Introduction: What is IVR registration at banks?
IVR stands for Internal Referral Register (Intern Verwijzingsregister). A bank can include limited identifying data of persons or legal entities involved in an incident at that bank in this own, internal register. Only employees of that own bank can consult the IVR; the nature of the incident is according to the Dutch Banking Association (Nederlandse Vereniging van Banken, NVB) only known to the security department. The IVR is therefore not a central register in which banks mutually share incident information. In case of serious incidents, identifying data can additionally be included in the External Referral Register (Extern Verwijzingsregister, EVR). See NVB: warning registers of banks.
In this article we discuss extensively the legal aspects of IVR registration at banks. We cover the legal frameworks, the consequences of a registration, the principle of proportionality, the procedure for removal of a registration, and the role of complaints bodies such as Kifid and the court. We also discuss the relationship with other registration systems and how you as a customer can exercise your rights.
The legal framework regarding IVR registration at banks
The registration of customers in the IVR is subject to strict regulations to guarantee the privacy and rights of customers. Banks must comply with the General Data Protection Regulation (GDPR, or AVG in Dutch) and the Financial Supervision Act (Wet op het financieel toezicht, Wft). The GDPR sets requirements for the lawfulness, transparency, and purpose limitation of the processing of personal data. This means that banks may only register data if they have a legitimate basis for doing so, for example preventing financial fraud.
For the processing of personal data, the GDPR and the applicable internal rules of the bank, among others, remain relevant. The NVB explains that the Incident Register and EVR are part of the Financial Institutions Incident Warning System (Incidentenwaarschuwingssysteem Financiële Instellingen) and that strict PIFI rules apply to the recording, exchange, and use of that data. The IVR remains the internal register of the own bank.
The combination of these rules means that banks cannot simply include someone in the IVR; this must be done carefully and proportionally, with respect for the customer’s rights.
The consequences of an IVR registration for customers
A listing in the IVR can have far-reaching consequences for consumers and entrepreneurs. Banks use this registration to assess whether they still want to serve a customer. With a negative registration, this can lead to the refusal of a loan, not opening a new bank account, or even terminating an existing relationship.
An IVR registration can have consequences for the services of the own bank. Other financial institutions do not consult the internal IVR of that bank. The NVB states that identifying data can additionally be included in the EVR in serious cases; another financial institution can consult the EVR. The involved financial institution itself assesses what consequences a registration has.
It is therefore of great importance that customers know what information is registered about them and how they can act against this. It is also advisable to understand the relationship with other systems such as blacklisting at banks or the incident register, as these can be interrelated.
The principle of proportionality in IVR registration at banks
A fundamental legal principle that plays a role in IVR registration at banks is the principle of proportionality. This means that the registration of data must be proportional to the intended purpose. Banks may only register data that is necessary to manage risks. A registration may not unreasonably infringe on the rights of the customer.
When applying this principle, the bank must weigh whether the interest of preventing fraud or financial damage outweighs the customer’s interest in protecting their reputation and privacy. The bank must also ensure that the registered data is accurate and up-to-date, and that the registration is not maintained longer than necessary.
If a customer believes that a registration is disproportionate, they can object and request the bank to review or remove the registration. In case of conflicts, the customer can turn to Kifid or the court to have the proportionality of the registration assessed.
The procedure for requesting the removal of an IVR registration
If you are dealing with an unjustified or incorrect registration in the IVR, you can submit a request for removal to the bank. It is advisable to do this in writing and clearly indicate why you believe the registration is unjustified, for example by providing evidence that the incident did not take place or that the bank had no reasonable basis for the registration.
The bank is obliged to seriously assess your request and respond within a reasonable period. If the bank decides to maintain the registration, it must do so with reasons. If you do not agree with this decision, you can use the complaints procedure at Kifid. Here you can request a binding decision on the lawfulness of the registration.
When this route also offers no solution, the possibility remains to approach the court. On rechtspraak.nl you can find information about the method of litigating and which court has jurisdiction. It is wise to engage legal assistance for a good approach.
The role of Kifid and the court in disputes over IVR registration at banks
The Financial Services Complaints Institute (Klachteninstituut Financiële Dienstverlening, Kifid) plays an important role in resolving disputes between customers and banks regarding IVR registration. Kifid offers an accessible and cost-effective way to handle complaints. Customers can file a complaint about an unjustified registration and Kifid can make a binding decision.
If you are not satisfied with the decision of Kifid, or if the matter is more complex and requires legal interpretation, you can consider going to the civil court. The court can assess whether the bank has complied with laws and regulations and whether the registration was proportional. In some cases, the court can also determine that the bank must pay compensation.
For a successful procedure, it is important to collect all relevant documents, correspondence, and evidence well. In addition, engaging a lawyer, such as at Arslan & Arslan Advocaten, can significantly facilitate the process.
IVR registration at banks and the relationship with other registers
The IVR of a bank, the Incident Register/EVR, and the CIS database are different systems with their own goals and controllers. Foundation CIS (Stichting CIS) manages data relevant to claims and insurance acceptance for participating insurers and mandated agents. An IVR registration does not automatically lead to a registration in another system. See Foundation CIS: your data and CIS.
It is crucial to distinguish between these registrations because the consequences and procedures can differ per register. For example, the article CIS registration at banks – consequences and your rights extensively discusses the impact of CIS registrations, while EVR registration: difference with CIS explained delves deeper into the differences between registration systems.
By gaining insight into the different registers and how they work, you can better exercise your rights and respond adequately to a negative registration.
Prevention and legal tips for IVR registration at banks
Prevention is better than cure. To prevent a negative IVR registration, it is important to fulfill your financial obligations timely and correctly. In case of payment problems, always communicate timely with your bank to prevent escalation. It is also useful to document your bank relationships well and keep any correspondence.
If you are confronted with a registration, ask on the basis of the right of access (GDPR) what data has been registered. Check the accuracy and completeness of this data. If you find errors or see unjustified information, submit a request for correction or removal as soon as possible.
In case of doubt about your rights or in case of disputes, you can always seek advice from specialized lawyers. They can guide you in filing complaints, conducting objection procedures, and starting legal proceedings. More information about your rights can also be found via Kifid or official websites such as rechtspraak.nl.
Frequently asked questions
What is the difference between IVR registration and CIS registration?
IVR concerns the internal register of a bank for limited identifying data of persons involved in incidents at that bank. The CIS database is a database for participating insurers and mandated agents, containing among other things claim reports, guarantee fund reports, driving disqualifications, confidential communications, and EVR. They are different systems; a registration in one system does not automatically mean a registration in the other.
Can I have an IVR registration removed?
Yes, you can submit a request for removal to the bank if you believe that the registration is unjustified or disproportionate. The bank will assess your request and inform you of the outcome. In case of disputes, you can turn to Kifid or the court. It is advisable to engage legal help for this.
How do I know if I am registered in the IVR?
You have the right, based on the GDPR, to gain access to the data that banks have registered about you. You can submit a written access request to your bank. They are obliged to respond within a month and provide you with the requested information.
Read also
- EVR registration: difference with CIS explained
- CIS registration at banks – consequences and your rights
- Incident register: how do you get in and what can you do?
Need help?
Do you have questions about IVR registration at banks or are you confronted with a negative registration? At Arslan & Arslan Advocaten we are ready for you with expert legal advice and assistance. Contact us for a free initial consultation and discover what we can do for you.
Need help? Our BKR lawyer is happy to help you further. Feel free to contact us for a free initial consultation.