AEPD (Spain) - EXP202210237

AEPD - AEPD ai-00349-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 6(1)(b) GDPR Article 6(1)(c) GDPR Annex XII(A) General Vehicle Regulation Annex XIV General Vehicle Regulation Articicle 32 General Vehicle Regulation
Type:	Complaint
Outcome:	Rejected
Started:	08.03.2022
Decided:
Published:	28.11.2022
Fine:	n/a
Parties:	Dirección General de Tráfico
National Case Number/Name:	AEPD ai-00349-2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Teresa López

The Spanish DPA held that traffic officials do not have the capacity or possibility of verifying the documentation submitted to change the ownership of a vehicle. If the documentation submitted is fraudulent, no lack of diligence can be imputed.

English Summary

Facts

On 9 August 2019, the data subject lodged a complaint with the police regarding the theft of their wallet. On 20 August 2019, someone purchased a vehicle with the data subject's ID. On 20 January 2020, the vehicle was reported for driving without the compulsory insurance and Dirección General de Tráfico (national traffic department, also known as DGT) notified the previous owner the start of the sanctioning procedure. On 31 January 2020, the new owner (with the documentation of the data subject) files for the change of ownership before the DGT. On August 2020, the data subject receives notification of the traffic offence. On 13 August 2020, the data subject lodged a new complaint with the police, stating that someone had tried to put a car in their name and that they had received notification of the traffic offence.

The data subject states that the DGT did not carry out any checks to validate the change of ownership, allowing the change despite the existence of an outstanding debt on the vehicle. They also allege that the DGT processed their data without a legitimate basis.

Holding

The AEPD held that there was a legal basis to process the data: the documentation was required under the General Vehicle Regulation for the notification of the sale of the vehicle (Article 6(1)(c) GDPR), and, the entry in the vehicle register is made in the performance of a contract to which the data subject is a party (Article (6)(1)(b) GDPR).

The AEPD also found no lack of diligence on the part of the DGT in verifying the identity of the data subject, since the General Vehicle Regulation does not require verification or comparison of signatures, and the traffic official does not have the capacity or possibility to verify them.

Comment

The fact that the processing of the DGT relied on (Article (6)(1)(b) GDPR) and (Article 6(1)(c) GDPR) as legal basis affects the holding of the AEPD since in PS/00126/2021 the AEPD held: "if there is a fraudulent contracting of a product and the consent to perfect such contract has been given by a person other than the data subject (impersonation), we cannot understand that there is contractual consent on the part of the latter, who is harmed. In legal terms, we can consider that in this situation of fraud the legal business would not have been perfected, which would determine the inexistence of legitimacy to process the personal data of the data subject. This is because, once the contract has been signed, the legal basis for the processing that legitimizes the contractor as data controller to process the personal data of the data subject in a product contract would be the one provided for in art. 6.1.b) of the GDPR."

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/10








     File No.: EXP202210237



                  RESOLUTION OF ACTIONS FILE


Of the actions carried out by the Spanish Agency for Data Protection and
based on the following


                                      FACTS

FIRST: A.A.A., on behalf of B.B.B. (hereinafter, the part
claimant) on March 8, 2022 filed a claim with the Agency
Spanish Data Protection. The claim is directed against ADDRESS

GENERAL OF TRAFFIC with NIF Q2816003D (hereinafter, the DGT). The reasons in
on which the claim is based are as follows:

On 08/09/2019, the claimant filed a complaint for the theft of his wallet.
On 08/20/2019, a contract for the sale of a brand vehicle was signed.
***MARK.1, model ***MODELO.1, license plate ***MATRICULA.1 in which it appears

as the buyer the claiming party.
On 08/28/2019, the vehicle was reported for driving without mandatory insurance, beginning
the disciplinary procedure by the DGT by means of a notification sent in
dated 01/20/2020 to the person who appeared as its owner in the Registry
General of Vehicles. .

According to the claimant, on 01/31/2020, the owner appeared at
the dependencies of the DGT to carry out the change of ownership of the referred
car.
According to the claimant's statement, in August 2020 the DGT notified him of the
Committed traffic violation.

On 08/13/2020, the claimant filed a new complaint with the police at the
stating that on 08/29/2019 the police informed him that they had tried to put a
car in his name and that he had received notice of a traffic violation
relating to a car that is not owned by you.

The claimant states that the DGT did not verify

any to ensure that the change of ownership complied with the requirements
necessary, allowing it to be carried out without providing the supporting documentation of the
buyer and there is a current debt on the vehicle.
It also considers that the data protection rights of the company have been infringed.
complaining party when treated by the DGT without any legitimizing basis.


