AEPD (Spain) - TD/00054/2020

AEPD - TD/00054/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 12 GDPR Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	None
Parties:	CaixaBank S.A.
National Case Number/Name:	TD/00054/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) ordered a bank to complete its response following an access requests under Articles 12 and 15 GDPR.

English Summary

Facts

The complainant sought access to the information held by CaixaBank. After a first response from the bank, she complained that the information was "insufficient, unrealistic, and that a part of them were concealed". CaixaBank refused to disclose further details.

Dispute

Whether the complainant's right to access under Article 15 GDPR has been violated.

Holding

The AEPD confirmed that CaixaBank's response was incomplete and that the "purpose of these proceedings is to ensure that the guarantees and rights of the persons concerned are duly restored". The AEPD gave CaixaBank ten working days to either comply with the request or motivate the refusal.

Comment

On the AEPD's competence. The Authority noted that it is not competent to settle matters arising from a contractual relationship, such as the accuracy of the amount of debt owed or the determination of the conditions of a contractual provision.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

File No: TD/00054/2020
1037-100919
RESOLUTION Nº: R/00319/2020
Having regard to the complaint made to this Agency by Ms. A.A.A., (from
now the complainant), against CAIXABANK, S.A. (now the
claimed), because their right of access has not been duly attended to.
The procedural actions provided for in Title VIII of the Law have been carried out
Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of
digital rights (hereinafter referred to as LOPDGDD), the following have been found
FACTS
FIRST: The complainant exercised her right of access against the respondent with a tax identification number (NIF)
A08663619, without having received the legally established response to your request.
The claimant provides various documentation relating to the claim
raised before this Agency and on the exercise of the right exercised.
 On 3 April 2018, in view of the claim for the right of access, this
Agency resolved:
"In relation to your claim for protection of rights submitted to this
Agency referring to CAIXABANK, S.A., from the analysis of the documentation provided
It follows that it does not concern the exercise of the right recognised in Article
15.1 of Organic Law 15/1999, of 13 December, on the Protection of Personal Data
Personal Data Protection Act (LOPD), and developed in the Regulations implementing the LOPD,
approved by Royal Decree 1720/2007 of 21 December.
The right of access, as specified in Article 27.1 of the
Regulation, is the right of the person concerned to obtain information on whether his
personal data are being processed, the purpose of which is to
treatment being carried out, as well as the information available
on the origin of such data and the communications made or planned by the
themselves.
Paragraph 3 of that Article specifies that this right is independent
which grant those concerned special laws and, in particular, laws which
regulate the administrative procedure.
Furthermore, Article 29(3) makes it clear that the information
must be provided by the data controller shall comprise all the basic data of the
those resulting from any computer processing, as well as the
information available on the origin of the data, the assignees of the data and the
specification of the specific uses and purposes for which the
data is stored.
Thus, access to copies of certain documents or other information
associated with a business, employment or administrative relationship is not part of the
content of the access right regulated in the data protection regulations,
This question is therefore outside the competence of this Agency.
This is notwithstanding the fact that other legislation covers the obtaining of such
documentation, and the person concerned must apply to the competent authorities,
particularly the organs of consumption.
Consequently, in accordance with Articles 18 and 37(1)(d) of the
LOPD, it is agreed to INADMIT your claim.
SECOND: As a consequence of the Inadmission, you claim before the Audiencia Nacional
that fails:
"...That by dismissing the cause of inadmissibility raised by the party
co-defendant, the action in the main proceedings brought by
the Procurator of the Courts doña (...) in the name and on behalf of DOÑA
A.A.A., against the resolution of 7 May 2018 of the Director of the Agency
Spanish Data Protection Authority, by which the claim of the claimant is rejected
against CaixaBank, S.A., which was involved in the procedure for the protection of rights
TD/01002/2018, and declare the above-mentioned resolution null and void on the grounds that it does not conform to
right, agreeing instead that by the Spanish Data Protection Agency
and in respect of the appellant, initiate proceedings for the protection of
rights against CaixaBank S.A. with express imposition of the procedural costs to
the defendants..."
 This ruling opens a procedure for the processing of this claim and
gives transfer to the respondent to attend the right.
THIRD: In accordance with the tasks laid down in Regulation (EU)
2016/679, of 27 April 2016, General Data Protection (RGPD), proactive
by the data controller, you are required to inform the
Agency of the actions that have been taken to address the complaint
raised. In summary, the following allegations were made:
- The representative/Data Protection Officer of the respondent
in the allegations made during the processing of the
These proceedings, which have already dealt with the right of access
requested both now and earlier in 2017. They provide two letters
sent to the complainant for this purpose, i.e. to comply with the right to
access, one on 5 December 2017 and the current one on 7 April
2020.
- The complainant, who is aware of the allegations of the
transfer made by this Agency and, after having received the right
In summary, the information received is
insufficient, unrealistic and that data are hidden.
 "...That I do NOT agree with the information provided by CaixaBank in exercise my right to access personal data contained in your
files. It provides data on a sheet of paper that does not match reality,
so, they make it up, and the data, with the documents that support that
alleged express authorisation, and that commercial contracting, which has been
repeatedly requested, they hide it. I imagine they do because they don't
have. They do not have any documents to prove the false claims
which reflect in the sheet I received (...) that to date they have not
fulfilled its obligation to provide me with my right of access. It does not provide
the documents that were required, and the scarce data without documents
to confirm their reality that they contribute to a non
correspond to reality (...) CaixaBank SA invented the dates of
products are invented, the numbering of those products is invented
fictitious products, and do not provide any documents proving that the
contracted such products with them and do not provide the authorisations and
consents to be able to dispose of and give away my data which you must have of
each of these alleged products that are said to have
hired..."
- From this Agency, the complainant's allegations were sent to
claimed without, at the date of resolution of this claim, having
Nothing has been said about this.

