Rb. Amsterdam - ECLI:NL:RBAMS:2023:6456
| Rb. Amsterdam - ECLI:NL:RBAMS:2023:6456 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 17 GDPR Article 21 GDPR |
| Decided: | 26.10.2023 |
| Published: | 02.11.2023 |
| Parties: | ING Bank |
| National Case Number/Name: | ECLI:NL:RBAMS:2023:6456 |
| European Case Law Identifier: | ECLI:NL:RBAMS:2023:6456 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The District Court of Amsterdam held that a data subject’s right to be forgotten under Article 17 GDPR overrode the interests of a credit ranking agency in holding their financial records.
English Summary
Facts
In December 2005, the data subject took out a €202,500 mortgage for a house with ING Bank (the controller). In 2008, the data subject faced financial hardship and could no longer pay off the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest).
The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and wrote off its claim. Despite that, ING Bank still had the data subject negatively registered in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands.
On 6 December 2022, the data subject made an erasure request under Article 17 GDPR and an objection under Article 21 GDPR to have their negative registration no longer processed and removed. ING Bank refused both requests. In particular, ING argued that its legitimate interest in recording the data subject’s credit history overrode the data subject's right to be forgotten. On 19 April 2023, the data subject filed a claim with the Amsterdam District Court.
Holding
The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights.
As part of the balancing test, the Court examined the purpose of the Bank’s credit registration system, and whether this was a sufficient compelling legitimate ground. ING submitted that the purpose of its system was twofold: 1. To protect consumers from taking on too much debt; 2. To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations.
ING submitted that its legitimate interest in maintaining the registration with BKR outweighed the data subject’s interests, as the data subject had a problematic debt situation for several years and as a result had low creditworthiness.
The Court held that ING’s grounds did not constitute compelling legitimate grounds which could override the data subject’s legitimate interests. The Court took into consideration that the data subject had sought help for the debt and had managed to pay it off. Moreover, the Court also took into consideration that the bankruptcy arose following a significantly bad economic period after the 2008 financial crash. As a result, ING’s did not have a compelling legitimate interest in maintaining the registration, and thus, their interests did not override those of the data subject.
As a result, the Court ordered ING to fulfil the data subject’s erasure request within one week of the ruling.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
