Rb. Rotterdam - C/10/585969 / KG ZA 19-1184: Difference between revisions

Latest revision as of 16:29, 10 March 2022

Rb. Rotterdam - C/10/585969 / KG ZA 19-1184

Court:	Rb. Rotterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:
Decided:	06.01.2020
Published:	07.02.2020
Parties:	Quion Hypotheekbegeleiding B.V.
National Case Number/Name:	C/10/585969 / KG ZA 19-1184
European Case Law Identifier:	ECLI:NL:RBROT:2020:211
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The District Court of Rotterdam issued a judgement on the claim to remove personal data from the financial blacklists, including data relating to criminal records.

English Summary

Facts

The complainant was added in the blacklists maintained by the Dutch financial institutions for the period of four years based on three wrongdoings, registered by the mortgage advisor Quion:

Running a cannabis farm in an apartment the complainant was still paying mortgage for;
Not using that apartment as her own place of residence;
Not notifying Quion about her employment termination before signing the mortgage agreement.

Dispute

Holding

The Court found the following:

Running a cannabis farm is a criminal offence. For this information to be added in financial blacklists, it must be sufficiently established that the complainant has indeed been involved in the crime. This was not the case in this lawsuit, so Quion was ordered to remove this record from the internal blacklist;
Quion was ordered to remove the record about not using the apartment for own residence from the external blacklist but could keep it in the internal list;
Quion was ordered to remove the record about the failure to inform about the complainant’s employment termination from the external blacklist but could keep it in the internal list.

The decision was based almost entirely on the rules of the anti-fraud blacklist maintained by the Dutch financial institutions (“Protocol Incidentenwaarschuwingssysteem Financiële Instellingen”). One of the conditions for adding a person to these blacklists is proportionality, meaning that the interest of the financial institutions must outweigh the possible negative consequences of being added to this blacklist for the individuals. In this case the judge decided that Quion did not strike the right balance because the complainant kept paying the mortgage on time and there no damage was caused to the apartment or to the financial institutions.

Comment

Share your comment here!

Further Resources

Article from the website of Autoriteit persoonsgegevens (in NL)

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

DECISION

2.1.

In 2016 [plaintiff] requested a mortgage offer from Dynamic Credit Hypotheken B.V. (hereafter: Dynamic Credit), in connection with the purchase of the apartment located at the [address] in Rotterdam (hereafter: the apartment). On 12 May 2016 [plaintiff] received an offer. In that offer is stated:
4.1

When may we withdraw (cancel) the offer?

We may withdraw the offer in the following situations. You will then no longer be able to use the offer.

(…)

- If you or your advisor hasn't given us all the information

- If you or your advisor has given us false information

(…)

- If your situation has changed, as a result of which the information you provided previously has not

more correct or complete.
2.2.

[plaintiff] has accepted the offer made by Dynamic Credit (which also trades under the name BijBouwe). On 6 July 2016, the mortgage deed was passed. It says herein:
6.2

Stipulations from the General Terms and Conditions which are expressly stipulated

The General Terms and Conditions include the provisions set out below under (a) to (m) which, to the extent necessary, are hereby also expressly stipulated in this Mortgage Deed. (…)

(a) (…)

(b) Own occupancy

You may only use the Collateral to live with your family. You may therefore not allow anyone other than yourself (with Your family) to use the Collateral (without written permission from BijBouwe).

(c) (…)

(d) Good maintenance

You are required to properly maintain and use the Collateral in accordance with the law. You may not change the way you use the Collateral. If You have damage to the Collateral, it must be repaired quickly.

(…)
2.3.

[plaintiff] has at some point bought a second apartment. That apartment was delivered to her on 9 October 2018 and she moved into it.
2.4.

On 25 March 2019 an inspector from the Municipality of Rotterdam found a hemp nursery in the apartment at the [address] . The municipality informed [claimant] and Quion/Dynamic Credit of this.
2.5.

On 10 July 2019 Dynamic Credit informed [plaintiff] that, as a result of

detected irregularities in violation of the general conditions, including the presence of a hemp nursery in the apartment, terminates the mortgage loan. [plaintiff] then sold the apartment and repaid the entire debt to Dynamic Credit.
2.6.

By letter dated 1 July 2019, Quion informed [the plaintiff]:

The financing has been provided under the condition that the property may only be used for own residential purposes. There is no evidence that the collateral was purchased with the intention of using it for own residential purposes. The fact that a property was purchased in December that you did not occupy until recently supports the suspicion that the property was not purchased for your own occupation.

There has been a hemp nursery in the premises which caused serious dangers for the surrounding area. You have stated that the premises were not in use by you during the period that a hemp nursery was established in the premises. Case law shows that the owner of a property may be assumed to be familiar with everything that is in his home. This in combination with the fact that it has not been demonstrated that the property was actually let makes us consider you responsible.

Finally, there is concealment with regard to termination of employment. It is certain that the employment contract was terminated before or, at the latest, immediately after passing through.

We therefore consider it necessary to include your personal details and the incident in question in Quion Groep B.V.'s Incidents Register and in the External Referral Register.

(...) Your data will be recorded for a maximum period of eight years.
2.7.

On 9 August 2019, [plaintiff] objected to the inclusion of its data in the Quion Incidents Register and the External Referral Register (hereinafter also referred to as: the registers).
2.8.

In response, Quion has indicated to [plaintiff] that it will maintain the registration in the Registries, but that the duration of the registration will be reduced to four years because there have been no arrears during the term of the loan, and [plaintiff].

cooperated in a private sale of the collateral, which meant that no residual debt arose.
3 The dispute
3.1.

Plaintiff] primarily claims that the Interim Injunction Judge should order Quion by judgment, enforceable in stock, to remove and keep deleted all records relating to it in the Quion Incidents Register and the External Referral Register within five days after service of the judgment, on pain of forfeiture of a penalty of € 1,000.00 per day. The subsidiary claim of [plaintiff] seeks the removal and retention of registrations in (only) the External Referral Register. In addition, [plaintiff] claims that Quion should be ordered to pay the costs of these proceedings.
3.2.

Quion's primary defence is that it was not it, but Dynamic Credit that should have been summoned. Quion submits the following in that regard. Dynamic Credit has outsourced the supervision of the management of its mortgage loans to Quion. As part of its management task, Quion investigates incidents relating to customers of financiers such as Dynamic Credit. Quion has therefore investigated the hemp nursery in the apartment, whether [plaintiff] bought the apartment with the intention to live there, and her income situation in the period of the mortgage application. Quion must, among other things, comply with the Protocol Incident Warning System for Financial Institutions. If it detects a (possible) incident, it must register the details of the person concerned in its Incidents Register. Quion then advises the financier to take over. It is then up to the financier, in this case Dynamic Credit, to decide whether or not to register in the External Referral Register on the basis of that advice. A registration in the External Referral Register then refers to the personal data in Quion's Incidents Register. If the funder decides to register in the External Referral Register, Quion will actually do so on behalf and in the name of this funder. Quion cannot independently undo this registration. At most, it can ask the funder to instruct it to do so.
3.3.

[plaintiff] stated at the hearing that Quion's attorney at law would let her attorney at law know before issuing the summons for whom he is acting (Quion or Dynamic Credit), that he has not done so, and that Quion's attorney at law has been chosen for the summons because of both the letter of 1 July 2019, in which she has been notified of the inclusion of her data in the Quion Incidents Register and the External Referral Register, if the response to her objection originates from Quion, and Dynamic Credit is not mentioned in those letters.
3.4.

Against this background, the Interim Injunction Judge reads the claims of [Plaintiff] so as to claim that Quion be ordered to remove and keep removed all registrations relating to [Plaintiff] from the Quion Incidents Register, and to have all registrations relating to [Plaintiff] from the External Referral Register removed and kept removed. It appears from the proceedings at the hearing that Quion also read the claims as such.
3.5.

