Dutch Data Protection Agency Fines National Credit Register for Personal Data Access Charges

Dutch Data Protection Agency (DPA) fined Dutch National Credit Register (BKR) 830,000 Euros for charging individuals who wished to access their personal data that BKR holds on them.

BKR collects financial data of approximately 11 million individuals involved with affiliated credit providers.  In May 2018, BKR began charging a fee to data subjects for requesting access to their data in a digital format.  Data subjects could obtain a paper copy of their data free of charge only once a year.

GDPR provides controllers must provide access to personal data they hold on the data subject free of charge.  See GDPR Art. 12(5); see also GDPR Recital 59 (“Modalities should be provided for facilitating the exercise of the data subject’s rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object.”)  GDRP permits controllers to charge data subjects only when their requests are manifestly unfounded or excessive, particularly when data subjects make repetitive requests.

The DPA concluded that BKR’s practices violated the GDPR provisions and created too many obstacles for individuals who wished to access their data.  Therefore, the DPA imposed a €830,000 fine on the Credit Register.  In the words of the DPA chairman Aleid Wolfsen: “It is vital that people are able to access their credit registration data. A poor credit score can affect a person’s ability to take out a loan or mortgage. So it is important for people to be able to quickly and easily check what data of theirs is being processed and if this is being done in the proper manner.”

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653