Tietosuojavaltuutetun toimisto (Finland) - 8314/182/20
From GDPRhub
(Redirected from Tietosuojavaltuutetun toimisto - 8314/182/20)
| Tietosuojavaltuutetun toimisto - 8314/182/20 | |
|---|---|
 | |
| Authority: | Tietosuojavaltuutetun toimisto (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 5 GDPR |
| Type: | Advisory Opinion |
| Outcome: | n/a |
| Started: | |
| Decided: | 18.02.2021 |
| Published: | 16.03.2021 |
| Fine: | None |
| Parties: | Suomen Asiakastieto Oy |
| National Case Number/Name: | 8314/182/20 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Finnish |
| Original Source: | Finlex (in FI) |
| Initial Contributor: | V |
The Finnish DPA ordered Suomen Asiakastieto Oy to remove a payment default entry from their credit information registry which no longer had a legal basis to be be retained.
English Summary
Facts
X
Dispute
X
Holding
X
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
Correction of information in the credit register Thing Correction of information in Suomen Asiakastieto Oy's credit information register Applicant 's claims and reasons By a request for action made on 21 October 2020, the applicant has requested the Data Protection Commissioner to issue an order to Suomen Asiakastieto Oy (hereinafter the “registrar”) to remove the default entries in the applicant's credit information pursuant to section 13 of the Credit Information Act (527/2007). At the time the complaint was initiated, the applicant's credit information contained four information on defaults established by the authority pursuant to section 13 (1) (3) of the Credit Information Act, which had been established by unilateral court judgments. The applicant has stated that the valid default entries are related to the applicant's business as a private trader. According to the applicant, the insolvency entries have resulted from the bankruptcy in which the applicant had previously been declared a private trader. The bankruptcy was canceled in 2017 by a decision of the district court. In the applicant's view, the default entries must be removed in breach of the Credit Information Act, as they are not related to the applicant's personal finances and the entries are due to errors in the bankruptcy proceedings of the applicant's company. Statement received from the controller The matter has been clarified by the registrar on 16.11.2020, 7.1.2021 and 21.1.2021. According to the report received from the registrar on 16 November 2020, the applicant's credit statement contains the following entries: 3/2020, unilateral judgment, creditor D 11/2017, unilateral judgment, creditor C 10/2017, unilateral judgment, creditor B 10/2017, unilateral judgment, creditor A In the report issued, the controller has stated that the controller considers that the conditions for the storage and retention of subscriptions are based on the Credit Information Act. The applicant has informed the Office of the Data Protection Officer that he has provided the controller with information on pending recovery applications in the district court in connection with unilateral judgments. According to the report received from the registrar on 7 January 2021, the registrar has been informed of the recovery application in a case concerning three default entries stored in the applicant's credit data. Information on these matters has been removed from the applicant's credit information. The controller has stated that the controller removes the default entries at least temporarily when the controller receives information about the recovery application. According to the controller, the data will be deleted in such cases based on the controller's own policy. According to the registrar, in the case the applicant has paid the debts that caused the defaulted entries and thus acknowledged the receivables as correct. In the controller's view, the data subject has used the recovery only to request the entries to be deleted, knowing the controller's practical data deletion. The controller has asked the EDPS's office to comment on whether the default due to a unilateral judgment should be removed as soon as the controller is informed of the recovery application or only after the case has been re-examined in court and the debt action has been dismissed. In addition, the controller has inquired whether the default entry should be deleted as a result of the recovery application, if the debt for the default entry has been paid and the claim thus obtained has been accepted as correct. It is not known to the controller that recovery has been sought in a case concerning one of the default entries stored in the applicant's credit data. Therefore, the applicant's credit statement still has the following entry: 11/2017, unilateral judgment, creditor C In accordance with the report received from the registrar on 21 January 2021, the payment default entry dated 11/2017 is subject to an extension basis in accordance with section 18 (3) of the Credit Information Act. 2/2018 information on the bankruptcy application has been stored in the applicant's data. Bankruptcy has remained the same after the creditor has withdrawn his bankruptcy application. According to the registrar, the information on bankruptcy has been removed from the credit information register 6/2018 in accordance with section 18 (1) (1) of the Credit Information Act. Statement received from the applicant The applicant lodged its defense on 13 January 2021 and 25 January 2021. The applicant has stated that the applicant's company had been declared bankrupt 6/2017 by a decision of the District Court. The district court canceled bankruptcy 7/2017. The applicant considers that the bankruptcy never became final because the bankruptcy was revoked pursuant to Chapter 7, Section 13 of the Bankruptcy Act and a valid reason was given for the revocation. Prior to bankruptcy, the applicant had filed a corporate