ING – Court Ruling (Netherlands, 2022)

The data subject was registered at 'Bureau Krediet Registratie' (BKR, an agency for debt registration) by a bank (controller). The registration meant the data subject had a high risk profile. This registration would make it harder for the data subject to receive loans. According to this registration, the end date of the data subject's debt was 22 September 2020. The data subject stated various reasons for the fact that she had been in debt during this time, such as a failed relationship and issues at work. The data subject purchased a house on 19 July 2022. She stated that she needed financing quickly, and demanded that the controller would delete the credit registration at the BKR. She stated that she had regained her financial stability since 2020 and would move to a better house, which was the reason why she needed the mortgage. The controller declined to delete the registration. It stated that it didn't decide in the data subject's favour after conducting a balancing exercise. The District Court of First Instance of Amsterdam noted that the controller had rejected a request from the data subject according to Article 21 GDPR. The court stated that under Article 21(1) GDPR, a data subject has the right to object to processing if they provide concrete reasons for their 'specific situation'. The data subject has to prove the facts surrounding this specific situation when necessary. Controllers on the other hand must provide their legitimate interest when a data subject makes a claim under Article 21(1) GDPR. It must balance its own compelling legitimate interests against the fundamental rights or freedoms and interest of the data subject. The court held that this balancing exercise could also include circumstances which occurred after the credit registration. The court held that the controller had two compelling legitimate interests: (1) to warn other creditors of the risk and (2) protecting the consumer against accumulating too much debt. The data subject