# Hoge Raad - 25/02752 - Type: Case Law - Source: Hoge Raad - Date: 2026-11-10 - Original: https://gdprhub.eu/index.php?title=Hoge_Raad_-_25/02752 - Canonical: https://overview.legal/posts/615093 - Topics: Personal Data, Financial Sector, Controllers ## Summary The Supreme Court rejected a claim of a data subject to delete criminal personal data in an internal bank register, based on information concerning large cash expenditures. English Summary. Facts. In 2022, ING (the controller) ended the banking relationship of a client (data subject) for not giving a transparent picture of the use of his business account in a periodic client survey. Therefore, the data subject was not able to provide enough information to fulfil the obligations under the Financi ## Full text The Supreme Court rejected a claim of a data subject to delete criminal personal data in an internal bank register, based on information concerning large cash expenditures. English Summary. Facts. In 2022, ING (the controller) ended the banking relationship of a client (data subject) for not giving a transparent picture of the use of his business account in a periodic client survey. Therefore, the data subject was not able to provide enough information to fulfil the obligations under the Financial Supervision Act (Wet Financieel Toezicht) and the Law on the Prevention of Money Laundering and the Financing of Terrorism (Wwft). The controller noted down in their event administration and internal register that there were too large cash expenditures and the inadequate accounting thereof, and that too few measures were taken to exclude its involvement in healing, money laundering, and other financial economic crimes. This data is retained for a period of 8 years. The data subject ordered th ## Cited law provisions (14) ### GDPR — gdpr-art-4-par-3-en ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; ### GDPR — gdpr-art-5-par-1-pnt-b-en collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); ### GDPR — gdpr-art-5-par-1-pnt-c-en adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); ### GDPR — gdpr-art-5-par-1-pnt-d-en accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); ### GDPR — gdpr-art-5-par-2-en The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-6-par-1-pnt-f-en processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. ### GDPR — gdpr-art-21-par-1-en The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. ### GDPR — gdpr-art-81-par-1-en Where a competent court of a Member State has information on proceedings, concerning the same subject matter as regards processing by the same controller or processor, that are pending in a court in another Member State, it shall contact that court in the other Member State to confirm the existence of such proceedings. ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ### GDPR — gdpr-art-21-en Right to object --- Generated by overview.legal · https://overview.legal/posts/615093 · 2026-11-14