AEPD (Spain) - PS/00467/2020: Difference between revisions
From GDPRhub
No edit summary |
No edit summary |
||
| Line 52: | Line 52: | ||
}} | }} | ||
The Spanish DPA fined a controller €60,000 for processing personal data without a legal basis, since | The Spanish DPA fined a controller €60,000 for failing to respond to an access request, and for processing personal data without a legal basis, since it could not prove it had entered into a contract with the data subject. | ||
== English Summary == | == English Summary == | ||
Latest revision as of 10:55, 11 August 2021
| AEPD (Spain) - PS/00467/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(d) GDPR Article 6(1) GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 19.07.2021 |
| Published: | 27.07.2021 |
| Fine: | 60000 EUR |
| Parties: | PRA IBERIA, S.L. |
| National Case Number/Name: | PS/00467/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA fined a controller €60,000 for failing to respond to an access request, and for processing personal data without a legal basis, since it could not prove it had entered into a contract with the data subject.
English Summary
Facts
A data subject lodged a complaint with the Spanish DPA (AEPD) stating that a credit company was requiring the payment of a series of debts on behalf of a bank without having contracted any services. The data subject also tried to access their right to access before the company to verify what data the controller had on them, without receiving any official answer.
The AEPD requested the controller documentation to prove the existence of the contract. The controller provided the contract with the personal data and bank data, but was not able to provide a signed contract, a copy of the ID or a recording of the phone call in which the contract was made.
The debt had been surrogated from another company, that sold their portfolio of debtors. When the data subject received such notification, they decided to exercise the right to access.
The AEPD found that the bank account used for the purposes of the debt had only been active before the services had been contracted. The debt derived from the non-payment was generated five years after the cancellation of the account.
The bank could neither prove that the initial transfers or the devolution of the money had been carried out.
Holding
The AEPD concluded that the controller had violated Article 6 GDPR, since they were not able to prove that the data subject had validly entered the contract.
Additionally, the AEPD found that the controller had violated the principle of accuracy from Article 5(1)(d) GDPR, since the personal data of the data subject that they were processing were not accurate and the controller did not act to solve this.
The AEPD also found that the controller had not effectively answered to the access request submitted by the data subject, what implied a violation of Article 15 GDPR.
The AEPD decided to fine the controller a total of €60,000: €30,000 for the violation of Article 6, and €30,000 for the violation of Article 15.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/47
Procedure No.: PS / 00467/2020
RESOLUTION OF SANCTIONING PROCEDURE
In the sanctioning procedure PS / 00467/2020, instructed by the Spanish Agency for
Data Protection, to the entity, entity PRA IBERIA, S.L. with CIF .: B80568769, (in
hereinafter, “the claimed entity), for alleged infringement of Regulation (EU)
2016/679, of the European Parliament and of the Council, of 04/27/16, regarding Protection
of Natural Persons with regard to the Processing of Personal Data and the
Free Circulation of this Data (RGPD); Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights, (LOPDGDD) and in
based on the following:
BACKGROUND
FIRST On 08/07/19, you had a written entry in this Agency, presented by
Mrs. A.A.A. (hereinafter, "the complaining party"), among others, the following:
“PRA IBERIA, is claiming a debt from a contract that I do not know. Until
in 2013 third parties have been making bank transfers to me
Name. I have requested in writing, by telephone and certified mail to PRA IBERIA
information about this incident, but as of today, I have not received a reply for
no way, and they keep claiming the debt with interest. "
The following documentation was provided to the claim letter:
- Copy of letter dated 06/12/19 addressed to the claimant and sent by PRA
IBERIA, S.L. where the debt you have with them is reported as
consequence of the acquisition of a debtor portfolio from
SANTANDER CONSUMER FINANCE. The letter states that the date of
assignment was 04/30/08, and the date of the first default was 02/01/06.
- Letter dated 06/24/19 sent by the claimant to PRA IBERIA SL, where
the right of access to the documentation held by the entity of
her, in relation to the alleged debt. Delivery certificate is provided.
SECOND: On 09/17/19, this Agency sent a request
informative to the entity PRA IBERICA, SL. and the entity SANTANDER CONSUMER
FINANCE, in accordance with the provisions of article 65.4 of the Organic Law
3/2018, of December 5, on the protection of personal data and guarantee of the rights
chos digital, ("LOPDGDD").
THIRD: On 10/09/19, the entity SANTANDER CONSUMER FINANCE, S.A.
sends the following information to this Agency:
- That the existence of a contractual relationship with the
claimant relating to a credit card marketed together with
GAS NATURAL FENOSA, which was marketed by telephone on the day
10/04/2000.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/47
- A copy of the: "XXXXXXX CARD APPLICATION", dated
10/04/2000, where the data of the claimant and her address appear, but without
Claimant's signature. In the direct debit data, the entity
"XXXX C.A. DE MADRID and account number: **** XXXX ”crossed out by hand and
Overwritten in handwritten text the number "XXXX" as the text: "CTA
WRONG ”.
- Printing of the existing data in the entity's database is provided
SANTANDER CONSUMER, from the "CARD XXXX-UNION FENOSA", where
the identification of the claimant is recorded. In the domiciliation data
bank, consists of an account number of the bank, IBERCAJA:
**** XXXX). In the section of origin of the account, it is indicated “Capture
telephone ”.
- Printing of credit card charges made from
09/09/2002 (card activation date), until 12/13/2004.
- The entity certifies that the credit card receipts were returned
credit for the months of February to December of the year 2006, for an amount
total nominal value of 452.59 euros.
- It indicates that they sold the portfolio of defaults, on 04/30/08, to the company
AKTIV KAPITAL INVESTMENT PORTFOLIO A.G. represented fiscally in
Spain by PRA IBERIA SL, whose old name was: TREYM
CONSULTING Y SERVICIOS A EMPRESAS, S.L.U.
- It indicates that the aforementioned assignment of credits was communicated to the claimant
in the previous point, on 05/28/08. A copy of the letter is provided where it is communicated
the assignment of the credit to AKTIV CAPITAL INVESTMENTS PORTFOLIO A.G.
- It indicates that, "given the age of the file, the remaining documentation
relative to the claimant could not be located, since the
claims derived from it are, to date, prescribed ”.
FOURTH: On 10/17/19, PRA IBERIA, S.L.U. send this Agency the following
information and statements:
- A copy of the letter dated 05/28/08 addressed to the claimant is provided to the
address indicated in the credit card application document, where
the purchase of the loan portfolio by the AKTIV entity is reported
CAPITAL INVESTMENTS PORTFOLIO A.G. to the SANTANDER entity
CONSUMER FINANCE as well as the information and personal data with the
due credit and the possibility of contacting the entity TREYM CONSULTING AND
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/47
SERVICIOS A EMPRESAS, S.L.U. for access, cancellation or opposition of
said data.
- Provide a copy of the certificate signed by a notary public stating: “[…] the
01/12/18 the GLOBAL ASSET AND ASSET ASSIGNMENT has been formalized in Spain
LIABILITIES of the portfolios acquired in Spain by the company "AKTIV
KAPITAL PORTFOLIO AS, OSLO, SUCURSAL EN ZUG ", broadcasting on
block all the portfolios acquired in Spain by universal succession of the
first entity in favor of "PRA IBERIA, S.L UNIPERSONAL", patrimony in
which include, among others, the portfolio acquired by virtue of the deed of
ASSIGNMENT OF CREDIT indicated below and therefore the debt that
the corresponding to the claimant is hereby certified for the total amount
of XXX €.
- Provide a copy of the letter addressed to the claimant at the address indicated in the
card request sent by the entity PRA IBERIA, S.L.U., dated to
01/21/15, where they state the acquisition of all the assets and
liabilities of AKTIV KAPITAL, through the global transfer of the AKTIV business
KAPITAL and consequently of the credit subscribed with in its day by Santander
Consumer.
- They provide a document from the service provider for sending the requirements of
payment and transfer of credit from PRA IBERIA, S.L.U that certifies the generation and
printing on 02/10/15 of a request for payment in the name of the
claimant at the address indicated in the credit card application and your
made available to the distribution company Unipost, S.A. the day
02/13/15.
- They claim that, on 05/17/19, the claimant contacted them,
communicating a new address where they sent it again
information.
- They provide screen printing of the data obtained from the hiring
telephone number that were allegedly provided by the claimant. Bliss
data capture in the systems was printed and signed by a proxy of
Santander Consumer before registering the card.
- They affirm that: “The claimant contracted with Santander Consumer a credit card
Credit from Unión Fenosa by telephone on 10/4/2000. As a result of bliss
contracting, it was sent to the address provided by the claimant, both the
card as the conditions of this and the instructions for its activation. A) Yes
on 09/09/2002 the claimant activated the card through a payment at a station
service for € 39 and continue using the card until the entity
the assignor cancels it due to non-payment ”.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/47
- They affirm that: “Since 05/17/19 they have been in contact with the claimant to
solve your doubts. That is why they understood that it was not necessary to answer
formally to the request for access and that they have sent the claimant a
certified email with the card movements and where they clarify their payments ”.
- A copy of MRW Burofax is provided with the subject "Claim answer"
dated 10/17/19, where there is an attached file with a name
"Answer claim_e_08673_20193.pdf". A copy of the content is provided
of the file, this being a letter addressed to the claimant, dated 10/16/19,
where it is reported, among other aspects, that: - “On September 9, 2002
the credit card in your name was activated. - Who received two transfers
whose origin was an account of the transferor Santander Consumer for the
payments made but which cannot indicate the origin of said transfer
as they did not occur directly in their accounts ”.
- They provide a SANTANDER CONSUMER certificate stating the charges in
the credit card from 2002 to 2005.
FIFTH: On 11/21/19, the claimant sent this Agency a second letter
reporting the following:
- Send a copy of the documentation you received from the entity PRA IBÉRICA, the
10/22/19 in response to the access request that was sent to them on 06/24/19.
- Complaint that the claimed entity affirms that it made two transfers
to pay the card debt from a third checking account to the
SANTANDER CONSUMER entity, but they do not show you that they are made
by her or the account number from where they were made: 06/16/2008
of € XXX and On 06/28/2011 of € XXX,
- That they send you some bank details of the IBERCAJA financial institution, but
that he appeared in this entity and they told him that there was nothing in his name.
