Information and Data Protection Commissioner
CDP/IMI/LSA/20/2021
vs
COMPLAINT
1. On the 18th December 2020, (the “complainant” or the “data
subject”) lodged a complaint with the Supervisory Authority of Spain (Agencia Española de
Protección de Datos, hereinafter the “Spanish SA”) pursuant to article 77(1) of the General
Data Protection Regulation1 (the “Regulation”) against (the
“controller”).
2. In his complaint, that data subject argued that:
a. the controller, together with other entities based in Spain, entered his data into the
insolvency register3 (“ ”), in spite of the fact
that he had not given his authorisation to the controller to disclose his data to third
parties at the time of signing the contract with the controller 4 , nor at any later stage;
b. the controller never informed him that he could have been included in an insolvency
register, and about the insolvency registers that the controller participated in;
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC.
2
is a private limited company registered under the laws of Malta with registration number
and having registered address at
3
The insolvency register is owned and managed by
company incorporated under the laws of Spain with registration number and
having registered address at .
4
On the 13th March 2020, the complainant concluded a repayment agreement with the controller.
Page 1 of 11
c. the controller did not include him in the register in a faithful
manner, so that he could exercise his rights as soon as he was entitled to;
d. on the 26th November 2020, he exercised his right to erasure with .
According to the complainant, the controller and the other entities which included his
data in the register failed to effectively erase his personal data
without substantiating the reason for not doing so; and
e. that the amount of the debts is inaccurate.
3. In support of his complaint, the data subject submitted:
a. a copy of an extract from the registry dated the 27th November
2020, wherein an entry of the 7th June 2019 made by the controller shows a debt owed
by the complainant to the controller;
b. a copy of a second extract from the registry dated the 9th December
2020, wherein an entry of the 8th May 2019 made by the controller shows another debt
owed by the complainant to the controller; and
c. a copy of the reply of of the 9th December 2020 to the
complainant’s request to erase his personal data filed on the 26th November 2020,
wherein informed the complainant that it would not erase the data
entered in the register by the controller given that the latter confirmed its correctness.
4. By virtue of article 56 of the Regulation, the Spanish SA identified the Information and Data
Protection Commissioner (the “Commissioner”) as the lead supervisory authority competent
to handle the complaint. The Commissioner confirmed with the Spanish SA that it is indeed the
lead supervisory authority for the present case, and he proceeded to investigate the complaint
on the basis of the procedure set out in article 60 of the Regulation.
INVESTIGATION
5. On the 5th February 2021, pursuant to article 58(1)(a) of the Regulation, the Commissioner
requested the controller to provide its submissions in relation to the allegations raised by the
Page 2 of 10
complainant. In terms of this Office’s internal investigation procedure, the controller was
provided with a copy of the complaint together with the supporting documents attacted thereto.
6. By means of an e-mail dated the 22nd February 2021, the controller submitted the following
principal legal arguments for the Commissioner to consider in the legal analysis of the case:
i. that the data subject was in a portfolio that the controller purchased from
( ”);
ii. that on the 8th August 20185 , the complainant was made aware of the purchase of
his debt by means of a “welcome letter” (the “welcome letter”), wherein he was
informed about the possibility that his data could be notified to insolvency files, or
credit bureaus. According to the controller, it is not necessary to obtain the data
subject’s consent to be reported to , but it is sufficient to inform
him or her correctly. The controller attached a copy of this letter;
iii. that on the 26th March 2019, the controller sent to the complainant another written
payment request whereby he was informed of the possibility that his details could
be notified to insolvency, or credit bureau files. The controller attached a copy of
this letter;
iv. that on the 7th May 2019, given that he had not paid the outstanding debt, the
complainant was registered in by the controller;
v. that on the 26th November 2020, the complainant exercised his right to erasure
directly with , which request was refused because his debt was
pending and the requirements for registering him into the register were met; and
vi. that on the 2nd February 2021, he was removed from because
legal proceedings were initiated in relation to the debt owed.
7. On the 4th November 2021, the Commissioner requested the controller to provide him with
evidence that the welcome letter was delivered to the complainant.
5
This letter is dated the 11th August 2018.
Page 3 of 10
8. On the 9th November 2021, the controller submitted a certification issued by its service provider
in charge of dispatching outbound mail which, in the controller’s opinion, demonstrates that
the letter of the 11th August 2018 was sent to the complainant and that it was not returned.
9. On the 9th November 2021, the Commissioner requested the controller to confirm the delivery
method of the letter, i.e. regular or registered mail.
