Rb. Gelderland - C/05/391171 / HA RK 21-135

Rb. Gelderland - C/05/391171 / HA RK 21-135

Court:	Rb. Gelderland (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 6 GDPR Article 6(1)(f) GDPR Article 12(2) GDPR Article 17 GDPR Article 21 GDPR
Decided:	14.01.2022
Published:	21.01.2022
Parties:	Stichting Bureau Krediet Registratie
National Case Number/Name:	C/05/391171 / HA RK 21-135
European Case Law Identifier:	ECLI:NL:RBGEL:2022:126
Appeal from:
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	Rechtspraak.nl (in Dutch)
Initial Contributor:	Giel Ritzen

The District Court Gelderland held that although a credit registry office's (BKR) processing of a data subject’s personal data was lawful, the data subject’s interests overrode the office’s legitimate interest and that it therefore had to erase their personal data, pursuant to Article 17 GDPR.

English Summary

Facts

The controller is Stichting Bureau Kredietregistratie (BKR), which manages the credit registration register (CKI). This register provides an overview of creditworthiness of people. Data subject has autism and has several registrations in the CKI, because of numerous payment arrears and neglected payment obligations, with several credit providers. These registrations make it impossible for them to find investors for their company, because investors find data subject not to be creditworthy enough.

On 3 May 2021, data subject requested the BKR to remove all registrations relating to them from the CKI. The BKR rejected this request because it is only responsible for correct processing of the personal data it receives from the credit providers, and data subject had to submit their request to the providers.

Data subject brought the action before Court, claiming that personal data were processed unlawfully. In particular, (1) the BKR processes their personal data without a legal basis, (2) the retention period of the registrations is too long, (3) the manner of registration of special codes referring to the registration is inadequate, (4) the accessibility of their personal data is insufficiently verifiable, and (5) the CKI does not meet the necessity requirement.

Moreover, they requested the Court to order the BKR to remove all registrations relating to them from the CKI, because their interests overrode the interests of the BKR. Lastly, they claimed the BKR cannot simply refer them to the credit providers because the BKR is also a controller.

Holding

Regarding the first claim that personal data is processed unlawfully

First, the Court stated that, referring to a recent judgement of the Dutch Supreme Court, it is clear that the BKR has a legitimate interest to process data subject’s personal data, pursuant to Article 6(1)(f) GDPR. Second, the Court found that, although it is not laid down in law, the retention period of 5 years does not violate Article 5(1)(c) GDPR, because “case law has repeatedly confirmed that the five-year retention period generally satisfies the principles of proportionality and subsidiarity”. Third, the Court stated that the registration of special codes, which refer to whether the case concerns arrears, payment arrangements, encashments or write-offs, are adequate for the purpose of credit registration and therefore do not violate Article 5(1)(c) GDPR. After all, the Court noted, these codes explain the situation, and it is not needed to incorporate the exact reason why the special code was created. Fourth, the Court assessed whether the accessibility of data subject’s personal data is insufficiently verifiable. It found that the accessibility is clearly explained in Article 6 of the BKR’s General Regulations. The Court added that the mere fact that data subject finds that this gives access to too many recipients, does not lead to a violation of Article 5(1)(a) GDPR. Fifth, the Court stated that the CKI meets the necessity requirement, referring to previous case law. Hence, the Court concluded that the data subject’s personal data was processed lawfully.

Regarding the erasure request

First, the Court stated that the data subject can directly address the BKR with their objection against the processing of their personal data, and the resulting erasure request of the registrations. After all, the BKR is (also) the controller and Article 12(2) GDPR does not provide for the possibility to refer the data subject to another controller. According to the Court, if the BKR needs more information to process this request, they can request this information from the credit providers. Second, the Court assessed whether the interests of data subject override the BKR’s interests. The Court considered numerous factors: data subject’s autism; the fact that they searched professional help; the fact that they proposed a debt settlement proposal on own initiative; the fact that they now run their own small business and have been financially stable for a few years; and the fact that the registrations in the CKI make it hard to start over (with a clean slate).

The Court stated that, although the five-year retention period of the registrations has not yet passed, this period is a starting point, against which a data subject may object. In that regard, considering the above-mentioned personal circumstances of the data subject, and the importance to start with a clean sheet, the Court concluded that the BKR’s legitimate interest no longer overrides the interests of the data subject. Hence, it ordered the BKR to remove data subject’s registrations from the CKI, pursuant to Article 17 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Body
Gelderland District Court
Date of judgment
14-01-2022

Date of publication

21-01-2022

Case number

C/05/391171/ HA RK 21-135

Jurisdictions

Civil rights

Special characteristics

Order

Content indication

Art. 5, 6 para. 1, 12, 17 and 21 GDPR. No unlawful processing by BKR so that Art. 17 para. 1 lit. d GDPR is not applicable. BKR filed an objection pursuant to art. 21 GDPR to consider and decide on it. Allocation of subsidiary removal request.