LEGAL FOUNDATIONS
FIRST: The Director of the Spanish Agency of
Data Protection, as laid down in Article 56(2) in
in relation to Article 57(1)(f), both of Regulation (EU) 2016/679 of
European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter referred to as RGPD); and in article 47 of the
Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of
digital rights (hereinafter LOPDGDD).
SECOND: Article 64.1 of the LOPDGDD, provides the following:
"1. Where the procedure relates solely to the failure of
an application to exercise the rights laid down in Articles 15 to 22 of the
Regulation (EU) 2016/679, will be initiated by a formal admission agreement, which will
shall be adopted in accordance with the following Article.
In this case the period for deciding on the procedure shall be six months, counting
from the date on which the claimant was notified of the agreement to
admission to procedure. After this period, the interested party may consider
estimated your claim."
THIRD: Article 12 of Regulation (EU) 2016/679 of 27 April 2016
General of Data Protection (RGPD), provides that:
"1. The data controller shall take the appropriate measures to facilitate
the person concerned any information referred to in Articles 13 and 14, as well as any
communication pursuant to Articles 15 to 22 and 34 concerning processing, in the form
concise, transparent, intelligible and easily accessible, with clear and simple language, in
In particular, any information directed specifically at a child. The information
shall be provided in writing or by other means, including, where appropriate, by
electronic. At the request of the interested party, the information may be provided
verbally, provided that the identity of the person concerned is proven by other means.
2. The data controller shall facilitate the exercise of his
rights under Articles 15 to 22. In the cases referred to in Article 11
paragraph 2, the controller shall not refuse to act at the request of the data subject for the purpose
to exercise his rights under Articles 15 to 22, unless he can prove
who is not in a position to identify the person concerned.
3. The data controller shall provide the data subject with information concerning his
proceedings on the basis of an application under Articles 15 to 22, and, in
in any case, within one month from the receipt of the application. Said
This deadline may be extended by a further two months if necessary, taking into account the
complexity and the number of applications. The person in charge shall inform the applicant of
any such extension within one month of receipt of the
request, indicating the reasons for the delay. When the interested party submits the
request by electronic means, the information shall be provided by electronic means
where possible, unless the person concerned requests otherwise.
4. If the data controller does not comply with the request of the data subject, he
shall inform without delay, and at the latest after one month, of the receipt of the
application, the reasons for their failure to act and the possibility of submitting a
claim to a supervisory authority and to take legal action.
5. The information provided pursuant to Articles 13 and 14 and any
communication and any action taken pursuant to Articles 15 to 22 and 34
will be free of charge. Where requests are manifestly unfounded or
excessive, especially due to their repetitive nature, the person responsible for
treatment may:
(a) charge a reasonable fee commensurate with the administrative costs incurred
to provide the information or communication or to perform the requested action, or
(b) refuse to act on the request.
The controller shall bear the burden of proving the
manifestly unfounded or excessive.
6. Without prejudice to Article 11, where the person responsible for the
treatment has reasonable doubts as to the identity of the natural person
the application referred to in Articles 15 to 21, may request that the
provide the additional information necessary to confirm the identity of the person concerned.
7. The information to be provided to the persons concerned under Articles