3.5. [Claimant] substantiates its claims as follows. Inclusion in the registers of the fact that a hemp farm has been operated in her home is only allowed if it has been sufficiently established that she was involved in this. This is not the case. The unauthorised letting of the apartment/failure to comply with the obligation to live in the apartment and the failure to report the fact that she quit her job in the period before she passed the mortgage deed do not justify the inclusion of her personal data in the registers.
3.6.

Quion concludes by dismissing the claims and ordering [the plaintiff] to pay the costs of the proceedings. Quion takes the view that the mere presence of a hemp grower in a dwelling subject to a mortgage right qualifies as an incident within the meaning of the Protocol on the Alerting of Incidents by Financial Institutions. This considerably increases the risk of fire, while the financial institution is partly dependent on the state of the collateral for the repayment of its loan. This incident is therefore rightly included in the Incidents Register, according to Quion.

Quion further takes the position that it has advised Dynamic Credit on good grounds to include [plaintiff's] referral data in the External Referral Register. It argues the following in this respect. The hemp nursery was located in [plaintiff's] apartment. This justifies the assumption that she was the operator of it. At least it may be assumed that she was aware of this and nevertheless did not take any action against it. It is up to [plaintiff] to disprove this justified premise with documentary evidence. She does not go any further than an unsigned rental agreement drawn up in Dutch, which would have been concluded between parties who do not speak Dutch. Moreover, the story about renting out the apartment rattles on all sides. According to the lease, the rental started in August 2018. However, [the plaintiff] has stated to Quion that at the time the nursery was discovered, in March 2019, she had already been renting out the apartment for twelve months. On the other hand, in her notice of objection against the inclusion of her details in the registers, her lawyer writes again that the apartment had been let since October 2018. This would have been done in order to avoid double housing costs. [plaintiff] bought a second apartment in that period. However, [plaintiff] could also have lived in the first apartment in order to avoid double housing costs. In addition, there is nothing to show that [plaintiff] bought the apartment at the [address] with the intention to live there herself and that - by not reporting that she had quit her job - she deprived Dynamic Credit of the opportunity to assess her actual income position at the time of the mortgage application. For a potential mortgage lender, it is essential that the applicant is correctly informed about his/her salary. The amount of the salary and the certainty that this will be enjoyed in the future directly determine the size of a mortgage loan.
3.7.

The arguments of the parties relevant to the assessment of the claim are discussed below.
4 The assessment
The urgency of the matter
4.1.

Article 254 of the Rv provides that the judge in preliminary relief proceedings in urgent cases in which, in view of the interests of the parties, an immediate interim injunction is required, is authorized to give it. There is an urgent case in the sense referred to above if the plaintiff cannot be required to await the outcome of any proceedings on the merits.
4.2.

The purpose of registration in the Incidents Register of a financial institution is - in brief - to safeguard the safety and integrity of the financial sector (Article 4.1.1 of the Protocol Incidents Warning System for Financial Institutions (hereinafter: the Protocol)). The Incidents Register is linked to an External Referral Register, which contains referral data (such as a person's name and date of birth). This register can be consulted by other financial institutions. After another financial institution has determined that a certain person is included in the External Referral Register, this institution can consult the data in the Incidents Register of the other financial institution (Article 5.1.1 of the protocol). Access to the External Referral Register includes banks and insurers. The inclusion of Referral Data in this Register therefore has potential adverse consequences for the assessment of an application submitted by [plaintiff] for, for example, the opening of a bank account, the taking out of a money loan or the taking out of an insurance policy. As a result, she cannot be expected to await the outcome of any proceedings on the merits.

The assessment framework
4.3.

In the Incidents Register of a financial institution, data are recorded as a result of or relating to a (possible) incident, with the aim of supporting activities aimed at guaranteeing the security and integrity of the financial sector, as evidenced by the definition given in point 2 of the protocol. According to the protocol, an incident is understood to mean an event that has, could have or has had the consequence that the interests, integrity or safety of the clients or employees of a financial institution, the financial institution itself or the financial sector as a whole are or could be at stake, such as the falsification of notes, identity fraud, skimming, embezzlement in employment, phishing and deliberate deception.
4.4.

As stated above, an External Referral Register is linked to the Incidents Register. The inclusion of personal data in these registers can be regarded as a processing of personal data to which the General Data Protection Regulation (GTC) (applicable since 25 May 2018) applies. The protocol offers sufficient guarantees for processing personal data as prescribed by the GDPR. The protocol therefore serves as a starting point when assessing whether the inclusion of [plaintiff's] personal data in the registers is justified.
4.5.

Article 5.2.1 of the protocol stipulates that a financial institution must include in the External Referral Register referral data of (legal) persons who meet the criteria mentioned under a and b below, after application of the proportionality principle mentioned under c below.

(a) The conduct(s) of the (legal) person(s) constituted, constituted or may constitute a threat to (I) the (financial) interests of clients and/or employees of a financial institution, as well as the (organisation of the) financial institution(s) themselves or (II) the continuity and/or integrity of the financial sector.

(b) It is sufficiently established that the (legal) person concerned is involved in the conduct(s) referred to under (a). This means that, in principle, criminal offences are reported or complaints made to an investigating officer.

(c) The principle of proportionality shall be observed. This means that security matters will determine that the importance of inclusion in the External Referral Register takes precedence over the possible adverse consequences for the person concerned as a result of the inclusion of his or her personal data in the External Referral Register.
4.6.

With respect to the processing of criminal personal data in the registers, a conviction by the criminal court is not required. However, the data must be sufficiently certain. This means that there must be such concrete facts and circumstances that they can carry a statement of evidence that qualifies as a criminal offence within the meaning of Article 350 of the Code of Criminal Procedure. This is the case if the established conduct gives rise to a heavier suspicion than a reasonable suspicion of guilt (HR 29 May 2009, ECLI:NL:HR:2009:BH4720, r.o. 4.4). This principle is also laid down in the annex to the protocol. This states: 'The basic principle is that it must be possible to demonstrate in legal proceedings that there is sufficient evidence to qualify as fraud or other improper or punishable conduct in relation to a (legal) person demonstrably involved. If one of these elements is missing, no registration should take place. They constitute the criteria set out in Article 5.2.1(a) and (b)'.

The claim
4.7.

From Quion's letter of 1 July 2019 (cited above under 2.6), Quion's response to [the plaintiff's] notice of objection and Quion's explanation of this at the hearing, it appears that the registration relates to three incidents: the operation of the hemp farm in the mortgaged apartment, not using the apartment for her own occupation, and the concealment of the termination of her employment.
4.8.

The operation of a hemp farm is a criminal offence. In order to be allowed to include this information in the registers, it must be sufficiently clear from the assessment framework outlined in 4.6 that [the plaintiff] was involved in committing that offence. This has - in the provisional opinion - proved to be insufficient. Speech must be of such concrete facts and circumstances that they can bear a statement of evidence to be qualified as a criminal offence within the meaning of Article 350 of the Code of Criminal Procedure. The mere fact that a hemp farm was found in the apartment of which [the plaintiff] is the owner, now that it must be held that [the plaintiff] (as she states and does not contradict Quion) did not live there in that period, is insufficient for that purpose. The state of affairs surrounding the letting of the apartment by [plaintiff] to the person who (according to the documents submitted by [plaintiff]) is suspected by the Public Prosecution Service of exploiting the hemp farm and the fact that [plaintiff] quit her job during the period of the mortgage application does raise questions, but are - in the preliminary opinion of the Interim Injunction Judge - insufficient to be able to conclude that there are facts and circumstances that can support a statement of evidence with regard to complicity in, or complicity with, the cultivation of hemp. For the conclusion that it has been sufficiently established that there is a criminal offence - for the time being - there is therefore no ground. As a result, this incident may not be included in the Incidents Register. The primary claim is therefore granted to the extent that it serves to remove this incident from Quion's Incidents Register.
4.9.

