Final decision
The Luxembourg supervisory authority (“CNPD”) refers to the complaint of Mr
(hereinafter “ ”) lodged with the supervisory authority of Spain.
The initial wording of the complaint on IMI stated that:
“The complainant states that his data has been inscribed in the insolvency file ASNEF associated
to a debt which has not been notified. The date of the entry is and the creditor who
ordered the inscription is The debt amounts to ”
Based on said complaint, the CNPD requested the controller (hereinafter “ ”) to provide
a response to the issue raised as per Article 58.1(a) GDPR, in particular as regards to the lawfulness
of the processing of the complainant’s personal data.
The CNPD received the requested information within the set timeframe.
Following an enquiry by the CNPD, has provided all necessary documentation,
including general explanations on the management and administration of credits owned by third
parties as well as specific explanations related to the complainant’s personal situation. The
documentation was provided both in English and in Spanish.
Thus, based on this documentation, the CNPD is satisfied that fulfilled its obligations
under Regulation (EU) 2016/679 (GDPR) by immediately addressing the issue.
As the complaint has only a limited personal impact, the CNPD has consulted the Spanish SA to
determine whether the case could be dismissed. The CNPD and the Spanish SA agreed that, in
view of the above, no further action is required and that the cross-border complaint (national
reference E/08073/2018) could be closed.
A draft decision has been submitted by the CNPD on 7 February 2020 to the other supervisory
authorities concerned as per Article 60.3 GDPR (IMI entry number 108026).
As none of the other concerned supervisory authorities has objected to this draft decision within a
period of four weeks, the lead supervisory authority and the supervisory authorities shall be
deemed to be in agreement with said draft decision and shall be bound by it.
For the National Data Protection Commission