Rb. Amsterdam - ECLI:NL:RBAMS:2023:6456: Difference between revisions

Revision as of 18:15, 14 November 2023

Rb. Amsterdam - ECLI:NL:RBAMS:2023:6456

Court:	Rb. Amsterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 17 GDPR Article 21 GDPR
Decided:	26.10.2023
Published:	02.11.2023
Parties:	ING Bank
National Case Number/Name:	ECLI:NL:RBAMS:2023:6456
European Case Law Identifier:	ECLI:NL:RBAMS:2023:6456
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The District Court of Amsterdam held that a data subject’s right to be forgotten under Article 17 GDPR overrode the interests of a credit ranking agency in holding their financial records.

English Summary

Facts

In December 2005, the data subject took out a €202,500 mortgage for a house with ING Bank (the controller). In 2008, the data subject faced financial hardship and could no longer pay off the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest).

The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and wrote off its claim. Despite that, ING Bank still had the data subject negatively registered in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands.

On 6 December 2022, the data subject made an erasure request under Article 17 GDPR and an objection under Article 21 GDPR to have their negative registration no longer processed and removed. ING Bank refused both requests. In particular, ING argued that its legitimate interest in recording the data subject’s credit history overrode the data subject's right to be forgotten. On 19 April 2023, the data subject filed a claim with the Amsterdam District Court.

Holding

The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights.

As part of the balancing test, the Court examined the purpose of the Bank’s credit registration system, and whether this was a sufficient compelling legitimate ground. ING submitted that the purpose of its system was twofold: 1. To protect consumers from taking on too much debt; 2. To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations.

ING submitted that its legitimate interest in maintaining the registration with BKR outweighed the data subject’s interests, as the data subject had a problematic debt situation for several years and as a result had low creditworthiness.

The Court held that ING’s grounds did not constitute compelling legitimate grounds which could override the data subject’s legitimate interests. The Court took into consideration that the data subject had sought help for the debt and had managed to pay it off. Moreover, the Court also took into consideration that the bankruptcy arose following a significantly bad economic period after the 2008 financial crash. As a result, ING’s did not have a compelling legitimate interest in maintaining the registration, and thus, their interests did not override those of the data subject.

As a result, the Court ordered ING to fulfil the data subject’s erasure request within one week of the ruling.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

@@ Line 64: / Line 64: @@
 }}
-The District Court of Amsterdam held that a data subject’s right to be forgotten (Article 17 GDPR) overrode the interests of a credit ranking agency in holding the data subject’s financial records.
+The District Court of Amsterdam held that a data subject’s right to be forgotten under Article 17 GDPR overrode the interests of a credit ranking agency in holding their financial records.
 == English Summary ==
 === Facts ===
-In December 2005, the data subject took out a mortgage for a house for €202,500 with ING Bank (the controller).  In 2008, the data subject faced financial hardship and could no longer pay the mortgage, and had to declare bankruptcy.
+In December 2005, the data subject took out a €202,500 mortgage for a house with ING Bank (the controller).  In 2008, the data subject faced financial hardship and could no longer pay off the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest).
-In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest on the mortgage). The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and had to write off its claim against them.
-Despite having written off its claim, ING Bank still had the data subject registered negatively in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands.
+The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and wrote off its claim. Despite that, ING Bank still had the data subject negatively registered in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands.
-On 6 December 2022, the data subject made an objection under [[Article 21 GDPR]] and an erasure request (Article 17 GDPR) to ING Bank to remove their negative registration from CKI and BKR, as they wished to apply for a new mortgage to buy a house. ING Bank refused the requests.
+On 6 December 2022, the data subject made an erasure request under Article 17 GDPR and an objection under [[Article 21 GDPR]] to have their negative registration no longer processed and removed. ING Bank refused both requests. In particular, ING argued that its legitimate interest in recording the data subject’s credit history overrode the data subject's right to be forgotten. On 19 April 2023, the data subject filed a claim with the Amsterdam District Court.
-ING Bank processed the data subject’s data on the grounds of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] (legitimate interest). Under [[Article 21 GDPR#1|Article 21(1) GDPR]], a data subject is entitled to object to processing which use [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] as a basis. Under [[Article 17 GDPR#1c|Article 17(1)(c) GDPR]], where an objection under [[Article 21 GDPR]] is made to a controller, they are obliged to delete the data subject’s data. However, under [[Article 21 GDPR]], a controller may refuse an objection if they can demonstrate compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject. ING Bank argued that it was entitled to refuse the data subject’s request, as their legitimate interest in recording the data subject’s credit history overrode their right to be forgotten.
-On 19 April 2023, the data subject filed a claim with the Amsterdam District Court, asking that their erasure request be enforced.
 === Holding ===
 The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights.
-As part of the balancing test, the Court examined the purpose of the Bank’s credit registration system, and whether this was a sufficient compelling legitimate ground. ING submitted that the purpose of its system was twofold:
+As part of the balancing test, the Court examined the purpose of the Bank’s credit registration system, and whether this was a sufficient compelling legitimate ground. ING submitted that the purpose of its system was twofold: 1. To protect consumers from taking on too much debt; 2. To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations.
-# To protect consumers from taking on too much debt.
-# To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations.
 ING submitted that its legitimate interest in maintaining the registration with BKR outweighed the data subject’s interests, as the data subject had a problematic debt situation for several years and as a result had low creditworthiness.