Rabobank – Court Ruling (Netherlands, 2023)

Rabobank (the controller) provided a business loan of €86,000 to the data subject in 2008. In 2014, the controller terminated their financial relationship with the data subject, as the data subject was unable to meet payments on time and had exceeded their credit limit. In 2015, the data subject negotiated a new payment plan with the controller, but they were unable to maintain this. In September 2022, the data subject reached a new agreement with the controller, where the data subject paid €27,375 to the controller and the controller wrote off the remaining debt. On 6 October 2022, the controller formally waived their remaining claim against the data subject and the controller negatively registered the data subject in the national Credit Information System (CKI). Under domestic regulations, the data subject's negative registration could only be removed after five years by the controller, on 6 October 2027. On 6 February 2023 and 27 February 2023, the data subject requested the controller to remove his negative registration from the system so that he could purchase a commercial property. In response to both requests, the controller refused, noting that there were no compelling grounds to shorten the five year registration period. Following the controller's refusals, the data subject filed a claim with the District Court of Amsterdam, requesting that his negative registration be removed (erasure request). One of the grounds to exercise the right of erasure is an Article 21(1) GDPR objection to processing, where there are no overriding legitimate grounds for the processing (Article 17(1)(c) GDPR). Consequently, the Court considered the data subject's claim on the basis of Article 21(1) GDPR. The Court refused to enforce the data subject's request, as they found that the data subject had no overriding interests, rights or freedoms against the legitimate interests of the controller under Article 21(1) GDPR. The controller used Article 6(1)(f) GDPR as a legal ba