GHDHA - 200.291.947/01

From GDPRhub
Revision as of 20:34, 9 November 2021 by Crabbe (talk | contribs) (Created page with "{{COURTdecisionBOX |Jurisdiction=Netherlands |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=GHDHA |Court_With_Country=GHDHA (Netherlands) |Case_Number_Name=...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
GHDHA - 200.291.947/01
Courts logo1.png
Court: GHDHA (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 6(1)(f) GDPR
Article 17 GDPR
Article 21 GDPR
art. 35 (2) UAVG
Decided: 05.10.2021
Published: 03.11.2021
Parties: Aegon
National Case Number/Name: 200.291.947/01
European Case Law Identifier: ECLI:NL:GHDHA:2021:1924
Appeal from: Rb. Den Haag
C/09/595546 / HA RK 20-314
Appeal to:
Original Language(s): Dutch
Original Source: Rechtspraak.nl (in Dutch)
Initial Contributor: n/a

The Court of Appeal of The Hague is of the opinion that the balancing of interests from Art. 21 (1) GDPR succeeds in favour of the controller, since the data subject does not make it plausible that the individual interests exceed the interests of the sector as set out in Art. 4:32 Financial Supervision Act.

English Summary

Facts

The claimant requested the defendant to remove his registration of special codes in the Central Credit Information System (CKI) of the Bureau for Credit Registration. The registration in the CKI was in response to the claimant's inability to repay his mortgage debt to the defendant. Subsequently, the registration, which was dated September 2018, remained in effect for a period of 5 years, September 2023. The registration had the effect of preventing the claimant from taking out a new loan. In the first instance, the claimant demanded the removal of the registration accompanied by a daily penalty payment. The court ordered the defendant to remove the registration on 1 January 2023 instead of September 2023. However the penalty payment demanded was rejected. The applicant did not agree with the ruling and brought the case for appeal. The claimant put forward three grounds of appeal against the contested decision. First of all, the claimant points to the wrongful absence of relevant facts. Secondly, the claimant argued that the court should have first assessed whether the registration was still necessary before weighing up the interests. Finally, the claimant challenges the court's finding that the registration should not be removed until 1 January 2023. The defendant, in turn, put forward four grounds for appeal. Firstly, it also concerns the establishment of facts and, secondly, the admissibility of the application. Thirdly, the defendant complains that the court wrongly gave weight to the time lapse factor in the weighing of interests. Finally, the defendant argues that there is no ground for removal on 1 January 2023.

Holding

The Court of Appeal of The Hague tested two elements in its judgment, namely the admissibility of the request and whether the request for removal of the registration should be granted. With regard to the admissibility of the claimant's request of 28 April 2020, the Court of Appeal tested art. 35 (2) of the Dutch Data Protection Act (UAVG), which states that the appeal must be submitted to the court within six weeks after receipt of the response from the data controller. The defendant is of the opinion that the deadline was exceeded by the claimant since it submitted an identical application on 22 August 2019. However, the court considers that the request is admissible as the first request dated August 2019 was addressed to the wrong party, i.e. the defendant's sister company. The application dated April 2020 was addressed to the correct company and the application was filed with the court within the six-week period. The Court also notes that the Respondent, in its response to the second application dated April 2020, did not emphasise in May 2020 that, for the reason of a repeated and identical application, it would not consider the new application. Regarding the deletion request, the court examines Articles 6 (1) F , 17 and 21 GDPR. Article 21 (1), second sentence GDPR stipulates that the controller (the defendant) shall cease processing personal data unless it has compelling legitimate grounds for the processing which override the interests or the fundamental rights and freedoms of the data subject. It must be investigated whether the infringement of the data subject's interests is not disproportionate in relation to the purpose to be served by the processing (proportionality test) and whether that purpose cannot reasonably be achieved in a different manner that is less detrimental to the data subject (subsidiarity test). Pursuant to Section 4:32 of the Financial Supervision Act, credit providers are obliged to participate in a credit registration system. The purpose of credit registration is to promote socially responsible financial services, as (also) follows from the General Regulations of the CKI (hereinafter: CKI Regulations). On the one hand, it is in the interest of consumers to protect them from overcrediting and other financial problems (problematic debt situations). On the other hand, it is in the interest of credit providers to limit financial risks when granting credit and to prevent and combat abuse and fraud. The credit registration system serves these interests, for example by informing credit providers about relevant details that have occurred in the (recent) past. To this end a credit provider is obliged (pursuant to the CKI regulations) to register certain payment arrears and other irregularities in the CKI. In principle, such a special feature code remains in place for up to five years after the arrears have been repaid or the credit agreement has been terminated. The Respondent emphasises that the facts, more specifically the inability to repay excessive debts and the debt settlement process through which the Claimant was made debt free, indicate a risk of over-indebtedness. The write-off of the significant debt also indicates, according to the Defendant, the importance of registration so that other lenders can assess their credit risks. The plaintiff is not able to sufficiently demonstrate that its interests would outweigh this. The court should therefore conclude that the defendant's interest in maintaining the registration outweighs the plaintiff's interest in having it removed. The request for removal is therefore dismissed. The Court of Appeal set aside the order of 16 December 2020 of the District Court of The Hague.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.