
ING Bank processed the data subject’s data on the grounds of Article 6(1)(f) GDPR (legitimate interest). Under Article 21(1) GDPR, a data subject is entitled to object to processing which use Article 6(1)(f) GDPR as a basis. Under Article 17(1)(c) GDPR, where an objection under Article 21 GDPR is made to a controller, they are obliged to delete the data subject’s data. However, under Article 21 GDPR, a controller may refuse an objection if they can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject. ING Bank argued that it was entitled to refuse the data subject’s request, as their legitimate interest in recording the data subject’s credit history overrode their right to be forgotten.
On 19 April 2023, the data subject filed a claim with the Amsterdam District Court, asking that their erasure request be enforced.
Holding
The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights.
As part of the balancing test, the Court examined the purpose of the Bank’s credit registration system, and whether this was a sufficient compelling legitimate ground. ING submitted that the purpose of its system was twofold:
- To protect consumers from taking on too much debt.
- To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations.
ING submitted that its legitimate interest in maintaining the registration with BKR outweighed the data subject’s interests, as the data subject had a problematic debt situation for several years and as a result had low creditworthiness.
The Court held that ING’s grounds did not constitute compelling legitimate grounds which could override the data subject’s legitimate interests. The Court took into consideration that the data subject had sought help for the debt and had managed to pay it off. Moreover, the Court also took into consideration that the bankruptcy arose following a significantly bad economic period after the 2008 financial crash. As a result, ING’s did not have a compelling legitimate interest in maintaining the registration, and thus, their interests did not override those of the data subject.
As a result, the Court ordered ING to fulfil the data subject’s erasure request within one week of the ruling.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
