Rb. Amsterdam - ECLI:NL:RBAMS:2023:7218

From GDPRhub
Revision as of 15:58, 11 December 2023 by Aa (talk | contribs)
Rb. Amsterdam - ECLI:NL:RBAMS:2023:7218
Courts logo1.png
Court: Rb. Amsterdam (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 6(1)(f) GDPR
Decided: 15.11.2023
Published: 01.12.2023
Parties: Rabobank
National Case Number/Name: ECLI:NL:RBAMS:2023:7218
European Case Law Identifier: ECLI:NL:RBAMS:2023:7218
Appeal from:
Appeal to:
Original Language(s): Dutch
Original Source: de Rechtspraak (in Dutch)
Initial Contributor: n/a

A Court refused to enforce a data subject's objection to processing (Article 21(1) GDPR), which requested that their negative credit registration be removed from the Netherlands' national Credit Information System, as the data subject had no overriding interests, rights or freedoms against the legitimate interests of the controller.

English Summary

Facts

Rabobank (the controller) provided a business loan of €86,000 to the data subject in 2008. In 2014, the controller terminated their financial relationship with the data subject, as the data subject was unable to meet payments on time and had exceeded their credit limit.

In 2015, the data subject negotiated a new payment plan with the controller, but they were unable to maintain this. In September 2022, the data subject reached a new agreement with the controller, where the data subject paid €27,375 to the controller and the controller wrote off the remaining debt. On 6 October 2022, the controller formally waived their remaining claim against the data subject and the data subject was negatively registered in the national Credit Information System (CKI). Under domestic regulations, the data subject's negative registration could only be removed after five years, on 6 October 2027.

On 6 February 2023 and 27 February 2023, the data subject requested the controller to remove his negative registration from the system so that he could purchase a commercial property. In response to both requests, the controller refused, noting that there were no compelling grounds to shorten the five year registration period.

Following the controller's refusals, the data subject filed a claim with the District Court of Amsterdam, requesting that his negative registration be removed. As part of this request, the data subject made an objection to the processing of his personal data under Article 21(1) GDPR.

Holding

The Court refused to enforce the data subject's request, as they found that the data subject had no overriding interests, rights or freedoms against the legitimate interests of the controller under Article 21(1) GDPR.

The controller used Article 6(1)(f) GDPR as a legal basis for processing the data subject's personal data. In determining whether the data subject's interests, rights or freedoms could outweigh the legitimate interests of the controller, the Court took into account the following factors as part of its balancing exercise:

- the size of the debt and/or arrears;

- whether any payment arrangement has been properly fulfilled;

- the reason for (the occurrence and persistence of) the arrears and the degree of culpability;

- the current financial situation of the person concerned (including income) and if it is stable again: for how long;

- whether the person concerned has other debts;

- whether there has been serious default (structural or otherwise);

- the circumstance that the person concerned cannot wait with the loan (e.g. to buy a house) until the five-year period has expired (e.g. because of family and housing situation);

- the passage of time since repayment of the debt;

- the extent of the write-off.

The Court noted that in this case, there was a substantial debt (€86,000.00), which the controller eventually wrote off more than half of (over €51,000.00), and the data subject had failed to meet its repayment obligations multiple times. Moreover, only one year of the five-year registration term had elapsed, therefore, the threshold for deletion of the registration was still high.

As a result, the Court held that the data subject had no overriding interests, rights or freedoms against the controller, who had a legitimate interest in maintaining the negative registration and was entitled to reject the data subject's request.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.