AEPD (Spain) - EXP202305732
From GDPRhub
| AEPD - EXP202305732 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR Article 17 GDPR Art. 20.2 LOPDGDD Art. 32 LOPDGDD Art. 40.5 RLOPD |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 15.03.2023 |
| Decided: | 19.05.2025 |
| Published: | 08.07.2025 |
| Fine: | 200,000 EUR |
| Parties: | ASNEF-EQUIFAX |
| National Case Number/Name: | EXP202305732 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | ap |
The DPA fined a national credit bureau €200,000 for unlawfully including information regarding a data subject’s unpaid debt in their credit information system and not adequately responding to the data subject’s erasure requests.
English Summary
Facts
ASNEF-EQUIFAX (the controller) is a national credit bureau. The controller included personal data related to a data subject’s debt in their system three times at the request of SD IBERIAN (the creditor). The latter is a company that purchases debt and microloans from banks, and had debt against the data subject. The controller informed the data subject of the inclusion of their data in their credit information system by mail, however, the data subject did not receive the mail because they were sent to the wrong address. The data subject later made three separate requests for the controller to erase the data under Article 17 GDPR. The controller claimed that the requests were forwarded to the creditor, who did not respond. The controller later deleted the information as a precautionary measure and informed the data subject. The data subject learned about the debt being included in the controller's system after consulting ASNEF (National Association of Financial Credit Institutions).
The data subject filed a complaint with the DPA on 15 March 2023, and the DPA began sanctioning proceedings against the controller on 30 May 2024. The data subject argued that the data processing was unlawful, because it was included without verifying the accuracy of the debt or the lawfulness of including it in in the file. Furthermore, the controller did not inform the data subject when the data was included in the file. On the other hand, the controller argued that it had complied with its obligations under the GDPR and national data protection law. This included blocking the data as a precautionary measure and responding to the data subject in accordance with Article 12 GDPR. The controller does not have all the information regarding the debts, and therefore the creditor has the full responsibility of guaranteeing that the debts are lawfully included in the system. Furthermore, the controller argued that it did not process the data for the purposes of a credit information system, and therefore there was no unlawful processing.
Holding
The DPA first established ASNEF-EQUIFAX was a joint controller with the creditor, under Article 20(2) of the national data protection law (LOPDGDD) and Article 26 GDPR. Article 20(2) LOPDGDD explicitly establishes entities maintaining credit information systems and creditors as joint controllers. In addition, ASNEF-EQUIFAX jointly decides the purpose and means of processing with the creditor.
The DPA found a violation of Article 17 GDPR, in conjunction with Article 32 LOPDGDD. Article 20(2) LOPDGDD states that the creditor is responsible for the data being included lawfully, and is responsible for its accuracy. However, the DPA argued that this does not exonerate the controller of its responsibilities. The DPA emphasised that the controller cannot limit itself to forwarding a request for erasure to the creditor or act passively in the absence of a response.[1] The DPA considered that the controller had violated its duty of care; as the manager of the data subject’s file, the controller cannot rely on the decision of a third party to determine how it will act. According to the DPA, the controller had a responsibility to analyse the merits of the request and act in a reasoned manner.[2] Regardless of the arrangement between the controller and the creditor, the data subject had the right to exercise their right to erasure against the controller (Article 26(3) GDPR). The DPA stated that the controller should have blocked the data to prevent its further processing, in accordance with Article 32 LOPDGDD.
The DPA then found a violation of Article 6(1) GDPR. Article 40(5) Royal Decree 1720/2007 (RLOPD)[3] imposes the obligation on the controller to verify with the creditor whether the data subject’s address is accurate. The controller did not do this despite their letters being sent back by the Spanish postal service three times. The obligation to inform the data subject is also present in Article 20 LOPGDDD, which outlines a series of conditions for the processing of data related to credit information systems to be lawful. The DPA stated that the processing of the data was therefore unlawful, as the information obligations under Spanish national law (both the RLOPD and LOPDGDD) were not met. The DPA reiterated that the controller could not act passively and had the duty to actively verify the accuracy of the data subject’s address. Finally, the DPA stated that the decision to block the data did not mean that the previous processing was lawful.
The DPA fined the controller €200,000 in total: €100,000 for the violation of Article 17 GDPR, and €100,000 for the violation of Article 6(1) GDPR. The DPA considered this a serious violation, as the controller had repeatedly refused to verify the data subject’s address. This deprived the data subject of effectively exercising their rights under the GDPR, and was considered negligent behaviour by the controller. In addition, the DPA ordered the controller to continue the cautionary suspension of the data until the requirements for lawful processing are met.
Comment
Explanation for Royal Decree 1720/2007: this law amended the previous national data protection law (LOPD) implementing the EU Data Protection Directive (now derogated by the new national data protection law (LOPDGDD)). Royal Decree 1720/2007 is still in effect as a complement to the GDPR and the LOPDGDD in accordance with national case law (STS 20/12/22, rec. 2737/22): “In the absence of a regulation implementing the new organic law, Royal Decree 1720/2007 serves as the regulatory development of Organic Law 3/2018 [the LOPDGDD], which is necessary for its full effectiveness, without prejudice to the repeal of those provisions of the aforementioned regulation that "contradict, oppose, or are incompatible with the provisions of Regulation (EU) 2016/679 and this organic law".
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/60 File No.: EXP202305732 (PS/00157/2024) RESOLUTION OF THE SANCTIONING PROCEDURE Regarding the actions taken by the Spanish Data Protection Agency and based on the following: BACKGROUND FIRST: Complaint On March 15, 2023, A.A.A. (hereinafter, the complaining party) filed a complaint with the Spanish Data Protection Agency (hereinafter, AEPD). The complaint was directed against ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. (ASNEF), with CIF: B82064833 (the defendant), for the alleged violation of data protection regulations: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27/04/2016 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data (hereinafter, GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, LOPDGDD). In its letter, it states the following: 1. That on 15/11/2022, 16/01/2023, and 14/03/2023, at its own request and after consulting ASNEF, it learned that its personal data was included in the solvency file at the initiative of the SD IBERIAN PORTFOLIOS, S.A., (SD IBERIAN) with registration dates in the aforementioned file on 11/02/22, 01/09/23, and 03/07/23, and which refer to alleged unpaid amounts with which he did not agree. 2. That, on those same dates, after receiving the ASNEF reports, he requested to exercise his right to erasure of the personal data included in the file due to illegal use of the same without having proven the existence of the debt, the legality of his claim, or having been notified of the inclusion in the file, not only by SD IBERIAN, but also by ASNEF itself. He also indicated that the reports received from ASNEF included an address that he stated he had never lived in. 3.- That ASNEF's responses to the aforementioned requests were as follows: ASNEF never responded to the request of 11/15/22; to the request of 01/16/23, ASNEF notified you by email that it has proceeded to provisionally delete your personal data at the request of SD IBERIAN; and regarding the request of 03/14/23, it has not yet received a response. The following documentation is attached to the complaint: - A copy of the communication that ASNEF provided you on January 25, 2023, via email (***EMAIL.1), regarding the inclusion of your personal data in the file at the request of SD IBERIAN, informing you that the data associated with the identifier ***IDENTIFIER.1 has been provisionally removed from the ASNEF file. - A copy of the letter sent on March 14, 2023, to the CONSUMER PROTECTION SERVICE; DATA FILE RELATING TO THE EXERCISE OF THE RIGHTS OF INTERESTED PARTIES; P.O. Box (...) Madrid, requesting the cancellation of the data entered in the file, stating that it has no record of any relationship with SD IBERIAN PORTFOLIO, nor has it received any communication regarding its alleged credit claim. SECOND: Transfer to the respondent On April 26, 2023, in accordance with Article 65.4 of the LOPDGDD (Spanish Data Protection Act), the respondent was notified of this claim so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the data protection regulations. THIRD: Response from the Respondent On May 24, 2023, the Respondent filed a response, stating, among other things, the following: - That after consulting the Consumer Service Department, the request was forwarded to SD IBERIAN, and in none of the three cases did the creditor issue a statement. Therefore, the complainant's data was temporarily deleted, and the complainant was notified of this via email (***EMAIL.1). The email address to which the response to the first request, dated November 15, 2022 (***EMAIL.2), was found to be incorrect, which is why the consumer was unable to receive the first response, as stated in his or her complaint. - That after checking the ASNEF and ASNEF COMPANIES files with the claimant's data, as of 05/05/23, only debts were recorded in the ASNEF file at the request of EOS SPAIN SL. However, on 05/10/23, it was verified that there was a new entry at the request of SD IBERIAN, but after requesting data confirmation from said entity, no response was received. Therefore, on 05/24/23, the claimant's data provided by this entity was provisionally cancelled. - That a response has been issued to the claimant informing them of the steps taken and their current status in the ASNEF file. A copy of the following documents is attached to the response: a) Regarding the communications sent to the claimant regarding their requests to delete their data from the file: Regarding the request for data deletion made on 11/15/22: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/60 or a copy of the email sent from the address ***EMAIL.1 to the address ***EMAIL.3, dated 11/15/22, with the subject line, "Request to Exercise the Right to Cancellation" and stating the following: "Dear Sirs, I hereby request *to exercise the Right to Cancellation, for which I am providing the following documentation: 1. Photocopy of ID and 2. Letter requesting to exercise the Right to Cancellation dated 11/15/2022 (...)". o Copy of the "Email Delivery Receipt" dated 11/24/22, sent from address ***EMAIL.3 to address ***EMAIL.2 and with "Bcc: ***EMAIL.4", in File 2022/XXXXXX, containing as an attachment the file "2022/XXXXXX.pdf". o Copy of the letter sent to the claimant dated 11/24/22 and File No. 2022/XXXXXX, which informs you, among other things, of the following: "In accordance with your CANCELLATION request, registered in our offices on November 15, 2022, we inform you that, following the relevant checks, the provisional deregistration of the data associated with the identifier ***IDENTIFIER.1 has been carried out with the entity(ies) SD IBERIAN PORTFOLIOS in the ASNEF file. We also attach the information that finally appears in ASNEF (...)". - Regarding the data cancellation request made on 01/16/2023: o Copy of the email sent from the address ***EMAIL.1 to the address ***EMAIL.3, dated 01/16/2023, with the subject line, "Request to Exercise the Right to Cancellation" and stating the following: "Dear Sirs, I hereby request to *exercise the Right to Cancellation, for which I am providing the following documentation: 1.- Photocopy of ID and 2.- Letter requesting to exercise the Right to Cancellation dated 01/16/2023 (...)". o Copy of the "Email Delivery Receipt" dated 01/25/23, sent from address ***EMAIL.3 to address ***EMAIL.2 and with Bcc: ***EMAIL.4 in File 2023/XXXXX containing Annex 2023/XXXXX.pdf. o Copy of the letter sent to the claimant dated 01/25/23 and File No. 2023/XXXXX, which states, among other things, the following: "In accordance with your CANCELLATION request, registered in our offices on January 16, 2023, we inform you that, following the pertinent checks, the provisional deletion of the data associated with the identifier ***IDENTIFIER.1 has been carried out with the entity(ies) SD IBERIAN PORTFOLIOS in the ASNEF File. Likewise, we attach the information that finally appears associated in the ASNEF File (...)". - Regarding the data cancellation request made on 03/14/2023: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/60 or a copy of the email sent from the address ***EMAIL.1 to the address ***EMAIL.3, dated 03/14/2023, with the subject line, "Request to Exercise the Right to Cancellation" and stating the following: "Dear Sirs, I hereby request *to exercise the Right to Cancellation, for which I am providing the following documentation: 1.- Photocopy of ID and 2.- Letter requesting to exercise the Right to Cancellation dated 03/14/2023 (...)". or Copy of the "Email Delivery Receipt" dated 03/24/2023, sent from address ***EMAIL.3 to address ***EMAIL.2 and with Bcc: ***EMAIL.4 in File 2023/XXXXX containing Annex 2023/XXXXX.pdf. or Copy of the letter sent to the claimant dated 03/24/2023 and File No. 2023/XXXXX, which informs you, among other things, of the following: "In accordance with your CANCELLATION request, registered in our offices on March 14, 2023, we inform you that, following the relevant checks, the provisional deregistration of the entity(ies) SD IBERIAN PORTFOLIOS in the ASNEF file has been carried out for the data associated with the identifier: ***IDENTIFIER.1. Likewise, we attach the information associated with your ASNEF identifier (...)". b).- Regarding notifications of inclusion in the file: - Screenshot of the Auxiliary Notifications file showing the list of notifications sent to the claimant corresponding to SD IBERIAN: o ***REFERENCE.1 SD IBERIAN PORTFOLIO ***QUANTITY.1 11/03/2022 o ***REFERENCE.2 SD IBERIAN PORTFOLIO ***QUANTITY.2 01/10/2023 o ***REFERENCE.3 SD IBERIAN PORTFOLIO ***QUANTITY.3 03/08/2023 - Regarding the shipment with reference ***REFERENCE.1, sent on 11/03/2022, by regular mail, the following is submitted: o Copy of the letter, with reference number ***REFERENCE.1, dated 11/03/2022, sent by the respondent entity to Claimant at address ***ADDRESS.1 and informing him/her that, on November 2, 2022, SD IBERIAN PORTFOLIOS requested the registration of his/her personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.1. or Copy of the certificate issued by SERVINFORM, S.A. indicating: That on November 3, 2022, file ***FILE.1 was received, sent by Equifax Ibérica, with a total of 53,671 records, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 5/60 with the reference (...) appearing as the first communication to be processed, and the reference (...) appearing as the last communication to be processed, according to classification criteria ascending by postal code number. That during said process, the communication with reference ***REFERENCE.1 was generated, addressed to A.A.A. at ***ADDRESS.1. Said communication was generated, printed, and enveloped, without any incident that would have altered the final result of the procedure. It was made available to the postal service for subsequent distribution on delivery notes number 9942, with a total of 23,429 communications, and number 60901, with a total of 30,242 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any events occurring during its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST to the client EQUIFAX, dated 11/04/22, containing the file ***FILE.1. o Delivery note and delivery note at the (...) Post Office, with the value date 11/04/23 and the acceptance of 30,242 shipments, whose depositor is SERVINFORM, S.A. o Copy of the return receipt dated 11/21/22, issued by HISPAPOST for the letter with reference ***REFERENCE.1, sent to A.A.A.; ***ADDRESS.1, with the "Unknown" check mark in the box. - Regarding the shipment with reference ***REFERENCE.2 sent on 10/01/23, by regular mail: or Copy of the letter, with reference number ***REFERENCE.2, dated 10/01/23, sent by the entity being sued to the claimant at the address ***ADDRESS.1, informing the claimant that, on 09/01/23, the entity SD IBERIAN PORTFOLIOS requested the registration of its personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.2. or Copy of the certificate issued by SERVINFORM, S.A. indicating: That on 10/01/23, file ***FILE.2 was received, sent by Equifax Ibérica, with a total of 35,444 records, with the first communication to be processed appearing in it as reference (...), and the last communication to be processed as reference (...), according to classification criteria ascending by postal code number C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/60 That in said process, the communication reference ***REFERENCE.2 was generated, addressed to A.A.A. at ***ADDRESS.1 Said communication was generated, printed, and enveloped, without any incident that would have altered the final result of the procedure. It was made available to the postal service for subsequent distribution on delivery notes number 10753, with a total of 16,875 communications, and number 62,952, with a total of 18,569 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any events occurring throughout its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST of the client, EQUIFAX, dated 12/01/23, containing the file ***FILE.2. o Delivery note to the (...) Post Office, dated 12/01/23 and the acceptance of 18,565 shipments, deposited by SERVINFORM, S.A. o Copy of the return receipt dated 24/01/23, issued by HISPAPOST, for the letter with reference ***REFERENCE.2, sent to A.A.A.; ***ADDRESS.1, with a check mark in the "Unknown" box. - Regarding shipment reference 2023(…) sent on 03/08/23, by regular mail: o Copy of the letter, with reference number ***REFERENCE.3, dated 03/08/23, sent by the entity being sued to the claimant at the address ***ADDRESS.1, informing the claimant that, on 03/07/23, SD IBERIAN PORTFOLIOS requested the registration of its personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.3. o Copy of the certificate issued by SERVINFORM, S.A. indicating: That on 08/03/23, file ***FILE.3 was received, sent by Equifax Ibérica, with a total of 8,019 records, listing the first communication to be processed as reference (...), and the last communication to be processed as reference (...), according to classification criteria ascending by postal code number. That during said process, the communication reference ***REFERENCE.3 was generated, addressed to A.A.A. at ***ADDRESS.1 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/60 This communication was generated, printed, and enveloped, without any incident that could have altered the final result of the procedure. It was made available to the postal service for subsequent distribution on delivery notes number 11504, with a total of 3,569 communications, and number 64797, with a total of 4,450 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any events occurring during its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST to the client EQUIFAX, dated 03/10/23, containing the file ***FILE.3. o Delivery note to the (...) Post Office, dated 03/10/23 and the acceptance of 4,450 shipments, deposited by SERVINFORM, S.A. or a copy of the return receipt dated March 29, 2023, issued by HISPAPOST for the letter with reference ***REFERENCE.3, sent to A.A.A.; ***ADDRESS.1, with a check mark in the "Unknown" box. c).