Achmea – Court Ruling (Netherlands, 2019)

The applicant requested the Court to remove his credit registration from two bank databases, Achmea and ABN AMRO, because these registrations prevented him from obtaining loans and leases. The claimant based his application on Article 8 of the ECHR and Article 7 of the Charter. In their defence, the banks argued that the processing of the personal data was not based on the data subject’s consent under Article 6(1)(a) GDPR but on compliance with legal obligations under Article 6(1)(c) GDPR and that the data subject did not have the right to object to the processing. The Court had to balance the different interests at stake to assess whether the banks' refusal to erase the personal data was legitimate. First of all, the Court described that the objective of credit registration was to protect consumers against excessive lending and to protect providers of credit against borrowers who have not proven their ability to repay the loans. Then, the Court found that the credit registration system necessarily involves the processing of personal data, protected by Article 16(2) TFEU. It found that personal data can be collected only for specific purposes listed exhaustively under Article 6(1) GDPR. In addition, the Court stressed the difference between the right to object to processing on the one hand, which applies where the processing is based on Article 6(1)(e) GDPR or Article 6(1)(f) GDPR, and the right to erasure on the other hand, which applies even if the processing is based on Article 6(1)(c) GDPR. The Court confirmed that in this case the processing was based on Article 6(1)(c) GDPR and that the claimant could ask for the erasure of his personal data. However, the controllers could still refuse the erasure on the basis of compelling legitimate grounds which would outweigh the interests, rights and freedoms of the data subject. It found that only the “negative” credit registrations prevented the Claimant from obtaining loans and leases but that they were necessar