Difference between revisions of "Hof Arnhem-Leeuwarden - 200.266.445"

From GDPRhub
(Created page with "{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;" ! colspan="2" |Hof Arnhem-Leeuwarden - 200.256.387 |- | colspan="2" style="padding: 20px; background-c...")
 
Line 1: Line 1:
 
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
 
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
! colspan="2" |Hof Arnhem-Leeuwarden - 200.256.387
+
! colspan="2" |Hof Arnhem-Leeuwarden - 200.266.445
 
|-
 
|-
 
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:courtsNL.png|center|250px]]
 
| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:courtsNL.png|center|250px]]
Line 8: Line 8:
 
|Jurisdiction:||[[Data Protection in the Netherlands|Netherlands]]
 
|Jurisdiction:||[[Data Protection in the Netherlands|Netherlands]]
 
|-
 
|-
|Relevant Law:||[[Article 6 GDPR#1c|Article 6(1)(c) GDPR]]
+
|Relevant Law:||[[Article 5 GDPR|Article 5 GDPR]][[Category:Article 5 GDPR]]
[[Article 6 GDPR#1e|Article 6(1)(e) GDPR]]
 
  
[[Article 6 GDPR#2|Article 6(2) GDPR]]
+
[[Article 17 GDPR|Article 17 GDPR]][[Category:Article 17 GDPR]]
  
[[Article 17 GDPR#3b|Article 17(3)(b) GDPR]]
+
[[Article 21 GDPR|Article 21 GDPR]][[Category:Article 21 GDPR]]
 
 
[[Article 21 GDPR#1|Article 21(1) GDPR]]
 
 
|-
 
|-
|Decided:||3. 12. 2019
+
|Decided:||28.4.2020[[Category:2020]]
 
|-
 
|-
|Published:||9. 12. 2019
+
|Published:||13.5.2020
 
|-
 
|-
|Parties:||[https://www.ing.nl/particulier/english/index.html ING Bank N.V.]
+
|Parties:||[https://www.abnamro.com/en/index.html ABN AMRO Bank NV]
[https://www.rabobank.com/en/about-rabobank/cooperative/index.html Cooperative Rabobank U.A.]
 
 
 
International Card Services B.V.
 
 
|-
 
|-
|National Case Number:||200.256.387
+
|National Case Number:||200.266.445
 
|-
 
|-
|European Case Law Identifier:||<small>ECLI:NL:GHARL:2019:10345</small>
+
|European Case Law Identifier:||<small>ECLI:NL:GHARL:2020:3464</small>
 
|-
 
|-
|Appeal from:||Rb. Midden-Nederland (District Court of First Instance)
+
|Appeal from:||Rb. Gelderland (District Court of First Instance)
 
|-
 
|-
|Language:||Dutch
+
|Language:||Dutch[[Category:Dutch]]
 
|-
 
|-
|Original Source:||[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHARL:2019:10345&showbutton=true&keyword=AVG de Rechtspraak (in NL)]
+
|Original Source:||[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHARL:2020:3464 de Rechtspraak (in NL)]
|}The Arnhem-Leeuwarden Court of Appeal confirmed the first instance decision regarding the balancing of interests under Article 21(1) GDPR. In particular, the Court also considered the subjective position of the data subject. At the time of the facts, she was a registered accountant, and this made her conduct even more serious.  
+
|}
 +
 
 +
The Arnhem-Leeuwarden Court of Appeal confirmed the first instance decision regarding the balancing of interests under Article 21(1) GDPR. In particular, the Court also considered the subjective position of the data subject. At the time of the facts, she was a registered accountant, and this made her conduct even more serious.  
 +
 
 
==English Summary==
 
==English Summary==
 
===Facts===
 
===Facts===
The Durch Stichting Bureau Kredietregistratie (BKR), a private entity founded by banks, runs a Central Credit Information System (CKI). Dutch law requires banks to be connected to the CKI.
+
In order to obtain a loan, the data subject provided false document to the bank. Once the bank realized the fraud, it cancelled the contract and inserted the data subject details into two registries (IR and EVR) meant to protect and preserve the integrity of the financial system.
  
The claimant wanted certain data to be delete. It brought a legal action based on [[Article 17 GDPR|Article 17 GDPR]] and [[Article 21 GDPR|Article 21 GDPR]], read in conjunction with the Dutch Data Protection Act (''Wet bescherming persoonsgegevens - Wbp''). The Court of First Instance rejected the claims and dismissed the requests. Thus, the plaintiff appealed the decision before the Court of Appeal.
+
Before the Court of first instance, the data subject asked the deletion of her personal data from the registries or alternatively to limit the duration of the registrations to one year, or a period to be determined by the Court.
===Holding===
 
The Arnhem-Leeuwarden Court of Appeal found that the registration of personal data in the CKI of the BKR does constitute processing of personal data under [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]]. In this instance, this means that the processing at stake is necessary for the compliance with a legal financial obligation and leads to several consequences.
 
  
First, whenever the legal basis of the processing is necessary for compliance with a legal obligation each Member State may introduce more specific provisions according to [[Article 6 GDPR#2|Article 6(2) GDPR]]. In the present case, the processing is carried out under a national legal obligation and for the performance of a task carried out in the public interest since this system is the only credit registration system in the Netherlands. In addition, insofar the compliance with a legal obligation constitutes the primary the legal basis under [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]], the Court found that the data subject cannot exercise his right to object pursuant to [[Article 21 GDPR#1|Article 21(1) GDPR]].
+
The Court of first instance rejected the requests and the data subject challenged the decision before the Arnhem-Leeuwarden Court of Appeal.
  
Secondly, the right to erasure does not apply to the extent that the processing is necessary for the compliance with a legal obligation carried out in the public interest, by virtue of [[Article 17 GDPR#3b|Article 17(3)(b) GDPR]].
+
===Dispute===
 +
Τhe Court of Appeal had to assess whose interests prevail in this case: appellant´s interest to have her data deleted or the bank´s interests to keep data subject´s details into the registries and preserve the integrity of the financial system.
  