Locations

Rechtspraak.nl

Enhanced pronunciation

Share pronunciation

print
Save as PDF
Copy link

Pronunciation

decisionCOURT OF GELDERLANDTeam canton and commercial lawSeating place Arnhem case number / application number: C/05/391171/ HA RK 21-135Decision of 14 January 2022 in the case of
[applicant]
,residing at [place of residence] ,applicant, hereinafter [applicant],lawyer mr. A.M. van Schaick in Tilburg, against the foundation STICHTING BUREAU CREDIT REGISTRATION, established in Tiel, defendant, hereinafter: the BKR, lawyer mr. C.R.F. Plaizier in Amsterdam.1 The procedure1.1.The course of the procedure is apparent from: -the application with exhibits 1 to 13, -the statement of defense with exhibits 1 to 4, -the letter of September 29, 2021 on behalf of the BKR with exhibit 5, the aforementioned speaking notes of mr. Van Schaick, the aforesaid speaking notes of mr. Plaizier, the oral hearing held online via Skype on 4 October 2021. [applicant] appeared, assisted by mr. Van Schaick aforesaid. Mr. [legal manager] (legal manager) and Mr. [company lawyer] (company lawyer) appeared on behalf of the BKR, assisted by mr. Plaizier mentioned above.1.2. Finally, a decision has been made.2 What is this case about?2.1 In these proceedings, the question is whether the BKR must remove the credits registered by it, or at least the special codes registered by it, in the Central Credit Information System (hereinafter: CKI) of the BKR in the name of [applicant]. The background to this case is as follows.2.2.In 2017, [applicant] sought professional help in connection with his autism disorder and the payment arrears that had arisen with various creditors. Subsequently, in 2019, he made a proposal to his creditors to pay 32% of the outstanding balance against final discharge. Insofar as relevant here, this proposal was as follows: (…) In order to pay off my debts, I tried to start up a small business in the past year. Although I can barely provide for a living with this, the repayment capacity is limited. The problem is that investments are needed to continue growing the business. But with 3 negative BKR listings (see proof in attachment), there is no party that wants to invest in my company. So I can't continue with my company well, but the option of paid employment is also difficult due to my disability, such as the UWV confirmed. In addition, the current debt situation is very stressful and limiting for me. This limited perspective is also confirmed in a covering letter (see proof in attachment) from my ambulant counselor who hopefully emphasizes that you should assess this mail seriously and with care. Because I realize that words alone do not provide a solution, I have found a concerned good friend willing to lend me 8,000 euros as a private loan. Under the strict condition that this offers a new perspective and does not cover the bleeding. (…) In addition, I can also add 800 euros myself. Therefore, I would like to make a proposal to you as a creditor to finally discharge my outstanding debt against a one-off payment. For the sake of transparency, I have listed all creditors below, including the outstanding amount* and the discharge proposal. With the exception of the tax authorities, all creditors receive the same percentage. (…)2.3.
[applicant] is listed with the following credit registrations (hereinafter jointly: the BKR registrations or the registrations) in the CKI:International Card Services B.V. (hereinafter: ICS) with the following registrations: 19 May 2015 special code A1, 12 March 2018 special code A2, and 23 December 2019 credit end date. Qander Consumer Finance B.V. (hereinafter: Qander) with a registration of 1 October 2017 as the credit end date. Santander Consumer Finance B.V. (hereinafter: Santander) with the following registrations: December 17, 2015 special code A2, December 19, 2019 code A3, and December 19, 2019 credit end date. ABN AMRO Bank NV (hereinafter: ABN AMRO) with the following registrations: 13 October 2017 special code A1, 5 December 2015 special code A2, 27 December 2019 code A3, and 27 December 2019 end date of credit. with a business loan, and September 30, 2025 as the expected end date of the credit. It also states that if no changes are made, the coding of the first four credits will be removed on the following dates: December 21, 2024, October 1, 2022, December 19, 2024, and December 17, 2024.2.4. The A stands for backlog. According to Article 13 of the General Regulations CKI of the BKR (hereinafter: AR), the following figure means the following: (…) Code 1: a repayment arrangement has been made after a situation of arrears has occurred; Code 2: the business customer has demanded payment of the remainder of the or the entire claim in accordance with the applicable legal requirements; Code 3: the business customer has debited an amount of € 250 or more. If a debit takes place and the consumer no longer has to pay anything (final discharge), the termination of the agreement with an actual end date is reported at the same time as this code. In other cases, the business customer does not report an actual end date; (…) 2.5. On May 3, 2021, [applicant] requested the BKR to remove the aforementioned registrations. In a letter dated June 10, 2021, the BKR rejected that request. The reason for this was that [applicant] must address his request to the individual credit providers that have taken care of registration in the CKI. According to the BKR, it is only responsible for the correct processing of the personal data it receives from the credit providers.3 The request and the defence3.1.
[applicant] requests the court to order the BKR to: Primarily: register the credit agreements (as referred to under 2.3.) in the CKI and any related (internal) registers without delay, but at the latest within three days after notification of this decision, to remove or have them removed, on pain of a penalty of € 1,000.00 per day with a maximum of € 50,000.00, Alternatively: the special codes associated with the credit agreements entered into with ICS, Santander and ABN AMRO in the CKI without delay, but no later than three days after service of this decision, to be removed or have it removed, on pain of a penalty of € 1,000.00 per day with a maximum of € 50,000.00. In the alternative: the A3 codes associated with the credit agreements that entered into with Qander and Santander (court: Santander and ABN AMRO, in view of marginal number 3 of the application) in the CKI without delay, but at the latest within three days after notification of this decision, to be removed or to have it removed, on pain of a penalty of € 1,000.00 per day with a maximum of € 50,000. costs, plus the statutory interest thereon. 3.2.
