The relationship between AVG and CIS registration is a complex and topical issue within Dutch law. At Arslan & Arslan Advocaten we increasingly receive questions about how the General Data Protection Regulation (AVG/GDPR) applies to the use and management of CIS registrations. The Central Information Provision Foundation (CIS) plays a crucial role in collecting and providing personal data to insurers, but this must of course take place within the boundaries of privacy legislation. In this comprehensive blog post we explain the legal framework, what rights you have as a data subject, and what steps you can take if you believe your rights have been infringed.
What is a CIS registration and what data are processed?
The Stichting CIS manages a central register in which personal data relevant to the insurance sector are stored. The purpose of this register is to help insurers better assess risks and prevent fraud. The register records, among other things, claims history, policy data, payment arrears, and incidents. This information is then shared with affiliated insurers.
It is important to realise that the processing of this data falls within the scope of the AVG. This means that strict conditions must be met, including the principle of lawfulness (Article 6 AVG), transparency, purpose limitation, and data minimisation. The data may only be processed for a specific, explicit and legitimate purpose and may not be retained longer than necessary.
It is also important that the processing is proportionate and that the rights of data subjects, such as the right of access and rectification, are safeguarded. In the context of CIS registrations, this is reflected for example in the right of insured persons to know what data are processed and to correct or have incorrect data removed if they have been registered unjustly.
The AVG and the legal bases for CIS registrations
A key question in relation to AVG and CIS registration is on which legal bases Stichting CIS and insurers ground their processing. Article 6 of the AVG lists six possible legal grounds for processing, including consent, the performance of a contract, legal obligation, vital interests, a task carried out in the public interest, and legitimate interests.
In practice, Stichting CIS often relies on legitimate interest and the performance of a contract as grounds for processing. After all, insurers have a legitimate interest in assessing risks and preventing fraud. This interest, however, must be carefully weighed against the privacy rights of data subjects. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has made it clear in its enforcement practice that this balancing test must be transparent and proportionate.
Another important aspect is the duty to inform: data subjects must be informed about the processing, the purpose, the retention period and their rights. This is often done through privacy statements and policy terms and conditions. In addition, Stichting CIS must ensure appropriate security measures to protect personal data against unauthorised access or data breaches.
Rights of data subjects under the AVG in relation to CIS registrations
As a data subject you have various rights under the AVG that also apply to CIS registrations. These rights are set out, among other places, in Articles 15 through 21 of the AVG and include the right of access, rectification, erasure (right to be forgotten), restriction of processing, the right to object to processing, and the right to data portability.
The right of access (Article 15 AVG) allows you to know what data Stichting CIS has registered about you. Based on this access you can assess whether the data are accurate and complete. If that is not the case, you can submit a request for rectification (Article 16 AVG). The right to erasure (Article 17 AVG) allows you, in certain situations, to request the deletion of your data, for example when the data have been processed unlawfully or are no longer necessary for the original purpose.
However, with CIS registrations it is important to realise that not every request for deletion will be granted. Stichting CIS and insurers can, for example, argue that they have a legitimate interest in retaining certain data, for instance to prevent future fraud. In that context, the balance between the rights of the data subject and the interests of the controller is crucial.
If your request is rejected, you can object (Article 21 AVG) and, if necessary, file a complaint with the Dutch Data Protection Authority or take the matter to court. The Kifid (Financial Services Complaints Institute) can also play a role in disputes between consumers and insurers regarding CIS registrations.
Practical legal steps to remove a CIS registration
If you suspect that your CIS registration is incorrect or has been made unjustly, it is advisable first to request access to your file from Stichting CIS. You can do this in writing, and at the same time submit a request to correct or delete data.
If Stichting CIS does not comply, you can file a formal deletion request. At our firm we always recommend clearly referring to relevant AVG provisions such as Article 17 (right to erasure) and Article 6 (lawfulness of processing). In addition, you can make use of our service for removing CIS registrations, under which we provide legal advice and support in drafting your requests.