The Court in preliminary relief proceedings considered the following with regard to the failure to use the apartment for personal occupation and the concealment of the termination of the employment contract.
4.10.

That - as Quion stated - the apartment was never used by her for her own residence is disputed by [the plaintiff]. However, she does acknowledge that at some point she started living in another apartment (i.e. the apartment she bought in October 2018). She also acknowledges that - as Quion states - she quit her job before passing the mortgage deed and that she did not report this to Quion/Dynamic Credit. These are - in the preliminary opinion of the Court in preliminary relief proceedings - events as a result of which the interests of Dynamic Credit may be at stake and whose inclusion in the Incidents Register of a financial institution as Dynamic Credit is in accordance with the purpose of the Incidents Register. It is in a mortgagee's interest that all relevant information is provided by the applicant and that, if the situation has changed, this is passed on by the applicant. After all, as Quion argues, the amount of the salary and the certainty that this will be enjoyed in the (near) future determine the size of the loan. The offer also shows that Dynamic Credit reserves the right to withdraw the offer if the situation of the applicant has changed to such an extent that the previously provided information is no longer correct or complete, or if not all or wrong information has been provided. A mortgagee also has an interest in compliance by the mortgagor with the obligation laid down in the mortgage deed and the General Mortgage Conditions to occupy the collateral himself/herself, and the related obligation to properly maintain and use the collateral in accordance with the law. If these obligations are breached, the value of the collateral may be adversely affected.
4.11.

For the time being, the Court in preliminary relief proceedings deems it insufficiently plausible that the inclusion of these two incidents in Quion's - internal - Incidents Register is contrary to the principle of proportionality. The claim is therefore dismissed insofar as it seeks the removal of the data relating to these two incidents from Quion's Incidents Register.
4.12.

With respect to the inclusion of [plaintiff's] reference data in the External Referral Register, the Court in preliminary relief proceedings considered the following.
4.13.

The protocol prescribes that the principle of proportionality must be complied with. That is to say, it follows from Article 5.2.1 sub c of the protocol that the importance of including personal data in the External Referral Register takes precedence over the possible adverse consequences of this for the person whose personal data are included in the register (the data subject).
4.14.

A possible adverse consequence of inclusion in the External Referral Register is that the data subject's application for a financial product, such as a bank account, a loan or insurance, is refused by a financial institution that has access to the External Referral Register.
4.15.

The Interim Injunction Judge attributes - as a preliminary opinion - a heavier weight to this possible consequence for [plaintiff] than to the interest of financial institutions in the inclusion of [plaintiff's] personal data in the External Referral Register. In this consideration the Court in preliminary relief proceedings takes into account that the conduct referred to under 4.9 ff. above - not punishable - is of relatively minor seriousness and that this conduct has not caused any disadvantage to Dynamic Credit. It is certain that there has never been a delay in the payment of interest and redemption and also that the value of the apartment has not been affected to such an extent that the proceeds of the private sale of the apartment were insufficient to be able to pay the debt of [plaintiff] to Dynamic Credit in full.
4.16.

Now that the inclusion of [plaintiff's] personal data in the External Referral Register is deemed disproportionate for the time being, the second part of the primary claim is also awarded.
4.17.

The Court in preliminary relief proceedings assumes that Quion will comply with the judgment and therefore sees no reason at this time to impose a penalty payment.

The costs of the proceedings
4.18.

Since both parties are partly in the right and partly in the wrong

the costs of the proceedings are offset, each party being ordered to bear its own costs.