[applicant] bases his primary request for the removal of all registrations that the system of credit and debt registration in the CKI is generally in conflict with the GDPR and that the way in which the BKR processes its personal data is unlawful. He bases his alternative requests for the removal of the special codes to be based on various interests and personal circumstances and argues that the balancing of interests to be made must be in his favour. [applicant] states that in connection with its obligations as a controller, the BKR must itself decide on its request and cannot suffice by referring to the lenders concerned. 3.3. The BKR defends itself. The statements of the parties are discussed below – insofar as relevant.4 The assessmentDeletion of all processed personal data four terminated credits, and of the registration of the still current credit of the Qredits Foundation. It is not in dispute between the parties that these BKR registrations are personal data to which the GDPR applies and for which the BKR is the controller, in addition to the relevant credit providers. 4.2. As the controller, the BKR must process the personal data in accordance with the basic principles of Article 5 of the GDPR. Article 5(1)(a) of the GDPR states that personal data must be processed in a manner that is lawful, proper and transparent with regard to the data subject. Article 5 paragraph 1 sub c GDPR states that personal data must be sufficient, relevant and limited to what is necessary for the purposes for which they are processed (minimum data processing). The BKR can only lawfully process personal data if that processing is based on one of the foundations of Article 6 AVG.4.3. The BKR is only obliged to delete the personal data of [applicant] if one of the cases of paragraph 1 of Article 17 AVG applies and there is no exception as referred to in paragraph 3. Article 17 paragraph 1 provides:1. The data subject has the right to obtain from the controller without undue delay the erasure of personal data concerning him and the controller is obliged to delete personal data without undue delay where one of the following applies: a. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b. the data subject withdraws consent on which the processing is based pursuant to Article 6(1)(a) or 9(1)(a), and there is no other legal basis for the processing; the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);d. the personal data has been unlawfully processed; e. the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is responsible; f. the personal data have been collected in connection with an offer of information society services as referred to in Article 8, paragraph 1.4.4.
[Applicant] has argued in support of his primary removal request that the way in which the BKR currently processes his personal data is contrary to the GDPR for the following five reasons: The BKR lacks a basis The registration period is too long The method of registration of special codes is Insufficient Accessibility to his personal data is insufficiently verifiable. The current system does not meet the necessity requirement. The court understands from this that [applicant] requests the erasure of his personal data on the basis of Article 17 paragraph 1 under d AVG. The reasons put forward by [applicant] will be discussed successively below. a. Is there a basis on which the BKR can rely? 4.5. Article 6 paragraph 1 GDPR reads, insofar as relevant here, as follows: 1. The processing is only lawful if and insofar as at least one of the following conditions is met:(…)c. the processing is necessary to comply with a legal obligation to which the controller is responsible;(…)f. the processing is necessary for the protection of the legitimate interests of the controller or of a third party, (…)4.6.
[applicant] states that there is no basis for the processing of personal data of [applicant] in the CKI by the BKR. He has never given permission for this and the other grounds from Article 6(1) of the GDPR do not apply. For example, according to [applicant], Article 6(1)(c) of the GDPR does not apply because the obligation under Article 4:34 of the Financial Supervision Act (hereinafter: Wft) to participate in a statutory system for credit registration rests on the credit providers. and not on the BKR. According to [applicant], Article 6(1)(f) of the GDPR also does not apply because the BKR, as controller, has no obvious interest or obligation to process personal data. 4.7. The court considers that until recently it was unclear on which of the grounds referred to in Article 6 of the GDPR a registration with the BKR had to be assessed. It can be deduced from case law and the letter from the Dutch Data Protection Authority to the Minister of Finance of 14 November 2019 that a legal basis for the processing of personal data in the CKI is in any case Article 6 paragraph 1 under f AVG. It was unclear whether the c-ground also applies. In a decision of 3 December 2021, the Supreme Court answered preliminary questions about the applicable processing basis, thereby clarifying this1. It follows from this judgment that Article 6(1)(c) of the GDPR cannot serve as a basis for the lawful processing by credit providers of personal data in the CKI of the BKR, since there is no legal obligation to process data within the meaning of that article. Although Articles 4:32(1) and 4:34(1) Wft oblige credit providers to participate in and consult a credit registration system, these statutory provisions are not sufficiently clear and precise and their application is not sufficiently predictable for those to whom these legal provisions apply, as required by Article 6(3) of the GDPR. This is regulated in the CKI regulations, drawn up by the BKR, but those regulations are not based on a legal basis; the registration of personal data in the CKI takes place on the basis of an agreement between the BKR and credit providers. It follows from the answer to the first preliminary question that Article 6(1)(f) of the GDPR forms the basis for the processing by the credit provider as the controller of the data subject's personal data in the CKI of the BKR (see 3.1.9 and 3.2 .3 of this Supreme Court ruling). 