Indeed, it further is justified that the task carried out in the public interest under [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]] does not constitute an appropriate and adequate legal basis for all the personal data processed.
+
===Holding===
 +
Under Article 21 (1) GDPR, the Court should balance the interests at stake.  
  
Lastly, the Court recalled that other GDPR principles apply as well. As a consequence, the data controller has to process the personal data to the extent this is necessary for and proportionate to the purpose of the compliance.
+
On the one hand, the interest of the bank to preserve the safety and integrity of the financial sector. On the other hand, the data subject right to interrupt a damaging processing.
  
In this case, the Court found that the processing was lawful.
+
In the present case, data subject´s actions undoubtedly threatened the interests of the financial sector.
==Comment==
 
''Share your comment here!''
 
==Further Resources==
 
''Share blogs or news articles here!''
 
==English Machine Translation of the Decision==
 
The decision below is a machine translation of the original. Please refer to the Dutch original for more details.<pre>DECISION
 
  
1 The further course of the proceedings on appeal
+
However, the appellant argues that her interests should prevail over the bank´s ones. First, she works as accountant in the financial sector where this information is easily accessible and thus damages her reputation. Second, registrations make it impossible for her to obtain another mortgage and buy a new house.
1.1
 
  
The court of appeal refers to its judgment of 9 July 2019 for the course of the proceedings in the first instance and the course of the proceedings on appeal up to that point.
+
The Court of Appeal rejected these arguments. The incident was serious, especially for an accountant. This therefore justified the adverse consequences that the appellant may experience in her work. Furthermore, the appellant had not proved the necessity of a new house, since she had been living in a (different) home that she owned.
1.2
 
  
The further course of the proceedings can be seen from the following:
+
The interests and circumstances alleged by the appellant were therefore insufficient for the Court to reform the first decision. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of the data subject.
  
- the minutes of the multiple composition of the parties held on 10 September 2019.
+
As per the alternative request, the Court of Appeal did not consider the 8-years limit to be disproportionate due to the seriousness of the incident. The alternative request is therefore also rejected and the first decision entirely confirmed.
1.3
 
  
Subsequently, the Court of Appeal issued a judgment.
+
==Comment==
2 The established facts
+
''Share your comment here!''
  
The Court of Appeal bases its appeal on the facts as described in paragraphs 2.1 up to and including 2.9 of the judgment under appeal.
+
==Further Resources==
3 The dispute and the decision in first instance
+
''Share blogs or news articles here!''
3.1
 
  
In the first instance, [the appellant] claimed, in summary, that the Court in preliminary relief proceedings should order ING c.s. and Arrow Global Benelux Holdings B.V. (hereinafter referred to as: Arrow) to remove the codes from the CKI within 48 hours and to keep them removed, on pain of a penalty of € 1,000 per day with a maximum of € 100,000.
+
==English Machine Translation of the Decision==
3.2
+
The decision below is a machine translation of the original. Please refer to the Dutch original for more details.
 
 
By judgment of 20 February 2019 the Court in preliminary relief proceedings declared [the appellant] inadmissible his claim against Arrow and dismissed the claims against ING et al., ordering [the appellant] to pay the costs of the proceedings and the follow-up costs.
 
4 The grounds of the decision on appeal
 
 
 
Core of the case
 
4.1
 
 
 
Briefly summarised, the case at hand is as follows.
 
 
 
The [appellant] was an entrepreneur between 1997 and 2014. He had transferred his entrepreneurial activities to companies associated with him and financed them mainly by means of loans from, inter alia, ING and Rabobank. For some of the business loans, [the appellant] had provided a declaration of joint and several liability or a guarantee. In addition, [the appellant] had borrowed money in a personal capacity from LaSer Lafayette Services Nederland B.V. (hereinafter: LaSer), ING and ICS.
 
 
 
[Appellant] was in arrears with LaSer and ING c.s.
 
 
 
LaSer, ING and ICS have at any time proceeded to claim their claims.
 
  
As from mid-2015, [appellant] has gone through an extrajudicial process under the supervision of Kredietbank Limburg (hereinafter: the debt restructuring process). This debt restructuring process resulted in an (extrajudicial) agreement with the creditors that was signed on 16 August 2018. At the start of this process, the debts amounted to approximately € 1,464,567.26. During the debt restructuring process € 36,532.48 of this amount was paid to the creditors. At the end of the debt restructuring process, the remaining portion of the debts to [the appellant] was waived.
+
<pre>1 The procedure in court
  
In August 2018, LaSer, Arrow Global Limited (to whom LaSer had sold its loans to [the appellant]), ING and ICS had the Central Credit Information System (CKI) of the Stichting Bureau Krediet Registratie (hereinafter referred to as: BKR) register special asset codes 2 (the claim has been made payable) and 3 (an amount in excess of € 250 has been written off). Rabobank placed a code 3 in the BKR on 15 November 2018 - with retroactive effect to 16 August 2018. (All these codes by ING c.s. will hereinafter be referred to as: the codes).
+
For the procedure before the court, the court refers to the content of the decision of 24 June 2019, which was issued by the court of Gelderland, Arnhem seat.
 +
2 The procedure in court
 +
2.1
  
For five of the seven credits it is stated that the contract will be removed in August 2023, if no changes are made.
+
The course of the appeal procedure is evident from:
 +
- the notice of appeal with appendices, received on 19 September 2019;
 +
- the statement of defense with appendices, received on 5 November 2019, from ABN AMRO;
 +
- the V6 form with exhibits 3 to 6 by mr. Notenboom of 26 February 2020;
 +
- the V6 form with production 7 of mr. Notenboom of 9 March 2020.
 +
2.2
  
On 20 September 2018, [Appellant] submitted a request to ING and ICS to remove the encryption registrations. That request was rejected by ING and ICS on 2 October 2018 and 28 September 2018, respectively.
+
The oral hearing took place on 16 March 2020, in which [appellant] appeared, assisted by Mr. Notenboom. Mr. Achterberg has appeared on behalf of ABN AMRO. Mr. Notenboom and Mr. Achterberg presented speech notes at the hearing. Subsequently, the court determined the decision.
 +
3 The facts
  
