Defam – Court Ruling (Netherlands, 2021)

Controller is Defam, a credit provider. Data subject took out a credit of €10,000 for their friend, because the friend wanted to open a liquor store and did not have enough money. Data subject had to start paying off the loan from February 2014 onwards, but they did not pay the installments. After multiple payment arrears and broken payment arrangements, in December 2015, controller terminated the agreement, claimed the credit early, and registered the debt in the credit registration database (CKI) with the code “A2” (relating to data subject’s creditworthiness). After multiple payment arrangements, the debt was finally payed off on 30 January 2019. The registration of the codes relating to data subject’s creditworthiness will be deleted in January 2024. On 22 June 2020, Coderingsvrij B.V., on behalf of the data subject, objected to the registration in the CKI and requested removal, pursuant to Article 21 GDPR and Article 17 GDPR. Data subject claimed that he is now financially stable, and want to move out of the house of the parents of their partner, which is hard because of the registration of the “A2” code in the CKI. Controller refused to do so on 8 July 2020. After data subject requested again on 15 February 2021 to have the registration removed based because data subject’s interests overrode those of the controller, controller refused again on 25 February 2021. Then, the data subject brought the case before Court. First, the Court considered the admissibility of data subject’s appeal. The controller argued that the appeal was inadmissible because data subject did not appeal to their rejection on 8 July 2020, within 6 weeks, pursuant to Article 35 of the General Data Protection Implementing Act (UAVG). Moreover, the controller claimed that the request of 15 February 2021 was a repeated request, based on the same grounds, and could not be considered a new request. The Court rejected the argument because controller dealt with the request of 15 February 2021 in