On December 12, 2024, the Dutch data protection authority (AP) published its opinion, as submitted on November 26, 2024, on the draft De Nederlansche Bank (DNB) Mortgage Market Reporting Act.

The AP clarified that the draft Act obligates mortgage providers to share customer data, including mortgage loans they have provided or that are on their balance sheets to the DNB.

Recommendations of the AP

Specifically, the AP noted that the draft Act does not require customer data that is to be reported to the DNB to be pseudonymized, recommending that the draft Act should be amended to be a legal requirement when sharing data with the DNB.

In addition, the AP found that the mortgage data cannot only be used for statistical purposes but can be used by other parts of the DNB for other purposes. Accordingly, the AP recommended that the draft Act be amended to reflect the purpose limitation principle and prevent the internal forwarding of mortgage data within the DNB for other purposes.

The AP also detailed that personal data about mortgages may be stored for 15 years under the draft Act. The AP stipulated that, with no explanation provided in the explanatory memorandum of the draft Act, the retention period appears too long, recommending that personal data be stored for as short a time as possible.

Finally, the AP recommended that requirements surrounding Data Protection Impact Assessments (DPIAs) under the draft Act be clarified so that DPIAs are conducted before processing commences, and not postponed until the commencement of processing.

You can read the press release here, the opinion here, and the draft Act here, all only available in Dutch.