13 and 14 may be transmitted in combination with standardised icons allowing
provide in an easily visible, intelligible and clearly legible manner an adequate
overview of the planned treatment. The icons presented in the format
electronic will be mechanically readable.
8. The Commission shall be empowered to adopt delegated acts in accordance with
Article 92 to specify the information to be submitted through
icons and the procedures for providing standardised icons".
FOURTH: Article 15 of the RGPD provides that:
"1. The data subject shall have the right to obtain from the controller
confirmation as to whether or not personal data concerning you are being processed and, if so
case, right of access to personal data and to the following information:
a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the data have been disclosed; or
personal data will be communicated, in particular to third parties or
international organisations;
(d) if possible, the intended period of retention of the personal data or, of
not be possible, the criteria used to determine this deadline;
(e) the existence of the right to request the person responsible to correct or delete
of personal data or the limitation of the processing of personal data relating to
or to oppose such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data have not been obtained from the data subject, any
information available on their origin;
(h) the existence of automated decisions, including profiling, to
referred to in Article 22(1) and (4) and, at least in such cases, information
The importance and consequences of the new system for the development of the
provided for such processing for the data subject.
2. Where personal data are transferred to a third country or to an organisation
international, the person concerned shall have the right to be informed of the guarantees
appropriate under Article 46 concerning transfer.
3. The controller shall provide a copy of the personal data
object of treatment. The data controller may receive for any other copy requested
a reasonable fee based on administrative costs. When the
The application must be submitted electronically by the applicant, and unless the applicant requests
otherwise provided, the information shall be provided in an electronic format of
common use.
4. The right to obtain a copy referred to in paragraph 3 shall not affect
negatively to the rights and freedoms of others."
FIFTH: Article 13 of the LOPDGDD determines the following:
"1. The right of access of the affected party shall be exercised in accordance with the provisions
in Article 15 of Regulation (EU) 2016/679.
Where the controller processes a large amount of data relating to the data subject and
he exercises his right of access without specifying whether it concerns all or part of
the data controller may request, before providing the information, that the
concerned specifies the data or processing activities to which the
application.
2. The right of access shall be deemed granted if the data controller
provide the affected person with a system of remote, direct and secure access to the data
personal to guarantee, in a permanent way, access to its totality. To such the communication by the person in charge to the person concerned of the way in which he may
access to this system will be sufficient to satisfy the request to exercise the
right.
However, the person concerned may request from the person responsible information concerning
the points set out in Article 15(1) of Regulation (EU) 2016/679 which are not
be included in the remote access system.
3. For the purposes of Article 12(5) of Regulation (EU) 2016/679, the following shall apply
may consider the exercise of the right of access on more than one occasion to be repetitive
during the six-month period, unless there is legitimate cause to do so.
4. Where the person concerned chooses a means other than the one offered to him which entails
disproportionate cost, the application will be considered excessive, and therefore
affected will assume the excess costs that its choice entails. In this case, only
the controller shall be required to satisfy the right of access without
undue delay."