10. On the 16th November 2021, the controller confirmed that the document was not sent by
registered letter, which means that the controller does not have any written confirmation, or
acknowledgement of delivery. The controller pointed out that local regulations do not require
that such communication is sent by registered letter. In addition, the controller sustained that in
subsequent telephone calls between the controller and the complainant, the latter acknowledged
receipt of the welcome letter.
11. On the 15th February 2022, the Commissioner requested the controller to specify the legal basis
pursuant to which the personal data were transferred by the controller to .
12. On the 18th February 2022, the controller responded that “[t]he legal basis for reporting these
data to is legitimate interest art. (6.1.f GDPR) of the creditor but and also public interest
(art. 6.1.e GDPR), as Credit Bureaus help to preventing excessive indebtedness from growing
in our country (gives information to financial entities/banks about someone who is asking for
a loan and it contributes or the stability of financial system) and prevent excessive burden for
the economy. Also, this data communication to Credit Bureaus is provided in article 20 of the
Spanish Data protection Law (Spanish GDPR transposition Law) as a lawful and legitimate
data processing”.
13. On the 21st March 2022, the Commissioner requested the controller to specify the date when
the controller received the complainant’s personal data from . The controller
responded by means of an email dated 28th March 2022, wherein it stated that the complainant’s
personal data was received for the first time on the 31st July 2018, which is the date when a debt
portfolio purchase agreement between and the controller was signed before a notary
in Spain.
14. On the 30th March 2022, the Commissioner further requested the controller to submit a copy of
such agreement.
Page 4 of 10
15. On the 1st April 2022, the controller submitted a notarial testimony stating that a purchase of a
debt portfolio occurred on the 31st July 2018, including an informal translation into English.
However it did not submit a copy of the debt portfolio purchase agreement as requested by the
Commissioner. Hence, on the 22nd April 2022, the Commissioner reiterated his request.
16. On the 27th April 2022, the controller submitted a copy of a “purchase and assignment portfolio
without recourse deed”, dated the 31st July 2018, entered into between the legal representatives
of and the controller.
LEGAL ANALYSIS AND DECISION
17. In the legal analysis of the case, the Commissioner sought to examine and determine whether:
i. the controller complied with its obligations in terms of transparency in respect of the
complainant when the controller received the complainant’s personal data from
; and
ii. the controller processed the complainant’s personal data in a lawful manner when it
disclosed them to .
The obligation to provide information to the data subject
18. Transparency is a long-established feature of the law of the EU6 and one of the key principles
of processing personal data. Together with the principle of lawfulness and fairness, it is
enshrined in article 5(1)(a) of the Regulation, which provides that personal data shall be
“processed lawfully, fairly and in a transparent manner in relation to the data subject”
[emphasis added].
19. One of the components of the transparency obligation is the provision of information to data
subjects relating to fair processing7 in the manner prescribed by law. The Regulation set forth
the categories of information that shall be provided to a data subject in relation to the processing
of their personal data, more specifically, by virtue of article 13 thereof, when the data is
6
Article 29 Working Party, Guidelines on Transparency under Regulation 2016/679, WP 260 rev. 01, as last
revised and adopted on the 11th April 2018 (“WP 260”), page 4.
7
Ibid.
Page 5 of 10
collected from the data subject, and by virtue of article 14, when the data is obtained from
another source8 .
20. In the welcome letter, the controller declared that it had obtained the complainant’s personal
data from , which means that article 14 of the Regulation applies to the present case.
21. Article 14 of the Regulation places an obligation upon the controller to provide the data subject
with details about the processing activity where the personal data have not been obtained
directly from him or her, including:
(a) the identity and the contact details of the controller and, where applicable, of the
controller’s representative;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the
legal basis for the processing;
(d) the categories of personal data concerned;
(e) the recipients or categories of recipients of the personal data, if any;
(f) where applicable, that the controller intends to transfer personal data to a recipient in a
third country or international organisation and the existence or absence of an adequacy
decision by the Commission, or in the case of transfers referred to in Article 46 or 47,
or the second subparagraph of Article 49(1), reference to the appropriate or suitable
safeguards and the means to obtain a copy of them or where they have been made
available.
22. Paragraph 2 thereof stipulates that in addition to the information referred to in paragraph 1, the
controller shall provide the data subject with the following information necessary to ensure fair
and transparent processing in respect of the data subject:
8
WP 260, page 13.
