AEPD (Spain) - EXP202304146
From GDPRhub
| AEPD - EXP202304146 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR Article 12 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 08.07.2024 |
| Published: | |
| Fine: | 72,000 EUR |
| Parties: | Wenance Lending de España S.A. |
| National Case Number/Name: | EXP202304146 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | fb |
The DPA fined a fintech company €72,000 after its inadequate measures did not prevent a defrauder, who claimed to be the data subject, to enter into a loan agreement with the controller.
English Summary
Facts
On 21 August 2020, the data subject saw a job posting online. In order to apply for this position, the data subject was requested to send a selfie of them holding their ID card.
After that, they received a request by the controller to pay back a €200 loan.
Since the data subject believed they had never entered in a loan agreement with the controller, they contacted the latter. The controller informed the data subject that on 21 August 2020 it had received a loan request from them and transferred the amount to a bank account. The loan contract had been signed through an electronic signature.
In addition, on 12 August 2022 the data subject asked the controller to delete their data. The controller did not reply to the request.
As for the deletion request, the controller later argued that it could not delete the data since the contract was still in force.
Holding
First, the DPA investigation showed that the data subject was victim of a fraud. The data subject sent their picture and ID card to the defrauder. With this documents the latter digitally signed the loan contract with the controller. Therefore, the data subject never expressed their willingness to enter in such an agreement with the controller.
Second, the DPA noted that the anti-fraud measures taken by the controller were insufficient. More specifically, the controller argued that one of these measures is that the amount of money cannot be transferred to accounts that have been opened for less than 3 months.
However, in the case at hand, the controller transferred the money even though the account had been opened only one day before the loan contract was signed.
Thirdly, the DPA pointed out that this lack of checks led to the transfer of the money to a bank account not owned by the data subject. The DPA added that, in Spain, a bank transfer is successful even if the name in the bank transfer form is different from the account’s actual holder name.
Therefore, the DPA found that the controller had processed personal data without a proper legal basis, since the data subject had never entered in a contract with the controller. For these reasons, it found a violation of Article 6(1) GDPR.
Fourthly, as for the deletion request, the DPA noted that the controller should have replied to the request even if it believed that the request should have been rejected. Therefore, it found a violation of Article 12 GDPR.
On these grounds, the DPA issued a €72,000 fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/28 File No.: EXP202304146 SANCTIONING PROCEDURE RESOLUTION From the procedure initiated by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: A.A.A. (hereinafter, the complaining party) filed a complaint with the Spanish Data Protection Agency on February 8, 2023. The claim is directed against WENANCE LENDING DE ESPAÑA, S.A. with NIF A67194746 (hereinafter, the respondent party, WELP or WENANCE). The reasons on which the claim is based are the following: The complaining party states that WENANCE is imputing a debt to it that does not correspond to it, since it comes from the contracting of a loan made in an allegedly fraudulent manner. The loan was contracted on August 21, 2020. Along with the notification, a burofax is provided addressed by the claimant to WENANCE, dated August 12, 2022, in which it informs the claimant that it does not recognize the debt, nor that it has contracted any credit with the defendant; it also requires the claimant to stop processing its data in the future. It is deduced that the burofax was sent by the claimant after having received a notification or request for payment of the credit entered into. To said burofax, the claimant attaches two complaints that it filed with the National Police for these events (filed in October and December 2020). The first of them contains facts that could explain a possible impersonation of the claimant's identity: “On August 21 [2020] I saw a job offer on the milanuncios page. That in the advertisement they gave the telephone number ***TELEPHONE.1 to contact. The declarant contacts this number, indicating that she should send a Selfie of herself with the photo of the DNI front and back. That the declarant does so and does not receive a response again. That on the date [06/10/2020] her mother has received a call in which a financial insurer tells her that she owes 200 euros plus interest on a loan she had requested. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/28 That the declarant calls said company by telephone at ***TELEPHONE.2, who informs her of her loan, stating that she owes 319 euros and that she has to return it. And that there is an associate in Banco Santander, but it is not in her name. That the declarant contacts the collections company “welp.es” by e-mail from where they provide her with the capture of the contract, which she provides herewith.” In addition, the claimant provides a document called “Exercise of the right of deletion” addressed to the respondent party dated 02/02/2023. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), said claim was forwarded to WENANCE, so that it could proceed to analyze it and inform this Agency within one month of the actions taken to comply with the requirements provided for in the data protection regulations. The transfer, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was collected on March 31, 2023 as stated in the acknowledgement of receipt in the file. On May 4, 2023, this Agency received a response letter indicating the following: - The claimant effectively contracted a loan with WENANCE dated August 21, 2020. A copy of the same is provided. - At the time, she requested deletion of her personal data, but this could not be accepted because the contract was still in force - She claims that she considers the claimant's version "implausible" for several reasons: o In her opinion, it is impossible that on the same day that she gave her data to a third party, the latter opened a current account at Banco Santander (for the payment of the loan amount). o WENANCE only allows the amount of the requested credit to be sent to bank accounts that are more than three months old o WENANCE makes, through its payment service provider, a prior deposit to verify the ownership of the bank account o In addition, it notes that the complainant provides a complaint from October 2020, but is nevertheless surprised that two and a half years later there is no complaint or any type of judicial investigation C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/28 It provides a copy of the contract that would be signed electronically, by sending it to an email address and subsequent confirmation through a code sent by SMS to the mobile phone. The email address listed is: ***EMAIL.1. and the contact telephone line for sending the SMS: ***PHONE.1 THIRD: On May 8, 2023, in accordance with article 65 of the LOPDGDD, the claim submitted by the complaining party was admitted for processing. FOURTH: The General Subdirectorate of Data Inspection proceeded to carry out preliminary investigation actions to clarify the facts in question, pursuant to the functions assigned to the control authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and in accordance with the provisions of Title VII, Chapter I, Section Two, of the LOPDGDD, having knowledge, in essence, of the following: Date on which the claimed events took place: - Opening of the allegedly fraudulent loan: 08/21/2020 - Dates of police reports: 10/06/20 and 12/16/2020 - Date of submission of the burofax for the right of deletion to WENANCE: 12/08/2022. RESULT OF THE INVESTIGATION ACTIONS After analyzing the evidence of electronic signature of the contract provided by the respondent party, it is observed that: - It is a certificate issued by the trusted third party LLEIDANETWORKS Serveis Telemàtics S.A. (hereinafter ***URL.1), which is a qualified electronic trust service provider in accordance with the provisions of the eIDAS Regulation for the entire European Union and provides the qualified certified electronic delivery service, as published on the website of the Ministry of Economic Affairs and Digital Transformation. - The WELP CIF shown on the certificate is incorrect. The certificate shows: Welp.es (A12345678), when the actual WELP CIF is A67194746. The contract between WELP and ***URL.1 will be requested later and it will be confirmed that there is indeed a contract between them for certified electronic delivery, although in said contract the CIF also contains a typographical error: A97194746 instead of A67194746. - The signature evidence specified in the certificate is the following: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/28 2020-08-21 09:01:37 UTC-3: A certified process start type EMAIL has been sent to the email ***EMAIL.1. 