The claim indicates various resolutions of the AEPD in which
concluded "that if fraudulent contracting of a product occurs and the
consent to perfect said contract has been given by a person
other than the owner of the data (identity theft), we cannot understand that

there is contractual consent on the part of the latter who is harmed. (...)
in this situation of fraud the legal business would not have been perfected, which
would determine the lack of legitimacy to process the personal data of the
interested."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/10









Along with the claim, the following is provided:
-Complaint before the National Police of Mislata for the theft of the DNI.

-Alleged fraudulent contract of sale of the vehicle,
-Notifications made by the claimed entity to the people that were included in
their records as owners
-Proof of change of ownership of the vehicle by making a Notification
selling.
-Writ issued by the investigating court by which the opening of

preliminary investigations to clarify the facts.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
forward LOPDGDD), said claim was forwarded to the DGT, so that

proceed to its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements established in the regulations of
Data Protection.

The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations

Public (hereinafter, LPACAP), was collected on 04/24/2022 as stated in the
acknowledgment of receipt in the file.

On 06/23/2022, this Agency received a written response indicating:


"Regarding your brief, regarding the claim made before the Agency by the
representative of the claimant B.B.B., and to comply with the request, in
In accordance with article 65.4 of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights (LOPDGDD), is
reports the following:


As stated in the Agency's request, the facts that motivate the
claim are based on the receipt of a sanction on behalf of the claimant,
allegedly motivated by identity theft. Along with the claim
provides documentation related to a sanction filed under the aforementioned impersonation
identity and other documents associated with it.

Once the documentation provided has been reviewed, it is understood that the claimant had his
national identity document, a document that was later used to
make a purchase-sale of a vehicle and assign ownership of it. I know
attached complaint of the claimant dated 08/09/2019 in the General Directorate of the
Police, in which the theft is indicated, of the national identity document. Bliss

complaint is prior to the sanction and the purchase and sale of the vehicle.

On 08/28/2019, there is an infraction with the vehicle ***MATRICULA.1,
for driving without compulsory insurance, in the name of C.C.C., undocumented. On 01/08/2020
delivery is made at the address indicated by C.C.C., of the sanction with file

***FILE.1. Said sanction goes to the name of the owner of the vehicle, D.D.D. Y
since she is absent, she picks up the same E.E.E..



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/10








On 01/31/2020 the purchase-sale of the vehicle is notified at the Headquarters of Valencia,
in the name of the claimant. In said notification, a purchase document is provided.
sale (dated prior to the sanction) and the change of ownership proceeds. the same

day, the owner of the vehicle presents an allegation to the disciplinary file, indicating
that the vehicle was sold before the date of the sanction and the sale has been notified.

On 08/13/2020, the claimant complained to the General Directorate of the Police that he
received a notification from the DGT regarding the aforementioned sanction. Also
states in the complaint that on 08/29/2019 he was informed that an attempt had been made to

sell a car in your name. A document of proceedings is also attached
prior (act of initiation), dated 09/22/2020, of the Investigating Court number
Valencia 9. The claimant files an appeal for reversal on 03/18/2021,
appeal that is declared inadmissible for being filed out of time. The
claimant on 06/30/2021 presents an extraordinary appeal for review, which

is denied because it is not based on any of the causes related to the
firm acts in administrative channels.
On 01/30/2022, the claimant receives an order of urgency from the
Tax Agency, in order to settle the debt of the traffic penalty in the period
executive with an ordinary surcharge of 20%.


In view of the facts exposed, it is understood that it was presented at the Headquarters of
Valencia all the documentation referred to in Article 32 and Annex XIV, relating to the
Processing and change of ownership of vehicles, of Royal Decree 2822/1998, of 23
December, by which the General Vehicle Regulations are approved.
If the documents presented were falsified or presented fraudulently,

This fact must be denounced before the Justice. The Provincial Headquarters of the
DGT does not have the capabilities required to detect such acts of
illicit nature.

On the other hand, the inadmissibility of the reversal appeal is understood to be correct.

submitted after the deadline on 03/18/2021, even more so when it is evident that the
Claimant has proof of the sanction on 08/30/2020. No sentence indicated
legal firm, which may be a cause provided for in the extraordinary appeal of
review filed, for which reason said appeal is also considered correct
inadmissibility.


