ING Bank – Court Ruling (Netherlands, 2023)

In December 2005, the data subject took out a €202,500 mortgage for a house with ING Bank (the controller). In 2008, the data subject faced financial hardship and could no longer pay off the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest). The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and wrote off its claim. Despite that, ING Bank still had the data subject negatively registered in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands. On 6 December 2022, the data subject made an erasure request under Article 17 GDPR and an objection under Article 21 GDPR to have their negative registration no longer processed and removed. ING Bank refused both requests. In particular, ING argued that its legitimate interest in recording the data subject’s credit history overrode the data subject's right to be forgotten. On 19 April 2023, the data subject filed a claim with the Amsterdam District Court. The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights. In the balancing test, the Court determined the scope of the controller's legitimate interest through the purposes behind the Bank’s credit registration system. The Court understood the purpose of the credit registration system to be twofold: 1. To protect consumers from taking on too much debt; 2. To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations. ING submitted that its legitimate interest in maintaining the registration with BKR outweighed the data subject’s interests, as the data subject had a problematic debt situation for several years and as a result had low creditworthiness. Consequently, maintaining their negative registration fulfilled the purpose of credit registration system. The Court held that ING’s grounds did not constitute compelling legitimate grounds which could override the data subject’s legitimate interests. As the data subject had improved their credit worthiness and paid off their debts, the bank no longer had a legitimate interest in having them registered negatively because this was in opposition to the system's purpose The Court took into consideration that the data subject had sought help for the debt and had managed to pay it off. Moreover, the Court also took into consideration that the bankruptcy arose following a significantly bad economic period after the 2008 financial crash. As a result, ING’s did not have a compelling legitimate interest in maintaining the registration, and thus, their interests did not override those of the data subject. As a result, the Court ordered ING to fulfil the data subject’s erasure request within one week of the ruling.