4.8. It has been established that the BKR is also the controller with regard to the processing of personal data in the CKI. Partly in view of the decision of the Supreme Court, it is obvious that the BKR also processes the personal data on the basis of Article 6 paragraph 1 under f AVG. This also follows from the AR, in which the BKR itself states in Article 3 paragraph 4 "The processing of personal data in CKI finds its lawful basis in Article 6 paragraph 1 sub f of the GDPR, because the processing is necessary for the representation of the justified interests of Stichting BKR and its business clients.” Whether the data processing in the CKI by the BKR is lawful must therefore be assessed on the basis of the criterion of Article 6 paragraph 1 under f GDPR. Insofar as [applicant] intended to state that the BKR cannot successfully rely on this basis, regardless of the individual weighing up of interests, since the duties of care arising from the Wft do not rest on it and it has no relevant interest itself, the court him not in this. In view of the role of the BKR and its business operations, the processing is also necessary to promote a legitimate interest of the BKR. Keeping a central credit register is based on Article 4:32 Wft and Article 8 of the Consumer Credit Directive2. The BKR is the operator of the only credit information system in the Netherlands, the CKI. Because of this role, its main activities are collecting, organizing, recording in the CKI and providing personal data to credit providers. The processing of personal data therefore takes place for the purposes of the BKR's business operations. This processing is justified in view of the purpose of the BKR: protecting consumers from excessive credit and problematic debt situations, limiting the financial risks when extending credit for its business customers, and preventing and combating abuse and fraud. In principle, it can therefore be assumed that the processing of personal data by the BKR is necessary for the representation of the legitimate interests of the BKR and its affiliated credit providers. 4.9. The conclusion of the foregoing is that the BKR does not allow removal of the personal data of [applicant] needs to be transferred because of the alleged lack of a processing basis.b. Is the registration period/retention period too long? 4.10.
[applicant] argues that the retention period used by the BKR is too long and does not correspond to the principle of 'minimal data processing' of Article 5 paragraph 1 under c GDPR and the requirement that the storage period of the personal data must be limited to a strict minimum (Consideran 39 of the GDPR). According to [applicant] personal data are stored by the BKR for an unnecessarily long time, as evidenced by the fact that the fictitious end date of his credit agreements has already passed for eighteen months and the special codes are often even older. For example, the A2 codes are from 2015. The BKR thus acts contrary to the due care requirements of the GDPR. According to [applicant], the period of five years is arbitrary, has no legal basis and is not linked to the actual 'excess credit' or repayment, but to a fictitious end date. 4.11. The court states first and foremost that in view of the legitimate purposes of the data processing in the CKI, there is a need to keep registrations for some time after termination of a credit. After all, in order to protect consumers against excessive credit and problematic debts, it may be relevant to be able to view payment arrears or other irregularities that have arisen during the term of a credit in addition to current credits. Such details may also be relevant in order to limit the financial risks involved in lending for credit providers. The retention period necessary in view of the purpose of the processing may differ from case to case. However, this does not alter the fact that, in the context of legal certainty and transparency, it is important that a general retention period is established and communicated. Under Article 5 of the GDPR, controllers are also obliged to do so. The BKR has done this in Article 14 of its AR, which includes a detailed arrangement for retention periods in the CKI. It follows that data from past agreements, including A2 and A3 codings on an expired agreement, will be deleted five years after the actual agreement end date. 4.12. The fact that this five-year retention period is not laid down by law does not in itself mean that a five-year period is too long and does not generally comply with the principles of the GDPR. As the BKR has argued, that term is in line with the statutory system of short-term limitation periods. The Dutch Data Protection Authority has already stated in another context that such a term is not unreasonably onerous from a privacy perspective, namely with regard to the eight-year retention period of the Dutch Association for Trade Information Agencies. In addition, in September 2017, the Minister of Finance wrote in response to parliamentary questions that he saw insufficient reason at that time to request the BKR to include a shorter retention period in its AR3. The Minister of Social Affairs and Employment adopted the same position on request in March 20214. Finally, case law has confirmed several times that the retention period of five years generally complies with the principles of proportionality and subsidiarity. In this regard, the court refers, among other things, to what the 's-Hertogenbosch Court of Appeal ruled in legal consideration 3.5.13.1 of its decision of 6 August 20205 and to which reference was also made by the Arnhem-Leeuwarden Court of Appeal in its decision of 23 February 20216. [applicant] has stated that it considers the retention period to be arbitrary and too long, but has not stated, and certainly not substantiated at all, which general retention period would be appropriate and proportionate in its view. In view of the foregoing considerations, the court therefore sees no reason to rule that the current retention period of five years is in conflict with the GDPR.4.13. The conclusion is that establishing a general retention period of five years in the CKI does not there is a violation of the principle of storage limitation as used in Article 5 of the GDPR and that Article 17(1)(d) of the GDPR also does not apply.c. Is the method of registration inadequate?4.14.
[applicant] argues that the processing of personal data in the CKI is not sufficient within the meaning of Article 5(1)(c) of the GDPR. This requirement relates to the need to have sufficient and correct information in view of the purpose of the processing. According to [applicant], the method of registration of special codes in the CKI does not provide sufficient information about the actual situation underlying a registration. According to [applicant] this is mainly in the A3 coding. According to the BKR, this coding says that an amount of at least € 250.00 of the debt has been 'written off' by the creditor. In many cases, however, a debtor enters into an amicable settlement in which part of the debt is forgiven against payment of an amount. In other cases, a court renders a judgment in which the entire claim is not awarded or the bank's records are incorrect; special codes will still remain. The A3 coding and other information from the CKI create the impression that the debtor is a defaulter, as a result of which a credit provider who consults the CKI no longer provides a loan. It would be more correct if it were noted in the CKI that there is, for example, an installment arrangement with remission or that no A3 coding would follow at all after a settlement or judgment, according to [applicant].4.15. the BKR is of the opinion that the data processed in the CKI are sufficient with a view to the purpose of its processing. The purpose of the data processing is to