restructuring application. According to the applicant, a temporary injunction had been issued against the applicant's debts and reorganization proceedings had been initiated. However, the reorganization proceedings had ceased after the decision to initiate bankruptcy. The applicant has stated that the debt restructuring proceedings against the applicant failed because the liquidator appointed to the reorganization proceedings pursuant to section 8 of the Company Reorganization Act (47/1993) did not take into account the applicant's business Therefore, a new liquidator was appointed to the proceedings by a court decision and the previous liquidator was relieved of his duties. The applicant considers that the unilateral judgments handed down in the cases concerning the applicant were unlawful, as they were caused by the fact that the withdrawn bankruptcy application had terminated the reorganization proceedings against the applicant. The applicant has stated that he tried to negotiate payment schedules with creditors. The applicant has stated that he has applied for restitution on unilateral judgments of the district court for justified reasons. The applicant has stated that the entries in the credit register should be deleted under the same conditions after the annulment of the judgment as after the judgment was given. The applicant has stated that the information on the annulment of the judgment does not enter the credit register under the same conditions as the information on the judgment. The applicant has stated that in the past one unilateral judgment of the district court concerning the applicant has been overturned as a result of the applicant's application for recovery. However, the annulment of the judgment was not notified to the credit register until the applicant contacted the district court. The applicant has further stated that no one monitors the fact that the information in the credit record is kept up to date in situations where the judgment which caused the credit entry has been set aside. In the applicant's view, the case is still pending before a final judgment has been given in the readmission case, as the application for readmission seeks the annulment of the judgment or an appeal against the judgment. The applicant considers that the remaining entry in the applicant's credit information (11/2017, creditor C) cannot be subject to the extension criterion due to the bankruptcy application dated 2/2018. According to the applicant, the bankruptcy application was never notified and the bankruptcy never became final. The applicant has stated that the bankruptcy application dated 2/2018 was filed with the district court by a liquidator appointed to the debt restructuring proceedings against the applicant, who was relieved of his duties by a court decision without any compensation being imposed on the liquidator. The applicant considers that a mere bankruptcy application is not a sufficient ground for extending the credit information subscription, but that bankruptcy is always imposed by a decision of the district court. Legal issue A matter concerning the correction of information stored in the credit information register is pending. The question is whether the default entries entered in the credit information register concerning the applicant are incorrect for the interpretation of sections 6, 13 and 18 of the Credit Information Act (527/2007) within the meaning of section 31 of the Act. Decision and justification of the EDPS 1. Extension of a default due to a bankruptcy application In accordance with section 35 of the Credit Information Act, the registrar is ordered to correct the information concerning the applicant in the credit information register. Reasoning On the deposit and retention period of information on a unilateral judgment It is necessary to assess whether there are grounds for maintaining the default note dated 11/2017 (creditor C). Pursuant to section 18 (1) (6) of the Credit Information Act, default information identified by an authority must be deleted no later than three years after the information has been entered in the register. Pursuant to section 18 (2) of the Credit Information Act, if the registrar has become aware of the settlement of a receivable due to which the entry referred to in subsection 1 (6) has arisen, the information shall be deleted within two years of the entry. Pursuant to section 18 (3) of the Credit Information Act, it is not necessary to delete the entry referred to in subsection 1 (1) and (6) from the register if a new default entry has been made in the register before the deadline for deleting the previous entry has expired. However, the entry concerning the default referred to in subsection 1 (6) shall be deleted no later than four years after it was made. The Office of the Data Protection Commissioner has taken a position on coordinating the basis for the retention of a default note, ie the payment of a receivable, and the extension basis, ie the deposit of a new subscription, in accordance with section 18 of the Credit Information Act presented above. In accordance with the statement of the Data Protection Supervisor's Office, if the retention period for a default note has been extended to four years (Section 18 (3) of the Credit Information Act), payment of the claim (Section 18 (2) of the Credit Information Act) does not shorten the default period. After a new default note has been issued to the data subject which has extended the retention period of the previous default note, the settlement of that previous claim shall no longer have the effect of shortening the retention period. On the Deposit of Bankruptcy Information Pursuant to section 13 (1) (1) of the Credit Information Act, the information entered in the bankruptcy and corporate reorganization register referred to in the Act on the Bankruptcy and Corporate Restructuring Register (137/2004) may be stored in the credit information register as bankruptcy information. Pursuant to section 3 of the Bankruptcy and Corporate Reorganization Register Act, once a bankruptcy application has been filed, the court must enter the information about the bankruptcy application in the register. Pursuant to section 18 (1) (1) of the Credit Information Act, bankruptcy information must be deleted from the credit information register within one month of the bankruptcy and corporate reorganization information being deleted due to rejection or inadmissibility of the bankruptcy application or cancellation. Pursuant to section 6 (1) of the Credit Information Act, only information obtained from reliable sources and which is necessary and appropriate to describe the data subject's solvency or willingness to pay or ability to meet his or her obligations may be used and otherwise processed as credit data. Pursuant to Chapter 1, Section 4 of the Bankruptcy Act (120/2004), bankruptcy begins when a debtor is declared bankrupt by a court decision. Pursuant to Chapter 2, Section 1 of the Bankruptcy Act, a debtor who is insolvent may be placed in bankruptcy, unless otherwise provided by the Bankruptcy Act or elsewhere. For the purposes of this Act, insolvency means that the debtor is, other than temporarily, unable to pay his debts when they fall due. Consequently, bankruptcy is conditional on the insolvency of the debtor. Assessment of the case In the present case, it must be determined whether the default on the applicant's credit records is appropriate to describe the applicant's ability to pay, willingness to pay or ability to meet its obligations. In the present case, the default entry in the applicant's credit record (dated 11/2017, creditor C) has been entered in the credit record following a unilateral judgment in a debt case. It would be a matter of decision whether there are still grounds for maintaining the default note or whether the default note should be removed from the applicant's credit records. In accordance with the applicant's credit information extract from the registrar, the debt for the default payment has been paid and the registrar has received information on the payment of the debt on 8/2019. However, the registrar has stated that there is a ground for renewal, as a new default entry for the applicant has been made in the register before the deadline for deleting the default entry (dated 11/2017, creditor C) has expired. In the case, the bankruptcy case concerning the applicant has remained with it by the decision of the District Court 2/2018. Pursuant to the decision, the creditor who filed for bankruptcy has withdrawn his bankruptcy application and the application has not been notified to the debtor. In the case, the bankruptcy information must have been deleted from the applicant's credit information one month after the information has been deleted from the bankruptcy and corporate reorganization register (section 18 (1) (1) of the Credit Information Act). Credit information is subject to the condition that the information must be necessary and appropriate to describe the data subject's solvency or willingness to pay. In this case, the bankruptcy case has remained with it and the court has failed to examine whether the conditions for bankruptcy were met or whether the debtor was insolvent. The Data Protection Officer considers that, taking into account the provisions of section 6 of the Credit Information Act, a default note resulting from a bankruptcy case and a canceled bankruptcy application may not extend a previously deposited default note in accordance with section 18 (3) of the Credit Information Act. As the extension criterion is not applicable in the present case, the default note deposited on 11/2017 should have been deleted in accordance with section 18 of the Credit Information Act no later than three years after entry in the register or earlier if the controller has received information on payment. In the view of the EDPS, there are no longer grounds for maintaining the default note (creditor C) deposited on 11/2017, as the extension criterion in section 18 (3) of the Credit Information Act cannot be applied to the maintenance of the subscription. The Data Protection Commissioner shall issue an order to the data controller referred to in section 35 of the Credit Information Act to remove the payment default entry (creditor C) concerning the applicant deposited in 11/2017 from the applicant's credit information. 2.Deletion of a default due to a retrial The EDPS considers that there are no grounds for keeping the default note in the applicant's credit information in accordance with sections 6 and 13 of the Credit Information Act, as the unilateral judgment has been overturned. Reasoning According to the information received by the Office of the Data Protection Commissioner, the District Court has issued a decision 10/2020 in the matter following the applicant's readmission application. Pursuant to the decision, the unilateral judgment of 10/2017 on the action of creditor A is set aside. According to the decision, the applicant stated in his recovery application that the amount of the debt was not real, that the parties had agreed to pay the debt and that the applicant had paid the debt in accordance with the agreement. In its reply, creditor A stated that it had settled the matter as submitted by the applicant and that it no longer had any claims against the applicant. In accordance with the resolution, the case concerning the debt / service contract is left to it and the unilateral judgment is set aside. It is to be assessed whether there are grounds for maintaining the default note dated 10/2017 (creditor A). Pursuant to section 13 (1) of the Credit Information Act, information on non-payment established by a final court judgment or a unilateral judgment may be stored in