@@ Line 1: / Line 1: @@
-{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
+{{COURTdecisionBOX
-! colspan="2" |Rb. Rotterdam - C/10/585969 / KG ZA 19-1184
-|-
-| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:courtsNL.png|center|250px]]
-|-
-|Court:||[[:Category:Rb. Rotterdam (Netherlands)|Rb. Rotterdam (Netherlands)]]
-[[Category:Rb. Rotterdam (Netherlands)]]
-|-
-|Jurisdiction:||[[Data Protection in the Netherlands|Netherlands]]
-[[Category:Netherlands]]
-|-
-|Relevant Law:||[[Article 4 GDPR#2|Article 4(2) GDPR]]
-[[Category:Article 4(2) GDPR]]
-[[Article 9 GDPR#1|Article 9(1) GDPR]]
+|Jurisdiction=Netherlands
-[[Category:Article 9(1) GDPR]]
+|Court-BG-Color=
+|Courtlogo=Courts_logo1.png
+|Court_Abbrevation=Rb. Rotterdam
+|Court_With_Country=Rb. Rotterdam (Netherlands)
-[[Article 9 GDPR#2|Article 9(2) GDPR]]
+|Case_Number_Name=C/10/585969 / KG ZA 19-1184
-[[Category:Article 9(2) GDPR]]
+|ECLI=ECLI:NL:RBROT:2020:211
-|-
-|Decided:||6. 1. 2020
+|Original_Source_Name_1=de Rechtspraak
-[[Category:2020]]
+|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBROT:2020:211&showbutton=true&keyword=AVG
-|-
+|Original_Source_Language_1=Dutch
-|Published:||7. 2. 2020
+|Original_Source_Language__Code_1=NL
-|-
+|Original_Source_Name_2=
-|Parties:||[https://www.quion.com/home.html QUION HYPOTHEEKBEGELEIDING B.V.]
+|Original_Source_Link_2=
-|-
+|Original_Source_Language_2=
-|National Case Number:||C/10/585969 / KG ZA 19-1184
+|Original_Source_Language__Code_2=
-|-
-|European Case Law Identifier:||<small>ECLI:NL:RBROT:2020:211</small>
+|Date_Decided=06.01.2020
-|-
+|Date_Published=07.02.2020
-|Appeal from:||n/a
+|Year=2020
-|-
-|Language:||Dutch
+|GDPR_Article_1=
-[[Category:Dutch]]
+|GDPR_Article_Link_1=
-|-
+|GDPR_Article_2=
-|Original Source:||[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBROT:2020:211&showbutton=true&keyword=AVG de Rechtspraak (in NL)]
+|GDPR_Article_Link_2=
-|}
+|EU_Law_Name_1=
+|EU_Law_Link_1=
+|EU_Law_Name_2=
+|EU_Law_Link_2=
+|National_Law_Name_1=
+|National_Law_Link_1=
+|National_Law_Name_2=
+|National_Law_Link_2=
+|National_Law_Name_3=
+|National_Law_Link_3=
+|Party_Name_1=Quion Hypotheekbegeleiding B.V.
+|Party_Link_1=https://www.quion.com/home.html
+|Party_Name_2=
+|Party_Link_2=
+|Party_Name_3=
+|Party_Link_3=
+|Appeal_From_Body=
+|Appeal_From_Case_Number_Name=
+|Appeal_From_Status=
+|Appeal_From_Link=
+|Appeal_To_Body=
+|Appeal_To_Case_Number_Name=
+|Appeal_To_Status=
+|Appeal_To_Link=
+|Initial_Contributor=
+|
+}}
 The District Court of Rotterdam issued a judgement on the claim to remove personal data from the financial blacklists, including data relating to criminal records.
@@ Line 65: / Line 87: @@
 ==Further Resources==
-''Share blogs or news articles here!''
+[https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/register-zwarte-lijsten/zwarte-lijst-financiele-instellingen Article from the website of Autoriteit persoonsgegevens (in NL)]
 ==English Machine Translation of the Decision==
@@ Line 73: / Line 95: @@
 <pre>DECISION
-The plaintiff states that DNA testing on body material is currently the only (real) possibility to determine whether the person from whom this body material originates is her biological father. He has never acknowledged her. This man died in 2018. He suffered from epilepsy and during his life participated in a medical-scientific research of the Erasmus Medical Centre, defendant. At the request of the hospital, he provided body material for this examination. Prior to this examination, the man filled in a form, a 'patient consent form', in which he was promised, among other things, that his body material would be treated confidentially. The hospital invokes its duty of confidentiality, with reference to the General Data Protection Ordinance (AVG), among other things. The following is the starting point for the assessment. Fundamental rights such as the right to respect for private life, the right to freedom of thought, conscience and religion and the right to freedom of expression are based on a general personality right, including the right to know from which parents one descends. This right is laid down internationally in Article 7 of the Convention on the Rights of the Child, to which the Netherlands is a party. This right is not absolute and must give way to the rights and freedoms of others when these weigh more heavily in the particular case (HR, 15 April 1994, NJ 1994, 608, LJN: ZC1337). With due observance of the above, a balance of interests will have to be made in order to determine whether the plaintiff can demand the cooperation of the hospital in order to exercise his right to know from whom she is descended if the confidentiality obligation is breached. The right of the man and the other family members involved to protect their privacy also plays a part in this weighing up of interests.
+.1.
-Locations
-Judgement
+In 2016 [plaintiff] requested a mortgage offer from Dynamic Credit Hypotheken B.V. (hereafter: Dynamic Credit), in connection with the purchase of the apartment located at the [address] in Rotterdam (hereafter: the apartment). On 12 May 2016 [plaintiff] received an offer. In that offer is stated:
-COURT ROTTERDAM
+.1
-Trade and port team
+When may we withdraw (cancel) the offer?
-Case number / role number: C/10/583910 / KG ZA 19-1062
+We may withdraw the offer in the following situations. You will then no longer be able to use the offer.
-Judgment in interlocutory proceedings of 12 December 2019
+(…)
-in the case of
+- If you or your advisor hasn't given us all the information
-[name of plaintiff],
+- If you or your advisor has given us false information
-residing at [domicile of the plaintiff],
+(…)
-plaintiff,
+- If your situation has changed, as a result of which the information you provided previously has not
-Attorney at law P.M. de Vries in Amsterdam,
+more correct or complete.
+.2.
-at the rate of
+[plaintiff] has accepted the offer made by Dynamic Credit (which also trades under the name BijBouwe). On 6 July 2016, the mortgage deed was passed. It says herein:
+.2
-the foundation
+Stipulations from the General Terms and Conditions which are expressly stipulated
-ERASMUS UNIVERSITY MEDICAL CENTER ROTTERDAM,
+The General Terms and Conditions include the provisions set out below under (a) to (m) which, to the extent necessary, are hereby also expressly stipulated in this Mortgage Deed. (…)
-established in Rotterdam,
+(a) (…)
-defendant,
+(b) Own occupancy
-attorney at law A.M. den Hartog-de Visser in Rotterdam.
+You may only use the Collateral to live with your family. You may therefore not allow anyone other than yourself (with Your family) to use the Collateral (without written permission from BijBouwe).
-The parties will hereinafter be referred to as [plaintiff's name] and EUMCR.
+(c) (…)
-The proceedings
+(d) Good maintenance
-.1.
-The course of the procedure is clear:
--the subpoena of 24 October 2019, with productions;
+You are required to properly maintain and use the Collateral in accordance with the law. You may not change the way you use the Collateral. If You have damage to the Collateral, it must be repaired quickly.
--the productions of EUMCR;
--the oral procedure of 28 November 2019;
--EUMCR's written pleading.
-.2.
-Finally, a judgment has been issued.
-The facts
-.1.
-The [name of the plaintiff] was born on [date of birth of the plaintiff] in [place of birth of the plaintiff]. Her mother is [name mother plaintiff] (hereinafter: the mother of [name plaintiff]).
-.2.
-On [date of birth] was born Mr. [name man] (hereinafter: Mr. [name man] ). Mr. [name man] died on [date of death].
+(…)
 .3.
-The [name of the plaintiff] has never been recognized by a man, not even by Mr. [name of the man]. She has (therefore) no legal father.
-The dispute
+[plaintiff] has at some point bought a second apartment. That apartment was delivered to her on 9 October 2018 and she moved into it.
-.1.
+.4.
-name of the plaintiff] claims that the judge in preliminary relief proceedings should declare the judgment enforceable on a provisional basis: EUMCR condemns to send within fourteen days after service of the judgment to be rendered in this matter the body material taken from [name of man], born on [date of birth] and deceased on 9 October 2018, primarily by courier to Verilabs (Gouda) and alternatively to an institution to be chosen by EUMCR that specialises in family law investigations, in order to carry out an investigation into the presence of DNA material and subsequently a paternity examination, on pain of a penalty of € 15.The EUMCR will pay a fine of € 000 for each day or part of a day that EUMCR does not comply with the judgment to be given in this matter;
-Orders EMC to pay the costs of the proceedings.
-.2.
+On 25 March 2019 an inspector from the Municipality of Rotterdam found a hemp nursery in the apartment at the [address] . The municipality informed [claimant] and Quion/Dynamic Credit of this.
-The [name of the plaintiff] - summarized - forms the basis of the following statements:
+.5.
--At the time of the birth of [name plaintiff] the mother of [name plaintiff] had a relationship with the lord [name man];
+On 10 July 2019 Dynamic Credit informed [plaintiff] that, as a result of
--Despite the fact that [name plaintiff] has never been recognized by the Lord [name man], she has often had contact with him and his relatives over the years;
+detected irregularities in violation of the general conditions, including the presence of a hemp nursery in the apartment, terminates the mortgage loan. [plaintiff] then sold the apartment and repaid the entire debt to Dynamic Credit.
+.6.
--According to the mother of [name plaintiff] the lord [name man] [name plaintiff] actually wanted to acknowledge but was always afraid that the mother of [name plaintiff] would demand maintenance from him; because of the latter recognition of [name plaintiff] by the lord [name man] did not occur during his life;
+By letter dated 1 July 2019, Quion informed [the plaintiff]:
--After the birth of [name of the plaintiff] Mr. [name of the husband] had five more children with two other women than the mother of [name of the plaintiff], namely twins born on [date of birth of twins 1] and twins born on [date of birth of twins 2], whose mother is [name of wife 1], and a son born on [date of birth of son] 2010 (hereafter): Of these five children, only [name of son] is recognised by Mr [name of husband];