protect consumers and lenders. The CKI records the type of credit involved, the amount for which a credit has been entered into, the registration date, the actual end date and which details have occurred. Special codes include whether it concerns a arrears, payment arrangement, claim or write-off. The fact that the exact reason for the occurrence of (for example) an A3 coding is not included in the CKI does not mean that the processing of the data is not sufficient to achieve the purpose of credit registration. With an A3 coding, it is registered whether it concerns a write-off or a remission. After all, an A3 coding with an end date shows that the credit provider and the consumer have come to an agreement, a final discharge has been granted and the credit has been terminated, while an A3 coding without an end date involves a write-off by the credit provider and the credit has not yet been terminated. If – as [applicant] has argued – there is incorrect processing by the lender, the lender will have to adjust the information in the CKI or delete data at the consumer's request. In addition, the personal circumstances of a consumer are taken into account if the consumer requests the lender to (premature) remove or adjust the special coding, since in that case individual interests must be weighed up. d. Is accessibility sufficiently verifiable?4.16.
[Applicant] states that it is not clear to him which parties and/or persons, in addition to the lender and the consumer themselves, have access to the personal data in the CKI. According to [applicant], this is in violation of Article 5(1)(a) of the GDPR, which stipulates, among other things, that the processing of personal data must be transparent. In support of this, [applicant] referred to the advice of the Dutch Data Protection Authority of 14 November 2019, which stated that it is not clear who may consult the CKI, when and under what conditions. 4.17. The court considers as follows. It follows from 5 paragraph 1 under a of the GDPR that any processing of personal data must be lawful, fair and transparent. It must be transparent for every natural person that the personal data in question are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. Information and communication about the processing of personal data should be easily accessible and understandable. This principle has been elaborated, among other things, in Article 14 of the GDPR. It follows from Article 14(1)(e) of the GDPR that the controller must inform the data subject about the recipients or categories of recipients of personal data. The BKR has elaborated its information obligation under Article 14 of the GDPR in Article 6 of the AR, which includes the following: Article 6 WHO RECEIVES PERSONAL DATA1 The BKR Foundation may only provide the personal data received from business customers to: a. business customers; b. the processor authorized to consult and/or register the CKI for a business customer; c. the consumer; d. persons and institutions that are allowed to request these on the basis of a legal provision and who lawfully rely on them; e. the Supervisory Board based on the Articles of Association and the Good Governance Regulations; f. Compliance and Audit Committee based on the Compliance and Audit Committee Regulations; g. the external accountant who performs work for Stichting BKR; h. administrative bodies that have been formally designated as supervisors. (…) Which parties fall under 'business customer' is defined in Article 1 of the AR and is further described in Article 32 of the AR. The court is of the opinion that with the elaboration in Article 6 of the AR, in combination with Articles 1 and 32 of the AR, the BKR has met the requirement of transparency described above. The mere fact that [applicant] is of the opinion that this gives too many recipients access to his personal data does not mean that the BKR is acting in violation of Article 5 paragraph 1 sub a GDPR and that his personal data are being processed unlawfully. Does the system meet the necessity requirement? 4.18.
The [applicant] argues that, pursuant to number 39 in the preamble to the GDPR, personal data may only be processed if the purpose of the processing cannot reasonably be achieved in any other way. [applicant] disputes that registering personal data in the CKI is the only or most suitable way to achieve the purpose of credit registration. According to [applicant], the current system is disproportionate because in practice a consumer with a special code can no longer obtain credit, as a result of which consumers end up in further financial problems. For example, a consumer may be forced to rent an expensive home instead of purchasing a cheaper owner-occupied home through a mortgage loan. According to [applicant], lenders largely work with automatic systems to test credit applications, whereby special codes are immediately a no-go. Finally, [applicant] argues that the fear of recidivism that underlies the credit registration system is unjustified, and that this follows, among other things, from empirical research by the NVVK (note). According to [applicant], better aids are debt counseling and training or awareness, whether or not linked to a shorter registration period than five years. 4.19. The BKR disputes that consumers with a special code cannot possibly take out a credit. According to the BKR, it follows from the petition of [applicant] and the recent BKR extract that, despite the previously registered credits and special codes, he has taken out a loan from the Qredits Foundation and also has the option of applying to Yeaz! to take out a credit. Even if a consumer cannot take out a mortgage loan due to a special code registered in the CKI, this does not mean, according to the BKR, that the current credit system is in conflict with the principle of proportionality and subsidiarity. 4.20. The court considers as follows. When assessing whether the processing of personal data in the CKI is necessary, the principles of proportionality and subsidiarity are important. Case law has repeatedly confirmed that the requirements of proportionality and subsidiarity are in principle met when data is registered in the CKI7. Whether this is also met in an individual case is tested if a data subject requests the premature removal or adjustment of a coding. Precisely because special codes can have far-reaching consequences for those involved and enforcement thereof is no longer appropriate in individual cases, there is the possibility of individual balancing of interests. The current credit system makes it undeniably much more difficult to take on loans and debt again for consumers who have previously run into financial difficulties. This is in the interest of credit providers, but in most cases also consumers who are having difficulty getting or keeping their financial household in order. It cannot be concluded on the basis of the research cited by [applicant] that the fear of recidivism is unjustified. The court wants to assume that there are several ways to prevent consumers from (again) getting into financial problems, and that the options suggested by [applicant] are often effective too, but that does not mean that these options alone can provide the same protection. as the protection offered by the only credit system in the Netherlands. With regard to [applicant]'s suggestion to establish a shorter general retention period, the court refers to what has already been ruled above about the current general retention period of five years. 