ING Bank N.V. – Court Ruling (Netherlands, 2019)

The Durch Stichting Bureau Kredietregistratie (BKR), a private entity founded by banks, runs a Central Credit Information System (CKI). Dutch law requires banks to be connected to the CKI. The claimant wanted certain data to be delete. It brought a legal action based on Article 17 GDPR and Article 21 GDPR, read in conjunction with the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp). The Court of First Instance rejected the claims and dismissed the requests. Thus, the plaintiff appealed the decision before the Court of Appeal. The Arnhem-Leeuwarden Court of Appeal found that the registration of personal data in the CKI of the BKR does constitute processing of personal data under Article 6(1)(c) GDPR. In this instance, this means that the processing at stake is necessary for the compliance with a legal financial obligation and leads to several consequences. First, whenever the legal basis of the processing is necessary for compliance with a legal obligation each Member State may introduce more specific provisions according to Article 6(2) GDPR. In the present case, the processing is carried out under a national legal obligation and for the performance of a task carried out in the public interest since this system is the only credit registration system in the Netherlands. In addition, insofar the compliance with a legal obligation constitutes the primary the legal basis under Article 6(1)(c) GDPR, the Court found that the data subject cannot exercise his right to object pursuant to Article 21(1) GDPR. Secondly, the right to erasure does not apply to the extent that the processing is necessary for the compliance with a legal obligation carried out in the public interest, by virtue of Article 17(3)(b) GDPR. Indeed, it further is justified that the task carried out in the public interest under Article 6(1)(e) GDPR does not constitute an appropriate and adequate legal basis for all the personal data processed. Lastly, the Court recalled that other GDPR principles apply as well. As a consequence, the data controller has to process the personal data to the extent this is necessary for and proportionate to the purpose of the compliance. In this case, the Court found that the processing was lawful.