If Stichting CIS or the insurer refuses the request, you can file a complaint with the Dutch Data Protection Authority or submit a dispute to Kifid. Kifid can, for example, rule on the lawfulness of the registration and the handling of your requests. Case law on Rechtspraak.nl can also provide guidance in the assessment of your case.
AVG and CIS registration: what do case law and Kifid say?
Case law on AVG and CIS registration is still evolving, but there are already several important rulings that shed light on the rights and obligations of the parties. For example, courts have in multiple cases held that Stichting CIS and insurers must handle the processing and retention of personal data with care and that incorrect or outdated data must be deleted.
In addition, Kifid has issued various decisions in which the importance of transparency and proper information provision is central, for example in disputes about the right of access and rectification of registered data. In some cases, Kifid has instructed insurers to correct or delete data where it appeared that the data were incorrect or insufficiently substantiated.
These decisions emphasise that it is important not only to apply the AVG strictly, but also to protect the interests of insured persons. It is essential that you as a data subject are well informed about your rights and that you take timely action when you believe your data have been processed incorrectly.
The role of the incidents register alongside CIS registrations
In addition to CIS registrations, there is also a so-called incidents register. This register contains information about specific incidents that may be relevant to insurers, such as cases of fraud or payment arrears. These data also fall under the AVG and therefore require careful processing.
Processing in the incidents register follows the same principles as for CIS: there must be a clear legal basis, transparency towards data subjects, and safeguards for correct and proportionate processing. The data may only be used for the purpose for which they were collected and may not be retained longer than necessary.
If you have been included in the incidents register, you have the same rights as with CIS registrations. You can request access, submit requests for correction or deletion, and object to the processing. It is therefore advisable to check your data regularly, especially when you wish to take out or renew insurance.
Practical tips for companies and insured persons regarding AVG and CIS registration
For both insurers and insured persons it is important to know the rights and obligations arising from the combination of AVG and CIS registration. Insurers must ensure that they comply with the AVG by providing transparency about processing, conducting a proper balancing of interests, and implementing appropriate security measures.
Insured persons, in turn, should be alert to their rights and actively make use of their rights of access and rectification. If you doubt the accuracy of your CIS registration, it is wise to seek legal assistance in time. Our firm can support you in drafting letters and conducting discussions with Stichting CIS and insurers.
We also advise companies and insured persons to always read the privacy statements carefully and, where necessary, to ask questions about the processing of personal data. It can also be useful to follow the most recent developments in case law and Kifid decisions, so that you are well aware of your rights and obligations.
Frequently asked questions
What can I do if my CIS registration is incorrect?
You have the right to obtain access to your CIS registration and to have incorrect data corrected or deleted. Submit a written request to Stichting CIS for this purpose. If they do not cooperate, you can file a complaint with the Dutch Data Protection Authority or submit a dispute to Kifid. If in doubt, you can also seek help with removing your CIS registration.
How long may my data be retained in the CIS register?
Under the AVG, personal data may not be kept longer than necessary for the purpose for which they were collected. Stichting CIS applies retention periods that depend on the type of data and the purpose of the processing. If in doubt, you can request access and ask for outdated data to be deleted.
Can I object to a CIS registration?
Yes, you can object to the processing of your data in the CIS register, especially when you believe that the processing is unlawful or that your interests outweigh the legitimate interest of Stichting CIS. You can submit this objection in writing and, if it is rejected, file a complaint with the Dutch Data Protection Authority or involve Kifid.
Read also
- CIS registration: what is it and how can you remove it?
- EVR registration: difference from CIS explained
- CIS registration with insurers – what does this mean for you?
Need help?
Do you have questions about AVG and CIS registration or do you doubt whether your personal data are being processed correctly? At Arslan & Arslan Advocaten we are ready to provide you with expert legal advice. Contact us for a free initial consultation and find out what we can do for you.
Need help? Our BKR lawyer will be happy to assist you. Contact us without obligation for free initial advice.