the credit information register as personal default information identified by the authority. In his decision EOAK / 945/2016, the Parliamentary Ombudsman stated that if the obligation to pay has been reasonably challenged in court in such a way that it may have an effect, the Ombudsman does not, in the Ombudsman's view, satisfy the condition that the entry be insolvent or insolvent. In the present case, the unilateral judgment in the debt case which caused the insolvency entry has been set aside by a decision of the district court. The case concerning the debt is left to it in accordance with the judgment of the district court. The EDPS considers that there are no grounds for maintaining the default note in accordance with Sections 6 and 13 of the Credit Information Act, as the unilateral judgment has been overturned and no default of payment has been established by a final court judgment. According to a report received by the EDPS from the controller, the controller has already temporarily deleted the default entry in question as a result of the initiation of the recovery application. Therefore, there is no need to issue an order to the data controller referred to in section 35 of the Credit Information Act to delete the information concerning the applicant from the applicant's credit information, as the default note has already been deleted. Applicable law Credit Information Act Section 6, Section 13, Section 18, Section 31, Section 35 Bankruptcy Act Chapter 1 Section 4, Chapter 2 Section 1 Appeal According to section 25 of the Data Protection Act (1050/2018), this decision may be appealed to an administrative court in accordance with the provisions of the Act on Administrative Proceedings (808/2019). Guidance of the Data Protection Officer Impact of pending recovery requests on the retention of default entries The applicant has stated that he has filed recovery applications in the district court for unilateral judgments in respect of which insolvency entries have been recorded in the applicant's credit records. According to the registrar, in the case the applicant has paid the debts that caused the defaulted entries and thus acknowledged the receivables as correct. In the controller's view, the data subject has used the recovery only to request the entries to be deleted, knowing the controller's practical data deletion. The controller has asked the EDPS's office to comment on whether the default due to a unilateral judgment should be removed as soon as the controller is informed of the recovery application or only after the case has been re-examined in court and the debt action has been dismissed. In addition, the controller has inquired whether the default entry should be deleted as a result of the recovery application, if the debt for the default entry has been paid and the claim thus obtained has been accepted as correct. The controller has stated that, in accordance with its own practice, the controller has temporarily removed default entries due to unilateral judgments after receiving information about recovery applications related to these judgments. Therefore, the EDPS considers that it is not necessary to assess the grounds for rectifying the information in accordance with Sections 31 and 35 of the Credit Information Act. The EDPS provides general guidance on the storage and retention of credit information. Effect of debt repayment The above-mentioned decision of the District Court following the applicant's application for recovery stated that the applicant had paid the debt which was the subject of a unilateral judgment. In accordance with the resolution, the unilateral judgment was set aside and the debt / employment case was left to it. It would appear that, following a request for recovery, a unilateral judgment can also be set aside in cases where the debtor has paid the debt which is the subject of the debt judgment. Consequently, it would not be possible to conclude from the payment of the debt that the unilateral judgment would remain final. When assessing the effect of the payment of a debt, attention should also be paid to the provisions concerning the retention period of default notes pursuant to section 18 of the Credit Information Act, on the basis of which the payment of a debt has, in principle, a shortening retention period. In accordance with the preliminary work of the Credit Information Act (HE 241/2006, p. 40), the provisions of the Credit Information Act are intended to encourage debtors to pay their debts and thus to support general payment morale. Processing of recovery applications by the courts The application for recovery is provided for in the Code of Judicial Procedure (4/1734). Pursuant to Chapter 12, Section 15 of the Code of Judicial Procedure, a party against whom a unilateral judgment has been given has the right to seek recovery in the court which has given the unilateral judgment. Recovery shall be requested in writing within 30 days of the date on which the applicant for recovery is informed of the unilateral judgment in the presence of a foreclosure or otherwise proven. If the unilateral judgment was given because the party did not comply with the request to reply in writing or to appear before the court, the application must state the reason for changing the judgment which could have been relevant to the decision. Where a unilateral judgment has been given because a party has not submitted a written statement setting out his views on the issues raised in the request, his views shall be set out in the application for recovery. It has been stated in the preliminary works of the trial (HE 15/1990 vp, p. 97) that by imposing the rather strict requirements described above on the application for readmission, the aim has been to prevent the possibility of using recovery to prolong the proceedings. It is for the court to assess the claims for recovery. The