The claim of [Appellant] on appeal
+
The appeal is based on the facts as described in paragraphs 2.1 to 2.5 of the order of 24 June 2019.
4.2
+
4 The statement of reasons for the appeal decision
  
The [Appellant] challenged the rejection by the Court in preliminary relief proceedings of its claims against ING et al. with eight grievances. In summary, he requests on appeal that the judgment of the Interim Injunction Judge of 20 February 2019 be set aside and that the claims brought in the first instance be allowed, with ING c.s. being ordered to pay the costs of the proceedings in both instances, the surcharges and statutory interest.
+
heart of the matter
 
+
4.1 At the end of 2016, ABN AMRO [appellant] provided a mortgage loan for the purchase and renovation of a home. On 21 December 2018, ABN included AMRO [appellant] in the Incident Register (hereinafter: IR) and the External Referral Register (hereinafter: EVR) for the maximum duration of 8 years. ABN AMRO subsequently terminated the banking relationship with [appellant], claimed the mortgage loan and initiated the executory sale of the house. ABN AMRO proceeded to do this because it appeared that the mortgage application had provided a false tax statement of [appellant's] bank account with Lloyds Bank from the email address of [appellant]. The fiscal overview on December 31, 2015 showed a closing balance of € 121,014.86, while the original fiscal overview of December 31, 2015 had a closing balance of
The complaints lend themselves to joint handling.
+
€ 11,014.86 mentions. [appellant] has acknowledged that the tax overview has been falsified, but has disputed that it has falsified the overview and that it has sent it to ABN AMRO by e-mail.
 
+
procedure in court
Urgent interest in the claimed provision
+
4.2 [appellant] has requested - in summary - the court to order ABN AMRO to remove the personal data of [appellant] from the IR and EVR within two working days after the decision, alternatively to limit the duration of the registrations to one year, or a period to be determined by the court, with confirmation by ABN AMRO of this removal or limitation of duration to [appellant] and to third parties to whom notifications of the registrations have been made, on pain of a penalty. In addition, [appellant] has requested ABN AMRO to be ordered to pay the legal costs.
 
4.3
 
4.3
  
The court of appeal states first of all that when answering the question of whether a remedy sought in interim relief proceedings, either after granting or after refusing it, qualifies for grant on appeal, it must also be assessed, if necessary ex officio, whether the plaintiff had an urgent interest in that remedy at the time of the judgment of the court of appeal (HR 31 May 2002, ECLI:NL:HR:2002:AE3437).
+
The court has considered that it must be assumed that [appellant] has sent a forged overview to ABN AMRO and judged that there is a heavier suspicion than a reasonable suspicion of guilt that [appellant] has used a forged document, one that is punishable fact to qualify conduct. The court subsequently rejected the primary request because - briefly stated - the interests of [appellant] in the removal of her personal data do not outweigh the legitimate interests of ABN AMRO in maintaining it. The alternative claim was rejected because the court the General Regulation Data (hereinafter AVG ) or the Implementation AVG provides a basis for limiting the duration of the registration.
 
 
The question whether a plaintiff in preliminary relief proceedings has a sufficiently urgent interest in the requested remedy must be answered on the basis of a weighing of the interests of the parties, assessed according to the situation at the time of the judgment.
 
4.4
 
 
 
The court of appeal will first form a provisional opinion of the law to be applied and then assess whether, in view of the interests of the parties, the requested interim relief should be granted.
 
  
The legal framework
+
assessment framework
 +
4.4 The assessment framework that the court used in paragraphs 4.1 to 4.4 of the decision of 24 June 2019 was not disputed by the parties, so that the court also takes this as a starting point. In short, the request for deletion of the data in the IR and EVR must be assessed on the basis of the GDPR . Article 21 (1) GDPR stipulates that a data subject has the right to object to the processing of personal data concerning him based on Article 6 (1) (e) and (f) GDPR at any time for reasons related to his specific situation . Pursuant to Article 17, paragraph 1, preamble and under c and d GDPRthe data subject has the right to have his personal data deleted if the data subject pursuant to Article 21 (1) GDPRobject to the processing and there are no prevailing compelling legitimate grounds for the processing, or if the personal data have been unlawfully processed. According to Article 6, paragraph 1, preamble and under f, the processing is lawful if and insofar as the processing is necessary for the representation of the legitimate interests of the controller or of a third party, except when the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those interests, especially when the data subject is a child. In doing so, the principles of proportionality and subsidiarity must be complied with.This means that the infringement of the interests of the data subjects must not be disproportionate to the purpose of the processing, and that this purpose cannot reasonably be achieved in another way less disadvantageous to the data subject.
 
4.5
 
4.5
  
[Appellant] based his claim primarily on Articles 17 and 21 in conjunction with Article 6 of the General Data Protection Regulation (hereinafter referred to as: AVG) and, in the alternative, on Articles 6:162 and/or 168 of the Dutch Civil Code (hereinafter referred to as: BW).
+
Furthermore, the registrations in the IR and EVR should be based on the Protocol Incident Warning System Financial Institutions (hereinafter: the protocol). The protocol further specifies in which cases data may be included and may remain included in the IR of the affiliated financial institution. The IR and the associated EVR aim to support activities aimed at ensuring the safety and integrity of the financial sector. In order to register data, it must be behavior that forms an disadvantage (IR) or threat (EVR) for the interests of the financial institutions or the continuity and integrity of the financial sector.
  