4.21. The conclusion is that there is no conflict with the GDPR on this point either. Conclusion with regard to the primary request. application is missing and [applicant]'s primary request to have all registrations in the CKI and any related (internal) registers removed is rejected. 6(1)(f) of the GDPR, [applicant] can rely on Article 21 of the GDPR. Article 21 GDPR gives a data subject the right to object, on grounds relating to his particular situation, to the processing of his personal data, if that processing is based on Article 6(1)(e) or (f) of the GDPR. The second sentence of the first paragraph of Article 21 GDPR reads: The controller shall cease processing the personal data unless he can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or which are related to the institution. , exercise or substantiation of a legal claim. In cases where a data subject has exercised this right to object and was thereby able to terminate the processing, he or she can also claim the erasure or removal of the data on the basis of Article 17 paragraph 1 under c GDPR. 4.24.
In the alternative, [applicant] requests that the special codes associated with the credit agreements with ICS, Santander and ABN AMRO be removed from the CKI or have them removed. In the alternative, [applicant] requests that BKR remove the A3 codes registered with regard to Qander and Santander. The court understands (partly in view of marginal number 3 in the application) that [applicant] meant the A3 coding with regard to ABN AMRO instead of Qander, since no A3 coding is noted with Qander. Can a removal request be addressed to the BKR?4.25. Firstly, the parties are divided on whether [applicant] can address his removal request to the BKR or whether he can only turn to the relevant lenders for this. 4.26. According to [applicant], he can address this request to the BKR because the BKR is a controller within the meaning of the GDPR. As a result, the BKR must guarantee the right to be forgotten. The BKR is independently responsible for processing personal data in the CKI, so that the BKR can also independently remove it. To this end, he argues that a lender cannot make changes to the CKI itself. This is always done via a request to the BKR, whereby the BKR also has the option to reject such a request from a lender. According to [applicant], the material assessment that must be made in the context of the weighing up of interests in a case against individual lenders amounts to the same assessment as now against the BKR. [Applicant] further argues that it would be desirable for consumers to be able to have multiple registrations removed at once with a request to the BKR. It is clearer, cheaper and more efficient for consumers to have that assessment done in one place. Otherwise, [applicant] would have to file separate petitions against four different lenders, according to [applicant]. 4.27. The BKR argues that [applicant] must address the individual lenders with this request. When weighing up interests based on a removal request, it must be assessed whether maintaining the special codes, in view of all the special circumstances of the consumer, is proportionate to the general goals of the CKI. According to the BKR, it does not have the necessary information and documents to make that assessment. For example, the BKR does not have the credit agreements, the correspondence between [applicant] and the lenders, or the debt settlement that [applicant] - as stated in the application - has offered to his creditors. Given the importance of responsible financial lending protected by the CKI, it would not be appropriate to deal with takedown requests in this careless manner. According to the BKR, it would also be undesirable for it to have access to that information in these and similar cases in order to arrive at a balancing of interests. The lender must make that assessment because it is familiar with the progress of the file and the payment history of [applicant]. If the BKR is provided with complete credit files, the principle of minimal data processing will be compromised. The BKR further argues that it has a serving role vis-à-vis the credit providers. As soon as it is requested to register, adjust or remove a credit, the BKR will carry out this. The BKR itself does not check whether the registration is lawful. Finally, the BKR explains that there is no need to print the BKR in the one-stop-shop role. [applicant] can address the relevant lenders, after which it is possible to submit the dispute to Kifid, which is free of charge. If this does not lead to the removal of registrations, [applicant] can file a petition against the individual credit providers, according to the BKR. 4.28. In the opinion of the court, [applicant] can directly address the BKR with his objections to the processing of his personal data and with the resulting request to remove the special codes. The obligation to consider an objection from a data subject and to cease processing if the condition of Article 21 GDPR is met rests with the controller according to the legal text. It is established that the BKR is (joint) controller with regard to the maintenance of the relevant special codes. Article 12(2) of the GDPR does not provide for the possibility as a controller not to process the handling of an objection based on Article 21 GDPR and to refer it to another controller. [applicant] is not a party to the agreement that the BKR has with its affiliated lenders. Insofar as it would therefore already follow from that agreement that only the lenders themselves can handle the objections based on Article 21 GDPR, which is not apparent from the AR, [applicant] is not bound by it. The fact that the BKR currently does not have the necessary information to make a careful assessment of interests does not change the foregoing. It is not clear why the BKR would not be able to request this information from the relevant lender(s) and not include the input of the lender(s) in its consideration. Sending complete credit files to the BKR does not seem immediately necessary in order to gain a picture of the facts and agreements relevant to a removal request. However, insofar as a summary would not suffice and the full credit file would be required, the court considers that this should not affect the principle of minimal data processing. After all, this information will then only be made available to the BKR for the purpose of handling the objection and will of course not form part of the CKI. The weighing of interests 4.29. In view of the objection of [applicant], the BKR must discontinue the maintenance of the special codes, unless it puts forward compelling legitimate grounds that outweigh the interests, rights and freedoms of [applicant]. This weighing of interests also includes the proportionality and subsidiarity test as referred to in the Santander decision.8 It follows from both the legal text and recital 69 to the GDPR that it is up to the BKR as controller to demonstrate that its compelling interests outweigh the interests or fundamental rights and freedoms of [applicant] . In view of the legal text of Article 6(1)(f) of the GDPR ("or of a third party"), this balancing of interests therefore concerns the interests of the BKR and the lenders on the one hand, and the interests of [applicant] on the other. 4.30.