+The financing has been provided under the condition that the property may only be used for own residential purposes. There is no evidence that the collateral was purchased with the intention of using it for own residential purposes. The fact that a property was purchased in December that you did not occupy until recently supports the suspicion that the property was not purchased for your own occupation.
--Because there are no obstacles to the determination of the parenthood of [name of plaintiff] as referred to in Section 1:207 subsection 2 of the Dutch Civil Code, she submitted an application to the District Court of Amsterdam on 5 (or 6) August 2019 for a judicial determination of the parenthood of Mr [name of husband];
+There has been a hemp nursery in the premises which caused serious dangers for the surrounding area. You have stated that the premises were not in use by you during the period that a hemp nursery was established in the premises. Case law shows that the owner of a property may be assumed to be familiar with everything that is in his home. This in combination with the fact that it has not been demonstrated that the property was actually let makes us consider you responsible.
--In the medical data of Mr. [name of man] [name of plaintiff] has [name of plaintiff] found documents concerning 'The ACES-study: epilepsy caused by antibodies that belong to the body'; these documents are part of a consent form signed by Mr. [name of man] and by the researcher that dates from 22 July 2016; the other documents show that this research is controlled by EUMCR; information about this research shows that blood has been taken from Mr. [name of man] and, if possible, also cerebrospinal fluid as part of the standard treatment; it is also indicated that the blood and the (possible) cerebrospinal fluid will be stored for fifteen years;
+Finally, there is concealment with regard to termination of employment. It is certain that the employment contract was terminated before or, at the latest, immediately after passing through.
--As far as known by [name of plaintiff] no other DNA material of Mr. [name of husband] has been preserved;
+We therefore consider it necessary to include your personal details and the incident in question in Quion Groep B.V.'s Incidents Register and in the External Referral Register.
--The paternity procedure initiated by [name of the plaintiff] can only succeed, if it challenges the outcome of a DNA investigation; there are no other ways to get more than summary evidence that Mr. [name of the plaintiff] is the father of [name of the plaintiff]; for example, there are no pictures with [name of the plaintiff] on them together with Mr. [name of the plaintiff] or cards or letters he has sent to [name of the plaintiff]; Although there are statements by sisters of Mr. [name man] that they have never had any doubt that Mr. [name man] is the father of [name plaintiff], it is questionable whether that fact is sufficient or at least relevant evidence for the success of the paternity procedure; [name son] , the only child recognized by Mr. [name man], is willing to cooperate in a DNA test, but his mother, Mrs. [name wife 2], does not want that;
+(...) Your data will be recorded for a maximum period of eight years.
+.7.
--As can be seen from, among other things, HR 15 April 1994, ECLI:NL:HR:1994:ZC1337, NJ 1994/608 (Valkenhorst), the general law of personality is based on the right to know from which parents one descends; this right has also been internationally recognised, namely in Article 7 of the Convention on the Rights of the Child and in Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, to which the Netherlands is party;
+On 9 August 2019, [plaintiff] objected to the inclusion of its data in the Quion Incidents Register and the External Referral Register (hereinafter also referred to as: the registers).
+.8.
--The [name of the plaintiff] therefore has a very great interest in an investigation into the presence of DNA-material of Mr. [name of the man] in the blood taken from Mr. [name of the man] during the above-mentioned epilepsy investigation and (possible) cerebrospinal fluid taken from Mr. [name of the man] and, in so far as this DNA-material is present, in a DNA-kinship investigation after taking her own DNA-material;
+In response, Quion has indicated to [plaintiff] that it will maintain the registration in the Registries, but that the duration of the registration will be reduced to four years because there have been no arrears during the term of the loan, and [plaintiff].
--In the balancing of interests to which the Interim Injunction Judge is bound, the interest of EUMCR must outweigh that interest by [name of plaintiff];
+cooperated in a private sale of the collateral, which meant that no residual debt arose.
+The dispute
+.1.
--name of the plaintiff] has an urgent interest in carrying out the DNA-testing on the aforementioned removed body material of Mr. [name of the man], since Mr. [name of the man] died on 9 October 2018 and [name of the plaintiff] has so far not been 'recognised' as his heir; When it is necessary to await the outcome of proceedings on the merits and subsequently the outcome of the DNA investigation and the judicial paternity determination, there is a good chance that the part of Mr. [naam man]'s estate to which [naam plaissees] is entitled has been lost by the other heir(s).
+Plaintiff] primarily claims that the Interim Injunction Judge should order Quion by judgment, enforceable in stock, to remove and keep deleted all records relating to it in the Quion Incidents Register and the External Referral Register within five days after service of the judgment, on pain of forfeiture of a penalty of € 1,000.00 per day. The subsidiary claim of [plaintiff] seeks the removal and retention of registrations in (only) the External Referral Register. In addition, [plaintiff] claims that Quion should be ordered to pay the costs of these proceedings.
+.2.
+Quion's primary defence is that it was not it, but Dynamic Credit that should have been summoned. Quion submits the following in that regard. Dynamic Credit has outsourced the supervision of the management of its mortgage loans to Quion. As part of its management task, Quion investigates incidents relating to customers of financiers such as Dynamic Credit. Quion has therefore investigated the hemp nursery in the apartment, whether [plaintiff] bought the apartment with the intention to live there, and her income situation in the period of the mortgage application. Quion must, among other things, comply with the Protocol Incident Warning System for Financial Institutions. If it detects a (possible) incident, it must register the details of the person concerned in its Incidents Register. Quion then advises the financier to take over. It is then up to the financier, in this case Dynamic Credit, to decide whether or not to register in the External Referral Register on the basis of that advice. A registration in the External Referral Register then refers to the personal data in Quion's Incidents Register. If the funder decides to register in the External Referral Register, Quion will actually do so on behalf and in the name of this funder. Quion cannot independently undo this registration. At most, it can ask the funder to instruct it to do so.
 .3.
-EUMCR puts forward a defence and concludes to reject the claim, with an order that [name of the plaintiff] be ordered to pay the costs of the proceedings.
+[plaintiff] stated at the hearing that Quion's attorney at law would let her attorney at law know before issuing the summons for whom he is acting (Quion or Dynamic Credit), that he has not done so, and that Quion's attorney at law has been chosen for the summons because of both the letter of 1 July 2019, in which she has been notified of the inclusion of her data in the Quion Incidents Register and the External Referral Register, if the response to her objection originates from Quion, and Dynamic Credit is not mentioned in those letters.
 .4.
-To this end, EUMCR - in summary - puts forward the following arguments:
--There is no legal basis on the basis of which EUMCR is obliged to provide the requested material;
--There is no question of any form of (presumed) consent of Mr. [naam man] with this provision;
+Against this background, the Interim Injunction Judge reads the claims of [Plaintiff] so as to claim that Quion be ordered to remove and keep removed all registrations relating to [Plaintiff] from the Quion Incidents Register, and to have all registrations relating to [Plaintiff] from the External Referral Register removed and kept removed. It appears from the proceedings at the hearing that Quion also read the claims as such.
+.5.
--In addition, the provision by EUMCR of this body material would contravene the provisions of the General Data Protection Ordinance currently in force;
+.5. [Claimant] substantiates its claims as follows. Inclusion in the registers of the fact that a hemp farm has been operated in her home is only allowed if it has been sufficiently established that she was involved in this. This is not the case. The unauthorised letting of the apartment/failure to comply with the obligation to live in the apartment and the failure to report the fact that she quit her job in the period before she passed the mortgage deed do not justify the inclusion of her personal data in the registers.
+.6.
--In addition, EUMCR's duty of professional secrecy also precludes the disclosure of Mr. [name of man]'s body material requested; this duty of professional secrecy also applies after the death of the person from whom the information originates;
+Quion concludes by dismissing the claims and ordering [the plaintiff] to pay the costs of the proceedings. Quion takes the view that the mere presence of a hemp grower in a dwelling subject to a mortgage right qualifies as an incident within the meaning of the Protocol on the Alerting of Incidents by Financial Institutions. This considerably increases the risk of fire, while the financial institution is partly dependent on the state of the collateral for the repayment of its loan. This incident is therefore rightly included in the Incidents Register, according to Quion.