In answering the question of whether the codings placed by ING c.s. should be removed, the following legal framework therefore applies.
+
request removal of IR and EVR registrations
4.6
+
4.6 The court rejects the primary request for deletion of the [appellant's] personal data in the IR and EVR and accepts the court's opinion on this point. The court agrees with the court that it has been established that [appellant] has provided a false tax overview to ABN AMRO. During the oral appeal, [appellant] acknowledged (again) that the tax overview of her bank account at Lloyds Bank, which was provided to ABN AMRO in connection with her mortgage application, was forged. Although [appellant] has contradicted that she drew up the forged overview and that she sent this overview to ABN AMRO from her e-mail address, [appellant] also failed to substantiate these statements on appeal.[appellant] has led ABN AMRO to believe that it is over
 +
Apparently € 110,000 more in own funds than was actually the case, apparently in order to qualify for the requested mortgage loan. This behavior undoubtedly leads to disadvantage and threat to the interests of the financial sector and provides an important interest on the part of ABN AMRO to register [appellant] in the IR and EVR. [appellant] has argued that her interests should be outweighed by the removal of the registrations, partly because the registrations hinder her in the exercise of her profession as an accountant. [appellant] claims that she mainly works at financial institutions and that when they consult the systems, these institutions encounter the notification of her in the IR and EVR. However, the incident is so serious, especially for someone who is an accountant,that the registrations are justified and that this therefore justifies the adverse consequences that [appellant] may experience in her work as an accountant. In addition, [appellant] has argued that she will not obtain new financing as long as the registrations are maintained. This circumstance does not lead to any other judgment either. Furthermore, it has not been shown that [appellant] is in need of housing, since [appellant] currently lives in a (different) home that she owns. Furthermore, it is expected that in the short term [appellant] can be further helped by the municipality to open a basic account, so that the registrations in this respect do not hinder [appellant] to participate in the financial traffic.The interests and circumstances put forward by [appellant], seen separately but also in mutual context, are insufficient for the court to arrive at a different decision than the court. Since [appellant] has insufficiently substantiated its statements regarding the falsified tax overview, as judged above, the Court of Appeal is unable to provide evidence. The court finds the recording and enforcement of the registrations in accordance with the principles of proportionality and subsidiarity. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.Since [appellant] has insufficiently substantiated its statements regarding the falsified tax overview, as judged above, the Court of Appeal is unable to provide evidence. The court finds the recording and enforcement of the registrations in accordance with the principles of proportionality and subsidiarity. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.Since [appellant] has insufficiently substantiated its statements regarding the falsified tax overview, as judged above, the Court of Appeal is unable to provide evidence. The court finds the recording and enforcement of the registrations in accordance with the principles of proportionality and subsidiarity. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.
  
Article 6 of the AVG contains an exhaustive list of the circumstances under which the processing of personal data is lawful. This is the case, among other things, if the processing is necessary in order to comply with a statutory obligation incumbent on the data controller (Article 6.1(c) AVG). It follows from recitals 41 and 45 of the AVG that this does not necessarily have to be a law in a formal sense, nor is it required that each individual processing is subject to specific legislation. Legislation that serves as a basis for several processing operations on the basis of a legal obligation incumbent on the controller, or for processing necessary for the performance of a task in the public interest, would suffice.
+
limitation duration registration IR and EVR
4.7
+
4.7 Unlike the court, the court is of the opinion that the GDPRand the Implementation Act does provide a basis for an order limiting the duration of the registration. The possibility of this lies in the further jurisdiction of the court to order that the processing of personal data be stopped. After all, the balancing of interests to delete the data also includes the consideration of limiting the duration of the registration and thus allowing the deletion to take place, not immediately but at an earlier time than the protocol should do at the latest. In this context, too, the Court of Appeal must weigh up the interests put forward by both parties and assess whether the principle of proportionality has been complied with. With reference to what has been considered about those interests under 4.6,the Court of Appeal does not consider the duration of the registrations of 8 years as disproportionate at present due to the seriousness of the incident. The alternative request of [appellant] will also be rejected.
 
+
5 Finally
ING c.s. are providers of credit within the meaning of Section 1:1 of the Financial Supervision Act (Wft). Pursuant to Sections 4:32(1) and 4:34 of the Wft, they are obliged to participate in a system of credit registration. The Central Credit Information System (CKI), which is maintained by the Bureau for Credit Registration (BKR) in Tiel, is the (only) existing system of credit registration in the Netherlands. The CKI contains automated processing of personal data to which the GTC applies. ING c.s. are participants in the CKI and, as participants, are bound by the CKI General Regulations adopted by the BKR.
 
4.8
 
 
 
The [Appellant's] personal details have therefore been recorded on the basis of a statutory obligation as referred to in Article 6, clause 1 (c), of the GCG.
 
4.9
 
 
 
If the processing of personal data, as in this case, is based on a statutory duty, the data subject ([appellant]) is not entitled to the right to erasure of data laid down in Article 17 of the AVG, as follows from Article 17, clause 3 (b) of the AVG. Nor does the data subject in that case have the right of objection as referred to in Article 21 of the AVG, since that right is linked to data processing on the basis of Article 6 clause 1 under e or f of the AVG.
 
4.10
 
 
 
However, the protection of natural persons in the processing of personal data is a fundamental right, according to consideration 1 at the AVG. The fundamental right to the protection of personal data is further enshrined in Article 10 of the Constitution and in Article 8 of the Charter of Fundamental Rights of the European Union, while as part of private life it is also protected in Article 8 of the European Convention on Human Rights (ECHR) and Article 17 of the International Covenant on Civil and Political Rights (ICCPR).
 
4.11
 
 
 
Recital 39 of the AVG also states that the personal data being processed must be adequate, relevant and limited to what is necessary for the purposes for which they are processed. Personal data may only be processed if the purpose of the processing cannot reasonably be achieved in any other way.
 
4.12
 
 
 
In addition, recital 47 of the AVG states that the legitimate interests of a controller or of a third party may provide a legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject are not overridden, taking into account the reasonable expectations of the data subject based on his or her relationship with the controller. A careful assessment should be made to determine whether a legitimate interest exists, as well as to determine whether a data subject may reasonably expect processing to be carried out for that purpose at the time and in the context of the collection of the personal data.
 