- Regarding other measures taken, the following documentation is submitted: Regarding the first inclusion of data in the file on 11/02/22: - Screenshot of the document "ASNEF-EQUIFAX INTERNAL APPLICATIONS 05/05/2023 S.I.C. MAINTENANCE OF OPERATION LETTERS CREDIT CONSULTATION/UPDATE OF LETTERS SENT: Identifier: (...) Letter Ref.: ***REFERENCE.1 Entity: 1137 - SD IBERIAN PORTFOLIO Notification Type: Inclusion Registration Date: 11/02/2022 View Date: 12/01/2022 (Date from which your data is visible to other entities). Issue Date: 11/03/2022 Closing Date: 10/31/2022 Return Date: 11/26/2022 Regarding the second inclusion of data in the file on 01/09/2023: - Screenshot of the document "ASNEF-EQUIFAX INTERNAL APPLICATIONS 05/05/2023 S.I.C. MAINTENANCE OF OPERATION LETTERS CREDIT CONSULTATION/UPDATE OF SENT LETTERS: Identifier: (…) Letter Ref.: ***REFERENCE.2 Entity: 1137 - SD IBERIAN PORTFOLIO C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 8/60 Notification Type: Inclusion Registration Date: 01/09/2023 Viewing Date: 02/08/2023 (Date from which your data is visible to other entities). Issue Date: 01/10/2023 Ctb Closing Date: 01/06/2023 Date Return: 04/02/2023 Regarding the third inclusion of data in the file on 07/03/2023: - Screenshot of the document "ASNEF-EQUIFAX INTERNAL APPLICATIONS 05/05/2023 S.I.C. MAINTENANCE OF OPERATION LETTERS CREDIT CONSULTATION/UPDATE OF SENT LETTERS: Identifier: (...) Letter Ref.: ***REFERENCE.3 Entity: 1137 - SD IBERIAN PORTFOLIO Notification Type: Inclusion Registration Date: 07/03/2023 View Date: 06/04/2023 (Date from which your data is visible to other entities). Issue Date: 08/03/2023 Date Closing date: 06/03/2023 Return date: 05/04/2023 - Screenshot of the "Transactions in the ASNEF File" file dated 05/05/2023, which only includes debts registered in the claimant's name in the ASNEF file at the request of EOS SPAIN SL. - Screenshot of the "Transactions in the ASNEF File" file dated 10/05/2023, which includes debts registered in the claimant's name in the ASNEF file at the request of EOS SPAIN SL. and SD IBERIAN PORTFOLIO with an unpaid balance of ***AMOUNT.4. - Copy of the email sent on 10/05/2023 from the email address ***EMAIL.5 to the email address ***EMAIL.6 requesting confirmation of the data. Claimant. - Copy of the letter sent by the respondent to the claimant, dated 05/24/2023 informing them that the data provided at the request of SD IBERIAN PORTFOLIOS has been provisionally deleted. - Screenshot of the "ASNEF/EQUIFAX INTERNAL APPLICATIONS OF ASNEF-EQUIFAX-S.I.C. “REDUCTION INQUIRY” dated 05/05/23, regarding the respondent, with the following information: OP ENTITY TYPE NATUR. MOT. BJ F. REDUCTION C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/60 1137 SD IBERIAN P. T CREDIT HOLDER GDPR 11/24/22 1137 SD IBERIAN P. T CREDIT HOLDER GDPR 01/25/23 1137 SD IBERIAN P. T CREDIT HOLDER GDPR 03/24/23 1137 SD IBERIAN P. T CREDIT HOLDER CLIENT 05/24/23 FOURTH: Inadmissibility for initial processing Dated 05/25/23, in accordance with In accordance with Article 65 of the LOPDGDD (Spanish Data Protection Act), the Director of the Data Protection Agency issued a decision rejecting the claim filed in procedure AT/02204/2023, considering that the requested right had been fulfilled. FIFTH: Filing of an appeal for reconsideration On June 25, 2023, a written appeal for reconsideration (RR/00448/2023) was filed with this Agency. The claimant states, among other things, the following: - That, although ASNEF EQUIFAX responded to his requests for the right to cancellation dated January 9, 2023, and March 7, 2023, this was not the case with the request of November 2, 2022, to which he never received a response. - That ASNEF EQUIFAX indicates that the notifications were sent to the Claimant with reference numbers ***REFERENCE.1, ***REFERENCE.2 and ***REFERENCE.3, dated 03/11/22, 10/01/23, and 08/03/23 respectively, by regular mail to the address provided by the creditor. However, said documentation includes a copy of the return of the notifications, stating that they were never received. - That the claim not only referred to the violation of Article 20.1c of the LOPDGDD regarding "not having been informed of the inclusion of their personal data in the ASNEF file," but also refers to Article 20.1b regarding "the data referring to certain, due, and payable debts," since the alleged creditor never provided documentation proving the existence of the alleged debt, and the address indicated did not exist. - That the resolution also fails to address the matter. "that the creditor has been informed to this effect in the contract, or at the time of requesting payment, about the possible inclusion in the default file." SIXTH: Allegations of the respondent to the appeal for reconsideration On February 26, 2024, this Agency received a written response from the respondent entity, stating, among other things, the following: - Regarding point 1 of the claimant's allegations, they indicate that, as already established in the response of May 24, 2023, this request was processed under file number 2022/XXXXXX, but that an incorrect email address was used as the response address, and therefore the response was not received by the claimant. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/60 received. However, the procedures for the cancellation requested by The claimant's requests were handled correctly. - That the claimant's requests were forwarded to the creditor entity, SD IBERIAN PORTFOLIO, without any comment on the matter. Therefore, the claimant's data was provisionally removed from the file. - That the query history included in the response to the following exercise of rights submitted by the claimant during the month of January 2023, which was addressed under file number 2023/XXXXX, also includes the two queries from the first response that were not received. - That regarding the allegations regarding the notifications of inclusion in the file, in which the claimant states that he has not received any communication in this regard, they indicate that the address to which said notifications are sent was provided by the creditor, who is responsible for the quality of the data transferred to the file, and that, as documented on 05/24/2023, the inclusions made by the creditor until At that time, the claimant was notified through notifications with references ***REFERENCE.1, ***REFERENCE.2, and ***REFERENCE.3, although it is true that all of them were returned. - It is recorded that subsequent inclusion notifications have been sent at the request of SD IBERIAN PORTFOLIO, with references ***REFERENCE.4 and ***REFERENCE.5, sent on 05/09/23 and 07/08/23, respectively, to the same contact address as those sent previously, but to date, none have been returned. Regarding the reference ***REFERENCE.4 sent on 05/09/23, by postal mail, the following documentation is submitted: o Copy of the letter, with reference number ***REFERENCE.4, dated 05/09/23, sent by the respondent entity to the claimant at the address ***ADDRESS.1 and informing you that, on 05/08/23, SD IBERIAN PORTFOLIOS requested the registration of your personal data in the ASNEF file, related to the non-payment of ***AMOUNT.4. or Copy of the certificate issued by ARTEOS DIGITAL, S.L. (as the successor entity of SERVINFORM, S.A.) with CIF: B64510373 indicating: That on 05/09/23, file ***FILE.4 was received, sent by Equifax Ibérica, with a total of 18,421 records, with the first communication to be processed being the one with reference to (...) and the last communication to be processed being the one with reference to (...), according to classification criteria ascending by postal code number. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/60 That during said process, the communication with reference ***REFERENCE.4 was generated, addressed to A.A.A. at ***ADDRESS.1. Said communication was generated, printed, and enveloped, without any incident that would have altered the final result of the procedure, and was made available to the postal service for subsequent distribution on delivery notes number 12276, with a total of 8,624 communications, and number 66488, with a total of 9,797 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any events occurring during its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST to the client EQUIFAX, dated 05/11/23, containing the file CREDI_INCLU_SP. o Delivery note to the (...) Post Office, dated 05/11/23 and the acceptance of 9,797 shipments, deposited by SERVINFORM, S.A. o Copy of the Certificate issued by ILUNION CEE CONTACT CENTER, S.A. (formerly ILUNION IT SERVICES S.A.) dated 02/23/24, which states: "After consulting the files related to the service provided with Equifax, the Reference Notification ***REFERENCE.4 is not currently in custody at the offices of Ilunión CEE Contact Center, S.A., nor has it been processed for any reason." Regarding the shipment with reference ***REFERENCE.5 sent on 07/08/23, by postal mail, the following documentation is submitted: o Copy of the letter, with reference number ***REFERENCE.5, dated 07/08/23, sent by the entity being sued to the claimant at the address ***ADDRESS.1, informing the claimant that, on 05/08/23, SD IBERIAN PORTFOLIOS requested the registration of its personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.6. o Copy of the certificate issued by ARTEOS DIGITAL, S.L. (as the successor entity of SERVINFORM, S.A.) with CIF: B64510373 indicating: That on 08/07/23, file ***FILE.5 was received, sent by Equifax Ibérica, with a total of 18,421 records, listing the first communication to be processed as reference (...) and the last communication to be processed as reference C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/60 (...) in ascending order by postal code number. That in said process, the communication reference ***REFERENCE.5 was generated, addressed to A.A.A. at ***ADDRESS.1 Said communication was generated, printed, and enveloped, without any incident that would have altered the final result of the procedure. The postal delivery service was made available for subsequent distribution on delivery notes number 68319, with a total of 5,924 communications, and number 13208, with a total of 6,523 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any incidents occurring throughout its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST of the client, EQUIFAX, dated 07/21/23, containing the file CREDIT_INCLU_SP. o Delivery note at the (...) Post Office, dated 07/20/23, and the acceptance of 5,924 shipments, deposited by SERVINFORM, S.A. o Copy of the Certificate issued by Ilunion CEE Contact Center, S.A. (formerly Ilunion IT Services S.A.) dated 02/23/24, which states: "Having reviewed the files relating to the provision of the service maintained with Equifax, the Reference Notification ***REFERENCE.5 is not currently in custody at the offices of Ilunion CEE Contact Center, S.A. nor has it been processed for any reason for return." SEVENTH: Resolution of the appeal for reconsideration On March 7, 2024, the Data Protection Agency's Board of Directors issued a resolution granting the appeal for reconsideration (RR/00448/2023), based on the fact that it had been established that the notifications of inclusion in the ASNEF solvency file by SD IBERIAN PORTFOLIO were not properly managed by the respondent, given that the letters were returned to the respondent after being sent to an address where the claimant was unknown. There was no evidence of compliance with the obligation established in Article 40.5 of the Regulation implementing Organic Law 15/1999, of December 13, on the protection of personal data, approved by Royal Decree 1720/2007, of December 21 (RLOPD), to verify with the creditor entity whether the address used for the Notification corresponded to the contractually agreed upon notification. EIGHTH: Agreement to initiate sanctioning proceedings On 05/30/2024, the Director of the Spanish Data Protection Agency (AEPD) agreed to initiate sanctioning proceedings against ASNEF-EQUIFAX, SERVICIOS (ASNEF), C/ Jorge Juan, 6, www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/60 DEL INFORMACIÓN SOBRE SOLVENCIA Y CREDITO, S.L. (ASNEF), with CIF: B82064833, for the alleged violation of Article 17 of the GDPR, classified in Article 83.5.b) of the GDPR, and for the alleged violation of Article 6.1 of the GDPR, classified in Article 83.5.a) of the GDPR. The opening agreement determined that the applicable penalty, given the evidence available at the time the case was opened, would amount to 100,000 euros (one hundred thousand euros) for the violation of Article 17 of the GDPR and 100,000 euros (one hundred thousand euros) for the violation of Article 6.1 of the GDPR, with the total penalty being 200,000 euros (two hundred thousand euros). NINTH: Objections to the Commencement Agreement After notification of the aforementioned commencement agreement in accordance with the rules established in the LPACAP, the respondent submitted a written statement of objections on June 20, 2024, in which it essentially stated the following: - Regarding the inclusion and accessibility of the data in the financial solvency file, it indicates that the claimant's personal data was never published or accessible in the common financial solvency file (ASNEF), so the unpaid transactions attributed to the claimant were not visible to any financial or credit institution. Consequently, no harm has occurred or violation of the claimant's right to honor, since the data remained blocked and could only be accessed by the affected party by exercising his or her right of access. Therefore, the existence of unlawful data processing cannot be considered, as the processing of the unpaid transactions did not materialize. - Regarding the alleged violation of Article 17 of the GDPR, it alleges that the deletion request requested by the claimant lacked sufficient support or justification to prove the nonexistence, invalidity, or inaccuracy of the debt, and was merely a statement by the party. It argues that imposing on ASNEF the obligation to permanently delete the data, without any evidence to disprove the veracity of the debt, would constitute a breach of the principle of legal certainty and would distort the function of the common financial solvency file as an essential instrument to guarantee the adequate assessment of solvency in economic and financial transactions. Nevertheless, ASNEF proceeded to the precautionary deletion of the claimant's data on the appropriate dates (November 24, 2022, January 25, 2023, and March 24, 2023), after not receiving a response from the creditor entity. thus fulfilling its obligation to block the data while the dispute was resolved. - Regarding the action required of the controller of the common file in the event of a data deletion request, it indicates that, in light of this doctrine of the Supreme Court (Judgment No. 2040/2014, Judgment No. 247/2021), it is evident that ASNEF acted in accordance with current regulations, since, without having any direct participation in the underlying contractual relationship between the claimant and SD Iberian, it diligently carried out the required actions, forwarded the deletion request to the creditor responsible for the inclusion and verified the permanence of the debt before settling. - It should be emphasized that the opening of the sanctioning procedure by the AEPD represents a breach of the principle of legitimate trust and legal certainty that should govern relations between citizens and the Administration, since the conduct observed by ASNEF has been accepted and acknowledged by the AEPD itself in multiple previous proceedings, without any criticism of such actions to date. The change in the sanctioning criteria, based on judicial resolutions subsequent to the events under analysis, requires the Administration to communicate this in advance through recommendations, instructions, or guidelines, and not through the direct imposition of sanctions, as recognized by the National Assembly. - Regarding ASNEF's status as joint data controller and its response to the deletion requests made by the complainant, the complainant argued that Article 26.3 of the GDPR only establishes that the data subject may exercise their rights against any of the joint data controllers, without implying that all of them must assume identical material obligations in resolving said requests. Therefore, the Spanish Data Protection Agency (AEPD), by assigning sanctioning liability to ASNEF-EQUIFAX for failing to permanently delete the data, interprets the liability of the joint controllers in an extensive manner and contrary to the literal meaning of the provision. This interpretation also ignores the well-established doctrine of the Court of Justice of the European Union (CJEU) and the Guidelines 07/2020 of the European Data Protection Board (EDPB). In this regard, ASNEF has acted in accordance with the law by submitting the requests. Deletion of the creditor responsible for including the data and, in the absence of a response, proceed with the precautionary cancellation of the data. The assignment of powers between joint controllers, included in the signed joint liability agreement, expressly delegates to the creditor the assessment and resolution of the merits of the cancellation requests. - Regarding the alleged violation of Article 6.1 of the GDPR, the Court argues that, according to the Supreme Court's case law (Judgments No. 226/2012, 614/2018, and others), the data subject has no obligation or jurisdiction to verify the existence or certainty of the reported debts, as this is a matter that exceeds its powers and is outside its sphere of control. And regarding the management of inclusion notifications and returned letters, the Court argues that it has acted in accordance with the provisions of Article 40 of Royal Decree 1720/2007, following an audited, independent, and automated confirmation procedure with the creditor entity, in those cases in which the notifications are returned. It should be noted that, in the present case, the dates of the return of the notifications were later than the dates on which ASNEF had already proceeded to provisionally remove the data from the database. claimant, in consideration of the exercise of the right to erasure. - Regarding the alleged lack of a legitimate basis for the processing of personal data by ASNEF, the Commission argues that, pursuant to the provisions of Article 20 of the LOPDGDD, it should be noted that this provision does not imply that the absence of any of these requirements automatically determines the unlawfulness of the data processing. Rather, it establishes a framework in which, unless proven otherwise, the existence of a prevailing legitimate interest that justifies such processing is presumed, in accordance with Article 6.1 of the GDPR. Therefore, the systematic interpretation of Article 20 of the LOPDGDD and European data protection regulations prevents ASNEF from being considered legally obligated to verify the existence, veracity, or certainty of the debt before processing it. This responsibility falls exclusively on the creditor, in accordance with Article 6.1 of the GDPR. 20.2 of the LOPDGDD (Spanish Data Protection Act) and, consequently, the attribution of sanctioning liability to ASNEF is not appropriate, as it has not processed data contrary to law and has acted within the applicable regulatory framework and in strict compliance with its obligations as the managing entity of the credit information system. - That ASNEF correctly processed the deletion requests submitted by the claimant, proceeding with the precautionary deletion of the data within the legally established timeframes and after receiving no response from the creditor, as established in Article 44 of Royal Decree 1720/2007. Likewise, it complied with the provisions of Article 40.5 of the aforementioned Regulation regarding the management of returned inclusion notifications, without requiring additional consultation with the creditor entity because the data had already been deleted and there was no active processing of the same, and that any discrepancy in the AEPD's criteria regarding the need to proceed with the definitive deletion of the data cannot justify the existence of negligence, given that ASNEF reasonably applied the criteria of caution and due diligence required based on its position. - Regarding the proportionality of the sanctions proposed by the AEPD, they are absolutely disproportionate and contrary to the principles that govern sanctioning law. First, the alleged violations are closely connected, and in accordance with the provisions of Article 29.5 of Law 40/2015, on the Legal Regime of the Public Sector, the principle of medial concurrence of violations is applicable, imposing only the sanction corresponding to the most serious violation. Second, the application of aggravating circumstances by the AEPD is unjustified, given that the personal data of the complainant were never visible in the common financial solvency file (ASNEF), given that they were provisionally canceled before the end of the thirty-day blocking period provided for in Article 20 of the LOPDGDD. This demonstrates the absence of any harm to the affected party, which excludes the appropriateness of considering the severity or duration of the alleged violation as aggravating factors. Ultimately, imposing the sanctions proposed by the AEPD on ASNEF would be contrary to the principles of proportionality and culpability. In response to these allegations, this Agency stated, in summary, the following, included in the Draft Resolution: a).