AEPD (Spain) - EXP202201247: Difference between revisions
m (→Facts) |
m (Ar moved page AEPD (Spain) - PS-00304-2022 to AEPD (Spain) - PS/00304/2022) |
(No difference)
|
Revision as of 12:26, 13 December 2023
AEPD - PS-00304-2022 | |
---|---|
Authority: | AEPD (Spain) |
Jurisdiction: | Spain |
Relevant Law: | Article 4(11) GDPR Article 6 GDPR Article 6(1) GDPR Article 58(2) GDPR Article 83(5) GDPR Article 47 LOPDGDD Article 48(1) LOPDGDD Article 50 LOPDGDD Article 6(1) LOPDGDD Article 63(2) LOPDGDD Article 65(4) LOPDGDD Article 72(1)(b) LOPDGDD |
Type: | Complaint |
Outcome: | Rejected |
Started: | 14.01.2022 |
Decided: | |
Published: | 28.11.2022 |
Fine: | n/a |
Parties: | Data Subject AUTOMOVILES FERSAN, S.A. |
National Case Number/Name: | PS-00304-2022 |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | Spanish |
Original Source: | AEPD (in ES) |
Initial Contributor: | isabela.maria.rosal |
Spanish DPA ruled that the processing of the personal data of the co-owner of a car bought via a loan is legitimate, even without their direct consent, highlighting that the data subject was not acting as a guarantor.
English Summary
Facts
The data subject made a complaint against the data controller since their personal data was used for allowing the loan for their sister buying a car. The data subject affirms that their personal data were processed by the data controller with no consent and alleged that they were set as the guarantor of the buying without their knowledge. However, there was evidence proving that the data subject knew about the transaction and, as mentioned by the data controller, the data subject is actually the co-owner of the car in dispute, not its guarantor.
Holding
The DPA ruled that processing the personal data of a subject who is the co-owner of the car bought via contract is legitimate, considering Article 6 of the GDPR. There is no need for consent of the data subject for the processing of personal data when they are part of a contract with the data controller. Since the data subject is a part of the co-owner of the car bought and does not act as a guarantor, the execution of a contract is a legitimate legal base for the processing of personal data. Thus, the DPA understood there was no breach of the GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 - File No.: EXP202201247 RESOLUTION OF SANCTIONING PROCEDURE From the procedure instructed by the Spanish Data Protection Agency and based to the following BACKGROUND FIRST: On January 14, 2022, A.A.A. (hereinafter, the complaining party) filed a claim with the Spanish Data Protection Agency. The claim is directed against AUTOMOVILES FERSAN, S.A. with NIF A03071248 (hereinafter, the claimed party). The reasons on which the claim is based are the following: The claimant states that the claimant has made use of her personal data to include them in a vehicle purchase contract without your consent. The complainant states that her personal data was used without her consent to guarantee the sale of a vehicle acquired by his sister, in the processing for its financing. He indicates that his sister made the purchase of the vehicle with the claimed entity, to which, said entity managed the procedures to formalize a loan contract financed by BMW BANK GMBH, using the claimant's data, to obtain sufficient guarantee and carry out the operation. When a non-payment occurs by the purchasing party, the financial institution demands the payment to the claimant, and by requiring this last justification for the required collection, said financial institution provides documents, described by the claimant as false, in which In addition to the personal data of his sister, as the buyer of the vehicle, They also add the personal data of the claimant, as well as her signature. Provides legal demand, and exclusive credit contract in the name of B.B.B. (sister of the claimant) SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), on February 3, 2022, said claim was transferred to the claimed party, so that it could proceed with its analysis and inform this Agency in the within one month, of the actions carried out to adapt to the requirements provided for in the data protection regulations. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/6 The transfer, which was carried out in accordance with the rules established in Law 39/2015, of October 1, of the Common Administrative Procedure of Administrations Public (hereinafter, LPACAP), was collected on February 4, 2022 as It appears in the acknowledgment of receipt that is in the file. On March 3, 2022, this Agency received a response letter indicating that AUTOMÓVILES FERSÁN, through BMW Group Financial Services, has a clear protocol on the documentation that must be requested when a person applies for financing, this protocol is strictly applied by part of the dealership, and this applies to all its commercials. The four brothers of the family intervene at different times in this operation. family (…), appearing as guarantors of the operation. It is stated that the operation was approved and was viable, with the co-ownership of Mrs. B.B.B. and Mrs. A.A.A.. The relationship of Ms. A.A.A. and his family with AUTOMÓVILES FERSÁN, SA from a Chronological point of view is as follows: October 25, 2018. Ms. C.C.C. (Sister of Mrs. A.A.A.) asks for a budget to AUTOMÓVILES FERSÁN, proposing the purchase and sale contract of the vehicle in the name of a company that is going to be established. October 29, 2018, Ms. C.C.C. Send the census registration and payroll of Ms. B.B.B. November 8, 2018 – D. D.D.D. (Brother of the claimant) send by mail the income 2017 (model100) from Ms. B.B.B.. November 9, 2018, 9:00. Since the operation required an input The option of having guarantors to guarantee the operation is valued very highly. November 9, 2018 - – D. D.D.D. Send payroll and registration by email Mrs. B.B.B. and he writes to (…) (employee of the claimed entity): "Hello (…), I am attaching the payroll and registration. When they ask you for a guarantor, tell me what documentation I have to provide. All the best". November 9, 2018, 6:45 p.m. Once the study of Ms. B.B.B. (sister of the claimant) have to provide collateral or entry of ***AMOUNT.