Nationwide Registration of Debts System Abandoned
Sloppy payers can heave a sigh of relief: for the time being,
the nationwide registration of debts system ("LIS") is
off. The Dutch Data Protection Authority ("the Dutch
DPA") has stated twice in an opinion that the projected manner
in which this system would be processing personal data conflicts
with the Dutch Personal Data Protection Act (Wet bescherming
persoonsgegevens ("Wbp")). The foundation Stichting LIS
that is responsible for setting up this system has stopped its
activities as a result of this advice.
What is the
LIS?
The objective of the LIS is to prevent the occurrence of
problematic debts among consumers through a registration of payment
arrears. It was planned that, among others, housing corporations,
energy suppliers, social services of municipalities, banks and debt
counselors would feed the system with their data. Apart from these
participants, all parties that have access to the Central Credit
Information System ("CKI") of the National Credit
Register ("BKR") would be able to consult the LIS. The
LIS forms an addition to the CKI, because it registers not only
whether a consumer has a negative score (the so-called BKR
registration), but also the actual payment arrears payable to
participants in the LIS.
Background of the LIS
The LIS would help credit providers better to perform the test
of creditworthiness that is mandatory pursuant to Section 4:34 of
the Financial Supervision Act ("Wft"). For example, they
may decide not to provide credits to consumers registered in the
LIS, or to offer them a more appropriate credit, depending on the
level of the payment arrears. Other participants, such as housing
corporations or energy suppliers, could use the data from the LIS
as a basis to provide consumers with a cheaper house or a more
advantageous energy product. Because all participants can take into
account the financial position of their (future) clients, the
chance of problematic debts arising may be
diminished.
Screening by the Dutch DPA
Stichting LIS twice requested the Dutch DPA to render an opinion
on the draft of the LIS. In response to the first request, the
Dutch DPA stated that the outlines of the draft did not comply with
the principles of proportionality and subsidiarity that the Wbp
requires as conditions for the processing of personal data. In
September 2009 the Dutch DPA again rendered a negative opinion with
regard to the draft that had been adjusted. The main findings from
this second opinion will be discussed below.
• No objective description of purposes
Firstly, the Dutch DPA held the description of the purposes by the
LIS to be too subjective. This description is the following:
"(…) to provide information to LIS participants about the
financial position of the consumer, and to act as
a system of credit registration in order to allow
an assessment, in the interest of the consumer, prior to the
formation of an agreement and during the
administration thereof, of whether the conclusion of such
an agreement in the requested form is a
responsible thing to do in order to prevent
problematic debts."
The key notion of problematic debts is not defined
anywhere, so that it is not clear what exactly is understood by
this term. The term 'responsible' is not further
explained or substantiated either. As a result, the participants
may use the information from the LIS to decide at their discretion
whether they will conclude an agreement with a registered consumer.
Furthermore, the LIS will not only be recording problematic debts,
but will also keep a credit registration. There is no
further substantiation of this additional 'function' of the
system.
Moreover, the Dutch DPA is of the view that providing information
about the 'financial position' is more
comprehensive than just providing information about debts in
arrears.
Finally, the option of being able to test also during the
administration of an agreement where there are any problematic
debts is not necessary in order to prevent problematic debts. This
option will lead to it that the LIS will also start functioning as
a recourse information system.
According to the Dutch DPA, the description of the purposed is too
broad and too subjective and therefore contrary to Section 7 of the
Wbp, which provides that personal data may only be collected for
specific, explicitly defined and legitimate purposes.
• No objective criteria for admission
The draft contains no objective criteria for the admission of new
participants. Potential new participants are '(…) credit
providers in the broadest possible sense, who are able to prove
based on their experience that a debt arising with them is a clear
indication for the occurrence of problematic debts.'
According to the Dutch DPA, this description is too broad and too
subjective, and will have as a consequence that if a certain type
of business acquires access to the LIS it will be difficult to deny
other similar businesses, which also meet the broad criteria for
admission, access to the system. The absence of strict criteria for
admission causes the data processing not to meet the requirement of
proportionality, and carries the risk that the data will be
processed further for other purposes that are not compatible with
the purposes for which they were obtained, or that data will be
processed that are excessive and irrelevant. As a result, the
criteria are in conflict with Section 8, opening lines and under f,
Section 9 and Section 11 (1) of the Wbp.
• Too broad
registration criteria
Because an entry into the LIS is very stigmatizing in nature, it
is of the utmost importance that the data entered really indicate
the existence of a problematic debts situation. In the current
draft, there is insufficient proof of a connection between payment
arrears and the existence of a problematic debts situation.
Research has shown that 33% of payment arrears among consumers are
not the result of inability to pay, but for example of
forgetfulness or an error in the administration of the invoicing
organization. Therefore the LIS will contain personal data of more
consumers than just people with problematic debts, and thus the LIS
does not meet the requirement of proportionality set out in Section
8, opening lines and under f of the Wbp.
Furthermore, the protocol with the LIS stipulates that disputed
claims will be registered in the LIS, unless such claims were
brought before a disputes resolution committee established by a LIS
participant. The registration of debts not yet irrevocably
established is in conflict with Section 11(2) of the Wbp, which
provides that personal data processed must be correct and
accurate.
• Other objections of the Dutch DPA
Apart from the above-mentioned categories of objections, the Dutch
DPA has also mentioned a number of separate objections, for example
that the LIS does not set clearly described limitations on the
right of inspection. In addition, the Dutch DPA points out that
consultation of the LIS by housing corporations and energy
suppliers is disproportionate, since these parties - unlike the
credit providers - do not have a legal basis to do so. According to
the Dutch DPA, their interest in consulting the LIS is purely
commercial and does not outweigh the consumers' interest in
privacy, also in view of the stigmatizing nature of the
LIS.
Conclusion
The projected processing operations of personal data in the
scope of the LIS seem to be in conflict with practically all key
provisions from the Wbp. The Stichting LIS has reacted to the
opinion of the Dutch DPA by stating that only a political decision
may still save the initiative. I would like to add that, besides a
political decision, a fundamental revision of the LIS draft also
seems necessary from a privacy point of view.