4.13
 
 
 
The above implies that even if the processing of personal data is based on a statutory obligation (in this case the Wft), the task of carrying out that obligation does not automatically justify any data processing. As was the case under the Personal Data Protection Act (Wbp), any processing of personal data must meet the requirements of proportionality and subsidiarity and, in view of the nature of the invasion of privacy, a case-by-case weighing of interests is necessary.
 
4.14
 
 
 
In this context, it should be borne in mind that in its judgment of 9 September 2011 (ECLI:NL:HR:2011:BQ8097), the Supreme Court considered that the Wbp, which was still in force at the time, should be interpreted in accordance with the provisions of Article 8 of the European Convention on Human Rights and that it follows from the legislative history of the Wbp that any data processing must comply with the principles of proportionality and subsidiarity. In the opinion of the Supreme Court, this means that the interference with the interests of the data subject may not be disproportionate in relation to the purpose to be served by the processing, and that this purpose cannot reasonably be processed in another way that is less disadvantageous to the data subject.
 
Since the purpose of the AVG is not to limit the rights of natural persons to the protection of their personal data (with respect to the Personal Data Protection Act), the aforementioned principles also apply to the processing of personal data pursuant to the AVG.
 
4.15
 
 
 
For the reasons stated above, the mere fact that Articles 17 and 21 of the AVG do not provide for the possibility of invoking the right to erasure of data and the possibility of objection in the event that the data processing is based on a statutory obligation, cannot lead to the conclusion that there is then no longer any place for review in the light of the principles of proportionality and subsidiarity and a balancing of interests.
 
 
 
In the opinion of the Court of Appeal it also applies if, as has been brought forward here (by ING and ICS), a request for removal has been made outside the period of six weeks referred to in Section 79 of the AVG in connection with Section 35 of the AVG Implementation Act (UAVG).
 
 
 
On this point, too, there is no reason to judge differently under the AVG than under the Wbp.
 
4.16
 
 
 
Data processing that conflicts with the aforementioned principles and in which the interests of the data subject outweigh the interests to be served with the processing must therefore be regarded as unlawful.
 
 
 
Examination in the light of the principles of proportionality and subsidiarity and the balancing of interests
 
4.17
 
 
 
In answering the question of whether ING c.s. should remove the BKR registrations because their enforcement is unlawful, it is not so much a question of weighing up the interests between [the appellant] and ING c.s., but of verifying the purpose of the coding registrations against the principles of proportionality and subsidiarity. In this way, the interests of [the appellant] in the removal of the codes in question will be weighed against the underlying interests of (maintaining) the registration of the codes.
 
4.18
 
 
 
The purpose of (the registrations pursuant to) the CKI is to promote socially responsible financial services. BKR wants to protect consumers from excessive lending and other financial problems (problematic debt situations). In addition, BKR makes a contribution for its business affiliates to limiting the financial risks in lending by informing these lenders of relevant peculiarities that have occurred in the recent past. To this end, late payments or other irregularities that arise during the term of a loan are reflected in the CKI by means of a special-purpose code. Once the claim has been settled, a maturity date shall be recorded with the contract and a period of five years shall run, after which the speciality code shall be removed.
 
4.19
 
 
 
In view of the objectives of the CKI's system, the registration of the specialty codes relating to [the appellant] is therefore proportional. Registration is also in line with the subsidiarity principle, as there is no other means for lenders to learn about the [appellant's] financial past other than by consulting the CKI.
 
4.20
 
 
 
In view of these objectives of the CKI system, the importance of continuing the BKR registrations is also given. After all, deleting or amending the BKR registrations would result in an incorrect representation in the CKI of [the appellant's] payment transactions and their history, thus undermining the purpose of the BKR.
 
4.21
 
 
 
4.21 [Appellant] has taken the position that he has a legitimate interest in removing the encodings because they impede him in obtaining a mortgage loan. He argues that he needs this loan, because otherwise he will not be able to obtain housing for him, his girlfriend and his girlfriend's children. In addition, he argues that he has been in permanent employment for a long time, so that he is financially stable. He now earns modal wages twice, while his girlfriend also has a fixed income. He argues that he has taken over the debts of the companies on the basis of a high payment morale and that he had a net disposable income of € 580 per month for many years during the debt restructuring process.
 
4.22
 
 
 
ING c.s. substantiated that these were only business debts, which [the appellant] would have taken over for noble reasons. Subsequently, [the appellant] did not substantiate its claims on this point, nor did it address any grievances against the fact established by the Court in preliminary relief proceedings under 2.1 of the contested judgment that [the appellant] had borrowed money from ICS and LaSer in a personal capacity and that he was liable in person for part of the business loans. Therefore, for the time being, the Court of Appeal assumes that the registrations of the codings are related to substantial debts arising not only from business credits for which [the appellant] had assumed personal liability, but also from private credits.
 
4.23
 
 
 
The mere fact that, as a result of the (enforcement of the) codings, [the appellant] encounters difficulties in obtaining a mortgage loan and for this reason finds it difficult or virtually impossible to buy a home - however annoying for [the appellant] - does not outweigh the interest of potential lenders in being able to weigh up whether or not to enter into a (mortgage) credit agreement with [the appellant] on the basis of full information. This is all the more compelling in the present case in view of the high level of indebtedness, most of which was only recently written off after only a small proportion of the total debt had been repaid. Potential lenders have a legitimate interest in learning about this credit history, so that they can see the details of the credit granted to [the appellant]. The fact that [the appellant] had been in permanent employment for a long time and is now earning considerable income from it does not make this any different.
 
4.24
 
 
 
Moreover, contrary to the [appellant's] assertion, it has become insufficiently plausible that [the appellant] would be unable to live anywhere as a result of the credit registrations. After all, it has been pointed out by ING et al. that [the appellant] is currently renting a dwelling under an open-ended tenancy agreement. The fact that, for personal reasons, [the appellant] would prefer not to invoke rent protection against the landlord and may therefore have to leave this property in the event of a possible sale thereof - as he stated during the appeal before the court of appeal - constitutes a circumstance that he cannot invoke against ING et al. The circumstance that the rent of the home is considerably higher than the amount that [the appellant] would have to pay in mortgage interest and redemption for a comparable owner-occupied home does not weigh sufficiently heavily either, against the background of the circumstances referred to under 4.23 above.
 
