HOIST FINANCE AB – Court Ruling (Netherlands, 2021)

Complainant’s debt at the predecessor of Hoist Finance was claimed by Hoist on 5 July 2006 because payment arrears. On 8 May 2006 a record of the payment irregularities was made in the Stichting Bureau Kredietregistratie (BKR register): code “A” was added to complainant’s name. On 28 June 2006 an additional code 2 was added to the registration, which mark the existence of a claimed debt. After the decision of the District Court of Groningen, the complainant agreed on a payment arrangement to pay the debt. On 1 June 2017 a code 3 was added to the complainant’s BKR registration to signify the payment agreement. The entire debt was paid on 27 June 2017. On 17 July 2020 Hoist Finance notified the complainant that it would have the 3-code removed from his BKR registration in response to the complainant’s request. On 10 September 2020 another BKR registration deletion request was submitted, but Hoist Finance rejected it on 21 September 2020. Complainant claims that codes “A” and “2” must be removed from his registration because he is disproportionately affected by it. He is in the process of buying a house and he cannot get his mortgage approved. Complainant also points out that he hasn’t had any debts for 3 years. Hoist Finance disagrees: the complainant did not submit his objection to the rejection to Court within the legal term of 6 weeks (under Article 35(2) UAVG), which makes his request inadmissible. Heist Finance also argues that the complainant does not have an urgent interest, his A2 registration should remain for the term of 5 years and that the deletion request is not sufficiently substantiated. In particular, the reason for maintaining the registration is that the complainant has had financial problems for a long time, which means that lenders still require protection in this case. The Court considered that there is doubt about whether Hoist Finance as a participant in the credit registration system makes credit registrations under Article 6(1)(c) or Article 6(1)(f) of the GDPR. If is also unclear whether the right to objection applies to BKR registrations and how Article 35(2) of the GDPR Implementation Act should be applied. The Court has mentioned three recent judgements. Because of this uncertainty the Court is referring the following questions for the Supreme Court: 1. Should the processing of concrete personal data by a credit institution, by means of an individual registration in the system of the BKR, be assessed against the provisions of Article 6(1)(c) of the GDPR, or Article 6(1)(f) of the GDPR, or both provisions? 2. Does the answer to question 1 mean that a. the person whose personal data have been recorded is not entitled to invoke the right to erasure referred to in Article 17 of the GDPR? b. the person is not entitled to a right of objection as referred to in Article 21 of the GDPR? 3. If the answer to question 2.b. means that no right of objection as referred to in Article 21 of the GDPR exists in the case of a BKR registration, does that mean that Article 35 of the GDPR Implementation Act plays no role in the legal proceedings to delete that registration?