SEVENTH: Before going into the substance of the issues raised, it should be noted
that these proceedings are being conducted following the refusal to
any of the rights regulated by data protection regulations (access,
correction, deletion, limitation, portability and opposition) and aims to
take appropriate measures to ensure that the guarantees and rights of the person concerned
are properly restored. Therefore, in the present case, only
and assessed those issues raised by the complainant that remain
included in the subject matter of the above-mentioned complaints procedure in respect of
data protection.
 The exercise of the right of access, like all other rights, is a
The very personal right consists of the citizen's right to obtain
information on the processing of your data, the possibility of
obtain a copy of the personal data concerning you that is being
object of processing, as well as information, in particular, on the purposes of the
processing, the categories of data, the recipients, any transfers, the time
the possibility of exercising other rights, the information
available on the origin of the data (if not obtained directly from
holder) or the existence of automated decisions, including profiling,
without affecting the data of third parties.
 In the case analysed here, the complainant has exercised its right to
access and the response received is considered to be incomplete and lacking in reality.
This Agency informs the complainant of this fact so that he can complete
your reply or clarify the points raised by the complainant. On the date of the resolution of this
no contribution has been made by the party complained of to the effect that the
right of access requested has been fully met.
On the basis of the foregoing, considering that the present proceedings have
to ensure that the guarantees and rights of those concerned are duly
restored, combining the information in the file with the regulations
referred to in the preceding paragraphs, this complaint must be upheld, as
an incomplete response has been issued.
Finally, if there is a dispute with the controller
on matters arising from the contractual relationship, they should be aware that the Spanish Data Protection Agency is not competent to resolve civil matters,
such as those relating to the civil or commercial validity of the contract, the accuracy of
the amount of the debt, the proper provision of the services contracted or the
interpretation of contractual clauses. The determination of the conditions of the
contractual or commercial service, based on an interpretation of the contract signed
between the parties and their correct application, should be brought before the
administrative or judicial authorities, as it exceeds the scope of the
Agency.
The bodies that issue binding decisions to this effect include
Consumer Arbitration Boards (provided that the creditor voluntarily submits
them), the Telecommunications User Assistance Office
(www.usuariosteleco.gob.es) or the judicial bodies. They are not binding, between
other, the decisions of consumer organisations and offices
municipal consumer goods.
It is therefore appropriate to uphold the claim which gave rise to this
procedure.
Having regard to the above-mentioned and other generally applicable provisions,
the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: ESTIMATE the claim made by Ms. A.A.A. and urge CAIXABANK,
S.A. with NIF A08663619, so that, within ten working days of
notification of the present resolution, send to the complaining party certification in the
to record that he has complied with the right of access exercised by him or
refuse, with reasons, to comply with your request, indicating why your request should not be dealt with
request. The actions taken as a result of this Resolution
must be communicated to this Agency within the same time limit. Failure to comply with this
resolution could lead to the commission of the offence referred to in Article
72.1.m) of the LOPDGDD, which will be sanctioned in accordance with Article 58.2 of the RGPD.
SECOND: TO NOTIFY this resolution to Ms. A.A.A. and CAIXABANK, S.A.
In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public after it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art.
48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the
LPACAP, the interested parties may lodge, on an optional basis, an appeal for reversal
to the Director of the Spanish Data Protection Agency within a period of
month from the day following notification of this resolution or directly
contentious-administrative appeal to the Administrative Chamber of the
Audiencia Nacional, in accordance with Article 25 and paragraph 5 of
the fourth additional provision of Law 29/1998 of 13 July 1998, regulating
Contentious-Administrative Jurisdiction, within two months from
day following notification of this act, as provided for in Article 46(1) of the
referred to Law.
Mar España Martí
Directora de la Agencia Española de Protección de Datos

Translated with www.DeepL.com/Translator (free version)