Dutch Arnhem-Leeuwarden Court of Appeal (hereinafter “Court”) seems to give insides on what accounts to an overriding interest according to Art. 21 para. 1 GDPR, when considering the right to deletion according to Art. 17 para. 1 lit. c GDPR (see here).
Facts
The data subject who works as an accountant had provided false information to the bank in order to receive a loan. When the bank discovered the fraudulent activity, they terminated the contract with the data subject and further, entered the data subject’s details into two registries, IR and EVR, that serve to protect and uphold the financial system’s integrity. The data subject requested the deletion of her personal data from said registries and, should a deletion not be feasible, asked to limit the duration of the registrations to one year or what the court of first instance deems an appropriate time frame. When the court of first instance rejected those requests, the data subject appealed the ruling before the Court.
Data Protection in a Nutshell
The data subject has the right to erasure in particular cases listed in Art. 17 para. 1 GDPR. In the case at hand, the subject seems to have objected to the processing according to Art. 21 para. 1 GDPR. This would then account to a valid ground for erasure according to Art. 17 para. 1 lit. c GDPR, to the extent that there are no overriding legitimate grounds for the processing.
Balancing interests
When evaluating whether the bank had an overriding interest, the Court points out that the registration in registries weight high as they safeguard the integrity of the financial sector. To that end, the court pointed out that the data subject, when applying for the loan, informed the bank to own 110.000 € more in assets than was actually the case. The court made clear that such malicious behavior undoubtedly justifies the bank’s interest to have the data subject’s details documented in the registries in order to avoid future fraud.
Interestingly the Court rejected the data subject’s argument that the registry entries would hinder her to continue her work as an accountant and instead used that argument to regard the committed offence particularly serious exactly because of her accountant profession. As a result, the court deemed the registry entries justified.
The court further regards the measure to be in line with the proportionality and subsidiarity principle as firstly, the data subject does not seem to be in urgent need of housing as she currently lives in another home, that she owns. Secondly, the court found that the data subject will still be able to open up a basic account in the short term which is why the registry entries will not hinder her from participating in the financial traffic.
All in all, the Court confirmed the decision of the court of first instance and pointed out, that the interest of the Bank to safeguard the integrity of the financial sector outweighed the interests of the data subject to have her financial registry entries deleted.
Take away
Fraudulent behavior, that essentially also affects the public at large, here the integrity of the financial sector, weighs higher than consideration concerning a persons occupational freedom, to the extent, that the person is not affected in its minimum living requirements such being able to participate in the financial traffic (bank account) and possessing a place to live (housing).
Finally, the Court points out, that the weighing of interest to delete the data must also include consideration of limiting the duration of the registration. To determine such a retention period, the Court puts forward another balancing test, and determines that a period of 8 years is not disproportionate.