- That they send you information about purchases that you do not know and that you still do not
be able to verify anything, as it is not provided by the bank contract, nor the
invoices, or transfers that justify that she is the cardholder and
therefore the debtor of what they claim.
SIXTH: On 06/01/20, an information request is sent to the financial institution
IBERCAJA BANCO, to identify the holders and authorized of the account
*** XXXX, as of October 4, 2000, the changes produced in these
data, and the time period in which said account remained open, in the event that
has been closed.
SEVENTH: On 06/16/20, IBERCAJA BANCO, S.A. sends this Agency the
following information and statements:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/47
- Account No. **** XXXX remained open from June 29, 2000 until
on December 21, 2001, where he appeared as the only owner in that period,
that is, from June / 2000 to 12/21/01, the claimant.
EIGHTH: On 06/18/20, PRA IBERIA, S.L.U. send this Agency the following
information and statements, requirement of this Agency:
- Which are provided by the stipulations that regulated the assignment of the debt between
SANTANDER CONSUMER FINANCE and AKTIV CAPITAL, today PRA IBERIA;
S.L.U. They provide document of "ELEVATION TO THE PUBLIC OF CONTRACT OF
ASSIGNMENT OF CREDITS ”by Notary Mr. ALBERTO BRAVO OLACIREGUI
dated 04/30/2008 containing: - SANTANDER CONSUMER FINANCE,
S.A., among others, as assignor. - AKTIV KAPITAL PORTFOLIO
INVESTMENTS, A.G. as assignee, being its tax representative is
TREYM CONSULTING AND BUSINESS SERVICES; S.L. - […] whereby the
ASSIGNORS sell and transmit to the ASSIGNEE, who buys and acquires, the
CREDIT PORTFOLIO, as defined in Exhibit II of the aforementioned
Contract.[…]"
- They provide a copy of the contract, a copy of the stipulations that regulated the transfer
of the debt between Santander Consumer Finance and Aktiv capital, today PRA
IBERIA S.L.U., signed and dated 04/30/2008 where it is stated, among others, the
following:
“[…] V. That the volume of the Loan Portfolio, the heterogeneity of the
Credits that compose it and, in many cases, its seniority and / or its
origin of any of the credit institutions merged with the
Assignors make sure that they cannot guarantee that the Credit Data
are always complete or correct. In particular, the Assignors do not rule out
that some of the Credits that appear in the Loan Portfolio are not in
reality existing credits or legally enforceable by the Sellers or not
are transmissible, so all of them should be considered to all
effects such as doubtful credits. For the same reasons, the documentation
Physics related to the Credits that the Sellers have does not
It is necessarily complete or exhaustive, and there may be no documentation
physics regarding some of the Credits. The Assignee knows and accepts these
characteristics of the Credits, the Credit Data and the
physical documentation related to the Credits.
[…] VII. That, within the framework of a prior negotiation for the possible
transfer of the Loan Portfolio, the Sellers and the Assignee have
held various meetings in which the Assignee has been able to obtain information
completely and to your satisfaction regarding the characteristics of the Portfolio
Credits, the procedures for registering and conserving the Credits of the
Assignors, the mechanisms for the collection of Credits used by the
Assignors, […] […]
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/47
1 .2. Exclusion of liability of the Assignors: The Parties acknowledge that
The object of the Contract is the sale of the Loan Portfolio in its
globality, without individualized consideration of each of the Credits that
they compose it and that they are given. Additionally, after the meetings between the
Parties and the due diligence process carried out by the Assignee, he knows and
accepts that the Sellers do not guarantee that the Credit Data will be
complete and accurate, and that some of the Credits may not exist due to
any cause (including prior payment), not be legally enforceable by the
Assignors or have their transferability restricted. Therefore, the totality and each
one of the Credits that the Assignee acquires are sold as doubtful
in accordance with the provisions of art. 1529 of the Civil Code, acquiring the
Assignee of the Loan Portfolio at its own risk (…) ”.
NINTH: On 01/18/21, the Director of the Spanish Agency for the Protection of
Data agreed to initiate a sanctioning procedure against the claimed entity, by virtue of
the powers established, for breaching the provisions of articles 6.1) of the RGPD,
Regarding the illicit treatment of the personal data of the claimant and for infringement
tion of article 15 of the RGPD, regarding the lack of diligence when facilitating the
access to information on the claimant's personal data with a sanction
total of 60,000 euros (sixty thousand euros), 30,000 euros for the violation of article
6.1 and 30,000 euros for the violation of article 15 of the RGPD.
TENTH: Notified the initiation agreement to the claimed entity, it in writing
dated 02/01/21 made, in summary, the following allegations:
1.- Expiration of the previous actions.
The previous actions on which this sanctioning procedure is based
They have expired as provided in article 67.2 of the LOPDGDD.
In this sense, it indicates the second fact of the agreement of the initiation of san-
that: “In view of the facts set forth in the claim and the documents
provided by the claimant, the General Sub-Directorate for Inspection of Proprietary Data
yielded to carry out actions for its clarification, under the protection of the powers of
vestigation granted to the control authorities in art 57.1 of the RGPD. Thus, with
dated 09/17/19, informative requirements are addressed to the entity PRA IBERICA, SL.
and the entity SANTANDER CONSUMER FINANCE. "
In its article 67 LOPDGDD, it indicates in its section 2 that: “2. Previous actions
investigation will be subject to the provisions of Section 2 of Chapter I of Title
VII of this organic law and may not have a duration of more than twelve months to
tar from the date of the agreement for admission to processing or the date of the agreement by the
that its initiation is decided when the Spanish Agency for Data Protection acts
on his own initiative or as a consequence of the communication that he had received
issued by the supervisory authority of another Member State of the European Union,
form article 64.3 of this organic law. "
Although the specific date of the agreement to process the ac-
previous research situations, and for which we must wait to know the experience
complete tooth of this procedure, which we can affirm in a resounding way,
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/47
the view of the second fact of this initial agreement is that said agreement was produced
prior to 09/17/2019, as it is on this date that the first
following actions after the Subdirectorate General for Data Inspection, in
function of the attributions granted by the law agrees the beginning of the same.
However, in the Resolution of the procedure No.: PS / 00418/2019, as the only reference
income found on the criteria of the Agency itself regarding the beginning of the computation
of the period of the previous actions of the inspection of article 67.2 LOPDGDD,
establishes that: “Once this admission for processing was agreed, the claimants were notified
tes, and not IZENPE, in accordance with the provisions of article 65.5 of the LOPDGDD,
They started preliminary investigation actions indicated with the number E / 00995/2019.
Within the framework of these actions, dated 02/04/2019, the inspection services
of this Agency sent IZENPE a request for information, in which it consists of:
this reference number and it is expressly indicated that said request be made
za “In the framework of the actions carried out by the General Subdirectorate of Ins-
pection of Data in order to clarify the terms of some facts susceptible to
possible infringement of current Data Protection regulations and of which he has had-
I know this Spanish Agency for Data Protection ”and in use of the fa-
cults conferred by article 58.1 of the RGPD and article 67 of the LOPDGDD. "
The expiration of the previous actions was already included in article 122.4 of the Royal
Decree 1720/2007, of December 21, approving the Regulation of
development of Organic Law 15/1999, of December 13, on data protection of
personal character (RDLOPD) establishing that the computation of the beginning or "dies ad quo"
from the date of presentation of the complaint.
The wording of said article is very clarifying for interpretative purposes since it
clearly ends the moment when the admission agreement to
processing of the preliminary investigation actions, which is none other than the beginning of the
Inspection actions through the attributions established by law: “4. Are
Previous actions will have a maximum duration of twelve months from the date of
date on which the complaint or reasoned request referred to in section 2 hu-
would have had entry into the Spanish Data Protection Agency or, if not
exist, as long as the Director of the Agency agreed to carry out said
performances. The expiration of the term without an agreement having been issued and notified
initiation of the sanctioning procedure will cause the expiration of the pre-action
vias. "
Said article reflects the importance of the expiration of the previous actions as
response to the adequacy of the administrative principles and especially the article
42.2 of Law 30/1992, of November 26, on the Legal Regime of the Administrations
Public tions and the Common Administrative Procedure (LRJPAC) and why if not
If this limit existed, the inspection actions could not be prolonged in such a way
that would violate the principle of legal security that our Constitution proclaims.
This criterion is reflected in different jurisprudence, among which stand out-
for its clarity, the Judgment of the Contentious-Administrative Chamber of the
National Dictum number 2696/2006 of October 17, 2007 (Appeal No.
180/2006), (…).
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/47
We consider for all this, and according to what has been reasoned heretofore, that the
plaintiff insofar as there has been a fraudulent use of the institution of
the preliminary proceedings. We are consequently faced with an assumption of fraud of
Law contemplated in article 6.4 of the Civil Code, inasmuch as it is intended to circumvent the
application of article 42.2 of Law 30/1992 using the request for information to,
with it, avoid the expiration of the sanctioning file. "
We will say that it is not possible to claim that the proceedings come from the new number of
inspection, which occurs on the same case, this is inspection E / 01924/2020,
of June 1, 2020 (continuation of inspection E / 08673/2019, October 2019), and
which was answered by this party on 06/18/2020 which contains a single
ca petition: “Copy of the stipulations that regulated the assignment of the debt between
Santander Consumer Finance and Aktiv capital, today PRA IBERIA S.L.U. ”.
Although the existence of the assignment of the claimant's credit and its details (date of
assignment, intervening Notary, amount of debt, etc.) is known to the Agency at least
us since receiving the claimant's resignation. In this sense, in the agreement of
initiation of the sanctioning procedure is indicated:
1) First Fact: “On 08/07/19, you have an entry in this Agency, a preliminary complaint
seated by the claimant in which it indicated, among others, the following: (…)
2) Third Fact: “On 10/09/19, the entity, SANTANDER CONSUMER FI-
NANCE, S.A. sends this Agency the following information and statements: (…)
3) Fact four: “On 10/17/19, PRA IBERIA, S.L.U. sends this Agency the following
following information and statements: (…)
It is noteworthy the period of time in which the Agency investigates new indi-
by the claimant, specifically the current account that appears in the contract.
