Editing Rb. Gelderland - C/05/400739 / KG ZA 22-54

From GDPRhub

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.

Latest revision Your text
Line 66: Line 66:
 
}}
 
}}
  
The District Court Gelderland ordered a credit scoring company to delete an entry in a data subject's credit history pursuant to [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. The court held that the entity had not adhered to its transparency and information obligations, rendering the registration unlawful.
+
The District Court Gelderland ordered the Stichting Bureau Krediet Registratie to delete the special code “9 Dispute” from a registration in their credit information register pursuant to [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]], because it had not adhered to their transparency- and information obligations and this registration was therefore unlawful.
  
 
== English Summary ==
 
== English Summary ==
  
 
=== Facts ===
 
=== Facts ===
The controller is Stichting Bureau Krediet Registratie (BKR), which manages the credit information register (CKI). This register provides an overview of the creditworthiness of people since credit providers (banks etc.) can register (severe) debts of individuals. There were three registrations related to the data subject in the CKI, with special codes that indicated that there had been several payment arrears. In 2021, the data subject requested the BKR to have these registrations and/or these special codes erased, but the controller refused. The data subject then brought the issue before Court, [[Rb. Gelderland - C/05/391171 / HA RK 21-135|which granted his claim and ordered BKR to erase the codes]]. The controller then appealed this decision.
+
The controller is Stichting Bureau Krediet Registratie (BKR), which manages the credit registration register (CKI). This register provides an overview of the creditworthiness of people since credit providers (banks etc.) can register (severe) debts of individuals. There were three registrations related to the data subject in the CKI, with special codes that indicated that there had been several payment arrears. In 2021, the data subject requested the BKR to have these registrations or these special codes erased, but the controller refused. The data subject then brought the issue before Court, which granted his claim and ordered BKR to erase the codes (ECLI:NL:RBGEL:2022:126). The controller then appealed to this decision.
  
 
After some initial hesitations, the controller removed the codes from the registrations, but added a new code “9 Dispute”. The data subject then requested the controller to remove this new code because he claimed that it also negatively affected his creditworthiness (even more than with the previous codes), but the controller refused and explained that this code had been added to explain that the removal of the special codes is still disputed in court (namely: the appeal).
 
After some initial hesitations, the controller removed the codes from the registrations, but added a new code “9 Dispute”. The data subject then requested the controller to remove this new code because he claimed that it also negatively affected his creditworthiness (even more than with the previous codes), but the controller refused and explained that this code had been added to explain that the removal of the special codes is still disputed in court (namely: the appeal).
Line 78: Line 78:
  
 
=== Holding ===
 
=== Holding ===
The Court decided that the registration was unlawful and ordered the controller to remove the special code “9 Dispute” from the registration pursuant to [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]].  
+
The Court rejected the claim.  
  
First, it considered that the data subject did not explain what the legal basis was to have the actual registrations removed (rather than only the special codes that are linked to the registrations), or why this should follow from the circumstances of the case. Hence, it rejected the claim to have the actual registrations removed.
+
First, it considered that the data subject did not explain what the legal basis was to have the actual the registrations removed (rather than only the special codes that are linked to the registrations), or why this should follow from the circumstances of the case. Hence, it rejected the claim to have the actual registrations removed. Second, it considered that the claim to have the special codes erased and to keep having these codes erased, must be rejected since the Court cannot assess any potential future registrations in advance. The Court stipulated that every registration must be assessed on the merits of that specific case.
  
Second, it considered that the claim to have the special codes (linked to the registrations) erased and ''to keep'' having these codes erased. The Court also rejected this claim since it could not assess any potential future registrations in advance. The Court stipulated that every registration must be assessed on the merits of that specific case.  
+
Third, the Court assessed the lawfulness of the registration of special code “9 Dispute”, and whether it should be erased pursuant to [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. The Court stipulated the controller has the duty to prove adherence to the principle of lawfulness and transparency pursuant to [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. Moreover, it considered that the BKR added this code on its own behalf (and not on the behalf of credit providers), that BKR did not inform the data subject of this registration pursuant to [[Article 14 GDPR|Article 14 GDPR]], and that this special code is not mentioned on their webpage which provides explanation on the different special codes. The Court concluded that the controller violated its duty to be transparent- and to inform pursuant to Article 5 in combination with [[Article 14 GDPR|Article 14 GDPR]].
  
Third, the Court assessed the lawfulness of the registration of special code “9 Dispute”, and whether it should be erased pursuant to [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. The Court stipulated the controller has the duty to prove adherence to the principle of lawfulness and transparency pursuant to [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. Moreover, it considered that the BKR added this code on its own behalf (and not on the behalf of credit providers), that BKR did not inform the data subject of this registration pursuant to [[Article 14 GDPR]], and that this special code is not mentioned on their webpage which provides explanation on the different special codes. The Court concluded that the controller violated its duty to be transparent and to inform data subjects pursuant to [[Article 5 GDPR|Article 5]] in combination with [[Article 14 GDPR]].
+
Hence, the Court decided that the registration is unlawful and ordered the controller to remove the special code “9 Dispute” from the registration pursuant to [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]].  
  
 
== Comment ==
 
== Comment ==

Please note that all contributions to GDPRhub are considered to be released under the Creative Commons Attribution-NonCommercial-ShareAlike (see GDPRhub:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please answer the question that appears below (more info):

Cancel Editing help (opens in new window)

Template used on this page: