Hoge Raad · 25/02752

The Supreme Court rejected a claim of a data subject to delete criminal personal data in an internal bank register, based on information concerning large cash expenditures. English Summary. Facts. In 2022, ING (the controller) ended the banking relationship of a client (data subject) for not giving a transparent picture of the use of his business account in a periodic client survey. Therefore, the data subject was not able to provide enough information to fulfil the obligations under the Financial Supervision Act (Wet Financieel Toezicht) and the Law on the Prevention of Money Laundering and the Financing of Terrorism (Wwft). The controller noted down in their event administration and internal register that there were too large cash expenditures and the inadequate accounting thereof, and that too few measures were taken to exclude its involvement in healing, money laundering, and other financial economic crimes. This data is retained for a period of 8 years. The data subject ordered th