--A balance of interests may not lead to a different result; the confidentiality that EUMCR must observe is also prompted by a great social interest that is involved in the performance of medical scientific research; in contrast to that great social interest of EUMCR, only the interest of [name of the plaintiff] in knowledge of her origins plays a role; that [name of the plaintiff] would also have had no health interest in her claim, nor has it become apparent.
+Quion further takes the position that it has advised Dynamic Credit on good grounds to include [plaintiff's] referral data in the External Referral Register. It argues the following in this respect. The hemp nursery was located in [plaintiff's] apartment. This justifies the assumption that she was the operator of it. At least it may be assumed that she was aware of this and nevertheless did not take any action against it. It is up to [plaintiff] to disprove this justified premise with documentary evidence. She does not go any further than an unsigned rental agreement drawn up in Dutch, which would have been concluded between parties who do not speak Dutch. Moreover, the story about renting out the apartment rattles on all sides. According to the lease, the rental started in August 2018. However, [the plaintiff] has stated to Quion that at the time the nursery was discovered, in March 2019, she had already been renting out the apartment for twelve months. On the other hand, in her notice of objection against the inclusion of her details in the registers, her lawyer writes again that the apartment had been let since October 2018. This would have been done in order to avoid double housing costs. [plaintiff] bought a second apartment in that period. However, [plaintiff] could also have lived in the first apartment in order to avoid double housing costs. In addition, there is nothing to show that [plaintiff] bought the apartment at the [address] with the intention to live there herself and that - by not reporting that she had quit her job - she deprived Dynamic Credit of the opportunity to assess her actual income position at the time of the mortgage application. For a potential mortgage lender, it is essential that the applicant is correctly informed about his/her salary. The amount of the salary and the certainty that this will be enjoyed in the future directly determine the size of a mortgage loan.
+.7.
+The arguments of the parties relevant to the assessment of the claim are discussed below.
 The assessment
+The urgency of the matter
 .1.
-Leaving aside whether [plaintiff's name] in this case actually invokes a will of Mr. [man's name] during his lifetime to acknowledge [plaintiff's name], this will did not emerge from the documents that have been submitted. This will of Mr. [name man] to acknowledge [name plaintiff] has therefore become insufficiently plausible.
+Article 254 of the Rv provides that the judge in preliminary relief proceedings in urgent cases in which, in view of the interests of the parties, an immediate interim injunction is required, is authorized to give it. There is an urgent case in the sense referred to above if the plaintiff cannot be required to await the outcome of any proceedings on the merits.
 .2.
-The following is the starting point for the assessment. The general personality right underlying fundamental rights such as the right to respect for private life, the right to freedom of thought, conscience and religion and the right to freedom of expression also includes the right to know from which parents one descends. This right is laid down internationally in Article 7 of the Convention on the Rights of the Child, to which the Netherlands is a party. This right is not absolute and must give way to the rights and freedoms of others when these weigh more heavily in the particular case (HR 15 April 1994, NJ 1994, 608, LJN: ZC1337). In this case this right of [name of the plaintiff] is counterbalanced by the right of Mr. [name of husband] and the other family members involved to protect their personal privacy. This right is protected by EUMCR's duty of confidentiality.
-It turned out to be insufficient that the submitted body material of [name of man] was submitted by him within the framework of a medical treatment agreement within the meaning of Section 7:446 et seq. of the Dutch Civil Code. In the preliminary opinion of the judge in preliminary relief proceedings, the provisions of Section 7:457 of the Dutch Civil Code regarding the confidentiality obligation to be observed in the execution of the medical treatment agreement towards the patient are therefore not applicable. However, EUMCR's duty of confidentiality in the present case follows from Regulation (EU) 2016/79 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Ordinance/DSA) (see below 4.9), which has been applicable since 25 May 2018.
+The purpose of registration in the Incidents Register of a financial institution is - in brief - to safeguard the safety and integrity of the financial sector (Article 4.1.1 of the Protocol Incidents Warning System for Financial Institutions (hereinafter: the Protocol)). The Incidents Register is linked to an External Referral Register, which contains referral data (such as a person's name and date of birth). This register can be consulted by other financial institutions. After another financial institution has determined that a certain person is included in the External Referral Register, this institution can consult the data in the Incidents Register of the other financial institution (Article 5.1.1 of the protocol). Access to the External Referral Register includes banks and insurers. The inclusion of Referral Data in this Register therefore has potential adverse consequences for the assessment of an application submitted by [plaintiff] for, for example, the opening of a bank account, the taking out of a money loan or the taking out of an insurance policy. As a result, she cannot be expected to await the outcome of any proceedings on the merits.
+The assessment framework
 .3.
-The balance of interests to be carried out in this case should first of all take into account the aforementioned right of Mr. [name] and his other family members concerned to privacy. In that connection the Court considered as follows.
+In the Incidents Register of a financial institution, data are recorded as a result of or relating to a (possible) incident, with the aim of supporting activities aimed at guaranteeing the security and integrity of the financial sector, as evidenced by the definition given in point 2 of the protocol. According to the protocol, an incident is understood to mean an event that has, could have or has had the consequence that the interests, integrity or safety of the clients or employees of a financial institution, the financial institution itself or the financial sector as a whole are or could be at stake, such as the falsification of notes, identity fraud, skimming, embezzlement in employment, phishing and deliberate deception.
 .4.
-Mr. [name of husband] has since passed away. EUMCR has not disputed that the sisters of Mr. [naam man] never had any doubt that Mr. [naam man] is the father of [naam plaiseres]. Since the documents at issue do not show the opposite either, it has become sufficiently plausible for the judge in preliminary relief proceedings that these sisters do not regard the claimed release of their brother's DNA material to determine whether [name plaintiff] is his daughter as an invasion of their personal privacy. The conclusion is that under these concrete circumstances the right of [name of the plaintiff] to know from whom she descends, prevails over the right of Mr. [name of husband] and the other family members involved to protect their private life.
+As stated above, an External Referral Register is linked to the Incidents Register. The inclusion of personal data in these registers can be regarded as a processing of personal data to which the General Data Protection Regulation (GTC) (applicable since 25 May 2018) applies. The protocol offers sufficient guarantees for processing personal data as prescribed by the GDPR. The protocol therefore serves as a starting point when assessing whether the inclusion of [plaintiff's] personal data in the registers is justified.
 .5.
-The next question is whether this also justifies that the confidentiality obligation of EUMCR must be broken.
+Article 5.2.1 of the protocol stipulates that a financial institution must include in the External Referral Register referral data of (legal) persons who meet the criteria mentioned under a and b below, after application of the proportionality principle mentioned under c below.
+(a) The conduct(s) of the (legal) person(s) constituted, constituted or may constitute a threat to (I) the (financial) interests of clients and/or employees of a financial institution, as well as the (organisation of the) financial institution(s) themselves or (II) the continuity and/or integrity of the financial sector.
+(b) It is sufficiently established that the (legal) person concerned is involved in the conduct(s) referred to under (a). This means that, in principle, criminal offences are reported or complaints made to an investigating officer.
+(c) The principle of proportionality shall be observed. This means that security matters will determine that the importance of inclusion in the External Referral Register takes precedence over the possible adverse consequences for the person concerned as a result of the inclusion of his or her personal data in the External Referral Register.
 .6.
-The importance of [plaintiff's name] has already been discussed above.
+With respect to the processing of criminal personal data in the registers, a conviction by the criminal court is not required. However, the data must be sufficiently certain. This means that there must be such concrete facts and circumstances that they can carry a statement of evidence that qualifies as a criminal offence within the meaning of Article 350 of the Code of Criminal Procedure. This is the case if the established conduct gives rise to a heavier suspicion than a reasonable suspicion of guilt (HR 29 May 2009, ECLI:NL:HR:2009:BH4720, r.o. 4.4). This principle is also laid down in the annex to the protocol. This states: 'The basic principle is that it must be possible to demonstrate in legal proceedings that there is sufficient evidence to qualify as fraud or other improper or punishable conduct in relation to a (legal) person demonstrably involved. If one of these elements is missing, no registration should take place. They constitute the criteria set out in Article 5.2.1(a) and (b)'.