4.25
 
 
 
Needless to say, the Court of Appeal also noted that ING and Rabobank have initiated a preliminary hearing of witnesses, because they claim that they may have erred in entering into and/or the course of the debt rescheduling process. In this respect they explained that a debt to the father of [the appellant] may not have been remitted. In addition, they pointed out that it appeared to them that [the appellant's] salary increased substantially almost immediately after the debt restructuring process was completed, while it is not clear why [the appellant] would not have been able to receive this higher salary during the debt restructuring process and would therefore have been able to pay a larger proportion of his debts. It is true that the Court of Appeal cannot at this moment form an opinion on the question whether [the appellant] was guilty of facts that put ING and Rabobank on the wrong foot during the debt rescheduling process, but the circumstance that there is still uncertainty as to whether the debts of [the appellant] to ING and Rabobank have actually been discharged, is also a circumstance that weighs up in the balancing of interests.
 
4.26
 
 
 
The above leads to the conclusion that, for the time being, the weighing of interests to be carried out should be to the disadvantage of [the appellant]. Now that it has not emerged for the time being that the consequences of the BKR registrations for [the appellant] are so disproportionate that the interest in continuing to do so should give way and that the principle of subsidiarity has also been complied with, the processing (or retention) of [the appellant's] personal data in the CKI does not conflict with the fundamental rights referred to under 4.10 and is not unlawful.
 
4.27
 
 
 
The grievances therefore fail. The other points raised by the parties in the context of the grievances put forward do not require further discussion, as this could not lead to a different conclusion.
 
 
 
Evidence on offer
 
4.28
 
 
 
As a starting point, given the nature of the preliminary relief proceedings, there is generally no place in these proceedings for comprehensive proof. It has not been sufficiently stated or shown that in this case there are reasons to deviate from this principle. The Court of Appeal therefore disregarded the offer of evidence made by [the appellant].
 
 
 
Requests made in the responses of ING and Rabobank
 
4.29
 
 
 
ING has asked the court of appeal, when ratifying the judgment and the order to pay the costs of the proceedings, to redefine the salary of the lawyer at first instance. However, ING did not make this request in a ground of appeal that was recognisable as such, let alone that ING lodged an incidental appeal and formulated a petition in it. The Court of Appeal therefore disregarded ING's request.
 
4.30
 
 
 
The request made by Rabobank to order [the appellant] to pay the costs of the proceedings of Rabobank cannot be granted for the same reason, if and insofar as this would have allowed Rabobank to pay the costs of the proceedings in the first instance.
 
5 The Conclusion
 
 
5.1
 
5.1
  
The grievances fail. The contested judgment will be ratified.
+
Although the appeal succeeds on the point that the limitation in the duration of the registration can also be requested under the GDPR , the assessment of the request on this point does not lead to a different judgment. The contested decision will therefore be ratified.
 
5.2
 
5.2
  
As the unsuccessful party, the Court shall order [the appellant] to pay the costs of the appeal.
+
The appellant, as the unsuccessful party, will pay the costs of the appeal. The costs of the appeal proceedings on the part of ABN AMRO will be set at € 741 for court fees and € 2,148 for attorney's salaries in accordance with the liquidation rate (2 points x apple rate II).
 
 
The costs of the proceedings on appeal on the part of both ING, ICS and Rabobank are estimated at € 741 in disbursements and at € 2,148 for salary in accordance with the liquidation rate (2 points x rate II).
 
 
 
If not contested, the court will also award the claimed statutory interest on the litigation costs to be paid to ING and the after costs as mentioned below.
 
 
6 The decision
 
6 The decision
  
The Court of Appeal, on appeal in interim relief proceedings:
+
The appellate court, on appeal:
 
 
Ratifies the judgment of the Interim Injunction Judge in the District Court of Midden-Nederland of 20 February 2019;
 
 
 
orders [the appellant] to pay the costs of the appeal, until such time as this decision is rendered, on the part of ING fixed at € 741 in out-of-pocket expenses and at € 2,148 for salary in accordance with the liquidation rate, within fourteen days of the date of this decision, and - in the event that payment is not made within the said period - to be increased by statutory interest calculated as from the said period for payment;
 
  
Condemns the [Appellant] to pay the surcharges payable by ING, estimated at € 157, stipulating that this amount will be increased by € 82, in the event that the [Appellant] has not complied with this ruling within fourteen days of being notified of this ruling and has been served and paid within fourteen days of the date of this ruling, and - in the event that payment is not made within the said period - to be increased by the statutory interest as from the said period for payment;
+
ratifies the contested decision of the court of Gelderland, seat Arnhem, of 24 June 2019;
  
orders [the appellant] to pay the costs of the appeal, until this judgment has been delivered, on the part of ICS, fixed at € 741 in out-of-pocket expenses and at € 2,148 for salary in accordance with the liquidation rate;
+
orders [appellant] to pay the costs of the appeal, up to this judgment set at ABN AMRO at € 741 for disbursements and at € 2,148 for attorney's salary in accordance with the liquidation rate;
  
orders [the appellant] to pay the costs of the appeal, until such time as this judgment is delivered, set on the part of Rabobank at € 741 in respect of disbursements and at € 2,148 in respect of salary in accordance with the liquidation rate;
+
declares this decision enforceable with stock;
  
declares this judgment to be provisionally enforceable in so far as the orders to pay the costs referred to herein are concerned.
+
rejects the more or otherwise requested.
  
