HOIST FINANCE AB – Court Ruling (Netherlands, 2021)

This case concerns an interlocutory judgment in the case [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2021:174&showbutton=true&keyword=C%2f13%2f694440%2fKG C/13/694440/KG ZA-20-1118 MvW/JE dated 21 January 2021], in which the interim relief judge of the District Court of Amsterdam referred questions to the Dutch Supreme Court for a preliminary ruling pursuant to Section 392 RV. Controller is Hoist Finance. The data subject had taken out a loan with the controller. The controller claimed this credit after payment arrears had occurred. Because payment arrears had occurred, the data subject was registered in the Central Credit Information System (CKI) of the Credit Registration Office (BKR) with a special code "A". This special code was then adjusted in the following months do display that the claim had been claimed, and that the amount exceeded a certain threshold. After the debt had been settled, and the processor notified the controller of this, the controller ensured the data subject that it would have the entry removed from the BKR registration, which indicated that the amount of the claim exceeded a certain threshold. Because the controller did not comply with the request, the data subject submitted another request, which was rejected by the controller. The District Court of Amsterdam referred the following preliminary questions were put to the Supreme Court: 1.     Must the processing of specific personal data by a credit institution, by means of an individual registration in the system of BKR, be assessed in accordance with the provisions of Article 6(1)(c), Article 6(1)(f) GDPR, or both provisions? 2.     Does the answer to Question 1 mean: a)      that the person whose personal data have been recorded is not entitled to invoke the right to erasure provided for in Article 17 GDPR? b)      that person is not entitled to a right of objection as referred to in Article 21 GDPR? 3.      If the answer to Question 2b means that, in the case of a BKR registration, there is no right of objection within the meaning of Article 21 GDPR, does that mean that Article 35 of the Implementing Act General Data Protection Regulation (UAVG) plays no role in the legal proceedings to have that registration removed? The Supreme Court decided that Article 6(1)(c) GDPR cannot serve as a legal basis for the processing of personal data in the CKI of the BKR, and that such processing must be examined in accordance with Article 6(1)(f) GDPR. The answer to the second question was therefore that the data subject whose personal data have been registered with the BKR, is entitled (a) to erasure as referred to in Article 17 GDPR and (b) to the right of objection as referred to in Article 21 GDPR. The first question To answer the first preliminary question, the Supreme Court first assessed whether there was a legal obligation to process the personal data, and examined Article 4:32 (1) of the Financial Supervision Act (Wft) which creates this legal obligation. This provision prescribes that a creditor, in this case the controller, participates in the credit registration system. Article 4:34 of the same Act contains the duty of care to prevent excessive lending and the investigation of the financial position of the data subject. In the Netherlands, the performance of these duties by lenders is translated into registration in the BKR's CKI. The CKI, however, has no legal basis. It is based on self-regulation by the financial sector, which is accepted by the legislator. Article 3(4) of the CKI General Regulation states that the processing of personal data in the CKI is based on Article 6(1)(f) GDPR, because the processing is necessary to serve the legitimate interests of the BKR and its business customers. Furthermore, the Supreme Court assessed whether the processing could be based on Article 6(1)(c) GDPR, because Articles 4:32 and 4:34 Wft oblige credit providers to participate in, and consult a credit registration system. The Court noted that Article 6(3) GDPR read in conjunction with Recital 41, requires that the Member State legislation, in such a case, "should be clear and precise and its application should be foreseeable to persons subject to it". The provisions do not suffice this requirement, since it is not specified which personal data must or may be registered in the CKI, what the conditions for such registration are, and under what conditions and within what time limits, personal data must be deleted. This is all regulated in the CKI regulations, but these regulations have no legal basis. Therefore, these provisions do not create a legal obligation within the meaning of Article 6(1)(c) GDPR. The second and third question Since Article 6(1)(f) GDPR is the legal basis for the controller's processing of the personal data in the CKI, the answer to the second preliminary question is therefore, that the data subject whose personal data have been registered in the CKI is entitled exercise his right to erasure, Article 17 GDPR, and right to object, Article 21 GDPR. The third question will not be discussed since it is based on the assumption that there is no right of objection.