Dutch Supreme Court on bank registers: when is a note criminal offence data under the GDPR?

A trader in scrap iron and metals loses his business accounts. The bank records the reason in its internal registers and keeps it for eight years. The client argues that the note contains criminal offence data about him and demands its removal. On 6 November 2026 the Hoge Raad, the Dutch Supreme Court, dismissed his appeal (ECLI:NL:HR:2026:1815, in Dutch).

The ruling is short, but it touches two questions that every organisation with an incident or fraud register knows. When is a note "personal data relating to criminal convictions and offences" under Article 10 GDPR? And what must you be able to show when the data subject objects under Article 21 GDPR?

What happened

According to the trade register, the client's sole proprietorship deals in scrap iron and metals, among other things. In 2021 ING announced that it would end the relationship for the business accounts. The reason: in a periodic customer due diligence review the client had not given a transparent picture of how the accounts were used, so the bank could not sufficiently meet its obligations under the Dutch Financial Supervision Act (Wft) and the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft). The relationship ended in October 2022. The client first resisted but eventually accepted it (para. 2.1).

ING recorded data about him in its events administration (Gebeurtenissenadministratie) and its internal referral register (Interne Verwijzingsregister, IVR) for eight years. According to the note, the main reason was that he had made large cash expenditures that could not be accounted for. It added that he kept no adequate records of his cash purchases and took too few measures to rule out involvement in handling stolen goods, money laundering and other financial economic crime.

The client asked the courts to order ING to delete the registration. The district court refused, and on 13 May 2025 the Amsterdam Court of Appeal upheld that judgment (paras 2.2 to 2.4). The court of appeal proceeded on the basis that the IVR can only be consulted within ING and that an employee only sees that a person is listed, not why (ECLI:NL:GHAMS:2025:1261, para. 5.9, in Dutch).

Article 10 GDPR: three criteria, not just the national label

Article 10 GDPR sets extra conditions for data relating to criminal convictions and offences. Processing is only allowed under the control of official authority, or when Union or Member State law authorises it with appropriate safeguards (para. 3.1.2).

The court of appeal held that the note did not contain such data. It applied the test from a Supreme Court decision of 29 May 2009 (ECLI:NL:HR:2009:BH4720, in Dutch): criminal offence data are concrete facts and circumstances that could support a finding that a criminal offence has been proven. Unaccounted cash expenditures, poor bookkeeping and too few measures do not meet that test, the court of appeal held (para. 5.12 of its judgment).

Before the Supreme Court the client complained that the court of appeal had only looked at Dutch law. On the starting point he was right. The concept of an offence requires an autonomous and uniform interpretation throughout the Union, and according to the Court of Justice in B v Latvijas Republikas Saeima (C-439/19, paragraphs 87 and 88) three criteria are relevant (para. 3.1.3):

• the legal classification of the offence under national law;
• the intrinsic nature of the offence;
• the degree of severity of the penalty that the person concerned is liable to incur.

So conduct that national law does not classify as criminal can still fall under Article 10. In the Latvian case that was true of road traffic offences that led to penalty points (paragraphs 93 and 94).

The complaint failed all the same. The court of appeal had not disregarded the three criteria: in light of the debate between the parties it was entitled to find that the second and third criteria were not at issue (para. 3.1.5). The Supreme Court refers here to the opinion of the Advocate General (in Dutch). He notes that it had been neither argued nor shown in the lower courts that the facts in the note could attract a penalty in some other way, for instance outside criminal law (opinion, point 4.5).

Article 21 GDPR: the bank's interest also carried the objection

Anyone who processes personal data on the basis of a public task or a legitimate interest (Article 6(1)(e) or (f)) has to deal with the right to object. If the data subject objects on grounds relating to his or her particular situation, the controller stops processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject (para. 3.2.2).

The client complained that the court of appeal had skipped that test. The court of appeal had held that ING has a legitimate and weighty interest, "also in view of its obligations under the Wwft" (our translation), in keeping a record for a certain time of the fact that it ended a relationship and why. In this case the client's interest did not outweigh it. The court of appeal took into account that the data had not been shown to be accessible to third parties, and that the client had not been shown to be hindered in obtaining financial services elsewhere (para. 5.19 of its judgment).

According to the Supreme Court, that finding implies that ING put forward compelling legitimate grounds that override the client's interests, rights and freedoms (para. 3.2.3).

What the Supreme Court did not decide

• No general ruling on registers. The Supreme Court did not weigh the interests itself. It assessed complaints against a balancing exercise that the court of appeal carried out "in the circumstances of this case" (our translation).
• No ruling that a note like this can never fall under Article 10. The three criteria apply. Two of them were not at issue here because of the way the case had been argued.
• No reasons on the rest. The remaining complaints, which according to the Advocate General's opinion (point 1.3) concerned among other things accessibility to third parties, accuracy and data minimisation (Article 5(1)(c) and (d)), were dismissed under Section 81(1) of the Dutch Judiciary Organisation Act, which means without explanation (para. 3.3).
• No ruling on the eight-year period as such. The ruling contains no consideration on that point.

What to check now

What follows is our advice, based on the ruling and on the court of appeal's judgment. It is not a holding of the Supreme Court. It applies to banks and insurers, and equally to other organisations and municipalities with an incident or fraud register.

1. Read your notes for what they actually state. The court of appeal took into account that ING had recorded the reasons for the termination and nowhere that the client had committed an offence (para. 5.20 of its judgment). It also took into account that the note matched the reasons in the termination letter. If your register does contain a concrete set of facts that could support a finding of a criminal offence, assume that Article 10 is in play.
2. Look beyond criminal law. If you record conduct that can attract a penalty outside criminal law, also assess the nature of the conduct and the severity of the penalty.
3. Document the balancing exercise, including the circumstances. Who can consult the register, does an employee see the reason or only a flag, and do data go to third parties? If you share your register with other organisations, you cannot lean on this assessment.
4. Build your objection procedure around Article 21. The right to object applies to legitimate interest and to public tasks, so also to municipalities. When an objection comes in, record which particular situation the data subject invokes and why your grounds are compelling.
5. Justify the retention period yourself. The court of appeal spoke of keeping a record "for a certain time" (our translation). This ruling does not turn eight years into a general standard.

For a first structured check of a concrete processing operation under the GDPR and the AI Act, you can use the free case check. More rulings are in our overview of GDPR case law.