The Dutch Data Protection Authority (AP) has issued an opinion on a bill aimed at regulating credit registration, stating that improvements are still needed despite notable progress.

This bill, initiated in 2019 on the AP's recommendation, aims to strengthen data protection in the context of credit registration managed by the Credit Registration Office (BKR). The Dutch authority acknowledges significant improvements, including the legal recognition of the BKR's role, the reduction of credit history retention periods, clarification of the mandatory registration threshold, and simplification of data deletion requests.

However, the AP considers that modifications remain essential. The bill does not specify which data the BKR can rely on to assess the risk of payment default. Moreover, the possibility of using data "for other purposes provided by law" is deemed too vague and should be restricted to the major public interest objectives provided by the GDPR. Finally, the text does not sufficiently regulate the use of archived data, which should be limited to statistical purposes such as the development of scoring models.