The relationship between the AVG and CIS registration is a complex and topical subject within Dutch law. Increasingly, we at Arslan & Arslan Advocaten receive questions about how the Algemene Verordening Gegevensbescherming (AVG) applies to the use and management of CIS registrations. The Centrale Informatievoorziening Stichting (CIS) plays a crucial role in collecting and providing personal data to insurers, but this must of course be done within the limits of privacy legislation. In this comprehensive blog post we explain what the legal frameworks are, which rights you have as a data subject, and which steps you can take if you believe your rights have been violated.
What is a CIS registration and which data are processed?
The Stichting CIS manages a central register in which personal data relevant to the insurance industry are stored. The purpose of this register is to help insurers better assess risks and prevent fraud. The register contains, among other things, claims history, policy details, payment arrears and incidents. This information is then shared with connected insurers.
It is important to realize that the processing of this data falls within the scope of the AVG. This means that strict conditions must be met, including the lawfulness principle (artikel 6 AVG), transparency, purpose limitation and data minimisation. The data may only be processed for a specific, explicit and legitimate purpose and may not be retained longer than necessary.
It is also important that the processing is proportional and that the rights of the data subjects, such as the right of access and rectification, are safeguarded. In CIS registrations this, for example, manifests itself in the right of insured persons to know which data are processed and to correct or have removed incorrect data if they have been registered unjustly.
The AVG and the legal bases for CIS registrations
A core question regarding the AVG and CIS registration is on which legal bases Stichting CIS and insurers base their processing. Article 6 of the AVG lists six possible legal bases for processing, including consent, performance of a contract, legal obligation, vital interests, a task carried out in the public interest, and legitimate interests.
In practice, Stichting CIS often relies on legitimate interest and performance of a contract as bases for processing. Insurers clearly have a legitimate interest in assessing risks and preventing fraud. However, this interest must be carefully balanced against the privacy rights of the data subjects. The Autoriteit Persoonsgegevens has made clear in its enforcement practice that this balancing of interests must be transparent and proportionate.
Another important aspect is the information obligation: data subjects must be informed about the processing, the purpose, the retention period and their rights. This is often done via privacy statements and policy terms and conditions. In addition, Stichting CIS must ensure appropriate security measures to protect the personal data against unauthorised access or data breaches.
Rights of data subjects under the AVG for CIS registrations
As a data subject you have various rights under the AVG that also apply to CIS registrations. These rights are laid down, among other places, in artikelen 15 tot en met 21 van de AVG and include the right of access, rectification, erasure of data (right to be forgotten), restriction of processing, the right to object to processing and the right to data portability.
The right of access (artikel 15 AVG) gives you the opportunity to know which data Stichting CIS has registered about you. Based on this access you can assess whether the data are accurate and complete. If that is not the case, you can submit a request for rectification (artikel 16 AVG). The right to erasure of data (artikel 17 AVG) allows you in certain situations to request deletion of your data, for example when the data have been unlawfully processed or are no longer necessary for the original purpose.
With CIS registrations it is important to realise, however, that not every request for deletion will be granted. Stichting CIS and insurers can, for example, argue that they have a legitimate interest in retaining certain data, for instance to prevent future fraud. In that context the balance between the rights of the data subject and the interest of the controller is crucial.
If your request is rejected, you can object (artikel 21 AVG) and possibly lodge a complaint with the Autoriteit Persoonsgegevens or bring a case before the court. The Kifid (Klachteninstituut Financiële Dienstverlening) may also play a role in disputes between consumers and insurers regarding CIS registrations.
Practical legal steps for removing a CIS registration
If you suspect that your CIS registration is incorrect or was made unjustly, it is advisable to first request access to your file at Stichting CIS. You can do this in writing, and at the same time submit a request to correct or delete data.
If Stichting CIS does not comply, you can submit a formal request for deletion. At our firm we always advise to explicitly refer to relevant AVG articles such as artikel 17 (recht op gegevenswissing) and artikel 6 (rechtmatigheid van verwerking) when doing so. In addition, you can make use of our service voor het verwijderen van CIS-registraties, where we provide legal advice and support in drafting your requests.
