AEPD (Spain) - EXP202210237
From GDPRhub
| AEPD - AEPD ai-00349-2022 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR Article 6(1)(b) GDPR Article 6(1)(c) GDPR Annex XII(A) General Vehicle Regulation Annex XIV General Vehicle Regulation Articicle 32 General Vehicle Regulation |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 08.03.2022 |
| Decided: | |
| Published: | 28.11.2022 |
| Fine: | n/a |
| Parties: | Dirección General de Tráfico |
| National Case Number/Name: | AEPD ai-00349-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Teresa López |
The Spanish DPA rejected a complaint against the national traffic department concerning a lack of legal basis for processing under Article 6 GDPR. The DPA held that traffic officials do not have the capacity or possibility of verifying the documentation submitted to change the ownership of a vehicle. If the documentation submitted is fraudulent, no lack of due diligence can be imputed.
English Summary
Facts
On 9 August 2019, the data subject lodged a complaint with the police regarding the theft of their wallet. On 20 August 2019, someone purchased a vehicle with the data subject's ID. On 20 January 2020, the vehicle was reported for driving without the compulsory insurance and Dirección General de Tráfico (national traffic department, also known as DGT) (the controller) notified the previous owner the start of the sanctioning procedure. On 31 January 2020, the new owner (with the documentation of the data subject) filed for the change of ownership before the controller. In August 2020, the data subject received notification of a traffic offence. On 13 August 2020, the data subject lodged a new complaint with the police, stating that someone had tried to put a car in their name and that they had received notification of the traffic offence.
The data subject submitted a complaint to the Spanish DPA stating that the controller did not carry out any checks to validate the change of ownership, allowing the change despite the existence of an outstanding debt on the vehicle. They also alleged that the DGT processed their data without a legitimate basis.
Holding
The DPA held that there was a legal basis to process the data: the documentation was required under the General Vehicle Regulation for the notification of the sale of the vehicle (Article 6(1)(c) GDPR), and, the entry in the vehicle register was made in the performance of a contract to which the data subject was a party (Article (6)(1)(b) GDPR).
The DPA also found no lack of diligence on part of the controller in verifying the identity of the data subject, since the General Vehicle Regulation did not require verification or comparison of signatures, and the traffic official did not have the capacity or possibility to verify them.
Comment
The fact that the processing of the controller relied on Article (6)(1)(b) GDPR and Article 6(1)(c) GDPR as legal basis affects the holding of the DPA since in PS/00126/2021 the Spanish DPA held: "if there is a fraudulent contracting of a product and the consent to perfect such contract has been given by a person other than the data subject (impersonation), we cannot understand that there is contractual consent on the part of the latter, who is harmed. In legal terms, we can consider that in this situation of fraud the legal business would not have been perfected, which would determine the inexistence of legitimacy to process the personal data of the data subject. This is because, once the contract has been signed, the legal basis for the processing that legitimizes the contractor as data controller to process the personal data of the data subject in a product contract would be the one provided for in art. 6.1.b) of the GDPR."
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10
File No.: EXP202210237
RESOLUTION OF ACTIONS FILE
Of the actions carried out by the Spanish Agency for Data Protection and
based on the following
FACTS
FIRST: A.A.A., on behalf of B.B.B. (hereinafter, the part
claimant) on March 8, 2022 filed a claim with the Agency
Spanish Data Protection. The claim is directed against ADDRESS
GENERAL OF TRAFFIC with NIF Q2816003D (hereinafter, the DGT). The reasons in
on which the claim is based are as follows:
On 08/09/2019, the claimant filed a complaint for the theft of his wallet.
On 08/20/2019, a contract for the sale of a brand vehicle was signed.
***MARK.1, model ***MODELO.1, license plate ***MATRICULA.1 in which it appears
as the buyer the claiming party.
On 08/28/2019, the vehicle was reported for driving without mandatory insurance, beginning
the disciplinary procedure by the DGT by means of a notification sent in
dated 01/20/2020 to the person who appeared as its owner in the Registry
General of Vehicles. .
According to the claimant, on 01/31/2020, the owner appeared at
the dependencies of the DGT to carry out the change of ownership of the referred
car.
According to the claimant's statement, in August 2020 the DGT notified him of the
Committed traffic violation.
On 08/13/2020, the claimant filed a new complaint with the police at the
stating that on 08/29/2019 the police informed him that they had tried to put a
car in his name and that he had received notice of a traffic violation
relating to a car that is not owned by you.
The claimant states that the DGT did not verify
any to ensure that the change of ownership complied with the requirements
necessary, allowing it to be carried out without providing the supporting documentation of the
buyer and there is a current debt on the vehicle.
It also considers that the data protection rights of the company have been infringed.
complaining party when treated by the DGT without any legitimizing basis.
The claim indicates various resolutions of the AEPD in which
concluded "that if fraudulent contracting of a product occurs and the
consent to perfect said contract has been given by a person
other than the owner of the data (identity theft), we cannot understand that
there is contractual consent on the part of the latter who is harmed. (...)
in this situation of fraud the legal business would not have been perfected, which
would determine the lack of legitimacy to process the personal data of the
interested."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/10
Along with the claim, the following is provided:
-Complaint before the National Police of Mislata for the theft of the DNI.
-Alleged fraudulent contract of sale of the vehicle,
-Notifications made by the claimed entity to the people that were included in
their records as owners
-Proof of change of ownership of the vehicle by making a Notification
selling.
-Writ issued by the investigating court by which the opening of
preliminary investigations to clarify the facts.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
forward LOPDGDD), said claim was forwarded to the DGT, so that
proceed to its analysis and inform this Agency within a month of the
actions carried out to adapt to the requirements established in the regulations of
Data Protection.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP), was collected on 04/24/2022 as stated in the
acknowledgment of receipt in the file.
On 06/23/2022, this Agency received a written response indicating:
"Regarding your brief, regarding the claim made before the Agency by the
representative of the claimant B.B.B., and to comply with the request, in
In accordance with article 65.4 of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights (LOPDGDD), is
reports the following:
As stated in the Agency's request, the facts that motivate the
claim are based on the receipt of a sanction on behalf of the claimant,
allegedly motivated by identity theft. Along with the claim
provides documentation related to a sanction filed under the aforementioned impersonation
identity and other documents associated with it.
Once the documentation provided has been reviewed, it is understood that the claimant had his
national identity document, a document that was later used to
make a purchase-sale of a vehicle and assign ownership of it. I know
attached complaint of the claimant dated 08/09/2019 in the General Directorate of the
Police, in which the theft is indicated, of the national identity document. Bliss
complaint is prior to the sanction and the purchase and sale of the vehicle.
On 08/28/2019, there is an infraction with the vehicle ***MATRICULA.1,
for driving without compulsory insurance, in the name of C.C.C., undocumented. On 01/08/2020
delivery is made at the address indicated by C.C.C., of the sanction with file
***FILE.1. Said sanction goes to the name of the owner of the vehicle, D.D.D. Y
since she is absent, she picks up the same E.E.E..
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/10
On 01/31/2020 the purchase-sale of the vehicle is notified at the Headquarters of Valencia,
in the name of the claimant. In said notification, a purchase document is provided.
sale (dated prior to the sanction) and the change of ownership proceeds. the same
day, the owner of the vehicle presents an allegation to the disciplinary file, indicating
that the vehicle was sold before the date of the sanction and the sale has been notified.
On 08/13/2020, the claimant complained to the General Directorate of the Police that he
received a notification from the DGT regarding the aforementioned sanction. Also
states in the complaint that on 08/29/2019 he was informed that an attempt had been made to
sell a car in your name. A document of proceedings is also attached
prior (act of initiation), dated 09/22/2020, of the Investigating Court number
Valencia 9. The claimant files an appeal for reversal on 03/18/2021,
appeal that is declared inadmissible for being filed out of time. The
claimant on 06/30/2021 presents an extraordinary appeal for review, which
is denied because it is not based on any of the causes related to the
firm acts in administrative channels.
On 01/30/2022, the claimant receives an order of urgency from the
Tax Agency, in order to settle the debt of the traffic penalty in the period
executive with an ordinary surcharge of 20%.
In view of the facts exposed, it is understood that it was presented at the Headquarters of
Valencia all the documentation referred to in Article 32 and Annex XIV, relating to the
Processing and change of ownership of vehicles, of Royal Decree 2822/1998, of 23
December, by which the General Vehicle Regulations are approved.
If the documents presented were falsified or presented fraudulently,
This fact must be denounced before the Justice. The Provincial Headquarters of the
DGT does not have the capabilities required to detect such acts of
illicit nature.
On the other hand, the inadmissibility of the reversal appeal is understood to be correct.
submitted after the deadline on 03/18/2021, even more so when it is evident that the
Claimant has proof of the sanction on 08/30/2020. No sentence indicated
legal firm, which may be a cause provided for in the extraordinary appeal of
review filed, for which reason said appeal is also considered correct
inadmissibility.
In accordance with what was requested in the claim in the file ***FILE.2,
reports:
1.- The decision to be taken by the DGT does not apply. Once the debt has passed to
be required by the Tax Agency, it must be claimed before that
Agency, according to the corresponding sentence. The disciplinary procedure
46-007.199.491/0 has concluded in administrative proceedings for the DGT.
2.- The claimant has not requested the exercise of their rights related to the protection
of data, before the DGT, for which reason no response applies.
3.- The present document serves as an explanation of the causes that have motivated the
incidence.
4.- The implementation of measures adopted to avoid cases of a similar type does not apply,
since the DGT has acted in accordance with current regulations”.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/10
THIRD: On June 8, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the claimant party was admitted for processing.
FUNDAMENTALS OF LAW
Yo
In accordance with the functions that article 57.1 a), f) and h) of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter GDPR) confers on
each control authority and according to the provisions of articles 47 and 48.1 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), is competent to resolve these
investigation actions the Director of the Spanish Agency for the Protection of
Data.
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures."
II
Article 6 of the GDPR, Lawfulness of the treatment, establishes in point 1 that:
"1. Processing will only be lawful if at least one of the following is fulfilled
conditions:
a) the interested party gave his consent for the processing of his data
personal for one or more specific purposes;
b) the processing is necessary for the performance of a contract in which the
interested party or for the application at the request of this of measures
pre-contractual;
c) the processing is necessary for compliance with a legal obligation
applicable to the data controller;
d) the processing is necessary to protect vital interests of the data subject or
of another physical person;
e) the treatment is necessary for the fulfillment of a mission carried out in
public interest or in the exercise of public powers conferred on the person responsible
of the treatment;
f) the processing is necessary for the satisfaction of legitimate interests
pursued by the data controller or by a third party, provided that
such interests are not overridden by the interests or the rights and freedoms
of the interested party that require the protection of personal data,
in particular when the interested party is a child.
The provisions of letter f) of the first paragraph shall not apply to the
processing carried out by public authorities in the exercise of their
functions.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/10
On the other hand, article 4 of the GDPR, Definitions, in its sections 1, 2 and 11,
notes that:
“1) “personal data” means any information about an identified natural person
or identifiable ("the data subject"); Any identifiable natural person shall be considered
person whose identity can be determined, directly or indirectly, in
by means of an identifier, such as a name, a number
identification, location data, an online identifier, or one or more
elements of physical, physiological, genetic, psychological,
economic, cultural or social of said person; “
2) "processing": any operation or set of operations carried out
about personal data or sets of personal data, either by
automated procedures or not, such as the collection, registration, organization,
structuring, conservation, adaptation or modification, extraction, consultation,
use, communication by transmission, diffusion or any other form of
authorization of access, comparison or interconnection, limitation, deletion or
destruction; “
11) "consent of the interested party": any manifestation of free will,
specific, informed and unequivocal for which the interested party accepts, either
by means of a declaration or a clear affirmative action, the processing of data
personal matters that concern you."
In the present case, the DGT, as data controller, processed
the personal data of the claiming party, by registering their name in the Registry
General de Vehículos a vehicle, although it cannot be affirmed that said treatment is
carried out without legitimacy for it, as claimed by the claimant, since,
as established by Royal Decree 2822/1998, of December 23, by which
approves the General Regulation of Vehicles in its article 32:
"1. Any natural or legal person who owns a vehicle registered
in Spain and transmit it to another, even when it is done with reservation of
ownership or any other right over the vehicle, you must notify the
Traffic Headquarters of the province in which it has its legal domicile or to that
in which the vehicle was registered, within ten days from the
transmission, by means of a statement stating the
identification and address of the transferor and acquirer, as well as the date and
broadcast title
Together with the notification of the transmission, the permit or license will be attached.
of circulation, which will be filed in the Headquarters, as well as the document
accrediting the transmission, that of compliance with the corresponding
tax obligations and other documentation indicated in annex XIV
(…)
2. The Traffic Department to which the transmission notification is addressed with the
documents mentioned in the previous section will be recorded in the Registry
of Vehicles to the purchaser as the new owner, unless the vehicle is
affected by any of the impediments included in section 7 of
this article, a point that will be communicated to the transferor and the acquirer, in which
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/10
case, once the impediment has been canceled or resolved, the new
ownership, notifying the Town Halls of the legal domiciles of
those (…)
7. In the event that the constitution on the vehicle is recorded in the Vehicle Registry
vehicle of a mortgage registered in the Movable Mortgage Registry or the
existence of an agreement prohibiting disposal or reservation of ownership
registered in the Register of Installment Sale of Movable Property, only
will practice the change of ownership in the Vehicle Registry when
accredit the cancellation of the registration in the aforementioned Registries,
submitting the documents listed in section IV of annex XIV,
or the consent of the creditor or of the person favored by such
registration, although in the latter case it will continue to be recorded
said registration in the Vehicle Registry.
The annotation on the permit or circulation license will have the same effects.
of the constitution on the vehicle of a mortgage registered in the Registry of
Movable Mortgage, even when it is not recorded in the Vehicle Registry.
When a lease notation appears in the Vehicle Registry
with the option to buy or lease in the long term, it will only be practiced
the change of ownership in the Vehicle Registry when the
consent of the landlord.
An impediment to the change of ownership is the non-payment of the
Sanctions imposed for violations of Law 16/1987, of July 30, on
Ordinance of Terrestrial Transport, regarding the vehicles with which
that those had been committed, provided that they appear noted in the
Vehicle Registration.
Any impediment to the change of ownership will be communicated by the
Traffic Department to the purchaser (...)
For its part, Annex XIV of the aforementioned Regulation establishes:
"1. Transmissions between people who are not engaged in the sale of
vehicles.
A) Obligations of the transferor:
In accordance with the provisions of article 32, section 1 of this Regulation,
the transferor of a vehicle must, within ten days from the
transmission, communicate it to the Traffic Department with the documentation that
it is related below:
1st A statement stating the identifications and addresses
of the transferor and transferee.
In your case, the documents that on the identity and representation are
specified in section A, numbers 1 and 3 of annex XIII, on the
registration.
2nd Fee for the legally established amount.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/10
3rd The permit or circulation license.
4th Document accrediting the transmission, except in the case that the
seller and buyer submit their applications jointly.
5th Original and photocopy of the document accrediting the payment of the
Last receipt posted for the collection of Traction Vehicle Tax
Mechanics, or proof of its exemption.
6th Withdrawal form, duly completed, of change of ownership to
effects of the Tax on Mechanical Traction Vehicles.
7th If the vehicle being transferred is affected by rights that limit the
power to dispose of the transferor, in accordance with the provisions of the
section 7 of article 32 of this Regulation, a document must be presented
certifying the cancellation of the impediment in the corresponding Registry or
in which the consent of the creditor or of the person favored by
the inscription.
8th In the case of a special agricultural vehicle, document
accrediting the deregistration in the Official Register of Agricultural Machinery.”
Likewise, and in terms of documents referring to identity and representation,
indicates Annex XIII in its section A:
"A) Ordinary registration: In accordance with the provisions of articles 27,
section 2.c and 28, section 2 of this Regulation, for the registration of
Vehicles will be accompanied by the following documents:
1st Application signed by the interested party in the official model form that
will facilitate the Headquarters of Traffic.
If the applicant is a minor or disabled, they must be included in the
application, in addition, the data and signature of the person representing it, as well as
as the concept in which it does.
2nd Fee for the legally established amount.
3rd National identity document in force or, failing that, receipt of
have requested it, as well as the Family Book or other document that certifies the
data that appears in the national identity document that does not present.
If the applicant is a foreigner, they must present a Residence Card, as well as
Declaration of ownership of other vehicles registered in Spain, or
Spanish driving license of which he is or would have been the holder, or the number
Provincial registration of foreign drivers, if any.
In the case of foreigners who do not have a Residence Card,
They will present an identity document from the country of origin, if it is
citizens of States party to the Economic Area Agreement
European Union (EEA), or Passport or Certificate of Nationality if it is a
citizens of third countries, and they will also justify their domicile in Spain
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/10
through any document that proves it, such as ownership or
renting a home, or being registered in a Municipality.
When the applicant is a Legal Entity, he will submit a Number of
Fiscal Identification, as well as the National Identity Document, Passport
o Residence Card of the person who represents them and document that
certify that they have power to act on your behalf.
The originals of the aforementioned documents may be replaced by
photocopies of the same that the interested parties or their representatives must
provide at the time of submitting your application, provided they are
duly collated by the records of the bodies in which the
submitted the corresponding application, in accordance with the provisions of the
Article 38.4 a) and b) of Law 30/1992, of November 26, on the
Legal of Public Administrations and Administrative Procedure
Common, without prejudice to the possibility of exercising this function by
a Collegiate Administrative Manager in the terms determined in the
agreements that can be established with the Associations of Managers
Administrative.
Applications submitted by Bodies or Entities dependent on the
Public Administrations, General State, Autonomous, Provincial or
Municipal, will be signed by the Head of the Agency or Entity to which
belongs to the vehicle or person to whom it delegates, accompanied by the
required documentation."
Bearing in mind that the Provincial Traffic Headquarters of Valencia presented
a request for notification of sale of the vehicle, which was accompanied by the
documentation required in the General Vehicle Regulations to carry out said
procedure, including a sales contract where the seller is identified
and the buyer, it cannot be affirmed that the DGT has incurred in an illegitimate treatment
of data of the claimant, since the registration in the Vehicle Registry
is carried out in compliance with a legal obligation applicable to the person responsible for the
treatment, and, likewise, based on the execution of a contract in which the
interested is part.
II
The complaining party adds that the DGT did not act with due diligence as it had not
verified if the identification of the complaining party was correctly carried out.
However, having analyzed in the previous section the articles of the Regulation of
Vehicles applicable to the notification of sale, it must be concluded that, in the notification
of sale, the aforementioned legal text does not require verification and collation of signatures, given
also note that it is not necessary for the buyer and the seller to meet
at the same time at the Traffic Headquarters, since according to Annex XIV of the
aforementioned Regulation, with regard to the figure of the acquirer:
"B) Obligations of the purchaser:
In accordance with the provisions of article 32, section 3 of this Regulation,
the purchaser of a vehicle must, within thirty days from the date
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/10
of its acquisition, request from the Traffic Department the renewal of the permit or
driving license, presenting the following documents:
1st Application in official model form that will be provided by the Traffic Headquarters,
in which the identity and address of the transferor and acquirer is stated.
2nd Rate or rates for the legally established amount.
3rd The documents that on the identity and representation are specified in
section A, numbers 1 and 3 of annex XIII, on registration.
4th technical inspection card or certificate of characteristics, with
valid recognition.
5th Original of the self-assessment of the Transfer Tax
Patrimonial and Documented Legal Acts, or proof of the exemption or
not subject to it, and photocopy.
6th Self-assessment of the Special Tax on Certain Means of
Transportation or justification of non-subjection or exemption in cases of
transmission of a vehicle before four years have elapsed since its
first definitive registration with exemption or non-subjection.
7th Form of registration in the Tax on Mechanical Traction Vehicles.
8th Original and photocopy of proof of payment or exemption from Tax on
Mechanical Traction Vehicles, in the event that the transferor has not
fulfilled the obligation to notify the transmission provided for in article 32,
section 1 of this Regulation.
9th Document proving the acquisition, except in the case that the seller
and the buyer submit their applications jointly.”
Therefore, lack of diligence cannot be imputed, beyond the verification that
Provide all the documentation required in the Vehicle Regulations to carry out the
corresponding procedure. If the documentation presented is fraudulent, you do not have the
acting official capacity or possibility of verifying it.
IV.
Therefore, based on what is indicated in the previous paragraphs, no
Evidence proving the existence of an infringement in the area of competence of the
Spanish Data Protection Agency.
Thus, in accordance with what has been indicated, by the Director of the Spanish Agency for
Data Protection,
HE REMEMBERS:
FIRST: PROCEED TO THE ARCHIVE of the present proceedings.
SECOND: NOTIFY this resolution to B.B.B. and GENERAL DIRECTORATE OF
TRAFFIC.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.
Against this resolution, which puts an end to the administrative process as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common for Public Administrations, and in accordance with the provisions of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/10
arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may
file, optionally, an appeal for reinstatement before the Director of the Agency
Spanish Data Protection Agency within a period of one month from the day
following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and paragraph 5 of the provision
additional fourth of Law 29/1998, of July 13, regulating the Jurisdiction
Contentious-Administrative, within a period of two months from the day following
to the notification of this act, as provided in article 46.1 of the aforementioned Law.
940-110422
Mar Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
