Skip to main content
Praxikon
Agent check

Ruling

Dutch Supreme Court: whether data concern a criminal offence (Article 10 GDPR) is an EU concept with three criteria

Date
Status
final
Body
Hoge Raad, cliënt tegen ING
Reference
ECLI:NL:HR:2026:1815; 25/02752

What it is about

A bank ended its relationship with a client and recorded this, with the reason, in a note. The client argued that this was criminal-offence data (Article 10) and objected (Article 21). The Supreme Court: the concept of a criminal offence in Article 10 is interpreted uniformly across the EU, using three criteria from CJEU C-439/19: the classification under national law, the nature of the offence and the severity of the penalty. The court of appeal was entitled to hold that only the first criterion was at issue. On the objection, the finding that the bank had a legitimate and weighty interest, also in view of its anti-money laundering duties, implies that it had compelling legitimate grounds. The appeal was dismissed.

What this means in practice

Anyone recording signals about customers or employees, such as banks, insurers or a fraud or incident register, must check for each item whether it falls under Article 10, using the three EU criteria. On an objection under Article 21 the controller must show compelling legitimate grounds; a statutory duty such as anti-money laundering law can contribute. Record that balancing and the retention period.

The GDPR articles concerned

Source: Rechtspraak.nlchecked on 10 November 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines8 of 9

Enforcement and fines8 of 11

Legislation in motion