ING Bank N.V. – Court Ruling (Netherlands, 2024)

In 2003, the data subject opened an account with revolving credit at a Dutch bank, ING Bank N.V. (the controller). In October 2006, the data subject had a delay in the payment of his credit. In December 2006, the controller terminated the data subject’s contract and claimed payment of the then outstanding debt of €27,985.63. In 2007, the data subject made a payment arrangement, but ceased to honour this arrangement after paying only a few instalments. The controller sent letters requesting payments in 2015, 2017 and 2019 to the data subject. On 23 March 2023, the data subject successfully invoked the statute of limitations. The data subject’s balance deficit was registered by the controller in the Central Credit Information System (“Centraal Krediet Informatiesysteem – CKI”), which is administered by the Central Credit Registration Office (“Bureau Krediet Registratie – BKR”). The controller is obligated under [https://wetten.overheid.nl/BWBR0020368/2024-07-10 Article 4(32) of the Dutch financial Supervision Act] (“Wet financieel toezicht – Wft”) to participate in the Central Credit Information System. The aim of the credit registration is twofold: on the one hand to protect consumers from over-indebtedness, and on the other hand to protect credit providers from borrowers who have been found to be unable or unwilling to repay their loans. The workings of the CKI is laid down in the Dutch General Regulations CKI (“Algemeen Reglement CKI – AR”), including that the retention period is five years after fulfilling the debts. In this case, the retention period started when the data subject invoked the statute of limitations, thereby writing off his debts. The data subject then requested the controller to erase the registration. The controller did not comply. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The data subject requested the court to order the controller to erase the registration in the CKI. The data subject argued that their interests in erasing this registration outweighed the interests of the controller. The data subject lived in small social housing that does not allow for all his three kids to live there. This is why the data subject wanted to buy a house, but could not get a mortgage due to the registration in the CKI. The data subject argued that he had a stable financial situation as he had a permanent employment contract for an indefinite period and savings of around €23,000.00. The controller argued that there was not an urgent interest of the data subject as the data subject had housing to live in. Moreover, the controller suffered nearly €30,000 in damages because the data subject did not repay the loan and was successful in invoking the statute of limitations. The controller argued that if registration was removed, another credit provider would mistakenly think that the data subject had a clean credit history. The court held that the controller processed personal data as part of registering the personal data of the data subject in the CKI with the legal basis of legitimate interests under Article 6(1)(f) GDPR. The court held further that under Article 21(1) GDPR, the data subject has the right to object to processing of his personal data on the basis of Article 6(1)(f) GDPR at any time on grounds relating to his particular situation and the controller must then cease processing, unless it puts forward compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject. The court then performed a balancing of interests. The court also took into account that with the passage of time after registration in the CKI, the interests of the data subject will increasingly weigh more. The interests of the data subject to obtain a mortgage to provide a place for his children that is now not possible in his current rental house was found to be a concrete interest for removing the registration in the CKI. The court noticed that there was no information about other debts of the data subject, in any case not after invoking the statute of limitations. The court also noticed that the data subject was financially stable and therefore found that there are no concerns about the data subject’s recent financial past. Moreover, the five-year retention period started on 23 March 2021 when the data subject invoked the statute of limitations. Thus, only two years were left. The court agreed with the controller that the five-year retention period was intended, among other things, to protect other credit institutions by informing them with the recent financial past of a registered person. However, as this is about the recent financial past, that is also the reason why the registration is removed after five years in any case (no matter how serious the default or how large the write-off may have been). The court found that the controller did not provide sufficient arguments to uphold the remaining two years of the retention period to protect the data subject from over-indebtedness and other financial problems or to protect other lending institutions. The court thus held that the interests of the data subject outweighed the interests of the controller. The court ordered the controller to erase the registration of the data subject in the CKI within 14 days and to pay the costs of the proceedings.