- Regarding Article 17 of the GDPR and Article 32 of the LOPDGDD: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 16/60 - First: In its allegations, the respondent entity maintains that the complainant's personal data was never accessible to third parties, as it remained blocked and was only visible to the affected party, through the exercise of the right of access. Consequently, it maintains that there was no data processing that could violate applicable regulations. However, the analysis carried out by this Agency shows that the alleged conduct does not stem from the alleged visibility of the data, but rather from the inadequate management of the right to erasure exercised by the complainant. The respondent entity simply forwarded the requests to the creditor SD IBERIAN, without analyzing them or issuing a substantive response, thus failing to comply with its duty to directly address the rights of the interested party. Similarly, it has been found that the requests for precautionary removal of personal data from the solvency file were made a few days before they became accessible to third parties. However, this prior blocking does not exempt the entity from its obligation to have adequately managed the right to erasure, in accordance with Article 17 of the GDPR and Article 32 of the LOPDGDD, which requires technical and organizational measures to prevent the processing of data in certain circumstances. Furthermore, a defect has been identified in the notification of the resolution of the requests to the complainant, as they were sent to an incorrect email address, even though the entity had the correct address, as evidenced by a previous notification that was correctly sent. Therefore, it is confirmed that the respondent engaged in passive action in the exercise of a fundamental right, which constitutes a material breach of current regulations on the protection of personal data. - Second: The respondent alleged that, lacking supporting documentation from the complainant, it only proceeded to provisionally remove the data without permanently deleting it, arguing that this could compromise the stability of the credit information system. However, this interpretation does not comply with the provisions of the agreement initiating the sanctioning procedure, which made it clear that the respondent entity had to resolve the complainant's deletion request by blocking the data, in accordance with Article 17 of the GDPR in conjunction with Article 32 of the LOPDGDD, in order to prevent its processing while the complaint was being resolved. The Agency emphasizes that a definitive deletion without justification was not required, but rather a diligent and legally binding processing of the request submitted, an obligation that falls directly on each joint data controller pursuant to Article 26.3 of the GDPR. Far from it, the respondent entity merely forwarded the requests to the creditor (SD IBERIAN) and noted its lack of response, without conducting its own analysis or issuing a substantive response to the data subject. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 17/60 In support of this position, the Supreme Court jurisprudence is cited (STS 01/02/2014), which establishes that the data controller cannot act automatically or uncritically in the absence of documentation or a response from the creditor, but must assess the exercise of the right to erasure. Therefore, the defendant's conduct demonstrates a failure to act actively and diligently as joint data controller, thereby violating the principles of proactive accountability and effective protection of the data subject's rights enshrined in data protection regulations. - Third: The respondent entity maintains that it complied with the provisions of Article 44 of Royal Decree 1720/2007 by handling the deletion requests submitted by the complainant and proceeding with the precautionary deletion of the data, once the creditor's lack of response was confirmed. It adds that the complainant did not provide documentary evidence proving the inadmissibility of the inclusion, and cites Supreme Court case law (Supreme Court rulings 247/2021 and 562/2020) in support of the idea that not every objection renders the debt uncertain or doubtful. It also considers that the sanction imposed by the AEPD represents an alteration of the previously applied interpretative criterion, which, in its opinion, would violate the principle of legitimate expectations. To this end, it invokes Supreme Court Judgment 4607/2022, in relation to the application of the procedure established in Royal Decree 1720/2007 for the management of rights exercised in credit information systems. However, this Agency clarifies that the basis of the sanctioning procedure is not the alleged obligation to permanently delete the data without proof, but rather the failure to comply with the duty to diligently process the right to erasure, pursuant to Article 26.3 of the GDPR. Far from complying with this requirement, the respondent entity limited itself to forwarding the requests to the joint data controller (SD IBERIAN), without conducting its own assessment or issuing a reasoned response to the complainant, and without exhausting the obligations arising from its position as joint data controller. In this regard, the jurisprudence cited by the respondent herself, far from exonerating her, reinforces this Agency's criteria: the person responsible for the common file cannot act automatically or simply transfer the requests, but must reasonedly assess their content and resolve them in accordance with the applicable regulations. The fact that a precautionary withdrawal was chosen, without further action, does not remedy the failure to respond effectively to the complainant nor does it exempt the complainant from full compliance with the regulations regarding data protection. - Fourth: The respondent entity maintains that the AEPD's interpretation of Article 26.3 of the GDPR is incorrect, arguing that joint responsibility for data processing does not imply equivalent responsibility between the different parties involved, in accordance with the case law of the CJEU and the Supreme Court. It points out that such joint responsibility does not oblige each party to exercise their rights equally, especially when no documentation is provided proving the inappropriateness of the data processing. However, the Agency recalls that Article 26.3 of the GDPR clearly establishes that data subjects may exercise their rights against any of the joint controllers, regardless of the terms of the internal agreement between them. Therefore, all joint controllers are legally obliged to respond to rights requests directly, and merely transferring them to another data controller is not enough. It is emphasized that ASNEF, in its capacity as joint controller, should provide a reasoned response to the deletion requests received, assessing the information and background information available, and proceed in accordance with the law, which includes the prior blocking of the data if the conditions established in Article 32 of the LOPDGDD are met. Far from this, the respondent entity simply forwarded the requests to the creditor (SD IBERIAN), and after the lack of response, issued a precautionary deletion without justification or formal resolution. The jurisprudence invoked by the respondent, far from exempting its liability, confirms the obligation of each joint controller to act with diligence and transparency. In particular, the Supreme Court ruling cited recognizes that the data controller cannot hide behind the absence of documentation or the creditor's actions to evade its duty to properly resolve rights requests. Finally, it is clarified that this procedure does not introduce a change in the regulatory criteria, as the respondent suggests, but is based on the inadequate processing of the claimant's deletion requests. Although Royal Decree 1720/2007 remains in force regarding the legitimacy of including data in solvency files, the enforcement of deletion rights must be governed exclusively by the GDPR and the LOPDGDD. Regarding the alleged violation of Article 6.1 of the GDPR: - First: The respondent alleges that it is unclear which provision of Article 20 of the LOPDGDD is considered to have been violated by this Agency. However, the agreement initiating the sanctioning procedure already specified that ASNEF-EQUIFAX, as the entity that maintains the credit information system as joint controller, is subject to the provisions of Article 20.2 of the LOPDGDD, in conjunction with Article 26 of the GDPR. This article attributes the status of joint controller to the entities that maintain the file, as well as to the creditors, and both must guarantee that the processing of personal data complies with the law, including the existence of a legitimate basis in accordance with Article 6.1 of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 19/60 In this regard, Article 40 of Royal Decree 1720/2007 (in force in this regard pursuant to the Supreme Court ruling of 20/12/2022, rec. 2737/2022) imposes on the controller of the common file the obligation to notify each inclusion of data to the affected party using a reliable and auditable means, and must refrain from processing the data if said notification is returned and the address has not been verified with the creditor. From the documentation provided by the defendant itself, it appears that the inclusion notifications addressed to the claimant were returned by Correos because the address was incorrect, a situation known to the entity, which did not take any measures to verify the address with the creditor before sending new messages. Thus, Article 40.5 of the LOPD was violated, as the veracity of the address was not verified before proceeding with subsequent notifications. This lack of diligence demonstrates the absence of a valid legitimate basis for processing the claimant's data, as adequate compliance with the principle of lawfulness set forth in Article 6.1 of the GDPR was not guaranteed. The repeated use of an address known to be erroneous reflects an action contrary to the principle of due diligence governing personal data protection. - Second: The respondent entity maintains that it complied with its legal obligations regarding notification, pursuant to Article 20 of the LOPDGDD and Article 40 of Royal Decree 1720/2007, and argues that the responsibility for the accuracy of the postal address lies exclusively with the creditor entity. It also claims that the notification system has automated return management processes and that, in this case, the notifications were returned after the data had already been removed from the system, exempting it from further verification. Furthermore, the respondent asserts that, as it is not the party providing the data to the solvency file, it is not responsible for its accuracy or veracity, attributing this responsibility to the creditor in accordance with Article 20.1.a of the LOPDGDD. However, this Agency recalls that Article 20.2 of the LOPDGDD establishes joint responsibility for processing between the entities that manage the system and the creditors, in accordance with Article 26 of the GDPR. By virtue of this joint responsibility, the respondent has the obligation to ensure that the processing of personal data is legally compliant, which includes verifying that the conditions for inclusion in the file are duly met. In this case, it is proven that the postal notifications sent to the claimant were returned by the postal service with the indication "Unknown" on three consecutive occasions, within a period of four months, without the respondent checking with the creditor whether the address used matched the contractually agreed address, as required by Article 40.5 of the RLOPD. This omission demonstrates negligent conduct and is contrary to the principle of due diligence. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 20/60 Consequently, by not having provided a valid notification and by persisting in processing the claimant's personal data, the respondent entity incurred an unlawful processing pursuant to Article 6.1 of the GDPR, as it lacked a valid legitimate basis to continue recording the data in the solvency file. - Third: The respondent entity argues that Article 20 of the LOPDGDD (Spanish Data Protection Act) establishes a rebuttable presumption regarding the legitimacy of data processing in credit information systems, and that, by virtue of this, the responsibility for ensuring the legitimizing basis rests exclusively with the creditor. It also argues that, since the data were not ultimately published, no infringement would have occurred. However, Article 20 of the LOPDGDD clearly establishes that, while it is the creditor's responsibility to prove that the material requirements for including a debt in the file (certain, overdue, payable, uncontested, properly notified) are met, it also imposes on the entity that manages the system the status of joint controller of the data, in accordance with Article 26 of the GDPR. As such, the latter must verify that the processing is carried out in accordance with the law and with respect for the rights of the data subject. In this context, Article 40.5 of Royal Decree 1720/2007 imposes on the data controller the obligation to verify with the creditor the validity of the address when an inclusion notification is returned. In the present case, the three notifications sent to the claimant between November 2022 and March 2023 were returned with the reference "Unknown," without the respondent taking any steps to correct the address or contact the creditor, as required by law. This repeated failure to do so demonstrates a lack of due diligence in the management of personal data and violates the accuracy principle of Article 5.1.d of the GDPR, which requires ensuring that personal data is accurate and up-to-date, and that reasonable measures are taken to rectify any inaccuracies. The claim that the data was never published because "precautionary deletions" were made does not eliminate the infringement, since the unlawfulness materializes at the moment the data is recorded and processed without a valid legitimizing basis, a fact that is not remedied by the subsequent action of the affected party when exercising their right to erasure. Furthermore, the defendant maintains that it cannot be held liable for the infringement of Article 6.1 of the GDPR because it is not the party providing the data. However, this interpretation ignores the fact that the data controller has a duty to refrain from processing data when the formal requirements, including proper notification to the data subject, have not been adequately verified. Joint responsibility implies an active obligation of control and verification, not merely passive management of the data submitted by the creditor. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 21/60 Therefore, it is established that the respondent failed to comply with its legal obligations as joint data controller, which constitutes a violation of Article 6.1 of the GDPR, as data processing was carried out without a valid legal basis. - Fourth: The respondent alleges that, according to the case law of the CJEU (case C-683/21) and recital 148 of the GDPR, sanctions can only be imposed if it is proven that the violation was committed intentionally or negligently. It maintains that its actions were neither intentional nor negligent, as it adopted measures such as the precautionary deletion of the data before publication. Therefore, it requests that, where appropriate, a warning be imposed instead of a fine. However, Article 28.1 of the (LRJSP) establishes that administrative liability may be imposed not only for wilful misconduct, but also for negligence, the latter understood as negligence or recklessness. In this sense, it is sufficient that the subject has omitted the measures that were reasonably required to avoid the infringement, even if there is no direct intent to cause harm. In the present case, it has been proven that the defendant attempted to notify the claimant's data in the solvency file on three occasions using the same incorrect address, despite having received a refund on the first attempt. Therefore, it did not adopt the measure required by Article 40.5 of the RLOPD: verifying with the creditor entity whether the address was the one contractually agreed upon with the client before continuing with the processing of personal data. This omission constitutes negligent behavior, as the due diligence expected in the management of a credit information system that involves the processing of particularly sensitive personal data was not exercised. This lack of proactive and preventive action constitutes a negligent violation, sufficient under the law of sanctions to justify the imposition of a sanction. Therefore, the defendant's conduct cannot be considered exempt from liability. Repeated attempts to notify an incorrect address, without subsequent verification, demonstrate negligent behavior and contravene the legal requirements of accuracy, lawfulness, and diligence in the processing of personal data, particularly when such processing may significantly affect the rights of the data subject. - Fifth: The respondent entity alleges that, even if its conduct were considered negligent or intentional, the proposed sanction would be disproportionate, requesting the application of the principle of medial concurrence of infringements provided for in Article 29.5 of Law 40/2015 (LRJSP), so that only the most serious sanction would be imposed. It also requests the application of mitigating circumstances pursuant to Article 83.2 of the GDPR, alleging the short duration of the infringement and the alleged absence of actual harm to the claimant. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 22/60 However, medial concurrence requires that one infringement be the necessary means to commit another, a circumstance that does not apply in this case. The violation of Article 17 of the GDPR, regarding the inadequate attention to the right to erasure, and that of Article 6.1 of the GDPR, regarding the lack of a legitimate basis for data processing, respond to distinct, independent, and not interdependent facts. Each has its own cause and effect, and therefore requires individual assessment and sanction. Regarding the allegation of disproportionate sanction and the request for mitigating circumstances, it should be remembered that Article 83.2 of the GDPR requires weighing various circumstances to determine the appropriateness and amount of the sanction. In this case, aggravating factors have been taken into account, both in the violation of Article 17 of the GDPR (due to unduly limiting the exercise of rights by data subjects and acting with prior knowledge of their legal obligation), and in the violation of Article 6.1 of the GDPR (due to a violation of the basic principle of lawfulness of processing, with potential harm to the financial solvency of the data subject and without the required due diligence). Therefore, it is not appropriate to apply mitigating circumstances, since the short period of time alleged does not diminish the seriousness of the facts or the lack of adequate corrective measures by the defendant. Finally, regarding the defendant's request for evidence—consisting of requiring creditor SD IBERIAN to confirm the address and send the debt notification—this is considered inadmissible and irrelevant. The charge is not based on the address itself, but rather on the repeated notifications to an address that the entity knew was incorrect, without having verified the information as required by Article 40.5 of the RLOPD. The failure to comply on this point is independent and is based on the failure to exercise due diligence after the systematic return of notifications. Consequently, the allegation regarding the concurrence of violations and the application of mitigating circumstances is dismissed, confirming that the defendant's conduct specifically violated Article 6.1 of the GDPR by processing personal data without a valid legal basis and without having handled the legally required notification attempts with due diligence. TENTH: Proposed Resolution On March 12, 2025, the investigating body of this procedure issued a proposed resolution proposing that the Presidency of the Spanish Data Protection Agency sanction the entity ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. (ASNEF), with CIF: B82064833, pursuant to the provisions of Article 63.3 of the LPACAP (Spanish Tax Code), for the alleged violation of Article 17 of the GDPR with respect to Article 32 of the LOPDGDD, classified in Article 83.5.b) of the GDPR, with a fine of 100,000 euros (one hundred thousand euros), and for the violation of Article 6.1 of the GDPR, classified in Article 83.5.a) of the GDPR, with a fine of 100,000 euros (one hundred thousand euros). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 23/60 ELEVENTH: Objections to the proposed resolution On 02/04/2025, the respondent submitted a written statement of objections to the proposed resolution in which it stated, in summary, the following: First. Regarding the alleged inconsistency between the Proposed Resolution and the Resolution issued in the previous appeal for reconsideration: The respondent states that the Proposed Resolution is inconsistent and violates the principles of legal certainty and legitimate expectations, as it contradicts the previous ruling by the AEPD itself in the Resolution of March 7, 2024, issued in the context of the appeal for reconsideration filed by the complainant against the inadmissibility of its initial claim. The Court maintains that said resolution, which gave rise to the present sanctioning procedure, already assessed the facts under review, both with regard to the compliance with the right to erasure under Article 17 of the GDPR, and with regard to the alleged failure to notify the respondent of the inclusion of data in the ASNEF file. In particular, it notes that the AEPD considered the respondent's actions justified by provisionally blocking the data and sending a response to the complainant, notwithstanding the fact that the latter was sent to an incorrect email address due to human error. The Court further argues that there is no complaint regarding the two subsequent deletion requests, the handling of which was considered legally compliant in the previous administrative resolution. The Court concludes that the only objection raised by the AEPD in said resolution related exclusively to the failure to notify the respondent of the inclusion in the file, but not to unlawful processing of data or a failure to comply with the right to erasure. Therefore, the opening of this sanctioning procedure, especially with regard to the alleged violation of Article 17 of the GDPR, would be contrary to the principle that the Administration is bound by its own acts and to the doctrine of own acts, generating an effect equivalent to that of administrative res judicata, which invalidates the reopening of already resolved issues without new evidence. Second. Regarding the alleged violation of Article 17 of the General Data Protection Regulation by ASNEF-EQUIFAX The respondent alleges that the Proposed Resolution contains an incorrect interpretation of the legal regime applicable to credit reporting systems (CIS), ignoring not only the established doctrine of the Spanish Data Protection Agency (AEPD) but also the specific regulatory framework that has historically governed such systems. First, it is emphasized that the SICs constitute an essential tool for the functioning of the Spanish financial system, finding their legal basis in various legal provisions—among them, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 24/60 Article 29 of Law 2/2011, Law 5/2019 on Real Estate Credit Contracts and Law 16/2011 on Consumer Credit Contracts—which expressly recognize their existence and the possibility of processing personal data without the need for consent, provided that the guarantees provided for in data protection regulations are respected. It maintains that historically, the AEPD has recognized the distinction between the creditor, as the data controller, and the system manager, as the file controller, which has been corroborated by Supreme Court case law (Supreme Court ruling of June 5, 2004, rec. 39/2004). Under this dual model, the creditor is assigned the responsibility of verifying the existence of a certain, overdue, payable, and unpaid debt, as well as the obligation to prove that it has informed the interested party of its possible inclusion in the SIC. In light of Article 20.2 of the LOPDGDD (Spanish Data Protection Act), as well as Article 38 of the RLOPD (Spanish Data Protection Act) —a regulatory standard that remains in force insofar as it does not conflict with the GDPR—, the creditor entity must guarantee compliance with the requirements for the inclusion of data in the system, keeping supporting documentation available to the SIC manager and the AEPD. The respondent entity insists that the so-called "precautionary deletion" of the data, carried out in the absence of a response from the creditor to the deletion requests, is not a discretionary practice, but rather an obligation expressly provided for in Article 44.3(1) of the RLOPD. In this sense, blocking or precautionary deletion constitutes the legally established mechanism to ensure the rights of the data subject in the event of inaction by the creditor, without the managing entity being legally empowered to assess the material justification for the deletion of the data. Therefore, the allegation of a violation of Article 17 of the GDPR is based, according to the respondent, on an erroneous transfer of the creditor's obligations to the joint controller managing the file. It is recalled that Article 26 of the GDPR establishes a framework of joint liability that allows for the distribution of functions among those responsible, without such joint liability necessarily implying a joint obligation or an identity of duties. Additionally, the complaint questions the AEPD's requirement that ASNEF-EQUIFAX carry out a thorough analysis of the origin of the debt reported by the creditor, when the regulations recognize that the entity managing the file does not have access to the necessary elements for such an assessment. The Draft Resolution thus ignores the principle of legality and predictability of sanctions by imposing an obligation that does not derive from any current law, violating the principle of legitimate expectations and the Supreme Court's doctrine on the requirement of lex certa in the area of sanctions. The respondent maintains that it acted in accordance with the applicable regulatory framework, formally responding to the interested party's requests within the legal deadline and proceeding with the precautionary deletion of the data in accordance with Article 32 of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 25/60 LOPDGDD. It also criticizes the fact that the AEPD, instead of questioning the breach of the substantive obligation, criticizes the logical reasoning followed by the entity to comply with the regulations, which exceeds the sanctioning powers legally recognized to said Authority. It maintains that the Draft Resolution misinterprets the legal regime applicable to credit information systems (CIS), particularly with regard to the scope of the obligations that fall on the common file manager in the context of exercising the right to erasure. First, the "precautionary cancellation" concept applied by ASNEF-Equifax is not an ad hoc construction, but is expressly provided for in Article 44.3 of the Implementing Regulation of the LOPD (RD 1720/2007), which remains in effect after the entry into force of the GDPR and the LOPDGDD. This provision imposes on the controller of the common file the obligation to delete or block the data when, after forwarding the request to the creditor responsible for the processing, no response is received within the legally established period. In such a case, the data is automatically deleted from the system and exclusively blocked, in accordance with Article 32 of the LOPDGDD. Likewise, current regulations categorically establish—Article 20.2 of the LOPDGDD—that it is the sole responsibility of the creditor to ensure that the legal requirements for the debt's inclusion in the system are met, and the creditor is the only party obligated to prove such requirements. In this context, the manager of the common file lacks the authority or power to independently verify the existence of these requirements, a circumstance that has been repeatedly recognized by the Spanish Data Protection Agency (AEPD) in reports and prior instructions, as well as by the jurisprudence of the Supreme Court. It maintains that, in relation to the exercise of the right to erasure by the interested party, ASNEF-Equifax complied with its legal obligation to respond within the deadline, proceeding to erase the data in the absence of a response from the creditor, which is the procedure provided for by the applicable regulations. No breach can be attributed to the failure to carry out a substantive assessment of the merits of the claim, since, lacking knowledge of the circumstances of the claim, this would exceed the Court's powers as joint technical controller of the file. Additionally, it should be kept in mind that the obligations arising from joint data processing, pursuant to Article 26 of the GDPR, must be understood as "respective" and not joint. This criterion has been confirmed by Guidelines 07/2020 of the European Data Protection Board (EDPB) and by the case law of the Court of Justice of the European Union (CJEU), which limit the liability of joint controllers to those stages of processing over which they exercise effective control. The Court maintains that it has complied at all times with current regulations and established doctrine. Any attempt by the AEPD to impose an C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 26/60 additional obligation—such as the requirement for substantive credit analysis by the common file manager—represents a de facto regulatory innovation and a violation of the principle of legality in sanctioning matters, as recalled by the Supreme Court in its Judgment of July 15, 2024 (cassation 5039/2022). Pursuant to this principle, it is not permissible to sanction conduct that was not reasonably foreseeable as an infringement at the time it was committed. It therefore maintains that the conduct displayed by ASNEF-Equifax has not only respected Article 17 of the GDPR, but has also been guided by the principles of diligence, legality, and respect for the distribution of responsibilities established by regulations in the field of SICs, making the criticism that it seeks to impute in the Resolution Proposal inadmissible. Third.- Regarding the absence of a violation of Article 6.1 of the GDPR by ASNEF and the inadmissibility of the allegation of unlawful processing of data. ASNEF-Equifax maintains that the allegation of unlawful processing of personal data under Article 6.1 of the GDPR is unfounded, given that the complainant's data was never processed for purposes specific to the credit information system (SIC), remaining at all times in a preventive blocking situation, in accordance with the provisions of Article 20.1.c) of the LOPDGDD. The entity confirms that, in the three cases analyzed, the inclusion of the data was followed, within a short period of time, by the complainant's exercise of the right to erasure and, in the absence of a response from the creditor, by the immediate precautionary deletion or permanent blocking of the data, which prevented its access by third parties or its use for creditworthiness assessment. In accordance with the LOPDGDD (Spanish Data Protection Act), data communicated to the SIC must remain blocked for 30 days from notification, so that the affected party can exercise their rights. During this period, as stipulated in Article 32, data processing is limited exclusively to compliance with legal obligations and cannot serve as a basis for assessing the affected party's solvency. ASNEF-Equifax acted in accordance with this regulatory framework, deleting the data before the expiration of this period. In addition, the entity formally notified the creditor of the inclusion of the data in each case, using the address provided by the creditor, and complied with the requirements established by Article 40 of the RLOPD, including verification of returns and address verification. The return of notifications cannot be attributed to a deficiency in delivery if the address declared as contractual was used. Furthermore, in neither case was the verification obligation breached, as the data was deleted before the deadline for such verification was met. ASNEF-Equifax denounces the AEPD's contradiction in accusing it of not having acted on refunds when, at the same time, access to data blocked for purposes other than those provided for in Article 32 would constitute a violation of data protection regulations. Furthermore, it highlights the peculiar temporal coincidence between the alleged lack of receipt of notifications by the claimant and the systematic exercise of the right to erasure just days after the debt was reported, which, at the very least, raises reasonable doubts about the affected party's actual knowledge. For all these reasons, ASNEF-Equifax concludes that its actions were entirely lawful, in accordance with the principles of legality, accuracy, and proactive responsibility, and that the alleged violation of Article 6.1 of the GDPR is inadmissible, as at no time was the complainant's personal data processed without a valid legal basis or for purposes specific to the SIC. Fourth.- Regarding the violation of the principle of culpability and, subsidiarily, the principle of proportionality in the Initiation Agreement Asnef-Equifax maintains that the sanctioning procedure initiated by the Spanish Data Protection Agency (AEPD) manifestly violates the principle of culpability, the essential core of administrative sanctioning law, recognized by reiterated jurisprudence of the Constitutional Court (Supreme Court Judgments 18/1981, 76/1990, 59/2014, among others), as well as by Article 28.1 of Law 40/2015, and by the consolidated jurisprudence of the Supreme Court (Supreme Court Judgments of April 3, 2000, July 14, 1998, November 22, 2004). This principle unavoidably requires the existence of intent or negligence in the sanctioned conduct, prohibiting any type of strict liability. The accusation made by the AEPD in this case is made without proving the subjective element of culpability, given that Asnef-Equifax has displayed diligent conduct, in accordance with current regulations and the criteria previously maintained by the AEPD regarding credit reporting systems. Likewise, the application of the culpability principle has been reaffirmed by the Court of Justice of the European Union in its judgment of December 5, 2023 (Case C-807/21), which declared that Article 83 of the GDPR requires proof of intent or negligence on the part of the data controller to impose sanctions, and that the unlawfulness of the conduct cannot be unforeseeable to the sanctioned party. In the present case, Asnef-Equifax's conduct complied at all times with applicable regulations, including the temporary blocking of the data for the legal period of 30 days, notification to the affected party through the address provided by the creditor, diligent management of the rights to erasure, and the effective deletion of the data in the absence of a response from the creditor. At no time were the data processed for credit assessment purposes nor were they accessible to SIC entities. Additionally, there is a violation of the principle of legitimate expectations, due to an unexpected shift in interpretation by the AEPD, contrary to its own administrative precedents. According to the jurisprudence of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 28/60 Supreme Court (Supreme Court ruling, July 15, 2024) and the National Court (Supreme Court ruling, October 6, 2010, Supreme Court ruling, April 23, 2019), the Administration cannot alter established criteria through sanctioning resolutions, nor require behaviors whose illegality was not reasonably foreseeable. Consequently, since the existence of intentional or negligent conduct has not been proven, and since my client acted in accordance with the regulatory standards and the legitimate expectations generated by the AEPD itself, the requirement of culpability for imposing a sanction is not met, which should lead to the dismissal of the case or, alternatively, a release from liability in accordance with the principle of proportionality. Regarding the violation of the principle of proportionality in the proposal: In the event that the alleged lack of culpability is rejected, Asnef-Equifax maintains, alternatively, that the AEPD has violated the principle of proportionality in determining the sanction, by failing to adequately assess the specific circumstances of the case or the actual intensity of the alleged violation. In accordance with the reiterated doctrine of the Supreme Court (e.g., Supreme Court ruling of November 20, 2001, rec. 7686/1997), the Administration is obliged to weigh the circumstances of the specific case to impose sanctions appropriate to the actual seriousness of the facts and cannot rely on unlimited discretion. In particular, the application of two aggravating factors is questioned: a) That relating to the nature, seriousness, and duration of the violation, and b) That relating to the alleged intentionality or negligence of the conduct of Asnef-Equifax. Regarding the former, the proposal maintains—without any evidence and through an inadmissible generalization—that Asnef's actions would have affected all of the exonerated debtors who had exercised their rights. This claim lacks factual support and is completely unrelated to the file, which neither proves the claimant's debt relief nor shows any damages. Furthermore, it is evident that the passage has been transcribed from another sanctioning procedure unrelated to the present one, which violates the principle of individualization of the sanction. Regarding the alleged violation of Article 6.1 of the GDPR, the AEPD bases the aggravation simply on the reference to the type of infringement and on hypothetical damages arising from an alleged inclusion in the credit information system, when the file shows that the data was never accessible to third parties nor did any damage occur to the claimant's economic sphere. Such reasoning fails the proportionality test, as it is based on unfounded and unrealistic assessments. Regarding the aggravating circumstance of intentionality or negligence, the proposal is even more unjustified. The AEPD criticizes Asnef-Equifax for not having been aware of a supposed change in criteria based on a 2014 Supreme Court ruling, ignoring the fact that this change was qualified by subsequent case law and that the AEPD itself has for decades maintained a criterion contrary to the one now being sought. Attributing intentionality or fault to someone who has faithfully followed the instructions and historical criteria of the sanctioning authority itself flagrantly violates the principle of legitimate expectations and turns diligence into a sanctioning reproach. Even more serious is the attempt to aggravate Asnef's conduct for the mere fact that it is engaged in the management of credit information systems, which would imply the application of a triple penalty: for the activity, for the alleged greater due diligence required, and for its connection to the processing of personal data. Such reasoning represents an unacceptable inversion of the principles of legality, culpability, and proportionality, transforming the sanctioning regime into a system of strict liability. For all the above reasons, and in the event that the case is not closed in accordance with the primary request, the AEPD is requested to not apply the aforementioned aggravating factors, or, alternatively, to replace the sanction with a warning measure in accordance with Article 58.2.b) of the GDPR, or a significant reduction in the amount of the sanction, given the concurrent circumstances that substantially reduce the severity and culpability attributable to the conduct of Asnef-Equifax. From the actions taken in this procedure and the documentation in the file, the following have been established: PROVEN FACTS First: The file records: - The communication that ASNEF-EQUIFAX sent to the complainant on January 25, 2023, addressed to the email address (***EMAIL.1), regarding the inclusion of their personal data in the ASNEF file at the request of SD IBERIAN. However, they informed them that their data had been provisionally removed. - Letter sent by the complainant on March 14, 2023, to the CONSUMER PROTECTION SERVICE - DATA FILE RELATING TO THE EXERCISE OF INTERESTED PARTIES' RIGHTS; ***EMAIL.3, requesting the deletion of the data entered in the file. These communications have been submitted by the complainant along with their complaint. Second: The following communications are recorded in the file: a) Regarding the request from the complaining party to delete their data from the file: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 30/60 Regarding the request for data cancellation made on 11/15/22: o Copy of the email sent from the address ***EMAIL.1 to the address ***EMAIL.3, dated 11/15/22, with the subject line, "Request to Exercise the Right to Cancellation" and stating the following: "Dear Sirs, I hereby request to *exercise the Right to Cancellation, for which I am providing the following documentation: 1. Photocopy of my ID and 2. Letter requesting to exercise the Right to Cancellation dated 11/15/2022 (...)". o Copy of the "Email Delivery Receipt" dated 11/24/22, sent from address ***EMAIL.3 to address ***EMAIL.2 and with "Bcc: ***EMAIL.4", in File 2022/XXXXXX, containing as an attachment, the file "2022/XXXXXX.pdf". o Copy of the letter sent to the claimant dated 11/24/22 and File No. 2022/XXXXXX, where they inform you, among other things, of the following: "In accordance with your CANCELLATION request, registered in our offices on November 15, 2022, we inform you that, following the relevant checks, the data associated with the identifier ***IDENTIFIER.1 has been provisionally removed from the ASNEF File of the entity(ies) SD IBERIAN PORTFOLIOS. Likewise, we attach the information that finally appears associated with your identifier in the ASNEF File (...)". - Regarding the data cancellation request made on 01/16/2023: o Copy of the email sent from the address ***EMAIL.1 to the address ***EMAIL.3, dated 01/16/2023, with the subject line, "Request to Exercise the Right to Cancellation" and stating the following: "Dear Sirs, I hereby request *to exercise the Right to Cancellation, for which I am providing the following documentation: 1.