2020-08-21 09:03:00 UTC-3: A certified OTP notification type SMS has been sent to the phone ***PHONE.1. 2020-08-21 09:03:26 UTC-3: Received an HTTPS request from IP ***IP.1 corresponding to the signing event. - Analyzing the evidence provided along with the previous data, it is perceived that: The email to start the process has originated in UTC-3 and the signature footer of the contract states Buenos Aires, Argentina. (Inspector's clarification: This origin is common in electronic communications certificates with WELP issued by ***URL.1.) The data where the email with the documentation and the SMS with the contract signature code are sent are: ***EMAIL.1 and ***PHONE.1. This phone number matches the phone number listed in the complaint filed with the police by the complainant, the phone number with which he allegedly contacted to send the photos and apply for the job. The data that appear in the SEPA Direct Debit Order as Debtor are: o Name and surname: A.A.A. o Address: Street ***ADDRESS.1 o Bank: BANCO SANTANDER o IBAN: ***IBAN.1 (Account number where the loan was received, whose holder is supposedly the claimant) Process of request to the claimant On June 16, 2023, the claimant is requested additional information to gather clarifications on the date and data provided for the job offer, on the means used to provide said data and on the results obtained from any investigation related to the matter, originating from the filing of police reports. No response has been received from the claimant. Request to BANCO SANTANDER On June 16, 2023, a request for information was sent to BANCO SANTANDER in which it requested, among other things, the data of the complainant that they have in their systems, information on all contracts entered into with the complainant, as well as the identification and contact information of the holder of the bank account ***ACCOUNT.1 and its registration and deregistration date. (Remember that this bank account is the one to which WELP sent the amount of the credit granted). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/28 BANCO SANTANDER sends its response dated June 26, 2023, in which it states that: 1.- The holder of the bank account ***ACCOUNT.1 corresponds to the client B.B.B., DNI ***NIF.1, as the only party/holder with registration date 08/20/2020 and cancellation 01/15/2021. It provides a screenshot of the contracts of the client B.B.B. together with their registration and cancellation dates. It is therefore observed that the account receiving the amount of the credit is not owned by the complaining party. 2.- Provide the following details of the client B.B.B.: - Email: ***EMAIL.2 - Telephone: ***PHONE.3 - Address: Street ***ADDRESS.2. - Client since April 14, 2020. 3.- Provide the following details of the complaining party: - Email: ***EMAIL.1 - Telephone: ***PHONE.1 - Address: Street ***ADDRESS.1. - Client since June 30, 2021. 4.- Provide the active contracts of the complaining party. Among them is a current account whose number does not match the data provided by WELP. Request for information from WELP. On June 16, 2023, a request for information was sent to WELP in which it was asked, among other things, for the data of the complainant that it had in its systems, information on all contracts entered into with the complainant, as well as a detailed description of the procedure for the contracting of this bank loan and a copy of the contacts maintained with the complainant and the claims received by it in relation to the reported facts. WELP sent its written statement of allegations on June 26, 2023 and expanded it on July 3, 2023, together with the following documentation: 1.- First written response to the request. 2.- Agreement on the appointment of WELP's DPO. 3.- “Documentary Set”: Document that includes the following documentation: 1- Details of the claimant: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/28 2- List of all contracted products. 3- Procedure for contracting WELP bank loans. 4- Procedure for contracting the loan originating the claim. 5- Agent Validation Annex, which validated the documentation manually. 6- Documentation collected in the formalization of the contract to verify the identity of the claimant. 7- Documents containing records and communications received by the claimant. Pages. 8- Contract signed between WELP and ***URL.1. 4.- Video with the audios of the communications held between the claimant and WENANCE in October 2020. 5.- Second written response to the request. 6.- Certificate from BANCO SANTANDER dated June 28, 2023, issuing the amount of the loan to the account of the beneficiary “A.A.A.”, ***ACCOUNT.1. Point 1.- Having requested the data of the claimant that they have in their systems, WELP sends screenshots of the different systems where the data and/or information relating to the claimant are recorded. The following information is noteworthy: Email: ***EMAIL.1 and ***PHONE.1. Telephones: (…). This last telephone number matches the one in SANTANDER's systems. IBAN: ***ACCOUNT.1. Cases (incidents) dated 06/10/2020, 06/10/2020, 07/10/2020, 21/01/2021 and 21/06/2021. Capture of incident, with the text “I am A.A.A. with Dni ***NIF.1 and I am contacting you because I have to report that my identity has been stolen, by signing a contract with you and the police have asked me to ask you for a proof showing the debt that is in my name and the phone number from which it was made in order to proceed with the complaint, I would like you to provide it to me. Many thanks” Transfer receipt dated 08/21/2020 in favor of ***NIF.1 CONCEPT Welp - 235212 It also provides the signed contract (similar to the one provided in the response to the transfer) and screenshots with information about said contract. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/28 Point 2.- Regarding the products contracted by the complainant, WELP shows Welp Bronce SI Full Loan for the amount of €200 with a subscription date of 08/21/2020. Point 3.- Having requested the Procedure for contracting bank loans, the respondent indicates: I. Loan application The loan was requested online. The application could be made by any natural person with an Internet connection and access to the page who met the following requirements: a. Be a legal resident in Spain. b. Be of legal age. c. Have a bank account in the name of the holder requesting the loan. d. Demonstrate recurring income. e. Have a telephone number. f. Have an email address. II. Classification of the application and request for documentation Within Wenance's usual operations, when the consumer loan application was for a value of less than one thousand euros (€1,000), in accordance with Wenance's Manual for the Prevention of Money Laundering and Financing of Terrorism and, specifically, with its Customer Acceptance Policy dated January 18, 2019, simplified due diligence measures were required, as established in article 16 h) of Royal Decree 304/2014, of May 5, approving the Regulation of Law 10/2010, of April 28, on the prevention of money laundering and the financing of terrorism, which stipulated the following: "Obliged subjects may apply, depending on the risk, simplified due diligence measures regarding the following products or services: operations: h) Consumer credit contracts for an amount less than 2,500 euros provided that the repayment is made exclusively by charging a current account opened in the name of the debtor in a credit institution domiciled in the European Union or in equivalent third countries» Thus, in accordance with the above, Wenance carried out the following checks for said loans: a) completing an application form in which they provided the following personal information: 1. Name and surname. 