Specifically, the claimant informs the Agency on 11/21/19 that in Ibercaja they have not
given information, but the Agency does not send any type of information to said entity
bank until June 2020, that is, 7 months after knowing this new information.
mation by the claimant, also taking into account that the actions
inspection dates back, as we have previously commented, at least from
on 09/17/19.
Even counting that said new information had been enough to start
a new investigation, the Agency would have had 3 months since it knew them
to have acted against my principal, if he had considered it so, as the
own Agency in the Resolution of PS / 00418/19 cited above: “(…) the decision on
the admission or inadmissibility of processing must be notified to the claimant within three
months since the claim entered the Agency… ”. These 3 months have-
would have ended on 02/21/20, although it should be noted that it is not a new
vestigation but the continuation of the proceedings that were initiated before the
09/17/19
Thus, the following facts of the start-up agreement are relevant:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/47
“FIFTH: On 11/21/19, the claimant sends this Agency the following information
statement and representations: (…) - That they send you some bank details of IBERCAJA
but he appeared. "
SIXTH: On 06/16/20, IBERCAJA BANCO, S.A. sends this Agency the following
Following information and statements, at the request of this Agency: (…).
SEVENTH: On 06/18/20, PRA IBERIA, S.L.U. send this Agency the following
information and statements, requirement of this Agency: (…)
Thus, the complete or necessary information, in the opinion of the Agency, to finalize the ac-
inspection results, obtained on 06/18/2020, as indicated in the basis of
seventh law and it is not until 01/18/2021 that this party is notified of the present
agreement.
Taking into account the interruption of the statute of limitations and expiration due to the
alarm status, this is 81 days, counted from 04/14/2020 to 06/3/20201 or even
counting them by periods in months, this is 3 months, it turns out that:
1 Administrative deadlines 1.- Suspension of deadlines: Royal Decree 463/2020 of 14
March, Third Additional Provision. Terms are suspended and
deadlines for processing the procedures of public sector entities. The
Calculation of the terms will be resumed at the moment in which the Real loses validity.
Decree 463/2020 or, where appropriate, its extensions. Therefore, the terms are suspended
pending on 03/14/2020.
2.-Lifting of the suspension of the terms: Article 9 of Royal Decree 537/2020,
of May 22, by which the state of alarm declared by the Real De-
creto 463/2020, of March 14. Effective June 1, 2020, the computation
of the administrative periods that had been suspended will be resumed, or
It will be established, if this had been foreseen in a norm with the force of law approved during the
management of the state of alarm and its extensions. Administrative deadlines resume-
They will be on June 1, 2020. These terms, in general, will resume, including
therefore putting the days that had been exhausted before Royal Decree 463/20,
March 14.
However, these terms will be restarted, the full term being computed again, if
this would have been foreseen in a norm with the force of law approved during the term
of the state of alarm and its extensions. Substantive terms: prescription and expiration 1.-
Suspension of prescription and expiration periods: Royal Decree 463/2020 of 14
March, Fourth Additional Provision. The statute of limitations and expiration of
any shares and rights remain
1) The previous actions would expire, without taking into account the interruption of the state
alarm, at least on 09/17/20, 1 year after the start of the proceedings. Without
However, the sanctioning procedure agreement is received 1 year and 4 more months
afternoon.
2) The Agency knows new information on 11/21/2019 provided by the complainant-
However, it is not until June 2020 when it completes its inspection activity.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/47
The Agency should have resumed the inspection, if it had considered so in a
within 3 months, that is, on 02/21/2020 (and, in any case, before the state decree
alarm), although it is not until June 2020 that he restarts his investigation.
3) The Agency collects the complete information of its investigation on 06/18/2020, it is
In other words, you still have 3 months before the previous actions expired.
4) Taking into account the suspension of the alarm state (From March 14 to March 4,
June) said period could be extended until 12/17/2020, taking into account
even that we count full months (3 months instead of 81 days), therefore, the
Agency would have had a period of 6 additional months to see notified the
start of this agreement to my client.
5) The agreement to initiate the sanctioning procedure has been notified, at least 1
month after the expiration of the previous proceedings, that is, the
01/18/2021, counting on the periods of suspension of the state of alarm. For the former
above, this part understands that the previous actions that give rise to the present
sanctioning cedement are expired by the expiration of the established term.
cido in article 67.2 of the LOPDGDD.
Even understanding this part that the previous actions of this initiation agreement
sanctioning procedure suffers from expiration, my client will proceed to enter-
try to assess the facts of the infractions for which my command is held responsible.
you, distinguishing between them, that is, the violation of article 6.1. of the Rule-
Mention (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016,
concerning the protection of natural persons with regard to the processing of data
personnel and those suspended during the period of validity of the state of alarm and,
where appropriate, the extensions to be adopted.
2.-Lifting of the suspension of the prescription and expiration periods: Article 10
of Royal Decree 537/2020, of May 22, which extends the state of alarm
declared by Royal Decree 463/2020. Effective June 4, 2020,
raise the suspension of the statute of limitations and expiration of rights and actions
nes. the free circulation of these data and repealing Directive 95/46 / EC
-General data protection regulation- (RGPD) and the violation of article 15
GDPR.
2.- Of the violation of article 6.1.RGPD. Of the legality of the treatment.