In accordance with what was requested in the claim in the file ***FILE.2,
reports:
1.- The decision to be taken by the DGT does not apply. Once the debt has passed to
be required by the Tax Agency, it must be claimed before that
Agency, according to the corresponding sentence. The disciplinary procedure

46-007.199.491/0 has concluded in administrative proceedings for the DGT.
2.- The claimant has not requested the exercise of their rights related to the protection
of data, before the DGT, for which reason no response applies.
3.- The present document serves as an explanation of the causes that have motivated the
incidence.

4.- The implementation of measures adopted to avoid cases of a similar type does not apply,
since the DGT has acted in accordance with current regulations”.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/10








THIRD: On June 8, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the claimant party was admitted for processing.



                            FUNDAMENTALS OF LAW

                                            Yo

In accordance with the functions that article 57.1 a), f) and h) of the Regulation (EU)

2016/679 (General Data Protection Regulation, hereinafter GDPR) confers on
each control authority and according to the provisions of articles 47 and 48.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), is competent to resolve these
investigation actions the Director of the Spanish Agency for the Protection of
Data.


Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with character

subsidiary, by the general rules on administrative procedures."

                                            II

Article 6 of the GDPR, Lawfulness of the treatment, establishes in point 1 that:


       "1. Processing will only be lawful if at least one of the following is fulfilled
       conditions:
       a) the interested party gave his consent for the processing of his data
       personal for one or more specific purposes;
       b) the processing is necessary for the performance of a contract in which the

       interested party or for the application at the request of this of measures
       pre-contractual;
       c) the processing is necessary for compliance with a legal obligation
       applicable to the data controller;
       d) the processing is necessary to protect vital interests of the data subject or

       of another physical person;
       e) the treatment is necessary for the fulfillment of a mission carried out in
       public interest or in the exercise of public powers conferred on the person responsible
       of the treatment;
         f) the processing is necessary for the satisfaction of legitimate interests
       pursued by the data controller or by a third party, provided that

       such interests are not overridden by the interests or the rights and freedoms
       of the interested party that require the protection of personal data,
       in particular when the interested party is a child.

       The provisions of letter f) of the first paragraph shall not apply to the

       processing carried out by public authorities in the exercise of their
       functions.”


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/10








 On the other hand, article 4 of the GDPR, Definitions, in its sections 1, 2 and 11,
notes that:


       “1) “personal data” means any information about an identified natural person
       or identifiable ("the data subject"); Any identifiable natural person shall be considered
       person whose identity can be determined, directly or indirectly, in
       by means of an identifier, such as a name, a number
       identification, location data, an online identifier, or one or more
       elements of physical, physiological, genetic, psychological,

       economic, cultural or social of said person; “

       2) "processing": any operation or set of operations carried out
       about personal data or sets of personal data, either by
       automated procedures or not, such as the collection, registration, organization,

       structuring, conservation, adaptation or modification, extraction, consultation,
       use, communication by transmission, diffusion or any other form of
       authorization of access, comparison or interconnection, limitation, deletion or
       destruction; “

       11) "consent of the interested party": any manifestation of free will,

       specific, informed and unequivocal for which the interested party accepts, either
       by means of a declaration or a clear affirmative action, the processing of data
       personal matters that concern you."

In the present case, the DGT, as data controller, processed

the personal data of the claiming party, by registering their name in the Registry
General de Vehículos a vehicle, although it cannot be affirmed that said treatment is
carried out without legitimacy for it, as claimed by the claimant, since,
as established by Royal Decree 2822/1998, of December 23, by which
approves the General Regulation of Vehicles in its article 32:

       "1. Any natural or legal person who owns a vehicle registered

       in Spain and transmit it to another, even when it is done with reservation of
       ownership or any other right over the vehicle, you must notify the
       Traffic Headquarters of the province in which it has its legal domicile or to that
       in which the vehicle was registered, within ten days from the
       transmission, by means of a statement stating the

       identification and address of the transferor and acquirer, as well as the date and
       broadcast title

       Together with the notification of the transmission, the permit or license will be attached.
       of circulation, which will be filed in the Headquarters, as well as the document
       accrediting the transmission, that of compliance with the corresponding
       tax obligations and other documentation indicated in annex XIV

       (…)

       2. The Traffic Department to which the transmission notification is addressed with the
       documents mentioned in the previous section will be recorded in the Registry
       of Vehicles to the purchaser as the new owner, unless the vehicle is
       affected by any of the impediments included in section 7 of

       this article, a point that will be communicated to the transferor and the acquirer, in which
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/10








       case, once the impediment has been canceled or resolved, the new
       ownership, notifying the Town Halls of the legal domiciles of
       those (…)

       7. In the event that the constitution on the vehicle is recorded in the Vehicle Registry

       vehicle of a mortgage registered in the Movable Mortgage Registry or the
       existence of an agreement prohibiting disposal or reservation of ownership
       registered in the Register of Installment Sale of Movable Property, only
       will practice the change of ownership in the Vehicle Registry when
       accredit the cancellation of the registration in the aforementioned Registries,

       submitting the documents listed in section IV of annex XIV,
       or the consent of the creditor or of the person favored by such
       registration, although in the latter case it will continue to be recorded
       said registration in the Vehicle Registry.

       The annotation on the permit or circulation license will have the same effects.
       of the constitution on the vehicle of a mortgage registered in the Registry of

       Movable Mortgage, even when it is not recorded in the Vehicle Registry.

       When a lease notation appears in the Vehicle Registry
       with the option to buy or lease in the long term, it will only be practiced
       the change of ownership in the Vehicle Registry when the
       consent of the landlord.

       An impediment to the change of ownership is the non-payment of the

       Sanctions imposed for violations of Law 16/1987, of July 30, on
       Ordinance of Terrestrial Transport, regarding the vehicles with which
       that those had been committed, provided that they appear noted in the
       Vehicle Registration.

       Any impediment to the change of ownership will be communicated by the
       Traffic Department to the purchaser (...)


For its part, Annex XIV of the aforementioned Regulation establishes:

       "1. Transmissions between people who are not engaged in the sale of
       vehicles.

       A) Obligations of the transferor:

       In accordance with the provisions of article 32, section 1 of this Regulation,
       the transferor of a vehicle must, within ten days from the

       transmission, communicate it to the Traffic Department with the documentation that
       it is related below:

       1st A statement stating the identifications and addresses
       of the transferor and transferee.

       In your case, the documents that on the identity and representation are
       specified in section A, numbers 1 and 3 of annex XIII, on the

       registration.

       2nd Fee for the legally established amount.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/10








       3rd The permit or circulation license.

       4th Document accrediting the transmission, except in the case that the
       seller and buyer submit their applications jointly.

       5th Original and photocopy of the document accrediting the payment of the

       Last receipt posted for the collection of Traction Vehicle Tax
       Mechanics, or proof of its exemption.

       6th Withdrawal form, duly completed, of change of ownership to
       effects of the Tax on Mechanical Traction Vehicles.

       7th If the vehicle being transferred is affected by rights that limit the
       power to dispose of the transferor, in accordance with the provisions of the

       section 7 of article 32 of this Regulation, a document must be presented
       certifying the cancellation of the impediment in the corresponding Registry or
       in which the consent of the creditor or of the person favored by
       the inscription.

       8th In the case of a special agricultural vehicle, document
       accrediting the deregistration in the Official Register of Agricultural Machinery.”


Likewise, and in terms of documents referring to identity and representation,
indicates Annex XIII in its section A:

       "A) Ordinary registration: In accordance with the provisions of articles 27,
       section 2.c and 28, section 2 of this Regulation, for the registration of
       Vehicles will be accompanied by the following documents:

       1st Application signed by the interested party in the official model form that

       will facilitate the Headquarters of Traffic.

       If the applicant is a minor or disabled, they must be included in the
       application, in addition, the data and signature of the person representing it, as well as
       as the concept in which it does.

       2nd Fee for the legally established amount.

       3rd National identity document in force or, failing that, receipt of
       have requested it, as well as the Family Book or other document that certifies the

       data that appears in the national identity document that does not present.

       If the applicant is a foreigner, they must present a Residence Card, as well as
       Declaration of ownership of other vehicles registered in Spain, or
       Spanish driving license of which he is or would have been the holder, or the number
       Provincial registration of foreign drivers, if any.

       In the case of foreigners who do not have a Residence Card,

       They will present an identity document from the country of origin, if it is
       citizens of States party to the Economic Area Agreement
       European Union (EEA), or Passport or Certificate of Nationality if it is a
       citizens of third countries, and they will also justify their domicile in Spain


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/10








       through any document that proves it, such as ownership or
       renting a home, or being registered in a Municipality.

       When the applicant is a Legal Entity, he will submit a Number of
       Fiscal Identification, as well as the National Identity Document, Passport
       o Residence Card of the person who represents them and document that

       certify that they have power to act on your behalf.