[Applicant] has put forward the following facts and circumstances related to his specific situation. 4.31.
[Applicant] ran into financial problems because he did not have a proper financial education in his youth. This is related to his autism and the associated problems. His debts arose just before and/or during the credit crisis when, unlike now, lenders were generous with lending. In 2017, he sought professional help for his disorder. Since then, he has received specialist home guidance. His ambulatory mental health counselor stated about this in a letter dated 4 March 2021: “(…) We have been involved for some time now and support and guide [applicant] in several areas of life, including the debt part. [applicant] is doing his best with his own company. Despite the fact that the UWV has determined that he would not be able to earn the minimum wage independently, he is included in the target group register, he currently earns his own living and is trying to find solutions and arrangements himself. [Applicant] has learned to handle money better in recent years and is able to protect himself against a relapse after the debt period. In addition to help for his autism disorder, [applicant] turned to a budget coach on his own initiative in September 2016 to come to terms with his finances. In that context, work has also been done on a debt settlement. The statement submitted by the budget coach shows which points [applicant] worked on with his coach, and that the support was completed in September 2018. 4.32.In the autumn of 2019, [applicant] independently and on his own initiative submitted a debt settlement proposal to the creditors concerned. The proposal entailed that, with the exception of the Tax Authorities, the other six creditors would receive 32% of their outstanding amount against final discharge. Pursuant to this regulation, [applicant] had to pay a total amount of € 8,887.20. A copy of this proposal has been submitted (see under 2.2). ICS, Qander, Santander and ABN AMRO have accepted this proposal. After payment, Santander and ABN AMRO placed an A3 coding. The other creditors have not. 4.33. Since 2015 [applicant] has been an independent entrepreneur. The extract from the trade register shows that his company is engaged in the following activities: graphic design and web design, copywriter/copywriter B2B, online advertising via blogs and small-scale regional courier work on request. Things are not going wrong. He now enjoys an income of more than € 30,000.00 per year and the prospects for this year are also good. The annual figures for 2019 have been submitted. He has not had to claim any government support measures, and has not incurred any new private debts. From a landlord's statement of December 3, 2020, it appears that there has been no payment arrears since the start of the lease on August 13, 2018. 4.34. As the reason for his objection, [applicant] mentions, among other things, that the current BKR registrations still make it impossible for him to obtain a business loan, as a result of which he is hindered in carrying out and expanding his business. Only the public benefit institution Stichting Qredits has recently wanted to borrow [applicant] a small amount (for business purposes) (see loan 5 in the overview under 2.3.). To date, he has only found one commercial party (Yeaz!) willing to provide him with small business financing (€ 7,500.00) at a particularly high interest rate of 2% per month. The credit agreement of 9 November 2019 has been submitted. Without BKR registrations, he would be able to borrow a higher amount from a major bank for a lower interest rate, which would benefit the growth of his company. Furthermore, [applicant] mentions that the BKR registrations form an obstacle to his personal financial future, since he would like to buy a tiny house in his current living environment. The municipality [place] will soon offer possibilities for this. To do this, he must demonstrate that he has an amount of € 100,000.00 at his disposal. In view of an example calculation submitted by ABN AMRO, he can easily finance such an amount via a mortgage loan. However, every mortgage application bounces off its special coding, especially the A3 coding. According to the statement of 13 April 2021 submitted by the mortgage adviser of [applicant], there is no bank that accepts an A3 coding. It is very important to [applicant] not to miss the chance of a tiny house in or around [place]. In this way, he can purchase a home of his own with relatively limited resources, with the current low mortgage interest rate, and in a location that suits him well in view of his disorder, namely in his familiar environment and close to his loved ones. of the registrations is no longer present. [Applicant]'s income and personal situation have been stable and more than adequate for some time. At the same time, due to the BKR registrations, the business and personal development of [applicant] has come to a standstill for a while. The BKR registrations miss their target and their enforcement is not proportional. He cannot therefore be expected to wait until 2024 before he is free from BKR coding, according to [applicant].4.35. The BKR disputes that the weighing up of interests that must be made by the credit providers in favor of [ the applicant] would be based on the incomplete facts and circumstances that [applicant] has put forward and cannot be assessed for correctness. She believes that it is not her role to test the circumstances surrounding his living situation. It therefore argues that it can only dispute in a general sense that the living situation of [applicant] would be decisive for a credit provider. She points out that concrete substantiation must be given as to why purchasing a house would lead to advantages or savings. Furthermore, the BKR disputes that a credit provider would attach decisive importance to the desire to obtain a