- Photocopy of ID and 2.- Letter requesting to exercise the Right to Cancellation dated 01/16/2023 (...)". o Copy of the "Email Delivery Receipt" dated 01/25/23, sent from address ***EMAIL.3 to address ***EMAIL.2 and with Bcc: ***EMAIL.4 in File 2023/XXXXX containing Annex 2023/XXXXX.pdf. o Copy of the letter sent to the claimant dated 01/25/23 and File No. 2023/XXXXX, in which they inform you, among other things, of the following: "In accordance with your CANCELLATION request, registered in our offices on January 16, 2023, we inform you that, following the relevant checks, the provisional deregistration of the entity(ies) SD IBERIAN PORTFOLIOS has been carried out in the ASNEF File of the data associated with the identifier: ***IDENTIFIER.1. Likewise, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 31/60 We attach the information that finally appears associated with your identifier in the ASNEF File (...)" - Regarding the data cancellation request made on 03/14/2023: o Copy of the email sent from the address ***EMAIL.1 to the address ***EMAIL.3, dated 03/14/2023, with the subject line, "Request to Exercise the Right to Cancellation" and stating the following: "Dear Sirs, I hereby request *to exercise the Right to Cancellation, for which I am providing the following documentation: 1.- Photocopy of ID and 2.- Letter requesting to exercise the Right to Cancellation dated 03/14/2023 (...)". o Copy of the "Email Delivery Receipt" dated 03/24/23, sent from address ***EMAIL.3 to address ***EMAIL.2 and with Bcc: ***EMAIL.4 in File 2023/XXXXX containing Annex 2023/XXXXX.pdf. o Copy of the letter sent to the claimant dated 03/24/23 and File No. 2023/XXXXX, which informs you, among other things, of the following: "In accordance with your CANCELLATION request, registered in our offices on March 14, 2023, we inform you that, following the pertinent checks, the provisional deletion of the data associated with the identifier ***IDENTIFIER.1 has been carried out with the entity(ies) SD IBERIAN PORTFOLIOS in the ASNEF File. Likewise, we attach the information that finally appears associated with your identifier in the ASNEF File (...)". b).- Regarding the notifications sent to the claimant regarding their inclusion in the file: - Screenshot of the Auxiliary Notifications file showing the list of notifications sent by the claimant corresponding to SD IBERIAN: o ***REFERENCE.1 SD IBERIAN PORTFOLIO ***QUANTITY.1 03/11/22 o ***REFERENCE.2 SD IBERIAN PORTFOLIO ***QUANTITY.2 10/01/23 o ***REFERENCE.3 SD IBERIAN PORTFOLIO ***QUANTITY.3 08/03/23 - Regarding the shipment with reference ***REFERENCE.1, sent on 03/11/22, by regular mail, the following is submitted: o Copy of the letter, with reference number ***REFERENCE.1, dated 03/11/22, sent by the respondent entity to the claimant at the address ***ADDRESS.1 and informing you that, on 11/02/22, SD IBERIAN PORTFOLIOS requested the registration of your personal data in the ASNEF file, related to the non-payment of ***AMOUNT.1 euros. or a copy of the certificate issued by SERVINFORM, S.A. indicating: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 32/60 That on 03/11/22, file ***FILE.1 was received, sent by Equifax Ibérica, with a total of 53,671 records, with the first communication to be processed appearing in it as reference (...), and the last communication to be processed as reference (...), according to classification criteria ascending by postal code number. That during said process, the communication reference ***REFERENCE.1 was generated, addressed to A.A.A. at ***ADDRESS.1 Said communication was generated, printed, and enveloped, without any incident that would have altered the final result of the procedure. It was made available to the postal service for subsequent distribution on delivery notes number 9942, with a total of 23,429 communications, and number 60901, with a total of 30,242 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any events occurring throughout its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST of the client, EQUIFAX, dated 11/04/22, containing the file ***FILE.1. o Delivery note and delivery note at the (...) Post Office, with the value date of 11/04/23 and the acceptance of 30,242 shipments, whose depositor is SERVINFORM, S.A. o Copy of the return receipt dated 11/21/22, issued by HISPAPOST for the letter with reference ***REFERENCE.1, sent to D. A.A.A.; ***ADDRESS.1, with the "Unknown" check mark in the box. - Regarding the shipment with reference ***REFERENCE.2 sent on 10/01/23, by regular mail: or Copy of the letter, with reference number ***REFERENCE.2, dated 10/01/23, sent by the entity being sued to the claimant at the address ***ADDRESS.1, informing the claimant that, on 09/01/23, SD IBERIAN PORTFOLIOS requested the registration of its personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.2. or Copy of the certificate issued by SERVINFORM, S.A. indicating: That on 10/01/23, file ***FILE.2 was received, sent by Equifax Ibérica, with a total of 35,444 records, with the first communication to be processed appearing in it as reference (...), and the last communication to be processed as reference C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 33/60 (...), according to classification criteria ascending by postal code number That in said process, the communication reference ***REFERENCE.2 was generated, addressed to A.A.A. at ***ADDRESS.1 Said communication was generated, printed, and enveloped, without any incident that would have altered the final result of the procedure. It was made available to the postal service for subsequent distribution on delivery notes number 10753, with a total of 16,875 communications, and number 62,952, with a total of 18,569 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract, without any incidents occurring throughout its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST of the client, EQUIFAX, dated 12/01/23, containing the file ***FILE.2. o Delivery note to the (...) Post Office, dated 12/01/23 and the acceptance of 18,565 items, deposited by SERVINFORM, S.A. o Copy of the return receipt dated 24/01/23, issued by HISPAPOST for the letter with reference ***REFERENCE.2, sent to D. A.A.A.; ***ADDRESS.1, with the "Unknown" check mark in the box. - Regarding the shipment with reference ***REFERENCE.3 1137 sent on 03/08/23, by regular mail: or Copy of the letter, with reference number ***REFERENCE.3, dated 03/08/23, sent by the entity being sued to the claimant at the address ***ADDRESS.1, informing the claimant that, on 03/07/23, the entity SD IBERIAN PORTFOLIOS requested the registration of their personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.3. or Copy of the certificate issued by SERVINFORM, S.A. indicating: That on 08/03/23, file ***FILE.3 was received, sent by Equifax Ibérica, with a total of 8,019 records, with the first communication to be processed appearing in it as reference (...), and the last communication to be processed as reference (...), according to classification criteria ascending by postal code number. That during said process, the communication reference ***REFERENCE.3 was generated, addressed to A.A.A. at ***ADDRESS.1 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 34/60 Said communication was generated, printed, and enveloped, without any incident that could have altered the final result of the procedure. The postal delivery service made the communication available for subsequent distribution on delivery notes number 11504, with a total of 3,569 communications, and number 64797, with a total of 4,450 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in the aforementioned contract. No incidents occurred during its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST to the client EQUIFAX, dated 03/10/23, containing the file ***FILE.3. o Delivery note to the (...) Post Office, dated 03/10/23, and the acceptance of 4,450 items, deposited by SERVINFORM, S.A. o Copy of the return receipt dated 03/29/23, issued by HISPAPOST for the letter with reference ***REFERENCE.3, sent to A.A.A.; ***ADDRESS.1, with a check mark in the "Unknown" box. c).- Regarding other measures taken, the following documentation is submitted: Regarding the first inclusion of data in the file on 11/02/22: - Screenshot of the document "ASNEF-EQUIFAX INTERNAL APPLICATIONS 05/05/2023 S.I.C. MAINTENANCE OF OPERATION LETTERS CREDIT CONSULTATION/UPDATE OF SENT LETTERS: Identifier: (...) Letter Ref.: ***REFERENCE.1 Entity: 1137 - SD IBERIAN PORTFOLIO Notification Type: Inclusion Registration Date: 11/02/2022 View Date: 12/01/2022 (Date from which your data is visible to other entities). Issue Date: 11/03/2022 Date CTB closing date: 10/31/2022 Return date: 11/26/2022 Regarding the second inclusion of data in the file on 01/09/2023: - Screenshot of the document "ASNEF-EQUIFAX INTERNAL APPLICATIONS 05/05/2023 S.I.C. MAINTENANCE OF OPERATION LETTERS CREDIT CONSULTATION/UPDATE OF LETTERS SENT: Identifier: (…) Letter Ref.: ***REFERENCE.2 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 35/60 Entity: 1137 - SD IBERIAN PORTFOLIO Notification Type: Inclusion Registration Date: 01/09/2023 Date: Viewed: 02/08/2023 (Date from which your data is visible to other entities). Issue Date: 01/10/2023 Closing Date: 01/06/2023 Return: 04/02/2023 Regarding the third inclusion of data in the file on 07/03/2023: - Screenshot of the document "ASNEF-EQUIFAX INTERNAL APPLICATIONS 05/05/2023 S.I.C. MAINTENANCE OF OPERATION LETTERS CREDIT CONSULTATION/UPDATE OF SENT LETTERS: Identifier: (...) Letter Ref.: ***REFERENCE.3 Entity: 1137 - SD IBERIAN PORTFOLIO Notification Type: Inclusion Registration Date: 07/03/2023 Viewing Date: 06/04/2023 (Date from which your data is visible to other entities). Issue Date: 08/03/2023 Closing Date Ctb: 06/03/2023 Return date: 05/04/2023 - Screenshot of the "OPERATION IN THE ASNEF FILE" file dated 05/05/2023, which only includes debts registered in the claimant's name in the ASNEF file at the request of EOS SPAIN SL. - Screenshot of the "OPERATION IN THE ASNEF FILE" file dated 10/05/2023, which includes debts registered in the claimant's name in the ASNEF file at the request of EOS SPAIN SL. and SD IBERIAN PORTFOLIO with an unpaid balance of ***AMOUNT.4. - Copy of the email sent on 10/05/2023 from the email address ***EMAIL.5 to the email address ***EMAIL.6 requesting confirmation of the data. Claimant. - Copy of the letter sent by the respondent to the claimant, dated 05/24/2023, informing them that the data provided at the request of SD IBERIAN PORTFOLIOS has been provisionally deleted. - Screenshot of the "ASNEF/EQUIFAX INTERNAL APPLICATIONS OF ASNEF-EQUIFAX-S.I.C. “REFUND INQUIRY” dated 05/05/23, regarding the respondent, with the following information: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 36/60 OP ENTITY TYPE NATUR. MOT. BJ F. REFUND 1137 SD IBERIAN P. T CREDIT HOLDER GDPR 11/24/22 1137 SD IBERIAN P. T CREDIT HOLDER GDPR 01/25/23 1137 SD IBERIAN P. T CREDIT HOLDER GDPR 03/24/23 1137 SD IBERIAN P. T CREDIT HOLDER CLIENT 05/24/23 All communications and documents mentioned in this proven fact are included in the documentation submitted to the procedure by the party. Respondent. Third: The following communications and documentation provided by the respondent are recorded in the file: Regarding the shipment with reference ***REFERENCE.4 sent on 05/09/23: o Copy of the letter, with reference number ***REFERENCE.4, dated 05/09/23, sent by the respondent entity to the complainant at the address ***ADDRESS.1, informing them that, on 05/08/23, SD IBERIAN PORTFOLIOS requested the registration of their personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.4. o Copy of the certificate issued by ARTEOS DIGITAL, S.L. (as the successor entity of SERVINFORM, S.A.) with CIF: B64510373 indicating: That on On May 9, 2023, file ***FILE.4 was received, sent by Equifax Ibérica, with a total of 18,421 records. The first communication to be processed is listed as reference (...) and the last communication to be processed is reference (...), according to classification criteria ascending by postal code number. That in said process, the communication with reference ***REFERENCE.4 was generated, addressed to A.A.A. at ***ADDRESS.1 Said communication was generated, printed, and enveloped, without any incident that would alter the final result of the procedure, and was made available to the postal service for subsequent distribution on delivery notes number 12276 with a total of 8,624 communications and number 66,488 with a total of 9,797 communications. The entire communication generation procedure It was developed in accordance with the instructions and guidelines set forth in the aforementioned contract, without any events occurring throughout its various phases that would impede its normal development. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 37/60 o Copy of the Delivery Note issued by HISPAPOST of the client EQUIFAX, dated 05/11/23, containing the file CREDI_INCLU_SP. o Delivery note for the (...) Post Office, dated 05/11/23 and the acceptance of 9,797 shipments, whose depositor is SERVINFORM, S.A. o Copy of the Certificate issued by ILUNION CEE CONTACT CENTER, S.A (formerly ILUNION IT SERVICES S.A) dated 02/23/24, which states: "After reviewing the files related to the service provided with Equifax, they are not currently in custody at the offices of Ilunión CEE Contact Center, S.A. Reference Notification ***REFERENCE.4 has not been processed for any reason for return." Regarding the reference notification ***REFERENCE.5 sent on 07/08/23: o Copy of the letter, with reference number ***REFERENCE.5, dated 07/08/23, sent by the entity being sued to the claimant at the address ***ADDRESS.1, informing them that, on 05/08/23, the entity SD IBERIAN PORTFOLIOS requested the registration of their personal data in the ASNEF file, relating to the non-payment of ***AMOUNT.6. o Copy of the certificate issued by ARTEOS DIGITAL, S.L. (as the successor entity of SERVINFORM, S.A.) with CIF: B64510373 indicating: That on On July 8, 2023, file ***FILE.5 was received, sent by Equifax Ibérica, with a total of 18,421 records. The first communication to be processed is reference (...) and the last communication to be processed is reference (...), sorted by postal code number. That during this process, the communication with reference ***REFERENCE.5 was generated, addressed to A.A.A. at ***ADDRESS.1. This communication was generated, printed, and enveloped, without any incident that would alter the final result of the procedure, and was made available to the postal service for subsequent distribution on delivery notes number 68319, with a total of 5,924 communications, and number 13208, with a total of 6,523 communications. The entire communication generation procedure was carried out in accordance with the instructions and guidelines set forth in C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 38/60 the aforementioned contract, with no events occurring during its various phases that would have impeded its normal development. o Copy of the Delivery Note issued by HISPAPOST to the client EQUIFAX, dated 07/21/23, containing the file CRED_INCLU_SP. o Delivery note for the (...) Post Office, dated 07/20/23, and the acceptance of 5,924 shipments, whose depositor is SERVINFORM, S.A. o Copy of the Certificate issued by Ilunion CEE Contact Center, S.A. (formerly Ilunion IT Services S.A.) dated 02/23/2024, which states: "After consulting the files related to the provision of the service maintained with Equifax, the Reference Notification ***REFERENCE.5 is not currently in custody at the offices of Ilunion CEE Contact Center, S.A. nor has it been processed for any reason for return." LEGAL BASIS I. Jurisdiction In accordance with the provisions of Articles 58.2 and 60 of the GDPR and the provisions of Articles 47, 48.1, 64.2, and 68.1 and 68.2 of the LOPDGDD (Spanish Data Protection Act), the President of the AEPD is competent to resolve this procedure. Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development, and, insofar as they do not contradict them, in a subsidiary capacity, by the general rules on administrative procedures." II. Response to the allegations presented regarding the Proposed Resolution. First: Regarding the possible inconsistency of the Proposed Resolution with the content of the Resolution issued in the Appeal for Reconsideration dated 07/03/2023. The respondent states the inconsistency between the Proposed Resolution issued in this sanctioning procedure and the ruling already issued by this AEPD in the previous Resolution of March 7, 2024, issued in the appeal for reconsideration filed by the complainant. The Court maintains that this Draft Resolution accuses the complainant entity of violating the GDPR for failing to comply with the complainant's right to erasure and for processing his data without an adequate legal basis, as the prior notification prior to his inclusion in the ASNEF system was not successfully carried out. The Court argues that the AEPD's prior Resolution—which triggered this sanctioning procedure—expressly stated that the respondent entity proceeded to delete the complainant's personal data, there having been a mere material error in the transcription of his email address, which prevented the correct receipt of the response to his first deletion request. Therefore, the Draft Resolution violates the principles of legal certainty and legitimate trust. contradict previous pronouncements by the AEPD itself regarding the same facts and the same parties. This assertion cannot be accepted, as it is based on an erroneous premise, confusing the purpose and legal effects of said Resolution with a definitive ruling on the absence of an infringement. Said Resolution (Appeal for reconsideration dated 07/03/23) upheld the appeal filed by the complainant, considering that there was sufficient evidence of an infringement, expressly finding that the notifications of inclusion in the SIC (Spanish National Statistics Institute) (ASNEF) issued by SD IBERIAN were not carried out in accordance with applicable regulations, since they were returned by the postal services for being sent to an incorrect address, and that, when this occurred, the respondent did not carry out any verification of the veracity of the address provided by SD IBERIAN, thus failing to comply with its prior verification obligation established in Article 40.5 of the RLOPD. This Resolution concluded that, in the absence of such verification, "the processing of the appellant's data in the SIC (Spanish Registry of Taxpayers) (ASNEF) would not proceed," that is, it recognized the existence of indications of unlawful processing of personal data, thereby supporting the initiation of this sanctioning procedure. There is no contradiction between the Proposed Resolution and the ruling in the appeal for reconsideration; rather, this latter resolution constitutes precisely the basis and origin of this administrative action. Please note that the Appeal for Reconsideration Resolution did not exonerate the respondent from liability, but rather deemed the initial claim admissible. This Agency subsequently initiated the sanctioning procedure, as sufficient evidence of an infringement was found. Therefore, it is not appropriate to uphold the allegations made by the respondent, as no violation of the principles of legal certainty, legitimate expectations, or binding nature of the Administration's actions was found, as there is no contradiction between the Draft Resolution and the Appeal for Reconsideration Resolution of March 7, 2024, the latter being the basis for continuing the sanctioning procedure. Second: Regarding the alleged violation of Article 17 of the GDPR with respect to Article 32 of the LOPDGDD. The respondent argues that its actions have been fully in compliance with the law and the legal regime applicable to credit information systems (CIS), regulated by the GDPR, the LOPDGDD, and the RLOPD. It maintains that, according to this regime, the responsibility for ensuring that the debt meets the legal requirements for inclusion in the CIS falls exclusively on the creditor, not on the system manager, who does not have sufficient information to assess the debt. The respondent criticizes the AEPD's Draft Resolution as distorting this legal regime, imposing additional obligations on the SIC manager not provided for by law, such as analyzing compliance with the debt's requirements, which, in its opinion, exceeds its powers and functions. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 40/60 The respondent adds that the RLOPD expressly provides for precautionary deregistration when the creditor does not respond to the request for deletion. For these purposes, the term "precautionary" does not imply that the deregistration will subsequently be lifted. In this sense, ASNEF responded to the claimant's request and carried out the precautionary deregistration. In the respondent's opinion, it would comply with the provisions of Article 12 of the GDPR by forwarding the claim and then carrying out the precautionary deregistration of the registration, and responding to the complainant. It adds that the joint liability regime included in Article 26.3 of the GDPR does not require that joint controllers be liable for all, but rather each for their own. Hence the rule that if the creditor doesn't respond, the data is deleted. ASNEF didn't "limit" itself to forwarding the request; it responded and deleted the data. Well, as we have been stating and as the Supreme Court has reiterated (among others, the Supreme Court ruling of February 1, 2014), the SIC manager cannot limit itself to forwarding the deletion requests received to the creditor, nor act merely passively in the absence of a response from the creditor. It is their responsibility to analyze the merits of the request and act in a reasoned manner, deciding on the exercise of the right in accordance with the criteria established in the GDPR, the LOPDGDD, and the RLOPD. ASNEF-EQUIFAX is the entity that maintains the credit information system in its capacity as joint controller, and therefore, Article 20.2 of the LOPDGDD applies to it. Article 20.2 of the LOPDGDD applies to it, given that, together with the creditor, it determines the purposes and means of the processing. Therefore, the provisions of Article 26 of the GDPR regarding joint controllers apply to it. of the processing: “2. The entities that maintain the system and the creditors, with respect to the processing of data relating to their debtors, shall be joint controllers, and the provisions of Article 26 of Regulation (EU) 2016/679 shall apply. The creditor shall be responsible for ensuring that the requirements for inclusion in the debt system are met, and shall be liable for their nonexistence or inaccuracy...” In the present case, ASNEF included, on 02/11/22, 09/01/23, and 07/03/23, the claimant's personal data in its solvency file, at the creditor's initiative. For its part, the claimant, on November 15, 2022, January 16, 2023, and March 14, 2023, sent the corresponding requests for deletion of personal data to ASNEF, which then forwarded them to the alleged creditor, SD IBERIAN, for a ruling on said requests, but received no response, according to ASNEF itself. Well, only after receiving no response from SD IBERIAN, ASNEF proceeded to provisionally remove the claimant's personal data from the solvency file, with the removal date of 11/24/22; January 25, 2023 and March 24, 2023 respectively, as described in its response to the information request C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 41/60 made by this Agency on May 24, 2023, with the reason for the cancellation being "C. GDPR," as stated in the documentation provided. This means that: "The cancellation is being carried out during the exercise of rights in our Consumer Service (SAC) due to not receiving a response from the creditor within the established period. […] In the present case, it has been established that the respondent, in response to three successive requests for data deletion, simply forwarded them to the creditor entity (SD IBERIAN), without assessing their content or making a substantive decision on the matter. The response offered to the The complainant's action consisted of communicating a "precautionary withdrawal" without further justification or statement. This action directly breaches the required duty of care, as the file manager cannot condition its response on the action or inaction of a third party. ASNEF cannot simply forward the request to SD IBERIAN for its decision and uncritically follow its instructions, granting SD IBERIAN, as the entity that provided the data, the power to resolve the request for the exercise of the right. Rather, ASNEF itself must provide a reasoned response to the complainant's exercise of the right, as established in Article 26.3 of the GDPR: "...data subjects may exercise the rights granted to them by this Regulation against and against each of the data controllers." Specifically, ASNEF is obligated to resolve the request to exercise rights made by the complainant, proceeding to delete the data by blocking it, as established in Article 17 of the GDPR and Article 32 of the LOPDGDD, in order to prevent the processing of personal data (the registration of the debt). Furthermore, an additional breach has been found by ASNEF-EQUIFAX by sending communications to the complainant to an incorrect email address. This error prevented the interested party from effectively exercising their rights and aggravates the accusation of lack of diligence in the processing. For all these reasons, the respondent's claim for exoneration from liability based on an alleged impossibility of verifying the debt is inadmissible. Although Article 20.2 of the LOPDGDD assigns the creditor the obligation to ensure that the requirements for The inclusion does not release the SIC manager from his or her duty to actively cooperate in protecting the data subject's rights. Regarding the invocation of the Supreme Court ruling of July 15, 2024, and the allegation of an alleged violation of the principle of predictable sanctions, it should be noted that the obligation to process the right to erasure directly and in a reasoned manner is in no way a novel or unforeseeable criterion, but rather a direct and logical consequence of the joint responsibility regime and the principle of effective protection of rights enshrined in the GDPR. Article 26.3 of the GDPR grants data subjects the right to assert their rights before any joint controller, and Article 32 of the LOPDGDD establishes the operational framework for the secure deletion of data by blocking it when the right to erasure has been established. Both articles together ensure that the rights of data subjects are protected. respected and that the data is managed in a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 42/60 secure manner and in accordance with the law, as indicated in the agreement initiating the sanctioning procedure: "...ASNEF is obliged to resolve the request to exercise rights made by the complaining party, proceeding with the deletion, by means of the prior blocking of the data, as established in Article 17 of the GDPR and Article 32 of the LOPDGDD, in order to prevent the processing of personal data." Article 26.3 of the GDPR reinforces the need for transparency and accountability in data processing. The GDPR guarantees that data subjects can exercise their rights against any joint controller. If a joint controller receives the deletion request, it is obliged to initiate the process of addressing the requested right. If granted, this will materialize in the blocking of said data (Article 32 of the LOPDGDD). Article 26.3 of the GDPR imposes a clear and operational obligation: to process the request to exercise the right made by the complaining party. And to do so, as the Supreme Court ruling reproduced here clearly argues, it is not enough to send a letter to the joint controller and, in the absence of a response, proceed with a "preventive withdrawal." Rather, the documentation and the background information contained therein must be analyzed, the lack of a response must be interpreted, and finally, a response must be given to the party that submitted the request to exercise the right. This was not done in this case. Therefore, based on the documentation provided by the respondent, it can be concluded that the provisions of Article 17 of the GDPR have not been breached. Regarding the respondent's observation regarding the invoking a Supreme Court ruling on the LNFP app and the principle Transparency, indicating that the AEPD cannot introduce additional requirements not provided for in the law, even if the principle is vague, it should be noted that this Agency is not introducing any additional requirements, but rather applying those already established by law and jurisprudence. Third: Regarding the alleged violation of Article 6.1 of the GDPR. The respondent maintains that there has been no violation of Article 6.1 of the GDPR because the complainant's personal data were never processed for the purposes of a credit information system (CIS). That is, it understands that it cannot be held responsible for violating Article 6.1 of the GDPR, since there was no processing of the data for the purposes of the CIS, as the data was blocked and inaccessible, in accordance with the provisions of Article 32 of the LOPDGDD, since it complied with its obligation to notify the data subject of the inclusion of their data in the system, sending communications to the address provided by the creditor. The creditor argues that, once the data was blocked, they could not access or view the information. Furthermore, they question the claimant's attitude for having exercised the right to erasure almost immediately after the inclusion notifications—which they never received—, insinuating that such conduct is strikingly suspicious or based on unexplained prior knowledge of the facts. Well, we must begin by remembering that "due diligence" is the degree of care, attention, and caution that must be exercised in the course of an action that has legal or administrative consequences and involves conscious, proactive, and thorough action. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 43/60 proactive and thorough, and it has been established that the defendant did not comply with this principle because it attempted to send the claimant a second and third notification to an address it knew. Inaccurate information without first requiring the creditor to justify whether or not that information (the address) was the correct one. Therefore, the defendant, in its capacity as manager of the financial solvency file, cannot disassociate itself from the obligations imposed by current regulations, especially with regard to the verification and control of the requirements necessary for the inclusion of personal data in the SIC. The principle of due diligence is fully applicable. In this regard, Article 40.5 of Royal Decree 1720/2007 (RLOPD) imposes on the controller of the common file the obligation to verify with the creditor entity the accuracy of the affected party's address when inclusion notifications are returned. In the present case, it has been established that the defendant sent data inclusion notifications up to three times to an address that, from the first attempt, turned out to be incorrect, with the communications being returned by the postal service with the notation "unknown." However, despite this, the defendant did not take any action to verify with the creditor (SD IBERIAN) whether the address used was the one contractually agreed upon with the claimant, flagrantly violating the provisions of Article 40.5 of the RLOPD and demonstrating a complete lack of due diligence in its actions. ASNEF-EQUIFAX is the entity that maintains the credit information system in its capacity as joint data controller, and therefore, Article 20.2 of the LOPDGDD applies to it, given that, together with the creditor entity, it determines the purposes and means of the processing. Therefore, the provisions of Article 26 of the GDPR regarding joint data controllers apply to it. The ECJ of 7 March 2024 (C-604/22) establishes that a controller is a data controller when, in pursuit of its own objectives, it influences the processing of personal data and participates in determining the purposes and means of such processing, stating that “57 The Court of Justice has also held that a natural or legal person who, in pursuit of its own objectives, influences the processing of personal data and thereby participates in determining the purposes and means of such processing may be considered a controller within the meaning of Article 4(7) of the GDPR (see, by analogy, judgment of 10 July 2018, Jehovan todistajat, C 25/17, EU:C:2018:551, paragraph 68). Thus, in accordance with Article 26(1) of the GDPR, there are “joint controllers” of the processing" when two or more controllers jointly determine the purposes and means of the processing (judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C 683/21, EU:C:2023:949, paragraph 40)". For its part, the Supreme Court ruling of 12/20/22 (rec. 2737/22) states, in its sixth ground, regarding the validity of Royal Decree 1720/2007, the following: “(…) 2.- First, the fact that Organic Law 3/2018 expressly repeals Organic Law 15/1999, of December 13, on the Protection of Personal Data (with exceptions regarding certain matters that are not relevant here) does not necessarily mean that the regulation approved by Royal Decree 1720/2007 has been repealed. 3.- In the absence of a regulation implementing the new organic law, Royal Decree 1720/2007 serves as the regulatory development of Organic Law 3/2018, necessary for its full effectiveness, without prejudice to the repeal of those provisions of the aforementioned regulation that "contradict, oppose, or are incompatible with the provisions of Regulation (EU) 2016/679 and this Organic Law," as expressly provided in Section 3 of the sole repealing provision of Organic Law 3/2018 in relation to provisions of equal or lower rank (...)" The aforementioned Supreme Court concludes that in the new legal regime there are three distinct obligations: “(…) i) The creditor must inform the affected party, in the contract or at the time of requesting payment, about the possibility of inclusion in said systems, indicating those in which it participates (Article 20.1.c], first paragraph, of Organic Law 3/2018, which repeals Article 39 of the regulation approved by Royal Decree 1720/2007, insofar as it required that the information be provided cumulatively at both times) ii) The creditor, or anyone acting on its behalf or in its interest, must request payment from the debtor prior to communicating their data to the defaulters' file (Article 38.1.c of the regulation approved by Royal Decree 1720/2007) and will be obliged to keep the information available to the controller of the common file and to the Agency. Spanish Data Protection Agency, sufficient documentation that proves compliance with this requirement and the others required by the applicable regulations, in accordance with Article 38.3 of said regulation. iii) The entity that maintains the credit information system with data related to the breach of monetary, financial, or credit obligations must notify the affected party of the inclusion of such data and inform them of the possibility of exercising the rights established in Articles 15 to 22 of Regulation (EU) 2016/679 within thirty days following notification of the debt to the system, the data remaining blocked during this period (Article 20.1.c], second paragraph, of Organic Law 3/2018). The notification must be made through a reliable, auditable, and independent means of the notifying entity, which allows it to prove the effective execution of the submissions (Article 40.3 of said regulation) (...).” Article 40 of Royal Decree 1720/2007, in force pursuant to the aforementioned Supreme Court ruling of December 20, 2022 (Appeal No. 2737/2022), provides: “1. The controller of the common file must notify the interested parties regarding whom they have registered personal data, within thirty days of said registration, a list of those that have been included, also informing them of the possibility of exercising their rights of C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 45/60 access, rectification, cancellation, and opposition, under the terms established by Organic Law 15/1999, of December 13. 2. A notification will be made for each specific and determined debt, regardless of whether it is owed to the same or different parties. Creditors. 3. Notification must be made through a reliable, auditable, and independent means of the notifying entity, allowing it to prove the effective execution of the notifications. 4. In any case, the data controller must be able to know if the notification has been returned for any reason, in which case they will not be able to process the data relating to that data subject. Returns in which the recipient has refused to accept the notification will not be considered sufficient to prevent the processing of data relating to a data subject. 5. If the inclusion notification is returned, the data controller will verify with the creditor entity that the address used to send this notification corresponds to the one contractually agreed upon with the client for communication purposes and will not process the data if the aforementioned entity does not confirm the accuracy of this information. In this case, the respondent states in its written Date February 26, 2023, within the framework of appeal RR/00448/2023, the following: “(…) As already documented in our response of May 24, 2023, the inclusions made by SD IBERIAN PORTFOLIO up to that point were communicated to the claimant through notifications with references ***REFERENCE.1, ***REFERENCE.2, and ***REFERENCE.3, although it is true that they were returned (…).” According to the above, it is proven that the notifications of inclusion in the solvency file were not properly carried out by the respondent, given that the letters were returned to the claimant after being sent to an address where the claimant was unknown, as recorded in the postal service notes. This does not prove that, in compliance with the obligation established in Article 40.5 of the RLOPD, the claimant verified with the creditor entity (SD IBERIAN) if the address used for the notification corresponded to the one contractually agreed upon for communications purposes, and therefore, the breach of the prior notification obligations in accordance with the legal terms deprives the data processing of its legal basis, constituting unlawful processing contrary to Article 6.1 of the GDPR. In this regard, in its allegations regarding the initiation agreement, the respondent argued that ASNEF sent the notifications of inclusion in the SIC. When these were returned, the precautionary deletion had already been carried out due to the complainant's requests, so there was no point in verifying the address with the creditor. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 46/60 Regarding this allegation, it must be answered that this interpretation leaves the complainant's diligence to carry out a legally required procedure, such as verifying the creditor's address (particularly important in case of subsequent communications from the creditor regarding new debts, as occurred in this case). The truth is that Article 40.5 requires verification of the creditor's address, and ASNEF failed to do so. Fourth: The respondent bases its defense on the lack of culpability in its actions, arguing that it acted in accordance with the regulations applicable to credit information systems (CIS), following criteria previously established by the AEPD, and that the interpretation made in the Proposed Resolution would entail a change in criteria that violates the principles of legitimate expectations and legal certainty. Well, as clearly stated, it is the reiterated doctrine of the Constitutional Court and the Supreme Court that the principle of culpability constitutes an unavoidable prerequisite in the field of administrative sanctioning law (STC 9/2018, STS 3/04/2000), and that There was intent or negligence in the infringing conduct. In the present case, far from refuting such culpability, the fact is that the defendant engaged in negligent conduct by failing to exercise the required diligence in processing the claimant's personal data. Such negligence materializes in the repeated attempts to notify the data to an address that, from the first mailing, was listed as unknown, and the failure to verify the accuracy of the address used with the creditor institution as required after the return of the first notification. Therefore, it is clear that the defendant committed perfectly proven and objectively foreseeable negligent acts, justifying the attribution of sanctioning liability. Furthermore, the defendant seeks to exonerate itself from liability by claiming that the creditor is solely responsible for ensuring the legal requirements of the debt. In this regard, Article 20.2 of the LOPDGDD expressly establishes joint responsibility for data processing between the creditor entity and the SIC management entity, with Article 26 of the GDPR being fully applicable. By virtue of this joint responsibility, the defendant cannot limit itself to a passive or merely technical role, but is obliged to verify that the legal requirements for processing are met, including the accuracy of the data and effective notification to the data subject before proceeding with its inclusion in the solvency file. Diligent data management involves verifying and ensuring compliance with legal requirements at all times, which includes responding to objective evidence of inaccuracy, such as repeated returned notifications. Finally, the respondent argues that, by proceeding with the "precautionary deletion" or blocking of the data before the 30-day period had elapsed, there would have been no unlawful processing. This reasoning is incorrect, as unlawful processing occurs from the moment the personal data is registered in the credit information system without complying with the required legal requirements, in particular, without validly notifying the data subject and without verifying the accuracy of the data in accordance with Article 40.5 of the RLOPD. The subsequent blocking or precautionary deletion of the data does not eliminate the unlawfulness of the prior action, nor does it exempt the offending entity from liability. Fifth: The respondent alleges, in the alternative, a violation of the principle of proportionality in the Resolution Proposal, questioning the appropriateness of the sanction imposed in relation to the alleged violation of Articles 17 and 6.1 of the GDPR. Well, the principle of proportionality undoubtedly governs the field of sanctioning law, and requires that the sanction be appropriate, necessary, and balanced with respect to the seriousness of the violation committed. However, invoking this principle requires an objective analysis of the harm caused, the conduct displayed by the offender, and the circumstances of the specific case, all of which have been correctly considered in the Resolution Proposal. As the Supreme Court reiterated, among others, in its ruling of November 20, 2001 (Recital No. 7686/1997), the Administration cannot evade its duty to individualize the sanction based on the seriousness of the act and its consequences, but this does not preclude its authority to assess, within the legal framework, the existence of aggravating factors when these are based on objective and verified criteria. In the present case, the aggravating factors applied by the AEPD are justified by specific, duly verified facts, and not by conjectures or generic assessments. Regarding the aggravating factor related to the severity, duration, and nature of the violation: Contrary to what the respondent asserts, the seriousness of the facts is evident, and does not require that the affected party be "exonerated" from a debt, nor that the inclusion in the SIC has caused actual economic harm for the conduct to be classified as a serious violation. The failure to exercise due diligence in verifying the address for notification to the affected party, despite repeated returns due to unknown origin, constitutes a serious breach of the duty to inform. This failure is particularly relevant because it deprives the interested party of the effective exercise of their rights in a particularly sensitive matter such as the processing of personal data with potentially detrimental effects in the economic sphere. Therefore, the aggravating factor assessment made by the AEPD is supported by objective regulatory criteria, fully complying with the requirement of justification and proportionality. Furthermore, the respondent argues that it is inappropriate to consider the violation of Article 17 of the GDPR as highly serious because this Agency is basing its assessment on a general assessment and not on the specific circumstances of this case. The respondent itself maintains, throughout its arguments, that the procedure applied in this case corresponds to the standard protocol that it C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 48/60 uses in all similar cases, expressly defending the correctness and regularity of said procedure as justification for its actions. Consequently, since the party has asserted that the processing of the complainant's data was carried out in accordance with the standard procedure it applies to the majority of cases, it is legitimate to take into account the structural dimension of this non-compliance, to the extent that this conduct, upheld as common practice by the entity itself, could be affecting an undetermined number of data subjects in similar situations. Therefore, the assessment of the seriousness of the infringement is not based on hypothetical or abstract considerations, but on the verification that the model of action defended by the entity is correct. Regarding the claim made by the respondent entity regarding the application of the aggravating circumstance relating to the seriousness of the infringement in Article 6.1 of the GDPR, and in particular its assertion that this Agency would have limited itself to an automatic reproduction of the sanctioning type, it should be noted that this claim is unfounded. Indeed, the motivation for the aggravating circumstance is not based exclusively on the mere reference to the regulatory type, but rather on the special relevance of the basis for the lawfulness of the processing within the GDPR's system of guarantees. Furthermore, regarding the argument that the complainant's data was not accessible to third parties nor was it actually processed for the purposes of the credit information system, it should be noted that this circumstance cannot be attributed to diligent action on the part of the respondent entity. Quite the contrary, it was the proactive action of the complainant himself—who, despite not having received the inclusion notifications, systematically exercised his right to deletion in each of the cases—that prevented the data from becoming accessible to third parties. In this regard, it is particularly relevant that the respondent entity did not adopt any additional measures to verify the validity of the notification address or to ensure effective communication to the affected party, which further reinforces the inadmissibility of exonerating it from liability. The fact that the damage has not been consummated in terms of publication or accessibility of the data does not mitigate the seriousness of the breach when it occurs with respect to an essential obligation, such as the existence of a valid legal basis for the processing of personal data. For all these reasons, this Agency considers the application of the challenged aggravating circumstance to be fully in accordance with the law, as it is duly justified and supported both by the applicable regulations and by the established doctrine on the centrality of the principle of lawfulness in the GDPR. Regarding the absence of double counting of the same aggravating circumstance: the AEPD has not incurred in a duplicate sanction. Each violation has been assessed based on different facts: on the one hand, non-compliance with Article 17 of the GDPR C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 49/60 (for failing to properly process the right to erasure), and on the other, violation of Article 6.1 of the GDPR (for processing personal data without a valid legal basis due to failure to comply with prior notification requirements). These violations are independent, and the aggravating factors applied to each of them respond to different elements of the infringing behavior. The same act is not sanctioned twice, nor is the same aggravating circumstance assessed twice. Regarding the alleged lack of harm or access to data: the mere registration of data in an ICS without complying with legal requirements, such as valid notification to the data subject, already constitutes unlawful processing punishable under the GDPR. The risk generated by the improper registration itself represents a significant impact on the fundamental right to data protection, and the fact that the complainant, through his own diligence, discovered the inclusion and exercised his rights does not exonerate the respondent from liability or eliminate the effects of the breach. Regarding the inadmissibility of extending assessments from other procedures: the sanction is based exclusively on the specific facts established in this case, and the individualization of the infringing conduct is perfectly identifiable. Regarding the violation of Article 6.1 of the GDPR, this Agency does not limit itself to invoking the nature of the activity of the respondent entity in a generic manner. On the contrary, the assessment of negligence as an aggravating circumstance is based on a qualified criterion: the existence of well-established and publicly known jurisprudential principles for years, particularly since the Supreme Court ruling of May 21, 2014, regarding the requirements that must be met to consider the inclusion of personal data in a credit information system lawful. This ruling, which clearly establishes the limits to processing based on the legitimate interest of the creditor, has been repeatedly cited by legal scholars and by resolutions of this same Agency. It is therefore considered that a specialized entity such as Asnef-Equifax, which continuously operates in a sector intensive in the processing of sensitive personal data, cannot claim ignorance of such principles without engaging in particularly significant negligent conduct. Thus, negligence is not imputed in the abstract, but rather based on the degree of specialization, experience, and duty of enhanced diligence presumed in sector operators, who must be required to meet a higher standard of compliance with personal data protection regulations. Regarding the violation of Article 17 of the GDPR, it is true that the argument regarding the aggravating circumstance of negligence reproduces the doctrine contained in the Supreme Court ruling of June 5, 2007. However, this doctrine—which precisely distinguishes between the responsibilities of the creditor as data controller and the common file manager as system controller—has also been repeatedly adopted by the Agency in its historical interpretation of the regime applicable to credit information systems. Therefore, it should be noted that the negligence found is not only based on the reiteration of a structural criterion, but also on the fact that Asnef-Equifax, as joint controller and specialized operator, has been applying an operational procedure that, in the opinion of this Agency, does not meet the requirements arising from the duty to effectively and materially address the exercise of the right to erasure. This is not an automatic or redundant application of aggravating factors, but rather a differentiated assessment based on the specific conduct observed during the procedure. Consequently, the aggravating circumstances applied are sufficiently supported both by the applicable regulations and by established case law, and reflect a considered assessment of the actions of the respondent entity within the framework of its specific legal position and its role in the personal data processing ecosystem. In this context, it cannot be assumed that the standard of due diligence required of an entity such as Asnef-Equifax is comparable to that of any ordinary data controller. III. Regarding the Right to Erasure, Article 17 of the GDPR. Article 17 of the GDPR establishes the following regarding the “Right to erasure”: “1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay. The controller shall have the obligation to erase the personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws consent to which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a), and the consent is not based on another legal ground; c) the data subject objects to processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to processing pursuant to Article 21(2); d) the personal data have been unlawfully processed; (e) the personal data must be erased for compliance with a legal obligation laid down in Union or Member State law to which the controller is subject; (f) the personal data have been obtained in connection with the offer of information society services referred to in Article 8(1). 2. Where the controller has made personal data public and is obliged pursuant to paragraph 1 to erase those data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the personal data of the data subject's request to erase any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply where processing is necessary: a) for exercising the right to freedom of expression and information; b) for compliance with a legal obligation which requires processing imposed by European Union law. Union or of the Member States to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; c) for reasons of public interest in the area of public health, in accordance with Article 9(2)(h) and (i) and paragraph 3; d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with Article 89(1), to the extent that the right referred to in paragraph 1 would render impossible or seriously impede the achievement of the objectives of such processing; or e) for the establishment, exercise, or defense of legal claims.” In the specific case at hand, when the processing of data refers to its inclusion in financial solvency files, Art. Article 32 of the LOPDGDD establishes: 1. The data controller shall be obliged to block the data when it is necessary to rectify or delete it. 2. Blocking data consists of identifying and reserving the data, adopting technical and organizational measures to prevent its processing, including its viewing, except for making the data available to judges and courts, the Public Prosecutor's Office, or the competent Public Administrations, in particular data protection authorities, to enforce potential liability arising from the processing and only for the statute of limitations. After this period, the data must be destroyed. 3. Blocked data may not be processed for any purpose other than that indicated in the previous section. 4. When, in order to comply with this obligation, the configuration of the information system does not allow blocking or an adaptation is required that entails a disproportionate effort, a secure copy of the information will be made so that digital or other evidence can be obtained to prove its authenticity, the date of blocking, and the absence of data manipulation during the blocking process. 