+The claim
 .7.
-With regard to the content of EUMCR's duty of confidentiality and the interest that this duty serves to protect, the Court in preliminary relief proceedings considered as follows.
+From Quion's letter of 1 July 2019 (cited above under 2.6), Quion's response to [the plaintiff's] notice of objection and Quion's explanation of this at the hearing, it appears that the registration relates to three incidents: the operation of the hemp farm in the mortgaged apartment, not using the apartment for her own occupation, and the concealment of the termination of her employment.
 .8.
-Mr. [name man] suffered from epilepsy, this is not in dispute, and at the time he participated as a test subject in a scientific study into epilepsy.
-.8.1.
-Prior to his participation in this research, Mr. [name man] signed a form with the title on 27 July 2016:
-"Patient consent form
-The ACES study: epilepsy caused by the body's own antibodies".
-The statements in this consent form for which Mr. [name man] has 'signed' include the following:
-"I have read the information letter for the test subject. I could ask additional questions. My questions have been answered enough. I had enough time to decide whether or not to participate.
-(…)
-I consent to the use of my data and body material for the purposes set out in the information letter.
-I consent to the retention of my research data 15 years after the end of this research.
-I do/do not give permission to keep my body material 15 years after the end of this research, so that in the future it may be used for research as described in the information letter.
-I want to participate in this study."
-.8.2.
-The information letter that Mr. [name man] declares to have read because of his signature of this consent form reads - quoted where relevant - as follows:
-"The ACES study (Epilepsy caused by endogenous antibodies)
-Dear Sir/Madam,
-We kindly ask you to participate in a medical-scientific research (see title). You decide for yourself if you want to participate. Before you make that decision, it is important to know about the research. Please read this information letter carefully. (...) Also read the general brochure. It contains a lot of general information about medical research. (…)
-This research is carried out in a number of hospitals and epilepsy clinics in the Netherlands, controlled by the Erasmus Medical Centre, Rotterdam.
-What is the purpose of the study?
-In recent years, several new diseases of the brain have been discovered. These
-are not common, but they are treatable. Patients with these diseases have
-special substances in their blood that cause the disease, antibodies. This can cause all kinds of
-complaints arise: epilepsy, changed behaviour, excessive movements and even
-coma. These complaints can occur alone or in combination. You will be admitted to the hospital/
-in this facility because you have epilepsy. We think that there are known and still
-are unknown antibodies that can cause epilepsy. In this study, we will examine
-looking for antibodies (known and unknown) as a cause of epilepsy.
-(…)
-What happens to your data and body material?
-The general brochure explains that the researcher collects data about you and uses them to
-confidential. This means that a limited number of people will use your data for the
-to see the research. These persons are directly involved in the investigation and are entitled to have access to the information.
-use data only for the purpose of this investigation. They may disclose such data only for the purposes of the investigation.
-without mentioning your name or other personal data about you. Your identity
-so remains a secret. The researcher saves your data body material with a code.
-This means that on the study documents and materials, instead of your name, there is only one code.
-letter-digit code. Only the researcher keeps a list of which letter-
-number code to which name belongs.
-After the study, the data is stored for 15 years. This is necessary in order to be able to do everything properly.
-check. We also want your coded blood and (possible) cerebrospinal fluid for 15 years.
-keep it. For the purpose of using your data and material for other surveys that are
-to antibodies and epilepsy. This is to make the disease even better in the future.
-to study. These studies therefore have the same purpose as the study for which they are intended.
-you are now being asked. The data and body material will not be used for
-research into another disorder or problem. It goes without saying that the
-confidentiality that we have described above apply. On the consent form
-you can tick separately whether you agree to the storage of the blood and (possibly) cerebrospinal fluid.
-(…)”.
-.8.3.
-The general brochure referred to in the information letter is the brochure from the Ministry of Health, Welfare and Sport with the title
-"Medical research General information for the subject"
-This brochure reads - quoted where relevant - as follows:
-"You have been asked to participate in a medical-scientific research. This brochure provides general information about this. The information will help you decide whether you want to take part in the study. You can decide for yourself. Please read the brochure carefully before making your decision.
-(…)
-What happens if you do want to participate?
-If you want to participate, sign a statement. This has a declaration of consent. With your signature, you say that you voluntarily participate in the research. (…)
-(…)
-What are your rights as a test subject?
-As a subject, you have rights. These are laid down in the law. The most important are:
-(…)
-Right to the protection of your data
-During the investigation, the researcher collects data about you. This data remains confidential. Your data will be given a code, and your name will be omitted. You will never find your name in a report about the study. Read more about this on page 13 under the heading 'What happens to your data? ‘.
-(…)
-What happens to your data?
-Information that the researcher collects about you during the research remains confidential. The researcher stores your data with a code. This code is used in reports about the research. Only the researcher knows which code you have.
-Reliability
-A few other people can see your data. These people check whether the survey is good and reliable. (…)
-People who can see your data are, for example:
--the research team
--the manufacturer of the product under investigation
--the ethics committee
--the security committee monitoring the investigation
--the Health Care Inspectorate
-(…)”.
+The operation of a hemp farm is a criminal offence. In order to be allowed to include this information in the registers, it must be sufficiently clear from the assessment framework outlined in 4.6 that [the plaintiff] was involved in committing that offence. This has - in the provisional opinion - proved to be insufficient. Speech must be of such concrete facts and circumstances that they can bear a statement of evidence to be qualified as a criminal offence within the meaning of Article 350 of the Code of Criminal Procedure. The mere fact that a hemp farm was found in the apartment of which [the plaintiff] is the owner, now that it must be held that [the plaintiff] (as she states and does not contradict Quion) did not live there in that period, is insufficient for that purpose. The state of affairs surrounding the letting of the apartment by [plaintiff] to the person who (according to the documents submitted by [plaintiff]) is suspected by the Public Prosecution Service of exploiting the hemp farm and the fact that [plaintiff] quit her job during the period of the mortgage application does raise questions, but are - in the preliminary opinion of the Interim Injunction Judge - insufficient to be able to conclude that there are facts and circumstances that can support a statement of evidence with regard to complicity in, or complicity with, the cultivation of hemp. For the conclusion that it has been sufficiently established that there is a criminal offence - for the time being - there is therefore no ground. As a result, this incident may not be included in the Incidents Register. The primary claim is therefore granted to the extent that it serves to remove this incident from Quion's Incidents Register.
 .9.
-As stated above, the General Data Protection Regulation entered into force on 25 May 2018.
-.9.1.
+The Court in preliminary relief proceedings considered the following with regard to the failure to use the apartment for personal occupation and the concealment of the termination of the employment contract.
-Recitals 1 and 4 of the General Data Protection Ordinance are the first to be mentioned:
+.10.
-(1) The protection of individuals with regard to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union ('the Charter') and Article 16(1) of the Treaty on the Functioning of the European Union ('TFEU') confer on everyone the right to the protection of personal data concerning them.
-(…)
-(4) The processing of personal data must be for the benefit of mankind. The right to the protection of personal data is not an absolute right, but should be considered in relation to its function in society and should be weighed against other fundamental rights in accordance with the principle of proportionality. This Regulation respects all fundamental rights as well as the freedoms and principles recognised in the Charter as enshrined in the Treaties, notably respect for private and family life, home and communication, protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and the right to cultural, religious and linguistic diversity.
-.9.2.