       The originals of the aforementioned documents may be replaced by
       photocopies of the same that the interested parties or their representatives must
       provide at the time of submitting your application, provided they are
       duly collated by the records of the bodies in which the
       submitted the corresponding application, in accordance with the provisions of the

       Article 38.4 a) and b) of Law 30/1992, of November 26, on the
       Legal of Public Administrations and Administrative Procedure
       Common, without prejudice to the possibility of exercising this function by
       a Collegiate Administrative Manager in the terms determined in the
       agreements that can be established with the Associations of Managers
       Administrative.

       Applications submitted by Bodies or Entities dependent on the

       Public Administrations, General State, Autonomous, Provincial or
       Municipal, will be signed by the Head of the Agency or Entity to which
       belongs to the vehicle or person to whom it delegates, accompanied by the
       required documentation."

Bearing in mind that the Provincial Traffic Headquarters of Valencia presented
a request for notification of sale of the vehicle, which was accompanied by the

documentation required in the General Vehicle Regulations to carry out said
procedure, including a sales contract where the seller is identified
and the buyer, it cannot be affirmed that the DGT has incurred in an illegitimate treatment
of data of the claimant, since the registration in the Vehicle Registry
is carried out in compliance with a legal obligation applicable to the person responsible for the
treatment, and, likewise, based on the execution of a contract in which the

interested is part.

                                          II

The complaining party adds that the DGT did not act with due diligence as it had not
verified if the identification of the complaining party was correctly carried out.
However, having analyzed in the previous section the articles of the Regulation of

Vehicles applicable to the notification of sale, it must be concluded that, in the notification
of sale, the aforementioned legal text does not require verification and collation of signatures, given
also note that it is not necessary for the buyer and the seller to meet
at the same time at the Traffic Headquarters, since according to Annex XIV of the
aforementioned Regulation, with regard to the figure of the acquirer:


       "B) Obligations of the purchaser:
       In accordance with the provisions of article 32, section 3 of this Regulation,
       the purchaser of a vehicle must, within thirty days from the date


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/10








       of its acquisition, request from the Traffic Department the renewal of the permit or
       driving license, presenting the following documents:
       1st Application in official model form that will be provided by the Traffic Headquarters,

       in which the identity and address of the transferor and acquirer is stated.
       2nd Rate or rates for the legally established amount.
       3rd The documents that on the identity and representation are specified in
       section A, numbers 1 and 3 of annex XIII, on registration.
       4th technical inspection card or certificate of characteristics, with
       valid recognition.

       5th Original of the self-assessment of the Transfer Tax
       Patrimonial and Documented Legal Acts, or proof of the exemption or
       not subject to it, and photocopy.
       6th Self-assessment of the Special Tax on Certain Means of
       Transportation or justification of non-subjection or exemption in cases of

       transmission of a vehicle before four years have elapsed since its
       first definitive registration with exemption or non-subjection.
       7th Form of registration in the Tax on Mechanical Traction Vehicles.
       8th Original and photocopy of proof of payment or exemption from Tax on
       Mechanical Traction Vehicles, in the event that the transferor has not
       fulfilled the obligation to notify the transmission provided for in article 32,

       section 1 of this Regulation.
       9th Document proving the acquisition, except in the case that the seller
       and the buyer submit their applications jointly.”

Therefore, lack of diligence cannot be imputed, beyond the verification that

Provide all the documentation required in the Vehicle Regulations to carry out the
corresponding procedure. If the documentation presented is fraudulent, you do not have the
acting official capacity or possibility of verifying it.

                                           IV.


Therefore, based on what is indicated in the previous paragraphs, no
Evidence proving the existence of an infringement in the area of competence of the
Spanish Data Protection Agency.

Thus, in accordance with what has been indicated, by the Director of the Spanish Agency for

Data Protection,
HE REMEMBERS:

FIRST: PROCEED TO THE ARCHIVE of the present proceedings.


SECOND: NOTIFY this resolution to B.B.B. and GENERAL DIRECTORATE OF
TRAFFIC.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.


Against this resolution, which puts an end to the administrative process as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common for Public Administrations, and in accordance with the provisions of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/10









arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may

file, optionally, an appeal for reinstatement before the Director of the Agency
Spanish Data Protection Agency within a period of one month from the day
following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National Court,

in accordance with the provisions of article 25 and paragraph 5 of the provision
additional fourth of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-Administrative, within a period of two months from the day following

to the notification of this act, as provided in article 46.1 of the aforementioned Law.


                                                                                 940-110422
Mar Spain Marti

Director of the Spanish Data Protection Agency
















































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es