2. Identification number (DNI/NIE). 3. Date of birth. 4. Address. 5. Income. 6. Telephone. 7. Email. 8. Bank account number. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/28 b) Subsequently, if the clients met the requirements, they had to send the following documentation, which would be subsequently verified by an agent from the Sales department: 1. Photo of the DNI/NIE, both the front and the back. 2. Selfie holding the identity document in the hand. 3. Proof of income. 4. Proof of ownership of the bank account. III. Validation Once the documentation was received, the Sales Department Agent validated that the data provided by the client matched the documentation provided. In addition, he verified that the client was the owner of the bank account, that the DNI/NIE was valid and that the selfie photo matched the photo on the DNI/NIE, (…). If the client met all the requirements, the loan application was approved. IV. Contracting Subsequently, the client received the contract by email for signature and was sent a code via SMS to proceed with the signing of the contract. Once the contract was signed, the operations department issued a transfer order to the indicated account manually and the requested amount was deposited. Point 4.- Regarding the contracting of the claimant's loan, WELP reports that it was requested online and simplified measures were applied since it did not exceed one thousand euros: a) completing the application form and indicating personal data. b) Sending the following documentation: 1. Photo of the DNI/NIE, both the front and the back. 2. Selfie holding the identity document in the hand. 3. Proof of income and copy of the last pay slip. 4. Proof of ownership of the bank account. “The loan was pre-approved and the documentation was verified by C.C.C., a former agent of the Sales department, who verified that the data provided by the client matched the attached documentation. In addition, she verified that the DNI data matched those reflected in the bank account. Likewise, she verified that the DNI was valid and that the selfie photo matched the photo on the DNI/NIE.” Point 5.- Regarding the security mechanisms and measures used by WELP to ensure the authenticity of the data provided by the client, the respondent party refers to a list of measures, taking into account what was explained in the previous points regarding the applicable procedure: “a) Request for a photocopy of the DNI. b) Request for a photograph holding the document, in order to make a comparison between the applicant and the bearer. c) Request for the last payroll and bank receipt of payment, to manually compare that the data contained in these corresponded with that of the holder of the D.N.I. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/28 d) Telephone call to the number listed to check its operation. e) Validation of all documentation manually by the agent in charge at that time. “ For this validation, WELP provides a copy of the Agent Validation Annex (DOC#2.5) in which in Note 2 it can be seen: “doc ok 08/21/2020 15:53 by C.C.C.” and “data ok 08/21/2020 16:33 by D.D.D.” “f) Request for double authentication factor between the email provided and the telephone, in order to mitigate the risk of falsification in the signing of the contract. g) Manual transfer of the loan amount to the client's account.” Point 6.- Once the documentation provided for the formalization of the contract has been requested, WELP sends a photo of the front and a photo of the back of the ID of the complainant, a photo of the complainant carrying the ID, proof of income and a copy of the last payroll. Both the proof of income provided for the formalization of the contract and the copy of the last payroll are included in (DOC#2.6) and specify the account number ***ACCOUNT.1, an account that has been verified not to belong to the complainant. These documents could be images of the original documents sent by the claimant in which the account number was subsequently modified, before being sent for the loan contract. The respondent has not provided proof of ownership of the bank account which had supposedly been verified by the former Sales Department agent C.C.C.. Point 7.- Having requested information on the checks carried out by Unnax to verify the correspondence of the current account data with the data provided in the loan application process, WELP explains that “After successive checks by WENANCE, it has been verified that, on the date of the loan contract by Ms. A.A.A., the verification service was not performed by UNNAX REGULATORY SERVICES, E.D.E, S.L. (UNNAX), but manually, as indicated in points 3 to 5”. Point 8.- Regarding the contacts maintained with the complainant, WELP provides documents containing records and communications received by the complainant and a video with the audios of the communications maintained between the complainant and WELP in October 2020. It is verified that the exchange of emails has been carried out between the addresses ***EMAIL.1 and ***EMAIL.3. In this exchange of emails it is seen that, in response to the request of the complainant for proof showing the debt in his name and the telephone number from which the complaint was made, WELP provides the amortization table of the loan. Subsequently, the complainant sends WELP a copy of the police report, report 14741/20. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/28 WELP does not indicate any response to the burofax submitted by the complainant dated August 12, 2022. The video provided consists of four audios, recordings of the calls made by the complainant or by her mother. The most relevant information from the calls is the following: Audio 1 (06/10/22): Call from the complainant's mother to WELP. She claims that WELP has called her phone (the mother's, E.E.E.), insists that they have never asked for a loan and requests that all her daughter's data be deleted. Audio 2 (06/10/22): WELP reports that there is proof of a transfer. WELP asks if the account ending in 3689 belongs to the complainant. The complainant confirms that he does not have any account at Banco Santander: (…). At minute 7:54, WELP says: "You have to report it because someone has your data. We are going to track the phone of whoever did it because we have a verification call." Audio 3 (10/07/22): WELP provides the email where the complainant has to send the complaint Audio 4 (10/08/22): The complainant reports that they have filed a complaint with the police and have sent the complaint by email to ***EMAIL.3. At minute 14:06, the complainant asks: "This, since it has already been reported, there will not be any problem, right?" to which WELP responds: "No, now the problem is with the person who made the loan." Point 9.- WELP expands its written allegations by providing a certificate from BANCO SANTANDER dated June 28, 2023, which states the issuance of the amount of the loan to the account of the beneficiary “A.A.A.”, ***ACCOUNT.1. (DOC#4) WELP indicates that “the previous certificate is relevant for the purposes of demonstrating the verification of the authenticity of the account carried out by WENANCE. This is because, as the process was carried out 2 years ago and it is not possible to consult the manual verification carried out by the agent assigned to the account, beyond the documents already provided that are in the WENANCE computer system, through this certificate it is possible to prove, as of today, that the account registered in the loan application is associated with the applicant and that it was to whom the transfer for the amount of the loan was made.” It has been verified that this document is a certificate issued and signed by SANTANDER and it reflects the data that were specified at the time of making the transfer. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/28 Article 59 (Incorrect unique identifiers) of Royal Decree-Law 19/2018, of November 23, on payment services and other urgent financial measures (hereinafter, RDLSP) establishes that: “1. When a payment order is executed in accordance with the unique identifier, it will be considered correctly executed in relation to the beneficiary specified in said identifier.” The extract from the 2020 complaints report of the Bank of Spain in relation to the Unique Identifier indicates: “The payment services regulations indicate that the unique identifier consists of a combination of letters, numbers or signs specified by the payment service provider to the user of said services, which the latter must provide in order to unequivocally identify the other user of the payment service or the payment account of that other user in a payment transaction, and which would be given by the account number (IBAN) provided for the execution of the payment order. Thus, in accordance with the provisions of article 59 of the RDLSP, when a payment order is executed according to the unique identifier, said order will be considered correctly executed in relation to the beneficiary indicated in said identifier, the payment service provider not being responsible for the non-execution or defective execution of the operation when the unique identifier provided by the user was incorrect. However, in such cases, the payment service provider of the ordering party is required to make reasonable efforts to recover the funds, and may charge for such efforts the recovery costs that had been agreed in the framework contract. The payment services regulations also do not establish the obligation of the entities to check that the name of the beneficiary corresponds to that of the holder of the account number of the destination of the transfer or other additional data, beyond the coincidence of the beneficiary IBAN with that indicated in the payment order.” Therefore, the certificate provided by WELP does not allow the ownership of the bank account to be accredited. The RDLSP regulations and the extract from the 2020 complaints report of the Bank of Spain in relation to the Unique Identifier are recorded in the SIGRID system as associated objects. Deductions from the inspection report on the claims of the respondent party. In summary, the statements made by the respondent party and which have been proven to be contradicted are shown: .- “In short, it is impossible that with a mere photo of the complainant with the ID card, an online bank account was opened on the same day that said photo was provided.” The bank account was previously created and it has been confirmed that the ownership of the account does not belong to the complainant. .- “Furthermore, my client, also as a party obliged under the regulations on the Prevention of Money Laundering, as recorded in its prevention manual C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/28 of money laundering and as part of its risk policy, only allows the contracting of loans with persons with bank accounts that are at least 3 months old.” It has been verified that the account was created on August 20, 2020, one day before the contracting of the loan that is the subject of the claim. .- “The above is also evident, since Unnax, through the payment provider, duly accredited under the PSD2 directive, makes a deposit into the applicant's current account (with prior permission) to check whether the current account data corresponds to that provided in the application process (ID, name and surname, address, etc.) and to analyse expenses, income, etc. in order to analyse the applicant's solvency.” The respondent party acknowledges that the validation to verify the correspondence of the current account data with the data provided in the loan application process was manual: “After successive checks by WENANCE, it has been verified that, on the date of the loan contract by Ms. A.A.A., the verification service was not carried out by UNNAX REGULATORY SERVICES, E.D.E, S.L. (UNNAX), but manually, […]”. .- “Lastly (and not least), the complainant provides a complaint from October 2020. Two and a half years later there is no complaint? No judicial investigation? We are talking about €200 being received in the current account ***ACCOUNT.1, which appears in the name of the complainant.” The current account does not appear in the name of the complainant. In addition, it has been verified that, in the recordings provided, WELP indicates to the complainant that they are going to take internal action: "You have to report it because someone has your data. We are going to trace the phone of whoever did it because we have a verification call." WELP also reassures the complainant: "This, as it has already been reported, there will be no problem, right?" to which WELP responds: "No, now the problem is with the person who made the loan." .- “[…] this certificate allows us to prove, as of today, that the account registered in the loan application is associated with the applicant and that the transfer for the amount of the loan was made to the applicant.” It has been verified that this document is a certificate issued and signed by SANTANDER and reflects the data specified at the time of making the transfer, but it does not allow us to prove the ownership of the bank account. CONCLUSIONS C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/28 Claim for debt arising from the contracting of a loan made in an allegedly fraudulent manner. The existence of a transfer from WELP to the beneficiary account of the loan has been demonstrated. It has been confirmed that the account benefiting from the loan does not belong to the complainant but to another person (B.B.B. DNI ***NIF.2) with a registration date of 08/20/2020 and deregistration on 01/15/2021. The account was created on August 20, 2020, one day before the contracting of the loan subject to the claim. It has been verified that the email address and telephone number with which the loan was contracted and which appear in WELP's databases do not match the email address and telephone number that SANTANDER has in its databases and which the complainant has used to contact WELP. It has been established that WELP was aware of the alleged fraudulent contracting since October 6, 2020. WELP has not provided proof of ownership of the bank account that it supposedly had to have manually reviewed for the contracting of the loan. Having requested a copy of the contacts maintained with the complainant in relation to the reported events, WELP does not indicate any response to the burofax submitted by the complainant dated August 12, 2022, although in the response to the transfer it explained that the complainant requested the right to delete the data, which could not be granted due to having an active and unpaid contract between the parties. It has been established that, in the recordings provided, the complainant requests that all data relating to this loan be deleted. The recordings warn that WELP was going to track the phone from which the contract was made, advise the complainant to file a complaint and reassure her that once the complaint has been filed there will be no problem. The complainant has not received notification of the request (by post) as of the date of signature of this report, but it is evident that she provided a lot of information (photos of ID, selfie with ID, payroll and proof of payroll transfer). It has been shown that the statements provided by the respondent in her allegations regarding the transfer are not correct. It has been verified that the SANTANDER certificate presented by the respondent, to prove that the account registered in the loan application is associated with the applicant, reflects the data that was specified at the time of making the transfer, but does not allow the ownership of the bank account to be proven. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 14/28 FIFTH: According to the report collected from the AXESOR tool, the entity WENANCE LENDING DE ESPAÑA, S.A. is a company established in 2018, and with a (…). SIXTH: On July 20, 2023, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent party, for the alleged violation of Article 12 of the GDPR and Article 6.1 of the GDPR, classified in Article 83.5 of the GDPR. SEVENTH: There is reliable evidence of the receipt by the interested party of the aforementioned initiation agreement, which has been notified in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). After the period granted for the formulation of allegations has elapsed, it has been noted that no allegations have been received from the respondent party. Article 64.2.f) of the LPACAP - a provision of which the respondent party was informed in the agreement to open the procedure - establishes that if no allegations are made within the period provided for regarding the content of the initiation agreement, when it contains a precise statement regarding the imputed liability, it may be considered a resolution proposal. In the present case, the agreement to initiate the sanctioning procedure determined the facts in which the charge was specified, the infringement of the GDPR attributed to the respondent and the sanction that could be imposed. Therefore, taking into consideration that the respondent party has not made allegations to the agreement to initiate the procedure and in accordance with the provisions of article 64.2.f) of the LPACAP, the aforementioned agreement to initiate the procedure is considered in the present case a resolution proposal. In view of all the actions taken, the following facts are considered proven by the Spanish Data Protection Agency in the present procedure: PROVEN FACTS FIRST. The complainant declares that on August 21, 2020, he saw a job offer on the website “milanuncios”. The advertisement gave the telephone number ***TELEPHONE.1 to contact. After contacting that number, the complainant claims to have sent a selfie of himself with the photo of the front and back of his ID. SECOND. On 08/21/2020, WENANCE entered into a consumer credit contract, in which, as the borrower, the following data appear: “1. Customer data Name and surname: A.A.A. Date of birth: XXXXXX Address: ***ADDRESS.1 Mobile phone: ***PHONE.1 Email: ***EMAIL.1 NIF/NIE: ***NIF.1 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 15/28 THIRD. The formalization of the celebration of the contract referred to in the proven fact above was carried out through the following procedure: According to the data that appear in the certificate issued by the telecommunications operator LLEIDANETWORKS Serveis Telemàtics S.A. as a trusted service provider, the following steps were followed for the celebration of the contract electronically: - (…). FOURTH. The credit amount was deposited in the current account with code ***ACCOUNT.1. According to the certificate from Banco Santander that appears in the file: 1.- The holder of the bank account ***ACCOUNT.1 corresponds to the client B.B.B., DNI ***NIF.2, (…). 2.- The following details of the client B.B.B. are provided: - Email: ***EMAIL.2 - Telephone: ***TELEPHONE.2 - Address: ***ADDRESS.2. - Client since XXXXXXXXX This proves that the amount of the credit was deposited in a bank account owned by a person other than the claimant. FIFTH. The procedure for granting the credit established by the respondent, depending on the amount of the same, was the following: a) Completion of the application form indicating personal data. b) Submission of the following documentation: a. Photo of the DNI/NIE, both the front and the back. b. Selfie holding the identity document in the hand. c. Proof of income and copy of the last pay slip. d. Proof of ownership of the bank account. SIXTH: The respondent has not provided proof of ownership of the bank account that was supposedly verified by the former Sales department agent. SEVENTH. In relation to the verification of the ownership of the bank account into which the amount of the requested credit was to be paid, the respondent party stated that it had contracted a payment provider, duly accredited under the PSD2 directive, Unnax, a deposit into the applicant's current account (with prior permission) to check whether the current account details correspond to those provided in the application process (ID, name and surname, address, etc.) and to analyse the expenses, income, etc. in order to analyse the applicant's solvency. However, he subsequently claims that after successive checks by WENANCE, it was proven that, on the date the loan was taken out by Ms. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 16/28 A.A.A., the verification service was not carried out by UNNAX REGULATORY SERVICES, E.D.E, S.L. (UNNAX), but manually. The respondent party does not provide any documentation on said verification. EIGHTH. The respondent party claims to have a mechanism to prevent fraud, consisting of requiring as a requirement that the bank account into which the deposit is made is more than three months old. This requirement was not fulfilled, since according to the documentation in the file the dates are the following: - Date of opening of the receiving account at Banco Santander: 08/20/2020 - Date of signing the loan agreement: 08/21/2020 - Date of deposit of the amount into the bank account: 08/21/2020 NINTH. There is a burofax addressed by the claimant to WENANCE, dated August 12, 2022, by which it informs it that it does not recognize the debt, nor that it has contracted any credit with the defendant; it also requires it to stop processing its data in the future. WENANCE acknowledges having received it, indicating that the deletion could not be accepted because the execution of the contract is in force, in its opinion. As stated in the report on preliminary investigation actions, having requested a copy of the contacts maintained with the complainant in relation to the reported events, WELP does not indicate any response to the burofax submitted by the complainant dated August 12, 2022. LEGAL BASIS I Competence In accordance with the powers that article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), grants to each supervisory authority and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. Data Protection. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Data Protection Agency will be governed by the provisions of Regulation (EU) 2016/679, in this organic law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 17/28 II. Preliminary questions In the present case, in accordance with the provisions of article 4.1 of the RGPD, there is evidence of the processing of personal data, since WENANCE LENDING DE ESPAÑA, S.A. carries out this activity in its capacity as controller of the processing, since it is the one who determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR: “Controller” or “controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; if the law of the Union or of the Member States determines. III Applicable provisions Article 5 of the GDPR deals with the principles governing the processing of personal data, which provides: “1. Personal data will be: a) processed lawfully, fairly and in a transparent manner with the interested party (<<lawfulness, fairness and transparency>>) Section 2 of Article 5 of the GDPR establishes that “The data controller will be responsible for compliance with the provisions of section 1 and able to demonstrate it (<<proactive responsibility>>)” Article 6 of the GDPR under the heading “Lawfulness of processing” specifies in its section 1 the cases in which the processing of third party data is considered lawful: “1. Processing will only be lawful if it meets at least one of the following conditions: a) the interested party gave his consent for the processing of his personal data for one or more specific purposes; b) the processing is necessary for the execution of a contract to which the interested party is a party or for the implementation at the request of the latter of pre-contractual measures; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 18/28 The provisions of letter f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their functions.” IV Unfulfilled obligation The respondent party in this initiation agreement is accused of infringing Article 6.1 of the GDPR. The documentation in the file provides evidence that WENANCE processed the personal data of the complainant (name, surname, address, date of birth, DNI number) without any of the grounds for the lawfulness