€. THIRD: On April 14, 2022, in accordance with article 65 of the LOPDGDD, the claim presented by the complaining party was admitted for processing. FOURTH: On July 20, 2022, the Director of the Spanish Agency for Data Protection agreed to initiate sanctioning proceedings against the claimed party, in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (in hereinafter, LPACAP), for the alleged violation of article 6.1 of the RGPD, typified in Article 83.5 of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/6 FIFTH: The aforementioned initiation agreement has been notified in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations (hereinafter, LPACAP), the claimed party presented a written of allegations in which, in summary, he stated verbatim the following: (…). See Annex I. (…) Annex II is sent. (…). (…): (…). (…). (…). (…). (…). (…). SIXTH: On August 11, 2022, the procedure instructor agreed to give by reproducing for evidentiary purposes the claim filed by the claimant and your documentation, the documents obtained and generated during the admission phase processing the claim, and the report of previous investigation actions that They are part of the procedure. Likewise, it is considered reproduced for the purposes evidence, the allegations to the agreement to initiate the sanctioning procedure referenced, presented by the claimed entity and the documentation that they accompanies SEVENTH: On August 30, 2022, a proposed resolution was formulated, proposing that the Director of the Spanish Data Protection Agency sanction AUTOMOVILES FERSAN, S.A. with NIF A03071248, for an infringement of article 6.1 of the RGPD, typified in article 83.5 of the RGPD, and for the purposes of prescription, by article 72.1 b) of the LOPDGDD, with a fine of 5,000 euros (five thousand euros) EIGHTH: On September 9, 2022, the claimed entity presents allegations to the proposed resolution pointing out that the claim, in no way moment he acts as a guarantor but as a co-owner. It is further stated that: • (…). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/6 • (…). (…) Of the actions carried out in this procedure and the documentation recorded in the file, the following have been accredited: PROVEN FACTS FIRST: The claimant affirms that her personal data has been used by the defendant without his consent to endorse the sale of a vehicle purchased by his sister Provides legal demand, and exclusive credit contract in the name of B.B.B. (sister of the claimant) SECOND: The claimed entity states that the claimant is a co-owner, since He and his sister bought the vehicle that was the subject of the conflict. Provides: (…) (…) (…) (…) FOUNDATIONS OF LAW Yo In accordance with the powers that article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), grants each control authority and as established in articles 47 and 48.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve this procedure the Director of the Spanish Data Protection Agency. Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Data Protection Agency will be governed by the provisions in Regulation (EU) 2016/679, in this organic law, by the provisions regulations dictated in its development and, insofar as they do not contradict them, with a subsidiary, by the general rules on administrative procedures.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/6 II Article 4.11 of the GDPR defines the consent of the interested party as “any manifestation of free, specific, informed and unequivocal will by which the interested party accepts, either by a declaration or a clear affirmative action, the processing of personal data that concerns you.” In this sense, article 6.1 of the LOPDGDD establishes that “in accordance with the provided in article 4.11 of Regulation (EU) 2016/679, consent is understood to be ment of the affected person any manifestation of free, specific, informed and ineligible will. ambiguity by which he accepts, either through a statement or a clear action “Yes, the processing of personal data that concerns you.” For its part, article 6 of the RGPD establishes the following: "1. The treatment will only be legal if at least one of the following conditions is met: nes: a) the interested party gave his consent for the processing of his personal data for one or more specific purposes; b) the processing is necessary for the execution of a contract in which the interested party is part of or for the application at his request of pre-contractual measures; c) the processing is necessary for compliance with a legal obligation applicable to the responsible for the treatment; d) the processing is necessary to protect vital interests of the interested party or another Physical person; e) the processing is necessary for the fulfillment of a mission carried out in the interest public or in the exercise of public powers conferred on the controller; f) the processing is necessary for the satisfaction of legitimate interests pursued by the person responsible for the treatment or by a third party, provided that on said interests interests or fundamental rights and freedoms of the interest do not prevail. s that require the protection of personal data, particularly when the interest sado be a child. The provisions of letter f) of the first paragraph will not apply to the treatment carried out by public authorities in the exercise of their functions.” III In the present case, the complaining party denounces AUTOMOVILES FERSAN, S.A. because they demand payment from him as a guarantor for a vehicle that his sister B.B.B. despite the fact that, in the financing contract, only his sister appears and not her. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/6 The claimed entity has provided documentation that allows it to prove that the claimant is the joint owner of the vehicle that caused the requested debt and therefore, requires payment not as guarantor but as co-owner. Specifically, it provides the judicial claim for non-payment, in which both the claimant and the B.B.B. as owners of the vehicle and the financing contract. Therefore, after proving that the claimant is the joint owner of the vehicle and clarifying in concept of what the debt is claimed from, we must consider that the entity claimed is legitimized for the use of the personal data of the claimant, based on the prior execution of a purchase and sale contract, and therefore Therefore, a violation of article 6 of the RGPD indicated in the legal basis II. Therefore, after becoming aware of these facts, the Director of the Agency Spanish Data Protection RESOLVES: FIRST: PROCEED TO THE ARCHIVE of these proceedings. SECOND: NOTIFY this resolution to the claimant and defendant. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, and in accordance with the provisions of the arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may optionally file an appeal for reconsideration before the Director of the Agency Spanish Data Protection Agency within a period of one month from the day following the notification of this resolution or directly contentious appeal administrative before the Contentious-administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the provision fourth additional to Law 29/1998, of July 13, regulating the Jurisdiction Contentious-Administrative, within a period of two months from the following day to the notification of this act, as provided for in article 46.1 of the aforementioned Law. Sea Spain Martí Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es