Checking your creditworthiness (credit check)

Why a credit check?

Some companies provide consumers with products and services on credit. This means that consumers pay their bills afterwards, so after they have received the product. Some examples of such companies are banks, mail order companies, online shops, energy suppliers and telecommunications providers. These companies want to reduce the risk of customers not paying their bills as much as possible. That is why they often carry out a credit check in advance to determine whether the consumer will be able to pay (later).

Credit check result

Is a company performing a credit check on you? That check may reveal that you have payment arrears with another company. It may also indicate how likely it is that you won't be able to pay your bills. In that case, the company might refuse you as a customer, or inform you that you will not be permitted to pay after the fact. The company might also ask for an advance or a deposit.

Data for credit check

Companies can perform a credit check via the Credit Registration Office (BKR in Dutch) or a business information agency. By law, credit providers are obliged to participate in credit registration by the BKR. Other companies that provide credit are also affiliated with the BKR. These include stores that sell expensive items on credit (like washing machines or laptops) and telecommunications providers (in the case of contracts with a device).

Registration with the BKR

You are registered with the BKR as soon as a company affiliated with the BKR gives you a credit of more than 250 euros. Examples of credit include loans and the provision of credit cards or customer cards with the option of overdraft. The monthly costs for a contract phone are also a type of credit.

Whenever you apply for a loan or buy a product on credit from a company that is affiliated with the BKR, said company will then contact the BKR to obtain your personal details. If the company decides to grant you credit exceeding 250 euros , they are required to report it to the BKR. The BKR will then register this credit. Do you have payment arrears? The relevant company must report said arrears to the BKR, and the BKR will register them accordingly.

Viewing and changing BKR registration

• Do you want to view your BKR registration? You can view your credit overview at Mijn kredietoverzicht on the BKR consumer website.
• When viewing your BKR registration, you may come across errors. If so, you can request that the company that registered you with the BKR amend your personal details. This might be the bank where you took out a loan. You can read more about this at Registratie wijzigen on the BKR consumer website.

Retention period for BKR registration

Your BKR registration will remain in place for the duration of your credit. Once you have fully repaid the credit, the retention period starts. Your data will be retained for another five years after full payment, and will be visible to any credit providers who want to view your BKR credit registration. After full payment, your BKR registration will include mention of the fact that it pertains to repaid credit and will also list the end date of said credit. Your data will automatically be wiped from the BKR's central register once the five-year retention period has expired.

Business information agencies

Some companies that provide credit may ask a business information agency to perform an (online) credit check. Business information agencies provide information about consumers and companies to companies requesting said information.

Business information agencies retrieve data about companies and private individuals from public sources (registrations). They also use data received from other parties and general statistical data about other aspects, such as the area where you live. However, they are not permitted to simply collect and pass on all kinds of data about you. They can only do so if they comply with the privacy law, the General Data Protection Regulation (GDPR).

Infographic: this is how a credit check works

Did you know that credit checks are often performed without your knowledge? View the infographic (soon available in English).

What you need to know about business information agencies

When completing an online ordering process, such as in an online shop, for a product on credit or to take out a new energy contract, a credit check is often part of the online ordering process. The company you place the order with must clearly indicate this and inform you that your personal details will be sent to a business information agency for a credit check.

If you are refused during the ordering process or are required to pay a high deposit in advance, this may be due to the results of your credit check. If this result is unexpected, please ask for clarification. The company that gave the order for the credit check is then required to inform you who performed the credit check. You can then turn to that business information agency to request access to your details and check whether they are correct.

Sometimes, you can end up getting a bad credit score because someone else who has or has had debts lives or used to live at the same address. In that case, you can ask for your details to be amended; after all, that other person has nothing to do with you.

If you don't want a business information agency to process your personal details, you may also be able to object to that processing.

Exercise your privacy rights

It's important to be aware of your privacy rights. For example, you have the right:

• to know what data any organisation has regarding you,
• to have the data amended if it is not (or no longer) correct,
• in some cases, to object to the processing of your data,
• to receive clarification of how any automated decision about your case has been made.

You can use the model letters provided by the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, to contact any organisation.

If you do not receive a response or are dissatisfied with the organisation's response, you can then contact that organisation's Data Protection Officer (DPO).

Ask the AP to mediate

Are you unable to resolve it with the organisation? And the organisation's DPO is also unable to help you? You can then ask the AP to mediate. You can contact the AP by calling. The AP may be able to help you in exercising your privacy rights.

Submitting a tip or complaint to the AP

If you do not receive a (satisfactory) response from the organisation, you can submit a tip-off or complaint to the AP.

For organisations: Make sure you comply with the GDPR

Do you use business information agencies to check the creditworthiness of your customers? If so, you are required to comply with the GDPR. The following matters must be taken into consideration, among others.

A good reason

You may only send data about your (potential) customer to a business information agency if you have a legal basis to do so: a legally valid reason. You should check the legal grounds for your reasoning before you enter into any contract with a business information agency. And the business information agency should only receive personal data about your (potential) customer that is strictly necessary to perform the credit check.

Informing customers

Make sure you clearly inform your (potential) customer that you are having a credit check performed on him or her and by whom. You must inform your customer thereof before sending the personal data to the business information agency. This way, the customer can decide themselves whether or not to continue with the ordering process.

Automated decisions

Automated decision-making may be part of the online (ordering) process if:

• you have set up the ordering process in such a way that the result of the credit check automatically leads to a decision whether or not to enter into a contract with the (potential) customer;
• you base your decision whether or not to enter into a contract with a (potential) customer primarily on the result of the credit check.

Check all of this carefully before setting up your ordering process, as such automated decisions are only permitted in certain cases and under certain conditions.

For business information agencies Make sure you comply with the GDPR

Does your business information agency process personal data? In that case, you are required to comply with the GDPR. Here are some critical concerns:

• Make sure you have a legal basis for collecting, using, storing and disclosing personal data. Check the legal grounds for your activities involving personal data before you start, and hire a professional for their recommendations, if necessary.
• Only collect as much personal data as is strictly necessary to perform the credit check. For example, you are not permitted to process data that is merely 'useful' to have.
• You must actively inform those whose data you are collecting. In any case, make sure it is clear to them:
  • that you are collecting their personal data,
  • for what purpose you are doing so,
  • which legal basis you have for processing their personal data,
  • which of their personal data you have collected,
  • to whom you will disclose that data; and
  • what their rights are, such as the right of access or rectification, and how the person involved can go about exercising these rights.
• Set up a process that is easy to find and access regarding data subjects' rights, making it easy for them to submit a request for access, rectification or deletion of personal data or object to the processing. Set up an internal process that enables you can fulfil these requests in a timely manner and in full.
• Make sure the data you have collected is correct and up to date. Remove outdated data in a timely manner.
• Set up retention periods in line with the purpose of the data processing. Do not retain data longer than necessary for its specific purpose.

Automated decisions

Note! Automatically calculating a credit score may constitute automated decision-making. This is permitted in certain cases and under certain circumstances only. Your process may involve automated decision-making if the organisation for which you are performing a credit check bases its decision on whether or not to enter into a contract with the consumer primarily on the result of your credit check. You must therefore carefully check how the organisations for which you perform credit checks use the results of those checks. If needed, seek out a professional for their recommendations.