of the processing established in Article 6.1 of the GDPR being met. Indeed, as will be explained below, the respondent party has not provided documentation or information that allows it to be verified that the credit was actually contracted by the complainant. Recital 40 of the GDPR states on this issue: “For processing to be lawful, personal data must be processed with the consent of the data subject or on another legitimate basis established by law, either in this Regulation or by virtue of another Union or Member State law to which this Regulation refers, including the need to comply with the legal obligation applicable to the controller or the need to perform a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.” The administrative file contains a consumer credit contract, corresponding, in whose particular conditions the following appear as “customer data” : “1. Customer data Name and surname: A.A.A. Date of birth: XXXXXXX Address: ***ADDRESS.1 Mobile phone: ***PHONE.1 Email: ***EMAIL.1 NIF/NIE: ***NIF.1 The claimant has denied having given her consent to these contracts and having provided her personal data to WENANCE. She has filed a complaint with the Security Forces and Corps and has exercised her right to erasure against the respondent party. As will be detailed later, WENANCE did not take the necessary actions to ensure that the person taking out the loan was really the claimant party. Furthermore, it was not adequately ensured that the amount of the loan was received by the person who was listed as the borrower C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 19/28 It should be noted that, pursuant to the principle of proactive responsibility (Article 5.2 of the GDPR), which requires the controller of personal data to comply with the principles that govern it, which is of interest here, the principle of legality, and to be able to prove compliance, the burden of proof falls on the controller that the processing of the personal data of the complainant was covered by any of the circumstances of legality provided for in Article 6.1 of the GDPR. In the case at hand, the element of guilt, necessary for penalty liability to arise, results from the lack of diligence demonstrated by the respondent party in complying with article 6.1 of the GDPR. As seen in the background of the claim and subsequent allegations in the preliminary investigation phase, the arguments put forward by the respondent party are basically the following: - Execution of the loan contract and confirmation of the same through a certified electronic signature system WENANCE provides a consumer credit contract. It apparently contains the data of the complainant. According to the data appearing in the certificate issued by "the telecommunications operator LLEIDANETWORKS Serveis Telemàtics S.A. as a trusted service provider, the following steps were followed to conclude the contract electronically: (…). There is an appearance of a validly executed contract. However, as stated in the report of preliminary investigation actions, analyzing the evidence provided together with the previous data, it is perceived that: - The data where the email with the documentation and the SMS with the contract signature code are sent are: ***EMAIL.1 and ***PHONE.1. - This phone number coincides with the phone number that appears in the complaint filed with the police by the complainant, the phone number with which she allegedly contacted to send the photos and request the credit. - However, these contact details do not coincide with those that the complainant herself provided to BANCO SANTANDER (remember that she herself was also a client of said bank). Nor with the complainant's phone number that is included in the complaint. In any case, the conclusion of the contract by electronic means only presupposes that the alleged impersonator would have obtained and provided said contact details (e- mail and telephone number for confirmation of the contract), and it is necessary that, either at the time of requesting the contract or at the time of remittance of the amount C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 20/28 granted, the respondent party ensured that the applicant for the credit coincided with the holder of the destination bank account. - Ensuring the ownership of the destination account According to the allegations of the respondent party, it had a double mechanism to ensure that the amount of the credit requested was received in a bank account owned by the person who actually requested it. These mechanisms were the following: - Making a prior deposit, so that said ownership is confirmed. - The need for the bank account in which the amount is deposited to be at least three months old. Both are indeed basic precautions. Through the first, the confirmation of the ownership of the account is received, so that the remittance of the requested amount to someone who is not the true owner is avoided. And through the second, cases are avoided in which the impersonation of the ownership has been carried out in the bank account itself, so that until three months have passed since the opening, a credit cannot be received in it. This last aspect is especially important, since, as detailed in the factual narration, the credit was requested on the same day that the claimant had sent her data to a third party, presumably with fraudulent intentions in the latter's actions. Well, both precautions were negligently ignored by the complainant. In relation to the sending of a prior deposit to determine the ownership of the current account, (through its payment service provider), WENANCE has stated, in its response to the inspection, that “After successive checks by WENANCE, it has been verified that, on the date of the contracting of the loan by Ms. A.A.A., the verification service was not carried out by UNNAX REGULATORY SERVICES, E.D.E, S.L. (UNNAX), but manually, as indicated in points 3 to 5”. Thus, this verification was not carried out. And what is more important: from the investigation carried out by this Agency, there is evidence that the destination current account was not owned by the complainant but by a third party. In deed, according to the information provided by Banco Santander to the inspection: ´ “1.- The holder of the bank account ***ACCOUNT.1 corresponds to the client B.B.B., DNI ***NIF.2, as the only participant/holder with registration date 08/20/2020 and cancellation date 01/15/2021. Provide a screenshot of the contracts of the client B.B.B. along with their registration and cancellation dates. 2.- Provide the following details of the client B.B.B. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 21/28 - Email: ***EMAIL.2 - Telephone: ***TELEPHONE.1 - Address: ***ADDRESS.2 - Client since XXXXXXXX” The absence of controls, therefore, allowed the amount of the credit to be transferred to a person other than the one who claimed to have contracted. In this respect, it is hardly necessary to refute the insufficiency of the transfer certificate issued at the request of WENANCE by BANCO SANTANDER. In effect, the only thing that would prove is that the transfer request was made in favor of the claimant, and to the current account number ***ACCOUNT.1. That is, as the inspector's report rightly points out: “The payment services regulations also do not establish the obligation of the entities to check that the name of the beneficiary corresponds to that of the holder of the account number of the transfer destination or other additional data, beyond the coincidence of the beneficiary's IBAN with that indicated in the payment order. Therefore, the certificate provided by WELP does not allow the ownership of the bank account to be accredited.” As regards the second mechanism, that is, the necessary 3-month seniority in the bank account for the destination of the loan amount, the relevant dates are the following: - Contracting of the credit: 08/21/2020 (confirmed by the respondent party itself) - Deposit of the loan amount (€200) in the bank account: 08/21/2020 (confirmed by the transfer certificate issued by Banco Santander) - Opening date of the destination account no. ***ACCOUNT.1.: 08/20/2020 (confirmed by Banco Santander certificate) This confirms that the bank account was opened only one day