This judgment was rendered by mrs. S.B. Boorsma, H.C. Frankena and C.J.H.G. Bronzwaer and was pronounced publicly on 3 December 2019 in the presence of the Registrar.</pre>
+
This decision was made by mrs. CJHG Bronzwaer, JH Lieber and HL Wattel, signed by the youngest counsel in the absence of the Chairman and publicly pronounced in the presence of the Registrar April 28, 2020.
 +
</pre>

Revision as of 13:33, 19 May 2020

Hof Arnhem-Leeuwarden - 200.266.445
CourtsNL.png
Court: Hof Arnhem-Leeuwarden (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 5 GDPR

Article 17 GDPR

Article 21 GDPR

Decided: 28.4.2020
Published: 13.5.2020
Parties: ABN AMRO Bank NV
National Case Number: 200.266.445
European Case Law Identifier: ECLI:NL:GHARL:2020:3464
Appeal from: Rb. Gelderland (District Court of First Instance)
Language: Dutch
Original Source: de Rechtspraak (in NL)

The Arnhem-Leeuwarden Court of Appeal confirmed the first instance decision regarding the balancing of interests under Article 21(1) GDPR. In particular, the Court also considered the subjective position of the data subject. At the time of the facts, she was a registered accountant, and this made her conduct even more serious.

English Summary

Facts

In order to obtain a loan, the data subject provided false document to the bank. Once the bank realized the fraud, it cancelled the contract and inserted the data subject details into two registries (IR and EVR) meant to protect and preserve the integrity of the financial system.

Before the Court of first instance, the data subject asked the deletion of her personal data from the registries or alternatively to limit the duration of the registrations to one year, or a period to be determined by the Court.

The Court of first instance rejected the requests and the data subject challenged the decision before the Arnhem-Leeuwarden Court of Appeal.

Dispute

Τhe Court of Appeal had to assess whose interests prevail in this case: appellant´s interest to have her data deleted or the bank´s interests to keep data subject´s details into the registries and preserve the integrity of the financial system.

Holding

Under Article 21 (1) GDPR, the Court should balance the interests at stake.

On the one hand, the interest of the bank to preserve the safety and integrity of the financial sector. On the other hand, the data subject right to interrupt a damaging processing.

In the present case, data subject´s actions undoubtedly threatened the interests of the financial sector.

However, the appellant argues that her interests should prevail over the bank´s ones. First, she works as accountant in the financial sector where this information is easily accessible and thus damages her reputation. Second, registrations make it impossible for her to obtain another mortgage and buy a new house.

The Court of Appeal rejected these arguments. The incident was serious, especially for an accountant. This therefore justified the adverse consequences that the appellant may experience in her work. Furthermore, the appellant had not proved the necessity of a new house, since she had been living in a (different) home that she owned.

The interests and circumstances alleged by the appellant were therefore insufficient for the Court to reform the first decision. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of the data subject.

As per the alternative request, the Court of Appeal did not consider the 8-years limit to be disproportionate due to the seriousness of the incident. The alternative request is therefore also rejected and the first decision entirely confirmed.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

1 The procedure in court

For the procedure before the court, the court refers to the content of the decision of 24 June 2019, which was issued by the court of Gelderland, Arnhem seat.
2 The procedure in court
2.1

The course of the appeal procedure is evident from:
- the notice of appeal with appendices, received on 19 September 2019;
- the statement of defense with appendices, received on 5 November 2019, from ABN AMRO;
- the V6 form with exhibits 3 to 6 by mr. Notenboom of 26 February 2020;
- the V6 form with production 7 of mr. Notenboom of 9 March 2020.
2.2

The oral hearing took place on 16 March 2020, in which [appellant] appeared, assisted by Mr. Notenboom. Mr. Achterberg has appeared on behalf of ABN AMRO. Mr. Notenboom and Mr. Achterberg presented speech notes at the hearing. Subsequently, the court determined the decision.
3 The facts

The appeal is based on the facts as described in paragraphs 2.1 to 2.5 of the order of 24 June 2019.
4 The statement of reasons for the appeal decision

heart of the matter
4.1 At the end of 2016, ABN AMRO [appellant] provided a mortgage loan for the purchase and renovation of a home. On 21 December 2018, ABN included AMRO [appellant] in the Incident Register (hereinafter: IR) and the External Referral Register (hereinafter: EVR) for the maximum duration of 8 years. ABN AMRO subsequently terminated the banking relationship with [appellant], claimed the mortgage loan and initiated the executory sale of the house. ABN AMRO proceeded to do this because it appeared that the mortgage application had provided a false tax statement of [appellant's] bank account with Lloyds Bank from the email address of [appellant]. The fiscal overview on December 31, 2015 showed a closing balance of € 121,014.86, while the original fiscal overview of December 31, 2015 had a closing balance of
€ 11,014.86 mentions. [appellant] has acknowledged that the tax overview has been falsified, but has disputed that it has falsified the overview and that it has sent it to ABN AMRO by e-mail.
procedure in court
4.2 [appellant] has requested - in summary - the court to order ABN AMRO to remove the personal data of [appellant] from the IR and EVR within two working days after the decision, alternatively to limit the duration of the registrations to one year, or a period to be determined by the court, with confirmation by ABN AMRO of this removal or limitation of duration to [appellant] and to third parties to whom notifications of the registrations have been made, on pain of a penalty. In addition, [appellant] has requested ABN AMRO to be ordered to pay the legal costs.
4.3

The court has considered that it must be assumed that [appellant] has sent a forged overview to ABN AMRO and judged that there is a heavier suspicion than a reasonable suspicion of guilt that [appellant] has used a forged document, one that is punishable fact to qualify conduct. The court subsequently rejected the primary request because - briefly stated - the interests of [appellant] in the removal of her personal data do not outweigh the legitimate interests of ABN AMRO in maintaining it. The alternative claim was rejected because the court the General Regulation Data (hereinafter AVG ) or the Implementation AVG provides a basis for limiting the duration of the registration.