If Stichting CIS or the insurer refuses the request, it is possible to file a complaint with the Autoriteit Persoonsgegevens or to submit a dispute to Kifid. Kifid can, for example, rule on the lawfulness of the registration and the handling of your requests. Jurisprudence from Rechtspraak.nl can also be instructive in assessing your case.
AVG and CIS registration: what do the case law and Kifid say?
The case law concerning the AVG and CIS registration is still developing, but there are already some important rulings that shed light on the rights and obligations of the parties. For example, several courts have ruled that Stichting CIS and insurers must handle the processing and retention of personal data with care and that incorrect or outdated data must be removed.
In addition, Kifid has issued various decisions in which the importance of transparency and correct information provision is central. For example, in disputes about the right of access and correction of registered data. In some cases Kifid has ordered insurers to correct or delete data when it appeared that they were incorrect or insufficiently substantiated.
These rulings emphasise that it is important not only to apply the AVG strictly, but also to protect the interests of insured persons. It is therefore essential that you as a data subject are well informed about your rights and take timely action when you believe your data have been processed incorrectly.
The role of the incident register alongside CIS registrations
Besides the CIS registrations there is also a so-called incident register. This register contains information about specific incidents that may be relevant to insurers, such as cases of fraud or payment arrears. These data also fall under the AVG and therefore require careful processing.
Processing in the incident register follows the same principles as with CIS: there must be a clear legal basis, transparency towards data subjects and safeguards for correct and proportionate processing. It also applies that the data may only be used for the purpose for which they were collected and may not be retained longer than necessary.
If you are included in the incident register, you have the same rights as with CIS registrations. You can request access, submit requests for correction or deletion, and object to the processing. It is therefore advisable to regularly check your data, especially when you want to take out or renew an insurance policy.
Practical tips for businesses and insured persons regarding the AVG and CIS registration
For both insurers and insured persons it is important to be aware of the rights and obligations arising from the combination of the AVG and CIS registration. Insurers must ensure that they comply with the AVG by providing transparency about the processing, conducting a proper balancing of interests and implementing appropriate security measures.
Insured persons, for their part, should be alert to their rights and actively make use of their access and correction rights. If you doubt the accuracy of your CIS registration, it is wise to seek legal assistance in time. Our firm can assist you in drafting letters and conducting discussions with Stichting CIS and insurers.
We also advise companies and insured persons to always carefully read the privacy statements and ask questions about the processing of personal data where necessary. It can also be useful to follow the latest developments in case law and Kifid decisions so that you are well informed about your rights and obligations.
Frequently asked questions
What can I do if my CIS registration is incorrect?
You have the right to obtain access to your CIS registration and to have incorrect data corrected or deleted. Submit a written request to Stichting CIS for this. If they do not cooperate, you can file a complaint with the Autoriteit Persoonsgegevens or submit a dispute to Kifid. If in doubt you can also ask for help in removing your CIS registration.
How long may my data be kept in the CIS register?
Under the AVG personal data may not be retained longer than necessary for the purpose for which they were collected. Stichting CIS applies retention periods that depend on the type of data and the purpose of the processing. If in doubt you can request access and ask for deletion of outdated data.
Can I object to a CIS registration?
Yes, you can object to the processing of your data in the CIS register, especially if you believe that the processing is unlawful or that your interests outweigh the legitimate interest of Stichting CIS. You can submit this objection in writing and, if rejected, file a complaint with the Autoriteit Persoonsgegevens or involve Kifid.
Also read
- CIS-registratie: wat is het en hoe verwijdert u deze?
- EVR-registratie: verschil met CIS uitgelegd
- CIS-registratie bij verzekeraars – wat betekent dit voor u?
Need help?
Do you have questions about the AVG and CIS registration or are you unsure whether your personal data are being processed correctly? At Arslan & Arslan Advocaten we are ready to provide you with expert legal advice. Contact us for a free initial consultation and find out what we can do for you.
Need help? Our BKR-advocaat is happy to assist you further. Contact us without obligation for a free first consultation.