before the contracting of the credit and the remittance to it of the contracted amount. The measure that the respondent party itself claims to have implemented was not fulfilled. It is important to highlight the necessary compliance with security measures such as those detailed (but not complied with) by the complainant. Indeed, by checking the ownership of the current account, the amount would have been avoided from being sent to a person other than the one who had apparently requested the credit. And by checking the age of the account, this situation would have also been avoided even if the impersonator had (using the documentation previously obtained) been able to open a current account in the name of the complainant, since it would have been necessary to wait the three-month period. Given the lack of measures that there is evidence of occurred in the operations of the defendant, the result was not only the processing of data without any legitimacy on the part of the data controller, but also the result of the non-payment by C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 22/28 the impersonator has led to the claim for liability of the complainant itself, in whose name the improperly contracted credit appears. This is apart from the possible inclusion in data processing on financial solvency. For all these reasons, it is considered that WENANCE processed the personal data of the complainant without legitimacy, since a consumer credit was contracted in its name without it having given its response, or requested the contract, or any other basis for legitimacy of article 6.1 of the GDPR. V Classification and qualification of the infringement According to the evidence in the file, it is considered to be proven that the processing of the complainant's personal data carried out by WENANCE, which signed a consumer credit contract in her name, was not covered by any of the legal bases established in article 6.1 of the RGPD. Therefore, the known facts constitute an infringement of article 6.1 of the RGPD, classified in article 83.5.a) of the RGPD, a provision that provides: “5. Infringements of the following provisions shall be punished, in accordance with section 2, with administrative fines of up to EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual turnover of the previous financial year, whichever is higher: a) The basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9.” In order to determine the limitation period for infringements, the provisions of the LOPDGDD shall apply, which classifies the infringement charged to the defendant as very serious and sets a limitation period of three years for it. Article 72.1.a) of the LOPDGDD provides: “1. Pursuant to the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein and, in particular, the following are considered to be very serious and will be subject to a three-year statute of limitations: [...] b) The processing of personal data without any of the conditions for the lawfulness of processing established in Article 6 of Regulation (EU) 2016/679 being met.” VI Proposed sanction The corrective powers attributed to this Agency as a supervisory authority are listed in Article 58.2 of the GDPR, paragraphs a) to j). The provision mentions among them the power to impose an administrative fine in accordance with Article 83 of the GDPR (Article 58.2. i). Also, the power to order the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 23/28 data controller to comply with the provisions of the GDPR, where appropriate, in a certain manner and within a specified period (Article 58.2. d). In the present case, WENANCE is subject to an administrative fine in accordance with Article 58.2.i) of the GDPR for its infringement of Article 6.1 of the GDPR. Article 83 of the GDPR, “General conditions for the imposition of administrative fines”, states in its section 1 that the supervisory authority shall ensure that the imposition of fines for infringements of this Regulation indicated in sections 4, 5 and 6, complies in each individual case with the principles of effectiveness, proportionality and deterrent effect. The principle of proportionality requires a correlation between the infringement and the sanction, with the prohibition of unnecessary or excessive measures, so that it must be suitable to achieve the purposes that justify it. Article 83.2 of the GDPR determines the technique to be followed to achieve this adequacy between the sanction and the infringement committed and offers a list of criteria or factors that must be taken into account to grade the sanction. In relation to the facts established, the following factors are observed, which reflect a greater unlawfulness of the conduct and/or the culpability of the offending entity: - Circumstance of article 83.2.a) GDPR: a) the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the processing operation in question as well as the number of interested parties affected and the level of damages they have suffered; The particular seriousness of the infringing conduct must be made clear. Indeed, the negligence that occurs in this case has produced a special impact on the legal sphere and the life of the claimant, since she has been forced to take actions such as the necessary filing of two complaints with the security forces and bodies; the exercise of the right of deletion before the respondent, and to endure recovery actions for a debt of which she was not the true owner. All of this is caused by the unlawful processing carried out by the respondent party - Circumstance of article 83.2.k) RGPD: In relation to article 76.2.b) LOPDGDD: The obvious link between the business activity of the respondent and the processing of personal data. WENANCE's corporate purpose is, among others, the provision of financial services to the public. The execution of the contracts that you enter into with consumers in the development of this activity requires you to process numerous personal data of your clients or even third parties, from identifying data - such as name, surname and NIF -, bank details for direct debit of collections or payments and the postal address. This characteristic of your activity requires you to take extreme diligence in C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 24/28 compliance with the obligations imposed by the personal data protection regulations. The concurrence of mitigating circumstances is not appreciated. In accordance with the criteria of articles 83.1. and 83.2 of the GDPR, the infringement of article 6.1 of the GDPR attributed to WENANCE is sanctioned with the imposition of an administrative fine of €70,000 (SEVENTY THOUSAND euros) VII Exercise of the right to deletion Along with the claim, a burofax addressed to WENANCE was attached, dated 12 August 2022, in which it communicates that it does not recognize the debt, nor that it has contracted any credit with the defendant party; it also requires it to stop processing its data in the future. WENANCE acknowledges having received it, indicating that the deletion could not be accepted because the execution of the contract was in force, in its opinion. As stated in the report on preliminary investigations, having requested a copy of the contacts maintained with the complainant in relation to the reported events, WELP does not indicate any response to the burofax submitted by the complainant dated August 12, 2022. In this regard, article 17 of the GDPR establishes the following: “1. The interested party shall have the right to obtain from the controller without undue delay the deletion of personal data concerning him or her, who shall be obliged to delete personal data without undue delay when any of the following circumstances apply: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based in accordance with point (a) of Article 6(1) or point (a) of Article 9(2) and there is no other legal basis for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject; C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 25/28 f) the personal data have been obtained in relation to the offer of information society services referred to in Article 8, paragraph 1.” In relation to the exercise of this right, paragraphs 2 and 3 of Article 12 of the RGPD establish the following: “2. The controller shall facilitate the exercise by the interested party of his or her rights under Articles 15 to 22. In the cases referred to in Article 11, paragraph 2, the controller shall not refuse to act at the request of the interested party in order to exercise his or her rights under Articles 15 to 22, unless he or she can demonstrate that he or she is not in a position to identify the interested party. 