5. The Spanish Data Protection Agency and the regional data protection authorities, within the scope of their respective powers, may establish exceptions to the blocking obligation established in this article in cases where, given the nature of the data or the fact that they relate to a particularly large number of data subjects, their mere retention, even if blocked, could generate a high risk for the rights of those affected, as well as in cases where the retention of blocked data could entail a disproportionate cost for the data controller. In the present case, ASNEF included the claimant's personal data in its solvency file on November 2, 1/9, 2023, and March 7, 2023, at the initiative of SD IBERIAN. For its part, the claimant, on November 15, 1/16, 2023, and March 14, 2023, forwarded the corresponding requests for deletion of personal data to ASNEF, which then forwarded them to the alleged creditor, SD IBERIAN, for a decision on said requests, but received no response, according to ASNEF itself. Well, only after receiving no response from SD IBERIAN did ASNEF proceed to deregister the claimant. The claimant's personal data was removed from the solvency file, with the cancellation dates of 11/24/22, 01/25/23, and 03/24/23, respectively. This is described in its response to the request for information made by this Agency on 05/24/23. The reason for the cancellation is "C. GDPR," as stated in the documentation provided. This means that: "The cancellation is being carried out during the exercise of rights in our Consumer Service (SAC) due to not receiving a response from the creditor within the established period." […] ASNEF cannot simply forward the request to SD IBERIAN for its decision and uncritically follow its instructions, granting SD IBERIAN, as the entity that provided the data, the power to resolve the request to exercise this right. Rather, ASNEF itself must provide a reasoned response to the complainant's exercise of this right, as established in Article 26.3 of the GDPR: "...data subjects may exercise the rights granted to them by this Regulation against and against each of the data controllers." Specifically, ASNEF is obliged to resolve the request to exercise these rights made by the complainant, proceeding to delete the data by blocking it, as established in Article 17 of the GDPR and Article 32 of the LOPDGDD (Spanish Data Protection Act), in order to prevent the processing of personal data (the registration of the debt). In this sense, Supreme Court Ruling 2040/2014 makes it clear that ASNEF (National Tax Agency) is not merely a representative and therefore cannot simply uncritically follow the creditor's instructions: "Certainly, the creditor or anyone acting on its behalf or in its interest will be liable for the nonexistence or inaccuracy of the data it has provided for inclusion in the file, under the terms provided in the LOPD (Data Protection Act), since it is the creditor who can reasonably verify the requirements regarding the existence, veracity, and relevance of the data, being a party to the contractual relationship in which the breach occurred, as this court has declared in its Ruling No. 226/2012, of April 9." However, once the interested party exercises the right to rectification or cancellation before the person responsible for the delinquent debt register, if the claim is made in a documented and justified manner, the person responsible for this file must satisfy this right under the terms provided for in Article 16 of the LOPD. They cannot simply forward the request to the creditor, for them to decide, and uncritically follow the creditor's instructions, giving a standardized response to the affected party that denies the cancellation, as Equifax did. Furthermore, it would be unclear what the meaning of Article 16 of the LOPD is. 38.3 of the Regulation imposes on the creditor the obligation to keep the documentation proving the requirements required for including the debtor's data in the register of defaulters. This is available not only to the Spanish Data Protection Agency but also to the controller of the common file, if the latter complies with notifying the creditor of the right of rectification C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 53/60 or cancellation exercised by the affected party. The creditor may keep the data in the file only upon the creditor's request to do so. The creditor is not obliged to assess the cancellation request and, where appropriate, request the creditor for the documentation supporting the inclusion of the data in the register of defaulters to verify its relevance, sufficiency, and adequacy. Therefore, based on the available evidence, it is considered that the known facts constitute an infringement, attributable to ASNEF, for violation of Article 17 of the GDPR. IV. Classification and qualification of the infringement If confirmed, the aforementioned infringement of Article 17 of the GDPR entails the commission of the infringements classified in Article 83.5.b) of the GDPR, which considers that the violation of "the rights of data subjects pursuant to Articles 12 to 22" is punishable, in accordance with section 2 of the aforementioned Article 83 of the aforementioned Regulation, "with administrative fines of a maximum of €20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total global annual turnover of the previous financial year, whichever is higher." Furthermore, Article 71 of the LOPDGDD states that: “The acts and conduct referred to in sections 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute violations.” And Article 72 considers the following violations to be "very serious" for the purposes of statute of limitations: "1. In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, the following are considered very serious and will be subject to a three-year statute of limitations: violations that constitute a substantial violation of the articles mentioned therein, and in particular, the following (...): k) The impediment or obstruction or repeated failure to comply with the exercise of the rights established in Articles 15 to 22 of Regulation (EU) 2016/679. (...)" V. Sanction For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the available evidence, it is considered appropriate to grade the sanction to be imposed according to the following criteria established in Article 83.2 of the GDPR, which states: "2. The Administrative fines will be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures provided for in Article 58, paragraph 2, letters a) to h) and j). As a circumstance of Article 83.2 of the GDPR: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 54/60 - The nature, severity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damages and losses they have suffered (paragraph a): All persons registered in the ASNEF credit information system and exonerated from their debts who have attempted to exercise their rights before said entity, who may have seen such exercise limited if the creditor entity has not responded to the transfer from ASNEF. - The intentionality or negligence in The violation (section b): ASNEF knew that its actions were contrary to data protection regulations at least since this entity became aware of Supreme Court Ruling 2040/2014, issued by the First Chamber on May 21, 2014, an extract of which is reproduced above. With regard to letter k) of Article 83.2 of the GDPR, the LOPDGDD, in its Article 76, "Sanctions and corrective measures," provides: "1. The sanctions provided for in sections 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the grading criteria established in section 2 of the aforementioned article. 2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continuous nature of the violation. b) The connection between the offender's activity and the processing of personal data. c) The benefits obtained as a result of committing the infringement. d) The possibility that the affected party's conduct could have included the commission of the infringement. e) The existence of a merger or acquisition process subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity. f) The impact on the rights of minors. g) Having, when not mandatory, a data protection officer. h) Voluntary submission by the controller or processor to alternative dispute resolution mechanisms in those cases where there are disputes between them and any interested party." As a circumstance of Article 76.2 of the LOPDGDD, applied as an aggravating factor: - The connection between the offender's activity and the processing of personal data (section b): ASNEF, in the course of its business activity, needs to routinely process the personal data of those individuals included in its credit information system, which means that it has sufficient experience and should have adequate knowledge to process such data. The balance of the circumstances contemplated in Article 83.2 of the GDPR and 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 17 of the GDPR, allows for a fine of €100,000 (one hundred thousand euros). I. Regarding the lawfulness of processing, Article 6.1 of the GDPR C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 55/60 Data processing requires a legal basis. Thus, Article 6.1 of the GDPR, in addition to consent, establishes other possible bases that legitimize data processing without the need for the data subject's authorization. In particular, when it is necessary for the performance of a contract to which the data subject is a party or for the implementation, at the data subject's request, of pre-contractual measures, or when it is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of such data. Processing is also considered lawful when it is necessary for compliance with a legal obligation applicable to the data controller, to protect the vital interests of the data subject or another natural person, or for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the data controller. In this regard, Article 20 of the LOPDGDD establishes the following regarding "Credit Information Systems": "1. Unless proven otherwise, the processing of personal data related to the breach of monetary, financial, or credit obligations by common credit information systems shall be presumed lawful when the following requirements are met: a) The data has been provided by the creditor or by someone acting on its behalf or in its interest.b) The data relate to certain, due, and payable debts, the existence or amount of which has not been the subject of an administrative or judicial claim by the debtor or through a binding alternative dispute resolution procedure between the parties. c) The creditor has informed the affected party in the contract or at the time of requesting payment about the possibility of inclusion in such systems, indicating those in which it participates. The entity that maintains the credit information system with data relating to non-compliance with monetary, financial, or credit obligations must notify the affected party of the inclusion of such data and inform them of the possibility of exercising the rights established in Articles 15 to 22 of Regulation (EU) 2016/679 within thirty days of notification of the debt to the system, with the data remaining blocked during this period. d) That the data will only be kept in the system as long as the breach persists, with a maximum limit of five years from the due date of the monetary, financial, or credit obligation. e) That the data relating to a specific debtor may only be consulted when the person consulting the system maintains a contractual relationship with the affected party that involves the payment of a monetary amount, or the debtor has requested the conclusion of a contract involving financing, deferred payment, or periodic billing, as occurs, among other cases, in those provided for in the legislation on consumer credit contracts and real estate credit contracts. When the right to restriction of processing of data has been exercised through the system, challenging its accuracy in accordance with the provisions of Article 18.1.a) of Regulation (EU) 2016/679, the system will inform those who C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 56/60 may consult it in accordance with the previous paragraph of the mere existence of this circumstance, without providing the specific data regarding which the right has been exercised, while the request from the data subject is being resolved. f) That, in the event that the request to conclude the contract is denied, or the contract is not concluded, as a result of the consultation carried out, the person who consulted the system will inform the data subject of the result of said consultation. 2. Entities maintaining the system and creditors, with respect to the processing of data relating to their debtors, shall be joint controllers, and the provisions of Article 26 of Regulation (EU) 2016/679 shall apply. The creditor shall be responsible for ensuring that the requirements for inclusion in the debt system are met, and shall be liable for any non-existence or inaccuracy. 3. The presumption referred to in section 1 of this article does not cover cases in which the credit information is associated by the entity maintaining the system with information additional to that contemplated in said section, related to the debtor and obtained from other sources, in order to profile the debtor, particularly through the application of credit rating techniques." ASNEF-EQUIFAX is the entity that maintains the credit information system in its capacity as joint data controller, and therefore, Article 20.2 of the LOPDGDD applies to it, given that, together with the creditor entity, it is the entity that determines the purposes and means of the processing, and therefore, the provisions of Article 26 of the GDPR regarding joint data controllers apply to it. For its part, we must take into account the sixth ground of the Supreme Court ruling of 12/20/22 (rec. 2737/22), regarding the validity of Royal Decree 1720/2007, seen above. Therefore, in accordance with all of the above, it is established that the notifications of inclusion in the solvency file were not duly carried out by the respondent, given that the letters were returned to her after being sent to an address where the claimant was unknown, as recorded in the postal service notes. There is no evidence that, in compliance with the obligation established in Article 40.5 of the RLOPD, it verified with the creditor institution (SD IBERIAN) whether the address used for notification corresponded to the one contractually agreed upon for communication purposes. For all of the above, it is determined that, as joint controller, ASNEF should not have simply and repeatedly registered the personal data of the claimant in the credit information system on dates 09/11/22, 09/01/23, and 07/03/23 given that the requirements established in Article 20 of the LOPDGDD (General Data Protection Act) for presuming the existence of a prevailing legitimate interest were not met, which constitutes a violation of Article 6.1 of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 57/60 Therefore, based on the available evidence, it is considered that the known facts constitute an infraction, attributable to ASNEF, for violating Article 6.1 of the GDPR. II. Classification and qualification of the infraction If confirmed, the aforementioned violation of Article 6.1 of the GDPR constitutes the commission of the infractions classified in Article 83.5.a) of the GDPR. which considers that the violation of "the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9" is punishable, in accordance with Section 5 of the aforementioned Article 83 of the aforementioned Regulation, "with administrative fines of up to €20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the preceding financial year, whichever is higher." Article 71 of the LOPDGDD states that: "The acts and conduct referred to in Sections 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute violations." And Article 72 considers, for the purposes of the statute of limitations, that violations are “very serious”: 1. Pursuant to the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein, and in particular, the following, are considered very serious and will be subject to a three-year statute of limitations: (…) b) The processing of personal data without any of the conditions for the lawfulness of processing established in Article 6 of Regulation (EU) 2016/679 being met. (…). III. Penalty In order to establish the administrative fine to be imposed, the provisions contained in Articles 83.1 and 83.2 of the GDPR, and Article 76.2.b) of the LOPDGDD, indicated above in Section V, must be observed. In accordance with these provisions, for the purposes of determining the amount of the penalty to be imposed in this case for the infringement classified in Articles 83.5.a) and 6.1 of the GDPR, for which the defendant is held responsible, the following circumstances are considered concurrent: - The nature and severity of the infringement; the facts revealed affect a basic principle regarding the processing of personal data, such as the principle of legitimacy, which the law penalizes with the utmost severity; the level of damages suffered by the claimant, which affect their financial solvency due to having been included in common credit reporting systems without due diligence, Article 83.2.a of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 58/60 - The close connection between the offender's activity and the processing of personal data. The level of implementation of the entity and the activity it carries out, in which personal data are involved, are considered. millions of interested parties. This circumstance determines a higher level of demand and professionalism and, consequently, the liability of the entity complained against in relation to the processing of the data (Article 76.2.b) of the LOPDGDD in relation to Article 83.2.k). - The intentionality or negligence in the infringement, since the respondent included the data without the degree of diligence that the data controller is obliged to display in compliance with the obligations imposed by the data protection regulations, including the SAN of 10/17/2007. Although it was issued before the GDPR came into force, its ruling can be extrapolated to the case we are analyzing. The ruling, after alluding to the fact that entities whose activity involves continuous processing of client and third-party data must observe an adequate level of diligence, specified that "(...). The Supreme Court has held that negligence exists whenever a legal duty of care is disregarded, that is, when the offender fails to behave with the required diligence. In assessing the degree of diligence, the professionalism of the individual must be especially considered, and there is no doubt that, in the case under consideration, when the appellant's activity involves constant and extensive handling of personal data, rigor and exquisite care must be emphasized to comply with the legal provisions in this regard" (Article 83.2, b GDPR). The balance of the circumstances contemplated in Articles 83.2 of the GDPR and 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 6.1 of the GDPR, allows for the imposition of a penalty of €100,000 (one hundred thousand euros). I. Adoption of measures. In accordance with the provisions of the aforementioned Article 58.2 d) of the GDPR, according to which each supervisory authority may "order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period...", the respondent is required to maintain the precautionary suspension of the registration of the complainant's personal data in the creditworthiness file until the requirements of Article 6.1 of the GDPR are met. The imposition of these measures is compatible with the sanction of an administrative fine, as provided in Article 83.2 of the GDPR. Please note that failure to comply with the possible order to adopt measures imposed by this body in the resolution terminating this procedure may be considered an administrative offense pursuant to the GDPR, classified as an offense in Articles 83.5 and 83.6. Such conduct may lead to the opening of a subsequent administrative sanctioning procedure. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 59/60 Therefore, in accordance with applicable legislation and having assessed the criteria for graduating sanctions whose existence has been proven, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO IMPOSE on the entity ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. (ASNEF), with CIF: B82064833, for a violation of Article 17 of the GDPR, classified in Article 83.5 of the GDPR, a fine of 100,000 euros (one hundred thousand euros). SECOND: IMPOSE a fine of 100,000 euros (one hundred thousand euros) on ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOLVENCIA Y CRÉDITO, S.L. (ASNEF), with CIF: B82064833, for a violation of Article 6.1 of the GDPR, as defined in Article 83.5 of the GDPR. THIRD: ORDER ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOLVENCIA Y CRÉDITO, S.L. (ASNEF), with CIF: B82064833, which, pursuant to Article 58.2.d) of the GDPR, has, within one month of this resolution becoming final and enforceable, proven that it has provisionally suspended the registration of the claimant's personal data in the creditworthiness file. FOURTH: NOTIFY this resolution to ASNEF-EQUIFAX, SOLVENCY AND CREDIT INFORMATION SERVICES, S.L. FIFTH: This resolution will become enforceable once the deadline for filing the optional appeal for reconsideration expires (one month from the day following notification of this resolution) without the interested party having exercised this right. The sanctioned party is hereby notified that they must enforce the sanction imposed once this resolution becomes enforceable, in accordance with the provisions of Article 58.2.d). 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to Article 68 of the General Collection Regulations. 62 of Law 58/2003, of December 17, by depositing the fine, indicating the sanctioned party's NIF (Tax Identification Number) and the procedure number shown in the heading of this document, into the restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 60/60 the banking entity CAIXABANK, S.A. Otherwise, the collection will be carried out during the enforcement period. Once the notification has been received and enforced, if the enforcement date is between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be the 20th of the following month or the next business day after, and if it is between the 16th and last day of each month, inclusive, the payment deadline will be the 5th of the second following month or the next business day after. In accordance with the provisions of Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data), this Resolution will be made public once it has been notified to the interested parties. This resolution, which terminates the administrative process pursuant to Article 10 of the LOPDGDD (Organic Law on the Protection of Personal Data), may not be appealed against. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. Finally, it is noted that pursuant to the provisions of Art. 90.3 a) of the LPACAP (Spanish Data Protection Act), a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronicaweb/], or through one of the other registries provided for in Article 16.4 of the aforementioned Law 39/2015, of October 1. They must also forward to the Agency the documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the provisional suspension. Lorenzo Cotino Hueso President of the Spanish Data Protection Agency. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es