business loan. This in itself is insufficiently decisive and must also be made more concrete. Moreover, a substantiation of concrete plans with the credit and the interests that will be harmed if this is not done is required. The BKR is of the opinion that it is not for it to weigh the correctness of the points put forward by [applicant] with regard to his financial stability. Furthermore, she disputes that the financial situation of [applicant] requires that his removal request be granted. The fact that the financial situation of [applicant] has led to payment arrears and eventual cancellation of his debt with several credit providers will be a relevant factor for credit providers when weighing the interests while a (substantial) part of the registration period still remains. The size of the written-off debts in relative and absolute sense also play a role in this, according to the BKR. 4.36. The court is of the opinion that the BKR has not sufficiently demonstrated with the foregoing that the interests stated by it provide compelling legitimate grounds for maintaining the special codes associated with credit agreements 1, 3 and 4 at the moment. To this end, the following is considered. It has not been established that [applicant] acted intentionally or fraudulently. The fact that [applicant] still needs protection against excessive lending through the special codes does not follow from the facts and that the interests of other credit providers to be protected against possible financial risks outweigh the rights and freedoms of [applicant], the BKR has insufficiently substantiated. The BKR has mainly suffice to refer to the general interest of lenders in applying a retention period of five years and to case law showing that proper substantiation of the interests of the data subject is necessary before removal during the retention period can be considered. . She also pointed to her lack of information to enable her to make a proper assessment. However, insofar as the BKR doubts the correctness of the facts and circumstances that [applicant] has put forward to substantiate his interests, it could have asked [applicant] to supplement the information that it considers to be missing or to substantiate the alleged facts in more detail. . To the extent that it believes it lacks information that only the lenders have, it could have asked for it. However, it failed to do so, so that it cannot rely on incomplete information. The court therefore bases itself on the facts and circumstances presented by [applicant] and which have been summarized above. These are also largely substantiated with documents and not or hardly contested with reasons by the BKR. 4.37. It can be deduced from those facts and circumstances that [applicant] is aware of the vulnerability associated with his autism disorder and has therefore been receiving professional guidance since 2017. His mental health counselor considers him capable of preventing a recurrence of his debt problems and such a recurrence has not occurred since 2017. [applicant] has shown that he considers himself responsible for the debts that have arisen and has succeeded in reaching an arrangement with his creditors, which has also been complied with. There have been no payment arrears for 5 years and [applicant] manages to get by with the income from his small business. With what [applicant] has stated and substantiated, he has sufficiently demonstrated that he has entered stable waters. Nevertheless, the special codes prevent [applicant] from being able to buy a modest private home near his loved ones, as explained above. In view of the circumstances outlined, including in particular his need for an affordable home close to his loved ones, the importance of this for [applicant] is evident, both in a material sense and in an immaterial sense. In the opinion of the court it has also become sufficiently plausible that it is virtually impossible for [applicant] to obtain a current account credit at a current interest rate if the special codes are maintained. As a result, he is faced with significant interest charges that impact the financial health of his business and his ability to generate sufficient income. 4.38. In view of all these facts and circumstances, in the opinion of the court, the interest of future lenders to be able to see that payment problems have occurred in the past and that [applicant] has not been able to repay the full credit in a number of cases, not longer against the interest of [applicant] to be freed from the restrictions that the special codes impose on him. The retention period of five years is justified as a starting point, but if an objection is made to the enforcement of coding during that period, customization will have to be provided, also by the BKR. The importance of being able to start over with a clean slate at a certain point and, where this is justified and justified, to be able to leave behind a past of debts and payment problems, is of great importance. The BKR has not done enough in this case. Conclusion with regard to the alternative requests and legal costs4.39.The alternative request to order the BKR to remove the special codes in the CKI in the name of [applicant] is granted. The court sees no reason to impose a penalty. It can be assumed that the BKR complies with this decision. 4.40. The claim for payment of € 975.00 in extrajudicial collection costs is rejected. Article 6:96 paragraph 2 of the Dutch Civil Code does not provide an independent basis for the compensation of extrajudicial costs, but assumes that there is a legal obligation to pay compensation. Such an obligation is not at issue here. 4.41. The BKR, as the unsuccessful party, is ordered to pay the costs of these proceedings. The costs on the part of [applicant] are estimated at € 667.00 in court fees and € 1,126 in lawyer's salary (2 points x rate € 563.00).5 The decision The court 5.1 orders the BKR to days after the date of service of this decision to remove or have removed the special codes registered by it belonging to credit agreements 1, 3 and 4 (entered into with ICS, Santander and ABN AMRO) in the CKI of the BKR in the name of [applicant], 5.2. orders the BKR to pay the costs of these proceedings, estimated on the part of [applicant] at € 1,793.00, plus the statutory interest thereon from the fourteenth day after notification of the decision. This decision was given by mr. M.S.T. Called and pronounced in public on 14 January 2022.1 Supreme Court 3 December 2021, ECLI:NL:HR:2021:18142 Directive 2008/48/EC of the European Parliament and of the Council of the European Union of 23 April 2008 on credit agreements for consumers3 Parliamentary Papers II 2016/2017, 27154 Parliamentary Papers II 2020/2021, 25695 ECLI:NL:GHSHE:2020:25366 ECLI:NL:GHARL:2021:16797 See also Court Arnhem-Leeuwarden 17 December 2020, ECLI:NL:GHARL:2020: 105648 Supreme Court 9 September 2011, ECLI:NL:HR:2011:BQ8097