ING Bank N.V. – Court Ruling (Netherlands, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Arnhem-Leeuwarden Court of Appeal ruled that ING Bank's use of the Central Credit Information System is legal under Dutch law. The court found that the bank's processing of personal data is necessary to meet a legal obligation and serve the public interest. This decision means individuals cannot demand data deletion or object to this processing under GDPR.
What happened
ING Bank's use of the Central Credit Information System was challenged, but the court found it lawful under GDPR.
Who was affected
Individuals whose credit information is stored in the Central Credit Information System managed by ING Bank.
What the authority found
The court decided that ING Bank's data processing is necessary for legal compliance and public interest, so individuals cannot object or request deletion under GDPR.
Why this matters
This ruling clarifies that banks can process personal data for legal and public interest reasons without needing individual consent. Businesses should understand that legal obligations can override individual rights to object or erase data.
GDPR Articles Cited
The Durch Stichting Bureau Kredietregistratie (BKR), a private entity founded by banks, runs a Central Credit Information System (CKI). Dutch law requires banks to be connected to the CKI. The claimant wanted certain data to be delete. It brought a legal action based on Article 17 GDPR and Article 21 GDPR, read in conjunction with the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp). The Court of First Instance rejected the claims and dismissed the requests. Thus, the plaintiff appealed the decision before the Court of Appeal. The Arnhem-Leeuwarden Court of Appeal found that the registration of personal data in the CKI of the BKR does constitute processing of personal data under Article 6(1)(c) GDPR. In this instance, this means that the processing at stake is necessary for the compliance with a legal financial obligation and leads to several consequences. First, whenever the legal basis of the processing is necessary for compliance with a legal obligation each Member State may introduce more specific provisions according to Article 6(2) GDPR. In the present case, the processing is carried out under a national legal obligation and for the performance of a task carried out in the public interest since this system is the only credit registration system in the Netherlands. In addition, insofar the compliance with a legal obligation constitutes the primary the legal basis under Article 6(1)(c) GDPR, the Court found that the data subject cannot exercise his right to object pursuant to Article 21(1) GDPR. Secondly, the right to erasure does not apply to the extent that the processing is necessary for the compliance with a legal obligation carried out in the public interest, by virtue of Article 17(3)(b) GDPR. Indeed, it further is justified that the task carried out in the public interest under Article 6(1)(e) GDPR does not constitute an appropriate and adequate legal basis for all the personal data processed. Lastly, the Court recalled that other
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for ING Bank N.V. in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. ING Bank N.V. - Netherlands (2019). Retrieved from cookiefines.eu
Last updated: