AEPD (Spain) - AEPD ai-00349-2022
|AEPD - AEPD ai-00349-2022|
|Relevant Law:||Article 6(1) GDPR|
Article 6(1)(b) GDPR
Article 6(1)(c) GDPR
Annex XII(A) General Vehicle Regulation
Annex XIV General Vehicle Regulation
Articicle 32 General Vehicle Regulation
|Parties:||Dirección General de Tráfico|
|National Case Number/Name:||AEPD ai-00349-2022|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Teresa López|
The Spanish DPA rejected a complaint against the national traffic department, considering that the department does not have the capacity or possibility to verify the documentation submitted to change the ownership of a vehicle. Therefore, no lack of due diligence can be imputed, if the documentation submitted is fraudulent.
English Summary[edit | edit source]
Facts[edit | edit source]
On 9 August 2019, the data subject lodged a complaint with the police regarding the theft of their wallet. On 20 August 2019, someone purchased a vehicle with the data subject's ID. On 20 January 2020, the vehicle was reported for driving without the compulsory insurance. As a consequence, Dirección General de Tráfico (national traffic department, also known as DGT) (the controller) notified the previous owner the start of the sanctioning procedure. On 31 January 2020, the new owner (with the documentation of the data subject) filed for the change of ownership with the controller. In August 2020, the data subject received a traffic ticket related to the lack of compulsory insurance. On 13 August 2020, the data subject lodged a new complaint with the police, stating that someone had tried to register a car under their name and that they had received notification of a traffic offence.
The data subject submitted a complaint to the Spanish DPA stating that the controller did not carry out any checks to validate the change of ownership, allowing the change despite the existence of an outstanding debt on the vehicle. They also alleged that the controller processed their data without a legitimate basis.
Holding[edit | edit source]
The DPA held that there was a legal basis to process the data: the documentation was required under the General Vehicle Regulation for the notification of the sale of the vehicle (Article 6(1)(c) GDPR), and, the entry in the vehicle register was made in the performance of a contract to which the data subject was a party (Article (6)(1)(b) GDPR).
The DPA also found no lack of diligence on part of the controller in verifying the identity of the data subject, since the General Vehicle Regulation did not require verification or comparison of signatures, and the traffic official did not have the capacity or possibility to verify them.
Comment[edit | edit source]
The fact that the processing of the controller relied on Article (6)(1)(b) GDPR and Article 6(1)(c) GDPR as legal basis affects the holding of the DPA since in PS/00126/2021 the Spanish DPA held: "if there is a fraudulent contracting of a product and the consent to perfect such contract has been given by a person other than the data subject (impersonation), we cannot understand that there is contractual consent on the part of the latter, who is harmed. In legal terms, we can consider that in this situation of fraud the legal business would not have been perfected, which would determine the inexistence of legitimacy to process the personal data of the data subject. This is because, once the contract has been signed, the legal basis for the processing that legitimizes the contractor as data controller to process the personal data of the data subject in a product contract would be the one provided for in art. 6.1.b) of the GDPR."
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10 File No.: EXP202210237 RESOLUTION OF ACTIONS FILE Of the actions carried out by the Spanish Agency for Data Protection and based on the following FACTS FIRST: A.A.A., on behalf of B.B.B. (hereinafter, the part claimant) on March 8, 2022 filed a claim with the Agency Spanish Data Protection. The claim is directed against ADDRESS GENERAL OF TRAFFIC with NIF Q2816003D (hereinafter, the DGT). The reasons in on which the claim is based are as follows: On 08/09/2019, the claimant filed a complaint for the theft of his wallet. On 08/20/2019, a contract for the sale of a brand vehicle was signed. ***MARK.1, model ***MODELO.1, license plate ***MATRICULA.1 in which it appears as the buyer the claiming party. On 08/28/2019, the vehicle was reported for driving without mandatory insurance, beginning the disciplinary procedure by the DGT by means of a notification sent in dated 01/20/2020 to the person who appeared as its owner in the Registry General of Vehicles. . According to the claimant, on 01/31/2020, the owner appeared at the dependencies of the DGT to carry out the change of ownership of the referred car. According to the claimant's statement, in August 2020 the DGT notified him of the Committed traffic violation. On 08/13/2020, the claimant filed a new complaint with the police at the stating that on 08/29/2019 the police informed him that they had tried to put a car in his name and that he had received notice of a traffic violation relating to a car that is not owned by you. The claimant states that the DGT did not verify any to ensure that the change of ownership complied with the requirements necessary, allowing it to be carried out without providing the supporting documentation of the buyer and there is a current debt on the vehicle. It also considers that the data protection rights of the company have been infringed. complaining party when treated by the DGT without any legitimizing basis. The claim indicates various resolutions of the AEPD in which concluded "that if fraudulent contracting of a product occurs and the consent to perfect said contract has been given by a person other than the owner of the data (identity theft), we cannot understand that there is contractual consent on the part of the latter who is harmed. (...) in this situation of fraud the legal business would not have been perfected, which would determine the lack of legitimacy to process the personal data of the interested." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/10 Along with the claim, the following is provided: -Complaint before the National Police of Mislata for the theft of the DNI. -Alleged fraudulent contract of sale of the vehicle, -Notifications made by the claimed entity to the people that were included in their records as owners -Proof of change of ownership of the vehicle by making a Notification selling. -Writ issued by the investigating court by which the opening of preliminary investigations to clarify the facts. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in forward LOPDGDD), said claim was forwarded to the DGT, so that proceed to its analysis and inform this Agency within a month of the actions carried out to adapt to the requirements established in the regulations of Data Protection. The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, of the Common Administrative Procedure of the Administrations Public (hereinafter, LPACAP), was collected on 04/24/2022 as stated in the acknowledgment of receipt in the file. On 06/23/2022, this Agency received a written response indicating: "Regarding your brief, regarding the claim made before the Agency by the representative of the claimant B.B.B., and to comply with the request, in In accordance with article 65.4 of Organic Law 3/2018, of December 5, of Protection of Personal Data and guarantee of digital rights (LOPDGDD), is reports the following: As stated in the Agency's request, the facts that motivate the claim are based on the receipt of a sanction on behalf of the claimant, allegedly motivated by identity theft. Along with the claim provides documentation related to a sanction filed under the aforementioned impersonation identity and other documents associated with it. Once the documentation provided has been reviewed, it is understood that the claimant had his national identity document, a document that was later used to make a purchase-sale of a vehicle and assign ownership of it. I know attached complaint of the claimant dated 08/09/2019 in the General Directorate of the Police, in which the theft is indicated, of the national identity document. Bliss complaint is prior to the sanction and the purchase and sale of the vehicle. On 08/28/2019, there is an infraction with the vehicle ***MATRICULA.1, for driving without compulsory insurance, in the name of C.C.C., undocumented. On 01/08/2020 delivery is made at the address indicated by C.C.C., of the sanction with file ***FILE.1. Said sanction goes to the name of the owner of the vehicle, D.D.D. Y since she is absent, she picks up the same E.E.E.. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/10 On 01/31/2020 the purchase-sale of the vehicle is notified at the Headquarters of Valencia, in the name of the claimant. In said notification, a purchase document is provided. sale (dated prior to the sanction) and the change of ownership proceeds. the same day, the owner of the vehicle presents an allegation to the disciplinary file, indicating that the vehicle was sold before the date of the sanction and the sale has been notified. On 08/13/2020, the claimant complained to the General Directorate of the Police that he received a notification from the DGT regarding the aforementioned sanction. Also states in the complaint that on 08/29/2019 he was informed that an attempt had been made to sell a car in your name. A document of proceedings is also attached prior (act of initiation), dated 09/22/2020, of the Investigating Court number Valencia 9. The claimant files an appeal for reversal on 03/18/2021, appeal that is declared inadmissible for being filed out of time. The claimant on 06/30/2021 presents an extraordinary appeal for review, which is denied because it is not based on any of the causes related to the firm acts in administrative channels. On 01/30/2022, the claimant receives an order of urgency from the Tax Agency, in order to settle the debt of the traffic penalty in the period executive with an ordinary surcharge of 20%. In view of the facts exposed, it is understood that it was presented at the Headquarters of Valencia all the documentation referred to in Article 32 and Annex XIV, relating to the Processing and change of ownership of vehicles, of Royal Decree 2822/1998, of 23 December, by which the General Vehicle Regulations are approved. If the documents presented were falsified or presented fraudulently, This fact must be denounced before the Justice. The Provincial Headquarters of the DGT does not have the capabilities required to detect such acts of illicit nature. On the other hand, the inadmissibility of the reversal appeal is understood to be correct. submitted after the deadline on 03/18/2021, even more so when it is evident that the Claimant has proof of the sanction on 08/30/2020. No sentence indicated legal firm, which may be a cause provided for in the extraordinary appeal of review filed, for which reason said appeal is also considered correct inadmissibility. In accordance with what was requested in the claim in the file ***FILE.2, reports: 1.- The decision to be taken by the DGT does not apply. Once the debt has passed to be required by the Tax Agency, it must be claimed before that Agency, according to the corresponding sentence. The disciplinary procedure 46-007.199.491/0 has concluded in administrative proceedings for the DGT. 2.- The claimant has not requested the exercise of their rights related to the protection of data, before the DGT, for which reason no response applies. 3.- The present document serves as an explanation of the causes that have motivated the incidence. 4.- The implementation of measures adopted to avoid cases of a similar type does not apply, since the DGT has acted in accordance with current regulations”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/10 THIRD: On June 8, 2022, in accordance with article 65 of the LOPDGDD, the claim presented by the claimant party was admitted for processing. FUNDAMENTALS OF LAW Yo In accordance with the functions that article 57.1 a), f) and h) of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) confers on each control authority and according to the provisions of articles 47 and 48.1 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), is competent to resolve these investigation actions the Director of the Spanish Agency for the Protection of Data. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Data Protection Agency will be governed by the provisions in Regulation (EU) 2016/679, in this organic law, by the provisions regulations dictated in its development and, insofar as they do not contradict them, with character subsidiary, by the general rules on administrative procedures." II Article 6 of the GDPR, Lawfulness of the treatment, establishes in point 1 that: "1. Processing will only be lawful if at least one of the following is fulfilled conditions: a) the interested party gave his consent for the processing of his data personal for one or more specific purposes; b) the processing is necessary for the performance of a contract in which the interested party or for the application at the request of this of measures pre-contractual; c) the processing is necessary for compliance with a legal obligation applicable to the data controller; d) the processing is necessary to protect vital interests of the data subject or of another physical person; e) the treatment is necessary for the fulfillment of a mission carried out in public interest or in the exercise of public powers conferred on the person responsible of the treatment; f) the processing is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or the rights and freedoms of the interested party that require the protection of personal data, in particular when the interested party is a child. The provisions of letter f) of the first paragraph shall not apply to the processing carried out by public authorities in the exercise of their functions.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/10 On the other hand, article 4 of the GDPR, Definitions, in its sections 1, 2 and 11, notes that: “1) “personal data” means any information about an identified natural person or identifiable ("the data subject"); Any identifiable natural person shall be considered person whose identity can be determined, directly or indirectly, in by means of an identifier, such as a name, a number identification, location data, an online identifier, or one or more elements of physical, physiological, genetic, psychological, economic, cultural or social of said person; “ 2) "processing": any operation or set of operations carried out about personal data or sets of personal data, either by automated procedures or not, such as the collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of authorization of access, comparison or interconnection, limitation, deletion or destruction; “ 11) "consent of the interested party": any manifestation of free will, specific, informed and unequivocal for which the interested party accepts, either by means of a declaration or a clear affirmative action, the processing of data personal matters that concern you." In the present case, the DGT, as data controller, processed the personal data of the claiming party, by registering their name in the Registry General de Vehículos a vehicle, although it cannot be affirmed that said treatment is carried out without legitimacy for it, as claimed by the claimant, since, as established by Royal Decree 2822/1998, of December 23, by which approves the General Regulation of Vehicles in its article 32: "1. Any natural or legal person who owns a vehicle registered in Spain and transmit it to another, even when it is done with reservation of ownership or any other right over the vehicle, you must notify the Traffic Headquarters of the province in which it has its legal domicile or to that in which the vehicle was registered, within ten days from the transmission, by means of a statement stating the identification and address of the transferor and acquirer, as well as the date and broadcast title Together with the notification of the transmission, the permit or license will be attached. of circulation, which will be filed in the Headquarters, as well as the document accrediting the transmission, that of compliance with the corresponding tax obligations and other documentation indicated in annex XIV (…) 2. The Traffic Department to which the transmission notification is addressed with the documents mentioned in the previous section will be recorded in the Registry of Vehicles to the purchaser as the new owner, unless the vehicle is affected by any of the impediments included in section 7 of this article, a point that will be communicated to the transferor and the acquirer, in which C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/10 