Page 6 of 10
(a) the period for which the personal data will be stored, or if that is not possible, the criteria
used to determine that period;
(b) where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party;
(c) the existence of the right to request from the controller access to and rectification or
erasure of personal data or restriction of processing concerning the data subject and to
object to processing as well as the right to data portability;
(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the
existence of the right to withdraw consent at any time, without affecting the lawfulness
of processing based on consent before its withdrawal;
(e) the right to lodge a complaint with a supervisory authority;
(f) from which source the personal data originate, and if applicable, whether it came from
publicly accessible sources;
(g) the existence of automated decision-making, including profiling, referred to in Article
22(1) and (4) and, at least in those cases, meaningful information about the logic
involved, as well as the significance and the envisaged consequences of such processing
for the data subject.
23. Paragraph 3 of article 14 of the Regulation regulates the timeframes within which the required
information shall be provided to the data subject. As clarified by the Article 29 Working Party9 ,
the general rule is that the information shall be provided to the data subject by no later than one
(1) month after having obtained the personal data.
24. In the present case, the controller obtained the complainant’s personal data after it had
purchased a debt which the complainant owed to . The Commissioner therefore
proceeded to read the “purchase and assignment portfolio without recourse deed” dated the 31st
July 201810 and particularly recital III thereof, which states that, on the 10th July 2018, the
9
WP 260, pages 15 and 16.
10
Supra, para. 18.
Page 7 of 10
controller filed a binding offer with for the portfolio of unpaid credit rights that
included the debt owed by the complainant to . In the same recital, the parties
acknowledged that the controller was given the opportunity to audit certain documentation
related to the same portfolio.
25. Given that the portfolio included the debt owed by the complainant to , as confirmed
by the controller in its submissions 11, this fact unequivocally implies that the controller had
obtained the complainant’s personal data on, or before, the 10th July 2018, which is the date
when the controller made a binding offer with to purchase the debt portfolio.
26. The controller should have therefore provided the complainant with the information of article
14 of the Regulation at the latest by the 10th August 2018.
27. Notwithstanding this, the controller only provided such information to the complainant on, or
after the 20th August 201812, which is the day when the welcome letter was dispatched to the
complainant by controller’s service provider in charge, and which is more than one (1) month
from the date of obtaining the complainant’s personal data.
28. Pursuant to article 14(1)(e) of the Regulation, the controller shall inform the data subject about
the recipients or categories of recipients of the personal data, if any. Whilst the complainant
argued that the controller had neither informed him that he could have been included in an
insolvency register, nor about the controller’s participation in the insolvency registers, through
the welcome letter, the controller specified that in case of further insolvency, his personal data
could have been communicated by to any entity responsible for insolvency
registers or credit bureaus.
The lawfulness of the processing
29. At the outset, the Commissioner observed the principle of lawfulness of processing as held in
article 5(1)(a) of the Regulation, pursuant to which, each and every data processing operation
shall have a lawful ground for processing. Article 6(1) thereof stipulates what may constitute
11
Supra, para 6(i).
12
Supra, para. 8. In its declaration, the service provided stated that the welcome letter was generated, printed and
transferred to the outbound mailing service on the 20th August 2018.
Page 8 of 10
such a legal basis, taking also into consideration all the other core principles for processing
personal data as set out in article 5 of the Regulation.
30. During the course of the investigation, the controller submitted that the processing was
necessary for the purposes of the legitimate interests pursued by both the controller and third
parties. In this regard, the controller sought to protect the following interests: (a) to pursue debt
collection; (b) to inform the public, including financial entities and banks, about the
complainant’s indebtedness, which contributes to the stability of the financial system.
31. In this regard, the Commissioner assessed article 6(1)(f) of the Regulation, which provides that
the processing shall be lawful if it “is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests are overridden by
the interests or fundamental rights and freedoms of the data subject which require protection
of personal data […]” [emphasis added].
32. The Commissioner interprets “interest” to be the broader stake that a controller may have in
the processing, or the benefit that the controller or third parties may derive from such
processing.
33. By virtue of the principle of accountability, it is for the controller to make its own assessment
on a case-by-case basis in order to determine whether the interest is legitimate and therefore
fulfills the requirements of article 6(1)(f) of the Regulation.
34. The Commissioner therefore examined the interest invoked by the controller for processing the
complainant’s personal data when it transferred such personal data to the insolvency register.
Having given due regard to the clarity and specificity of the identified interest, being the aim
of pursuing debt collection on the one hand, and ensuring that third parties can make accurate
assessments when making lending decisions on the other hand, the Commissioner established
that the interest at stake is indeed legitimate.
35. At the same time, having duly examined the circumstances of the case, the Commissioner
established that there are no indicia that such interest is overridden by the interests or
fundamental rights and freedoms of the data subject which require protection of personal data.
Page 9 of 10