Of the assignment of credits and the legality of the treatment. From the facts of the present pro-
yield. From the diligent performance of my client. From the lack of probable elements
errors in the evaluation of the evidence by the Agency. Of compliance
of the criteria established by the AEPD.
As is proven in the documentation of the administrative procedure:
1) On 04/30/2008 the assignment of certain credits was subscribed and made public in-
tre Santander Consumer Finance, E.F.C., S.A. (Santander Consumer) and Aktiv Kapital
Potfolio Investments, A.G. (Aktiv Kapital) before a notary public. Among these credits are
found the claimant's.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/47
2) Subsequently and through different commercial operations of global transfer of
assets and liabilities, said credit is acquired by my client PRA Iberia, S.L.U.
(PRA)
3) Both in the declaration before a notary and in the inspection, Santander Consumer
states that the claimant acquired a credit card from Unión Fenosa by telephone.
ca 10/4/2000 under applicable law. Said telephone operation, effec-
ted under the applicable regulations at that time, it was reviewed and signed by
a representative of Santander Consumer before registering the card.
4) It is also credited in the movements that prove the use of the aforementioned card,
that it is activated on September 9, 2002 through a payment at the station
service of XXXXXXXXX – Cedip. For € XX and the card continues to be used until
that is canceled due to non-payment.
5) A certificate from Santander Consumer is also attached in which it is accredited
receipts pending payment, that is, receipts numbers 41 to 51 for an amount
Total nominal amount of XXX euros, the first of which was from 02/01/2006 and the last from
them on 12/01/2006. In other words, the card has been active from 09/09/2002 until
12/01/2006 in which it is canceled due to non-payment.
When the card is activated, it is observed that there has been a change in the account
current, thus in the movements that prove the existence of the debt, the account
The current in which the charges are made is: "Account Number: *** ACCOUNT.1" (the data
are not complete for confidentiality reasons of the transferor company) although
when the card was registered, almost 2 years before (on 10/04/2000) the account that was
reflected is * XXXX, which clearly shows the claimant changed the number
Checking account to activate the card and start using it.
7) Both the claimant and the Agency pay their attention to the account in which the
applied for the card on 10/04/2000 (account that according to Ibercaja's statement was closed
on 12/21/2001), although this account does not match the activation account of the
card on 09/09/2002, and where the card charges occurred, that is, the number
account number that appears in the movements that prove the use of the card, the
checking account "Account Number: **** XXXX".
8) Curiously, neither the claimant nor the Agency ask about this current account
neither my client nor Santander Consumer and that taking into account that the Agency
directs my client for the second time in June 2020 but does not say anything about the
statement of the claimant or its extension of the investigation to Ibercaja (not to
Santander Consumer) with what there is, there is no egalitarian application of the law, since
does not understand this part why the Agency did not communicate to this part in a second
occasion (so that he could ask the transferor entity) or he could go directly to
to the transferor entity to clarify the account in which the
credit card charges and payments.
9) The extracts from the aforementioned card from 09/01/2002 to 02/08/2006 prove
the use of the card up to 56 times for consumptions of more than 1,500
euros, in the period of more than 3 years in which it has been active, although the entity ce-
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/47
dente only certifies the debit balance of receipts since 02/01/2006 for the amount
principal (without interest) of XXX euros, with which clearly payments have been made
in the card charge account.
10) Finally, it is not found in the agreement at the beginning of the procedure.
sanctioner that the inspection has asked the entity Santander Consumer the
detail of the transfers received in your account for amounts of € 150
(06/16/2008) and € 250 (06/28/2011) as the claimant made the payment in the accounts
Santander Consumer.
11) My client provides the concept that you can consult in your accounts about this
last transfer, by virtue of the detail provided by the transferor, this being:
"TRANSFER OF: *** TRANSFER.1".
Thus, the issuing entity of the transfer is entity 2096, belonging to the entity
Caja de España, today Unicaja Banco2, although none of this is the subject of investigation.
tion by the Agency and what is investigated is partial and without my client
have the opportunity to contribute or add to the resolution of this case, leaving
thus at the discretion of the partial information provided in the inspection.
What has been reported up to now is that my client, regardless of the analysis
sis of the Agency on the contract signed by the transferor in April 2008 and at
that we will refer to later, has proven its diligence in complying with
the law and has presented evidence of the debt on behalf of the claimant, apparently
certain and enforceable, and the Agency does not reason how my client can accredit
greater diligence in complying with data protection regulations.
Yes, it should be mentioned in advance that the claimant at no time
has denied the debt, nor has provided the documentation provided to the police to
the presentation of the appropriate complaint for impersonation, if it is the
case, since they would be the competent bodies to carry out investigation tasks that
exceed the competence of my client.
Also mention that the most important proof of charge of the Agency in this
case (Ibercaja's answer) allows it to affirm that the data processing of the
claimant does not comply with the principles that must govern the processing of personal data
(Article 5 RGPD), although what the Agency forgets is that:
1) The debit and credit account of the card is not the same as the one consulted on the
Agency, nor the one that accredits the existence of the debt.
2) The information obtained by the Agency is carried out in the use of the attributes
tions conferred by law.
3) My client cannot, by himself, carry out this investigative work that he carries out
the Agency, or obtain confirmation from Ibercaja or any other bank.