+That - as Quion stated - the apartment was never used by her for her own residence is disputed by [the plaintiff]. However, she does acknowledge that at some point she started living in another apartment (i.e. the apartment she bought in October 2018). She also acknowledges that - as Quion states - she quit her job before passing the mortgage deed and that she did not report this to Quion/Dynamic Credit. These are - in the preliminary opinion of the Court in preliminary relief proceedings - events as a result of which the interests of Dynamic Credit may be at stake and whose inclusion in the Incidents Register of a financial institution as Dynamic Credit is in accordance with the purpose of the Incidents Register. It is in a mortgagee's interest that all relevant information is provided by the applicant and that, if the situation has changed, this is passed on by the applicant. After all, as Quion argues, the amount of the salary and the certainty that this will be enjoyed in the (near) future determine the size of the loan. The offer also shows that Dynamic Credit reserves the right to withdraw the offer if the situation of the applicant has changed to such an extent that the previously provided information is no longer correct or complete, or if not all or wrong information has been provided. A mortgagee also has an interest in compliance by the mortgagor with the obligation laid down in the mortgage deed and the General Mortgage Conditions to occupy the collateral himself/herself, and the related obligation to properly maintain and use the collateral in accordance with the law. If these obligations are breached, the value of the collateral may be adversely affected.
-Pursuant to the AVG, the 'processing' of personal data must be based on a basis that justifies processing. This term 'processing' is defined in Article 4 under 2 of the AVG:
+.11.
-any operation or set of operations which is performed upon personal data or set of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction of data
-If the party conducting a scientific examination of the body material of Mr. [name of man], EUMCR shall, in the preliminary ruling of the Interim Injunction Judge, be deemed to be the processing party within the meaning of this article.
-.9.3.
+For the time being, the Court in preliminary relief proceedings deems it insufficiently plausible that the inclusion of these two incidents in Quion's - internal - Incidents Register is contrary to the principle of proportionality. The claim is therefore dismissed insofar as it seeks the removal of the data relating to these two incidents from Quion's Incidents Register.
-Article 9 of the AVG contains a regulation for the 'processing' of special categories of personal data. This includes genetic data. See in that respect recital 35 of the GCPSC:
+.12.
-(35) Personal data on health should include all data that relate to the health status of a data subject and that provide information on the physical or mental health status of the data subject in the past, the present and the future. This includes information on the natural person collected in the context of registration for, or provision of, healthcare services as referred to in Directive 2011/24/EU of the European Parliament and of the Council (9 ) to that natural person; a number, symbol or characteristic attributed to a natural person which is a unique identifier of that natural person for health purposes; information resulting from the testing or examination of a body part or substance specific to the body, including genetic data and biological samples; and information on, for example, disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical condition of the person concerned, regardless of its source, such as, for example, a doctor or other health professional, a hospital, a medical device or an in vitro diagnosis.
-Pursuant to Article 9 paragraph 1 of the GCC, it is prohibited to process genetic data unless one of the conditions referred to in Article 9 paragraph 2 under a-j of the GCC is met, such as the consent of the person concerned (under a), a vital interest of this person or of a third party as referred to under c (as it reads), or the consent of the person concerned (as it reads), or the consent of a third party as referred to under a-j of the GCC is not required: the processing is necessary to protect the vital interests of the data subject or of another natural person if the data subject is physically or legally incapable of giving his/her consent), an important public interest (sub g) or processing of the data that must be necessary for a medical diagnosis (sub h).
-.9.4.
+With respect to the inclusion of [plaintiff's] reference data in the External Referral Register, the Court in preliminary relief proceedings considered the following.
-The provision of the DNA material of Mr. Berkul claimed by [name of plaintiff] to enable her to find out whether she descends from Mr. Berkul cannot, in the preliminary relief judge's opinion, be based on any of the conditions referred to in Article 9 paragraph 2 under a-j of the AVG, so that EUMCR is prohibited from providing this DNA material in the manner claimed by virtue of Article 9 paragraph 1 of the AVG.
+.13.
-.9.5.
+The protocol prescribes that the principle of proportionality must be complied with. That is to say, it follows from Article 5.2.1 sub c of the protocol that the importance of including personal data in the External Referral Register takes precedence over the possible adverse consequences of this for the person whose personal data are included in the register (the data subject).
-EUMCR can therefore only be forced to provide Mr. [naam man]'s DNA material at an advanced stage, if the aforementioned interest of [naam plaintiff] in knowing whether she descends from Mr. [naam man] should prevail over the above-mentioned interest of EUMCR in confidentiality. See recital 4 of the AVG cited above.
+.14.
-.10.
+A possible adverse consequence of inclusion in the External Referral Register is that the data subject's application for a financial product, such as a bank account, a loan or insurance, is refused by a financial institution that has access to the External Referral Register.
-The rationale of the duty of confidentiality of a care provider during a medical treatment is to prevent the sick from being discouraged from seeking medical assistance because of the fear that what would turn out to be or would be entrusted to the care provider could become public if its secrecy had not been ensured. As said, the processing by EUMCR of the body material of Mr. [name of man] was not part of a medical treatment but of medical-scientific research. For example, the permission of Mr. [name man] that follows from the permission form filled in by him does not relate to a medical treatment that he had to undergo but to a medical examination in which he would participate and in which he actually participated. In the preliminary ruling of the Court in preliminary relief proceedings it therefore goes too far to assume that breach of EUMCR's duty of confidentiality in this case could deter patients from seeking medical assistance from EUMCR. The risk lurking in the event of a breach of the duty of confidentiality that applies in the context of medical scientific research is much more that the willingness of future persons (patients) to participate in this research will be adversely affected. This risk is even greater if, as in the present case, the participant has been expressly asked to give his consent prior to participation in the study and has been promised that his body material to be examined will be treated with the utmost confidentiality. Therefore, in the preliminary ruling of the judge in preliminary relief proceedings, there is a good chance that the willingness of people to cooperate in medical research would be seriously jeopardised if EUMCR were to be forced to breach its confidentiality obligation. Where scientific research is one of the core tasks of EUMCR, it has thus been given the overriding importance of EUMCR's duty of confidentiality.
+.15.
-.11.
+The Interim Injunction Judge attributes - as a preliminary opinion - a heavier weight to this possible consequence for [plaintiff] than to the interest of financial institutions in the inclusion of [plaintiff's] personal data in the External Referral Register. In this consideration the Court in preliminary relief proceedings takes into account that the conduct referred to under 4.9 ff. above - not punishable - is of relatively minor seriousness and that this conduct has not caused any disadvantage to Dynamic Credit. It is certain that there has never been a delay in the payment of interest and redemption and also that the value of the apartment has not been affected to such an extent that the proceeds of the private sale of the apartment were insufficient to be able to pay the debt of [plaintiff] to Dynamic Credit in full.
-Against this obvious interest of EUMCR in secrecy is, as said, the interest of [name of the plaintiff] to know whether she descends from Mr. [name of husband]. In the preliminary ruling of the Court in preliminary relief proceedings this interest of EUMCR must weigh more heavily, taking into account that for the time being it cannot be excluded that an investigation of persons other than Mr. [naam man], whether or not in combination with statements from persons close to Mr. [naam man] and/or certain written documents, will be sufficient for the District Court of Amsterdam to establish the parenthood of Mr. [naam man]. The claims of [name of the plaintiff] are therefore rejected.
+.16.
-.12.
+Now that the inclusion of [plaintiff's] personal data in the External Referral Register is deemed disproportionate for the time being, the second part of the primary claim is also awarded.
-If the unsuccessful party is ordered to pay the costs of the proceedings, the [name of the plaintiff] will be ordered to pay the costs. Until this judgment, these costs on the part of EUMCR are estimated at:
+.17.
-Registrar's fee € 639.00
+The Court in preliminary relief proceedings assumes that Quion will comply with the judgment and therefore sees no reason at this time to impose a penalty payment.
-lawyer's salary € 980.00
+The costs of the proceedings
+.18.
-total of € 1,619.00.
+Since both parties are partly in the right and partly in the wrong
-The decision
+the costs of the proceedings are offset, each party being ordered to bear its own costs.
-The judge in preliminary relief proceedings
+</pre>
-rejects the claims;
-orders [the name of the plaintiff] to pay the costs of the proceedings, which until this order are estimated on the part of EUMCR at € 1,619.00;
-declares this order for costs to be enforceable as a stock.
-This judgment has been rendered by A.F.L. Geerdes and pronounced in public on 12 December 2019.
-/676</pre>