case, once the impediment has been canceled or resolved, the new ownership, notifying the Town Halls of the legal domiciles of those (…) 7. In the event that the constitution on the vehicle is recorded in the Vehicle Registry vehicle of a mortgage registered in the Movable Mortgage Registry or the existence of an agreement prohibiting disposal or reservation of ownership registered in the Register of Installment Sale of Movable Property, only will practice the change of ownership in the Vehicle Registry when accredit the cancellation of the registration in the aforementioned Registries, submitting the documents listed in section IV of annex XIV, or the consent of the creditor or of the person favored by such registration, although in the latter case it will continue to be recorded said registration in the Vehicle Registry. The annotation on the permit or circulation license will have the same effects. of the constitution on the vehicle of a mortgage registered in the Registry of Movable Mortgage, even when it is not recorded in the Vehicle Registry. When a lease notation appears in the Vehicle Registry with the option to buy or lease in the long term, it will only be practiced the change of ownership in the Vehicle Registry when the consent of the landlord. An impediment to the change of ownership is the non-payment of the Sanctions imposed for violations of Law 16/1987, of July 30, on Ordinance of Terrestrial Transport, regarding the vehicles with which that those had been committed, provided that they appear noted in the Vehicle Registration. Any impediment to the change of ownership will be communicated by the Traffic Department to the purchaser (...) For its part, Annex XIV of the aforementioned Regulation establishes: "1. Transmissions between people who are not engaged in the sale of vehicles. A) Obligations of the transferor: In accordance with the provisions of article 32, section 1 of this Regulation, the transferor of a vehicle must, within ten days from the transmission, communicate it to the Traffic Department with the documentation that it is related below: 1st A statement stating the identifications and addresses of the transferor and transferee. In your case, the documents that on the identity and representation are specified in section A, numbers 1 and 3 of annex XIII, on the registration. 2nd Fee for the legally established amount. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/10 3rd The permit or circulation license. 4th Document accrediting the transmission, except in the case that the seller and buyer submit their applications jointly. 5th Original and photocopy of the document accrediting the payment of the Last receipt posted for the collection of Traction Vehicle Tax Mechanics, or proof of its exemption. 6th Withdrawal form, duly completed, of change of ownership to effects of the Tax on Mechanical Traction Vehicles. 7th If the vehicle being transferred is affected by rights that limit the power to dispose of the transferor, in accordance with the provisions of the section 7 of article 32 of this Regulation, a document must be presented certifying the cancellation of the impediment in the corresponding Registry or in which the consent of the creditor or of the person favored by the inscription. 8th In the case of a special agricultural vehicle, document accrediting the deregistration in the Official Register of Agricultural Machinery.” Likewise, and in terms of documents referring to identity and representation, indicates Annex XIII in its section A: "A) Ordinary registration: In accordance with the provisions of articles 27, section 2.c and 28, section 2 of this Regulation, for the registration of Vehicles will be accompanied by the following documents: 1st Application signed by the interested party in the official model form that will facilitate the Headquarters of Traffic. If the applicant is a minor or disabled, they must be included in the application, in addition, the data and signature of the person representing it, as well as as the concept in which it does. 2nd Fee for the legally established amount. 3rd National identity document in force or, failing that, receipt of have requested it, as well as the Family Book or other document that certifies the data that appears in the national identity document that does not present. If the applicant is a foreigner, they must present a Residence Card, as well as Declaration of ownership of other vehicles registered in Spain, or Spanish driving license of which he is or would have been the holder, or the number Provincial registration of foreign drivers, if any. In the case of foreigners who do not have a Residence Card, They will present an identity document from the country of origin, if it is citizens of States party to the Economic Area Agreement European Union (EEA), or Passport or Certificate of Nationality if it is a citizens of third countries, and they will also justify their domicile in Spain C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/10 through any document that proves it, such as ownership or renting a home, or being registered in a Municipality. When the applicant is a Legal Entity, he will submit a Number of Fiscal Identification, as well as the National Identity Document, Passport o Residence Card of the person who represents them and document that certify that they have power to act on your behalf. The originals of the aforementioned documents may be replaced by photocopies of the same that the interested parties or their representatives must provide at the time of submitting your application, provided they are duly collated by the records of the bodies in which the submitted the corresponding application, in accordance with the provisions of the Article 38.4 a) and b) of Law 30/1992, of November 26, on the Legal of Public Administrations and Administrative Procedure Common, without prejudice to the possibility of exercising this function by a Collegiate Administrative Manager in the terms determined in the agreements that can be established with the Associations of Managers Administrative. Applications submitted by Bodies or Entities dependent on the Public Administrations, General State, Autonomous, Provincial or Municipal, will be signed by the Head of the Agency or Entity to which belongs to the vehicle or person to whom it delegates, accompanied by the required documentation." Bearing in mind that the Provincial Traffic Headquarters of Valencia presented a request for notification of sale of the vehicle, which was accompanied by the documentation required in the General Vehicle Regulations to carry out said procedure, including a sales contract where the seller is identified and the buyer, it cannot be affirmed that the DGT has incurred in an illegitimate treatment of data of the claimant, since the registration in the Vehicle Registry is carried out in compliance with a legal obligation applicable to the person responsible for the treatment, and, likewise, based on the execution of a contract in which the interested is part. II The complaining party adds that the DGT did not act with due diligence as it had not verified if the identification of the complaining party was correctly carried out. However, having analyzed in the previous section the articles of the Regulation of Vehicles applicable to the notification of sale, it must be concluded that, in the notification of sale, the aforementioned legal text does not require verification and collation of signatures, given also note that it is not necessary for the buyer and the seller to meet at the same time at the Traffic Headquarters, since according to Annex XIV of the aforementioned Regulation, with regard to the figure of the acquirer: "B) Obligations of the purchaser: In accordance with the provisions of article 32, section 3 of this Regulation, the purchaser of a vehicle must, within thirty days from the date C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/10 of its acquisition, request from the Traffic Department the renewal of the permit or driving license, presenting the following documents: 1st Application in official model form that will be provided by the Traffic Headquarters, in which the identity and address of the transferor and acquirer is stated. 2nd Rate or rates for the legally established amount. 3rd The documents that on the identity and representation are specified in section A, numbers 1 and 3 of annex XIII, on registration. 4th technical inspection card or certificate of characteristics, with valid recognition. 5th Original of the self-assessment of the Transfer Tax Patrimonial and Documented Legal Acts, or proof of the exemption or not subject to it, and photocopy. 6th Self-assessment of the Special Tax on Certain Means of Transportation or justification of non-subjection or exemption in cases of transmission of a vehicle before four years have elapsed since its first definitive registration with exemption or non-subjection. 7th Form of registration in the Tax on Mechanical Traction Vehicles. 8th Original and photocopy of proof of payment or exemption from Tax on Mechanical Traction Vehicles, in the event that the transferor has not fulfilled the obligation to notify the transmission provided for in article 32, section 1 of this Regulation. 9th Document proving the acquisition, except in the case that the seller and the buyer submit their applications jointly.” Therefore, lack of diligence cannot be imputed, beyond the verification that Provide all the documentation required in the Vehicle Regulations to carry out the corresponding procedure. If the documentation presented is fraudulent, you do not have the acting official capacity or possibility of verifying it. IV. Therefore, based on what is indicated in the previous paragraphs, no Evidence proving the existence of an infringement in the area of competence of the Spanish Data Protection Agency. Thus, in accordance with what has been indicated, by the Director of the Spanish Agency for Data Protection, HE REMEMBERS: FIRST: PROCEED TO THE ARCHIVE of the present proceedings. SECOND: NOTIFY this resolution to B.B.B. and GENERAL DIRECTORATE OF TRAFFIC. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once the interested parties have been notified. Against this resolution, which puts an end to the administrative process as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common for Public Administrations, and in accordance with the provisions of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/10 arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may file, optionally, an appeal for reinstatement before the Director of the Agency Spanish Data Protection Agency within a period of one month from the day following the notification of this resolution or directly contentious appeal before the Contentious-Administrative Chamber of the National Court, in accordance with the provisions of article 25 and paragraph 5 of the provision additional fourth of Law 29/1998, of July 13, regulating the Jurisdiction Contentious-Administrative, within a period of two months from the day following to the notification of this act, as provided in article 46.1 of the aforementioned Law. 940-110422 Mar Spain Marti Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es