You only have, based on the RGPD, the possibility of accessing said information always
that: a. It is provided by the interested party (in this case the claimant who has not been
contacted my client and has not shown interest in clarifying her case). b.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/47
Of the administrative bodies with investigative powers: Protection Agency
Data, police, judges and courts, etc.
All of the above implies that my client has acted with the greatest diligence
may demand in the treatment of the claimant's information, likewise, my maintenance
dante, in compliance with the criteria established by this Agency, has proceeded to cancel
the debt in their files and make it available to public authorities and bodies
and security forces, judges and courts - for the submission of all information and
documentation required for the clarification of the facts once the claim is
Keep filing the appropriate complaint for impersonation of responsibility. To this
This respect is credited by copying the situation in the systems of my command.
te, the current status of the claimant's file:
The criteria of the Agency is established in different resolutions, including
tar: 1) File Nº: E / 01202/2016 RESOLUTION OF THE ACTUATION FILE-
NES; 2) the RESOLUTION OF THE ACTION FILE of the procedure.
to Nº: E / 01178/2020 and, 3) file Nº: E / 00712/2019 (…); For its part, it stands out
procedure Nº: E / 01462/2019, (…).
3.- Of the assignment of credits and the legality of the treatment. Of the balloon contracts and
its regulation in the Civil Code (CC). Of the drafting of the contractual clauses and
competition for interpretation. Of the responsibility of the existence and legi-
timidity of credits in the CC. Of the nullity derived from article 1203 CC and the
TS doctrine. Of the non-retroactivity of the application of the law.
The Agency, both in fact Seventh and in Law Foundation II, 3rd analysis
This is part of the contract entered into between Aktiv Kapital and Santander Consumer in April
2008, specifically stipulations V, and clause 1.2. to conclude that:
1) That my client knew or, in the words of the Agency “assumed” from the beginning
as more probable the existence that the credits were not real or correct and
that even some of the credits may not exist.
2) That my client does not certify that he has adopted the measures required to comply with
diligent compliance with the obligation imposed by the RGPD, both in the compilation of
personal data as well as in the subsequent processing thereof, therefore, of the re
daction of the clauses signed in 2008, there is a serious lack of diligence
of the claimed entity in compliance with the obligations imposed by the regulation
protection of personal data. A diligent compliance with the
principle of legality in the processing of third party data would require that the person responsible
treatment is in a position to prove it, (principle of proactive responsibility
he).
3) The foregoing could imply the violation of article 6.1 of the
RGPD, whenever the claimed entity could have processed the personal data
of the claimant without any standing.
Being the related facts analyzed under the current regulations with in-
dependence on the prohibition of retroactive application of the law, by virtue of the
constitutional data, we must specify at this time that the interpretation of the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/47
Agency of the signed contract previously responds to a wording of 2008, in the
that there was a different culture in terms of data protection and the transfer of
credits from individuals and above all, to a partial interpretation of the Agency, since
does not take into consideration the application regime of these contracts under the
Applicable regulations: Civil Code and the jurisprudence of the Supreme Court. We must
also add the following clauses to the information extracted by the Agency:
1) Stipulation IX. "That, in view of the foregoing, the Sellers are interested in
sell and transmit raised and as doubtful, and the Assignee is interested in
buy and acquire, the Loan Portfolio (…) In particular, the object of this contract
is the balloon sale for a lump sum of the entire Loan Portfolio in
its status as a financial asset, without individualized consideration of each of
the Credits that compose it and taking into account, in particular, the doubtful character
of each and every one of the Credits. "
2) Clause 1.2. “(…). The Price is fixed and is not subject to any modification
As a consequence of the non-existence, those that rise intransmissibility or nexigibi-
quality of any of the Credits, due to the lack of solvency of the debtors, due to the
content of the Credit Data, or by any other assumption regarding the
that the responsibility of the Sellers has been expressly excluded "
3) Clause 2: “The Assignee, in his capacity as the legitimate owner of the Cré-
dited by virtue of this writing, assumes any type of responsibility derived or
that may derive from said ownership as of the date hereof, releasing
the Sellers of any liability derived from said ownership from said
date."
4) Clause 10. JURISDICTION. “For all litigation, discrepancy, question or claim
tion that could derive from the execution or interpretation of this Contract the Parties,
waiving any other jurisdiction, they submit to the exclusive jurisdiction of the Courts
gados and Courts of Madrid capital (Spain). "
As can be clearly verified, the operation signed between Santander Consu-
mer y Aktiv Kapial is an assignment of credits of article 1526 et seq. of the Civil Code that
is defined as a transfer of ownership of a credit between a former creditor
and a new one - transferor and assignee-, produced as a legal effect of a contra-
celebrated between them. There is not in the assignment of credits an entire assignment of the
contractual position, which would require the consent of the debtor, as happens in the
assignment of contracts, but only of active ownership, so that they will be dismembered
the positions relative to the creditor and debtor of one of the parties.
As a reflection of the responsibility of the Assignor, not towards the Assignee but towards the
debtor with respect to the assigned right, there is numerous jurisprudence of the Supreme Court
mo, that different Provincial Courts apply: 1) The Sentence of the AP Navarra,
sec. 3ª, S 12-19-2011, No. 289/2011 (…); 2) The Sentence of the Second Section 2nd of
the Provincial Court of León dated June 19, 2007 (…) ”.