Office of the Data Protection Officer is not competent to assess whether there have been valid reasons for the request for recovery and whether the request for recovery fulfills the conditions laid down for it by law. However, the Office of the Data Protection Officer has been informed by the District Court that pending recovery cases concerning the applicant will not be resolved in the near future. Therefore, before processing applications, the controller should make at least a temporary decision on the retention or deletion of the applicant's credit records. According to Section 3 (1) (1) of the Credit Information Act, credit information means information concerning the solvency or willingness to pay of a natural person or company or otherwise describing the ability of a person or company to meet its obligations and used for granting or supervising credit. Pursuant to section 13 (1) (3) of the Credit Information Act, information on non-payment established by a final court judgment or a unilateral judgment may be stored in the credit information register as personal default information identified by an authority. In accordance with the preliminary work of the Credit Information Act (HE 241/2006, p. 36), the validity requirement has sought to ensure that disputed debt claims do not give rise to a default or threat of default until the dispute has been resolved in court. An exception to the requirement of the validity of a judgment is made by a unilateral judgment. Pursuant to section 6 of the Credit Information Act, only such information may be used as credit information that is necessary and appropriate to describe the data subject's solvency or willingness to pay or the ability to meet his or her obligations. The EDPS also refers to the position of the Parliamentary Ombudsman (EOAK / 945/2016) that if an obligation to pay has been reasonably challenged in court in a way that may have an effect, the entry is in principle not appropriate to indicate the data subject's insolvency or willingness to pay. In addition, the EDPS refers to good credit practice. Pursuant to section 5 of the Credit Information Act, a credit information provider must exercise due diligence in its operations and ensure that: 1) the quality of credit information, the exercise of registered access rights and the information security and control of the processing of information systems are properly taken care of; 2) the protection of the privacy of data subjects is not restricted without a ground provided by law; 3) the right of data subjects to be assessed on the basis of correct and relevant information is not compromised. It would appear that the controller has two options for dealing with a pending recovery application: 1. The controller shall not correct the information in the data file of the data subject in the light of a pending unilateral recovery order. The default note resulting from a unilateral judgment will be retained in the applicant's credit records until the recovery application has been processed in court. In this situation, it is possible that the registrar retains in the applicant's credit information a default note that does not meet the conditions set for the default entry, e.g. uncontested liability for payment. It would appear that the processing times for recovery applications in the courts vary. If the processing time becomes long, it may lead to a situation that is unreasonable for the data subject if the court eventually ends up setting aside the unilateral judgment. 2. The controller shall correct the data in the data file of the data subject as soon as he becomes aware of a pending recovery application against a unilateral judgment. The registrar shall make a decision on the deposit of the default note once a court decision has been issued in the case concerning the application for recovery. In this situation, it is possible that a credit default entry that could have been retained by the controller in accordance with the provisions of section 18 of the Credit Information Act concerning retention periods may be deleted, at least temporarily, from the data subject's credit records. The purpose of the provisions of the Credit Information Act is that the information stored in the credit information register and passed on from there gives the most accurate picture of the data subject's ability to manage its obligations. In line with the preliminary work on the Credit Information Act, the regulatory framework of the Credit Information Act focuses on the use of preventive measures. According to the proposal, such means include the regulation of register data and the data subject's rights of access and control. The precautionary approach has been adopted in line with the preliminary work of the law, as data subjects registered in credit information activities - especially consumers and smaller companies and their responsible persons - are at a disadvantage vis-à-vis credit information providers and business lending companies. Data Protection Ombudsman Office solution has held that if the credit information law interpreting the apparent ambiguity, should the Credit Information Act to interpret the provisions of the law protecting the purpose of taking into account the credit information over an activity for the benefit of the disadvantaged party consumer. This interpretation is also supported by the data subject's right under Section 5 of the Credit Information Act to be assessed on the basis of correct and relevant information. The EDPS also emphasizes now the case in question the protection of the weaker party, ie the data subject. In addition, the EDPS recalls that the controller must also ensure in its procedures for recovery applications that data subjects are treated equally in the processing of credit data in accordance with section 11 of the Credit Information Act. This DPO control cannot be appealed.