assessment framework
4.4 The assessment framework that the court used in paragraphs 4.1 to 4.4 of the decision of 24 June 2019 was not disputed by the parties, so that the court also takes this as a starting point. In short, the request for deletion of the data in the IR and EVR must be assessed on the basis of the GDPR . Article 21 (1) GDPR stipulates that a data subject has the right to object to the processing of personal data concerning him based on Article 6 (1) (e) and (f) GDPR at any time for reasons related to his specific situation . Pursuant to Article 17, paragraph 1, preamble and under c and d GDPRthe data subject has the right to have his personal data deleted if the data subject pursuant to Article 21 (1) GDPRobject to the processing and there are no prevailing compelling legitimate grounds for the processing, or if the personal data have been unlawfully processed. According to Article 6, paragraph 1, preamble and under f, the processing is lawful if and insofar as the processing is necessary for the representation of the legitimate interests of the controller or of a third party, except when the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those interests, especially when the data subject is a child. In doing so, the principles of proportionality and subsidiarity must be complied with.This means that the infringement of the interests of the data subjects must not be disproportionate to the purpose of the processing, and that this purpose cannot reasonably be achieved in another way less disadvantageous to the data subject.
4.5

Furthermore, the registrations in the IR and EVR should be based on the Protocol Incident Warning System Financial Institutions (hereinafter: the protocol). The protocol further specifies in which cases data may be included and may remain included in the IR of the affiliated financial institution. The IR and the associated EVR aim to support activities aimed at ensuring the safety and integrity of the financial sector. In order to register data, it must be behavior that forms an disadvantage (IR) or threat (EVR) for the interests of the financial institutions or the continuity and integrity of the financial sector.

request removal of IR and EVR registrations
4.6 The court rejects the primary request for deletion of the [appellant's] personal data in the IR and EVR and accepts the court's opinion on this point. The court agrees with the court that it has been established that [appellant] has provided a false tax overview to ABN AMRO. During the oral appeal, [appellant] acknowledged (again) that the tax overview of her bank account at Lloyds Bank, which was provided to ABN AMRO in connection with her mortgage application, was forged. Although [appellant] has contradicted that she drew up the forged overview and that she sent this overview to ABN AMRO from her e-mail address, [appellant] also failed to substantiate these statements on appeal.[appellant] has led ABN AMRO to believe that it is over
Apparently € 110,000 more in own funds than was actually the case, apparently in order to qualify for the requested mortgage loan. This behavior undoubtedly leads to disadvantage and threat to the interests of the financial sector and provides an important interest on the part of ABN AMRO to register [appellant] in the IR and EVR. [appellant] has argued that her interests should be outweighed by the removal of the registrations, partly because the registrations hinder her in the exercise of her profession as an accountant. [appellant] claims that she mainly works at financial institutions and that when they consult the systems, these institutions encounter the notification of her in the IR and EVR. However, the incident is so serious, especially for someone who is an accountant,that the registrations are justified and that this therefore justifies the adverse consequences that [appellant] may experience in her work as an accountant. In addition, [appellant] has argued that she will not obtain new financing as long as the registrations are maintained. This circumstance does not lead to any other judgment either. Furthermore, it has not been shown that [appellant] is in need of housing, since [appellant] currently lives in a (different) home that she owns. Furthermore, it is expected that in the short term [appellant] can be further helped by the municipality to open a basic account, so that the registrations in this respect do not hinder [appellant] to participate in the financial traffic.The interests and circumstances put forward by [appellant], seen separately but also in mutual context, are insufficient for the court to arrive at a different decision than the court. Since [appellant] has insufficiently substantiated its statements regarding the falsified tax overview, as judged above, the Court of Appeal is unable to provide evidence. The court finds the recording and enforcement of the registrations in accordance with the principles of proportionality and subsidiarity. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.Since [appellant] has insufficiently substantiated its statements regarding the falsified tax overview, as judged above, the Court of Appeal is unable to provide evidence. The court finds the recording and enforcement of the registrations in accordance with the principles of proportionality and subsidiarity. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.Since [appellant] has insufficiently substantiated its statements regarding the falsified tax overview, as judged above, the Court of Appeal is unable to provide evidence. The court finds the recording and enforcement of the registrations in accordance with the principles of proportionality and subsidiarity. In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.In view of the above, the interest of ABN AMRO in maintaining the registrations outweighs the interests of [appellant] in its removal.

limitation duration registration IR and EVR
4.7 Unlike the court, the court is of the opinion that the GDPRand the Implementation Act does provide a basis for an order limiting the duration of the registration. The possibility of this lies in the further jurisdiction of the court to order that the processing of personal data be stopped. After all, the balancing of interests to delete the data also includes the consideration of limiting the duration of the registration and thus allowing the deletion to take place, not immediately but at an earlier time than the protocol should do at the latest. In this context, too, the Court of Appeal must weigh up the interests put forward by both parties and assess whether the principle of proportionality has been complied with. With reference to what has been considered about those interests under 4.6,the Court of Appeal does not consider the duration of the registrations of 8 years as disproportionate at present due to the seriousness of the incident. The alternative request of [appellant] will also be rejected.
5 Finally
5.1

Although the appeal succeeds on the point that the limitation in the duration of the registration can also be requested under the GDPR , the assessment of the request on this point does not lead to a different judgment. The contested decision will therefore be ratified.
5.2

The appellant, as the unsuccessful party, will pay the costs of the appeal. The costs of the appeal proceedings on the part of ABN AMRO will be set at € 741 for court fees and € 2,148 for attorney's salaries in accordance with the liquidation rate (2 points x apple rate II).
6 The decision

The appellate court, on appeal:

ratifies the contested decision of the court of Gelderland, seat Arnhem, of 24 June 2019;

orders [appellant] to pay the costs of the appeal, up to this judgment set at ABN AMRO at € 741 for disbursements and at € 2,148 for attorney's salary in accordance with the liquidation rate;

declares this decision enforceable with stock;

rejects the more or otherwise requested.

This decision was made by mrs. CJHG Bronzwaer, JH Lieber and HL Wattel, signed by the youngest counsel in the absence of the Chairman and publicly pronounced in the presence of the Registrar April 28, 2020.