3. The controller shall provide the data subject with information concerning its actions on the basis of a request pursuant to Articles 15 to 22 without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months if necessary, taking into account the complexity and number of requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, stating the reasons for the delay. Where the data subject submits the request by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests that it be provided otherwise.” According to the documentation in the file, it has been established that the respondent party has breached Article 12 of the Regulation since, regardless of the underlying reasons alleged by it in relation to the appropriateness of exercising the right to erasure, it should have responded to the complainant party within one month in relation to the request to exercise the right to erasure. VIII Right to erasure. Classification of the infringement According to the evidence available in this file, it is proven that the complaining party did not respond to the exercise of the right to erasure in accordance with the provisions of Article 12 of the GDPR Therefore, the known facts could constitute an infringement of Article 12 of the GDPR, as defined in Article 83.5.a) of the GDPR, which provides: “5. Infringements of the following provisions shall be punishable, in accordance with paragraph 2, by administrative fines of a maximum of EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the previous financial year, whichever is higher: b) the rights of interested parties pursuant to Articles 12 to 22; In order to determine the limitation period for infringements, the provisions of the LOPDGDD will apply, which classifies the infringement charged to the respondent as very serious and fixed C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 26/28 for it a limitation period of three years. Article 72.1 of the LOPDGDD provides: “1. Pursuant to the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein and, in particular, the following are considered to be very serious and will be subject to a three-year statute of limitations: [...] k) The repeated impediment or obstruction or failure to comply with the exercise of the rights established in Articles 15 to 22 of Regulation (EU) 2016/679. IX Proposed sanction The corrective powers attributed to this Agency as a supervisory authority are listed in Article 58.2 of the GDPR, paragraphs a) to j). The provision mentions among them the power to impose an administrative fine in accordance with Article 83 of the GDPR (Article 58.2. i). Also, the power to order the controller to comply with the provisions of the GDPR, where appropriate, in a certain manner and within a specified period (Article 58.2. d). In the present case, WENANCE is subject to an administrative fine for the infringement of Article 12 of the GDPR pursuant to Article 58.2.i) of the GDPR. Article 83 of the GDPR, “General conditions for the imposition of administrative fines”, states in its section 1 that the supervisory authority shall ensure that the imposition of fines for infringements of this Regulation indicated in paragraphs 4, 5 and 6 comply in each individual case with the principles of effectiveness, proportionality and deterrence. The principle of proportionality requires a correlation between the infringement and the sanction, with the prohibition of unnecessary or excessive measures, so that it must be suitable to achieve the purposes that justify it. Article 83.2. of the GDPR determines the technique to be followed to achieve this adequacy between the sanction and the infringement committed and offers a list of criteria or factors that must be taken into account to grade the sanction. In accordance with the criteria of articles 83.1. and 83.2 of the GDPR, the infringement of Article 12 of the GDPR attributed to WENANCE is sanctioned with the imposition of an administrative fine of €2,000 (two thousand euros) X Adoption of measures Once the infringements have been established, it is agreed to impose on the controller the adoption of appropriate measures to adjust its performance to the regulations mentioned in this act, in accordance with the provisions of the aforementioned article 58.2 d) of the GDPR, according to which C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 27/28 each supervisory authority may “order the controller or processor to comply processing operations with the provisions of this Regulation, where appropriate, in a specific manner and within a specified period…”. It is considered that the respondent party must be ordered to proceed to respond to the request for the right of deletion exercised by the complaining party, within one month from the administrative finality of this resolution. It is noted that failure to comply with the possible order to adopt measures imposed by this body in the sanctioning resolution may be considered as an administrative infringement in accordance with the provisions of the GDPR, classified as an infringement in its article 83.5 and 83.6, and such conduct may motivate the opening of a subsequent administrative sanctioning procedure. Therefore, in accordance with the above, the Director of the Spanish Data Protection Agency, RESOLVES: FIRST: TO IMPOSE on WENANCE LENDING DE ESPAÑA, S.A., with NIF A67194746, for an infringement of Article 6.1 of the GDPR and an infringement of Article 12 of the GDPR, both classified in Article 83.5 of the GDPR, - a fine of SEVENTY THOUSAND EUROS (€70,000) for the infringement of Article 6.1 of the GDPR - a fine of TWO THOUSAND EUROS (€2,000) for the infringement of Article 12 of the GDPR SECOND: TO ORDER WENANCE LENDING DE ESPAÑA, S.A., with NIF A67194746, that by virtue of Article 58.2.d) of the GDPR, within ONE MONTH, proves that it has responded to the request for the right of deletion exercised by the complaining party. THIRD: NOTIFY this resolution to WENANCE LENDING DE ESPAÑA, S.A.. with NIF A67194746 FOURTH: This resolution will be enforceable once the deadline for filing the optional appeal for reconsideration ends (one month from the day following the notification of this resolution) without the interested party having made use of this faculty. The sanctioned party is warned that he must make effective the sanction imposed once this resolution is enforceable, in accordance with the provisions of art. 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by means of its payment, indicating the NIF of the sanctioned party and the procedure number that appears in the heading of this document, in the restricted account number IBAN: ESXX XXXX XXXX XXXX XXXX XXXX (BIC/SWIFT Code: XXXXXXXXXXX), opened in the name of the Spanish Data Protection Agency at C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 28/28 the banking entity CAIXABANK, S.A.. Otherwise, it will be collected during the enforcement period. Once the notification has been received and is enforceable, if the date of enforceability is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this act, as provided for in article 46.1 of the aforementioned Law. Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final resolution may be provisionally suspended by administrative means if the interested party expresses his intention to lodge an administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a written document addressed to the Spanish Data Protection Agency, presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web/], or through one of the other registries provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. He must also transfer to the Agency the documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal within two months from the day following the notification of this resolution, it will terminate the provisional suspension. 938-250923 Mar España Martí Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es