Having clear the responsibility of the transferor over the object of sale (do not forget
we show that it is a right to collect what is sold, not an obligation to pay),
that the transferor, Santander Consumer, intends, with the inclusion of said clauses, is
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/47
the complete exoneration of liability against the Assignee, that is, Aktiv Kapi-
such. In other words, Aktiv Kapital accepts that the sale takes place in a balloon and with credits.
doubtful, which implies that it will not request any type of compensation from the Assignor,
that is, Santander Consumer. It has no additional application in terms of
data protection, although, surely if the contract was drawn up today,
its clauses would be more appropriate to the RGPD (…):
It is not possible, as the Agency indicates that the fact that an Assignor sells credit
dited as doubtful, implies that it transmits its responsibility to the Assignee, since this
goes against both the applicable legislation and the jurisprudence of the Supreme Court.
In fact, recent Supreme Court judgments such as Sentence no.
ro 2816/2019, of September 18, 2019 (from procedure 509/2017)
and STS November 20, 2008 STS 1127/2008, Appeal number: 2280/2002, (…).
Thus, the non-existence of the contract in the framework of a credit assignment implies the void
of the figure of subjective novation due to change of creditor included in article
1203 of the CC, thus becoming a "nullity derived" from the legal business
of assignment of credit between the assignor and me the assignee. Therefore, following the conclusion
decision of the Supreme Court on the nullity derived and thus the application of CC 1203 the only conse-
What can be applied to my client is to abide by the consequences of the
loss of their right, but in no case can the burden of responsibility be reversed.
bility established in the CC, so the assignee cannot incur liability
contractual agreement against the debtor assigned for the lack of fulfillment of their duties
contractual by the transferor.
In any case, as the Agency has already established in its different Resolutions,
the interpretation of the clauses in the contracts between the parties is exclusive
jurisdiction of civil courts, exceeding the powers attributed by
Law to the Agency. In this regard, it is worth highlighting clause 10 of the signed contract
between the Assignor (Santander Consumer) and the Assignee (Aktiv Kapital) (…)
For its part, it is noteworthy that the necessary application of the principle of non-retroactivity
validity of the Law, both in the regulations in force in distance contracting and in the
application of the principle of proactive responsibility of the GDPR.
Thus, the Agency has established the application of the principle of retroactive responsibility
of the RGPD, published in April 2016, to a contract signed in April 2008. Applies-
tion of the RGPD to a contract signed 8 years before the publication of the Regulation
General Data Protection and 10 years before its entry into force.
Non-retroactivity is a consequence of the criminal principle of typicity and legality
that, like other informing principles of Criminal Law, is applicable, muta-
tis mutandis to the sanctioning law.
The art. 9.3 of the Spanish Constitution indicates that the Constitution guarantees the irre-
troactivity of unfavorable or restrictive sanctioning provisions of rights
individual chos and art. 25 CE establishes that no one can be convicted or punished
caused by actions or omissions that at the time of their occurrence do not constitute
to, lack or administrative infraction, according to the legislation in force at that time. The
Chapter III of the Preliminary Title (arts. 25 to 31) of Law 40/2015, of October 1, of
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/47
Legal Regime of the Public Sector contains the constitutional precepts that regulate
lan the sanctioning power of the Administration (…)
4.- Of the result of the inspection actions. Of the principle of objectionable liability
tiva. Of the principle of guilt that should govern administrative law
As we relate in the first fact of this writing, my client cannot
be subject to a penalty for fault, as this would be to make responsible objectively,
which is therefore prohibited by legislation as well as by jurisprudence.
In this sense, we highlight the arguments of the following Resolutions of
the Spanish Agency for Data Protection:
1) File No.: E / 02304/2018 (…): in light of this provision, the san-
can be demanded by way of fraud or guilt, the latter being sufficient
case the mere non-observance of the duty of care. In the Judgment of 10/17/2007 "
The doctrine of the National Court on this matter is to require those entities
in which the development of their activity involves a continuous processing of data from
clients and third parties who observe an adequate level of diligence. In the SAN of
10/17/2007; SAN from 04/29/2010
2) File No.: E / 02157/2018: Also the SAN of 04/29/2010, in its Foundation
Sixth legal officer, regarding a fraudulent hiring, indicated that “The question does not
It is to determine whether the appellant processed the personal data of the complainant without
your consent, such as whether or not you used reasonable diligence in trying to
identify the person with whom you signed the contract ”.
5.- Of the absence of application of article 58 RGPD as an alternative measure. Of the
lack of transparency of the Agency before the start of this procedure
sanctioner. Principle of Equality before the Law.
From this understanding of things, constitutional jurisprudence holds that
the principles of legal certainty and the interdiction of the arbitrariness of powers
Public authorities prevent judicial bodies from arbitrarily departing from precedents
own. Consequently, the principle of equality is violated, in its aspect of rights.
to equality in application of the Law, when the same body, existing identi-
substantiality of the assumption of fact prosecuted, deviates from the criterion maintained in
previous cases, without there being a sufficient and reasonable foundation to justify
than the new position in the interpretation and application of the same legality.
In this sense, as we have commented, the Agency has known since 11/21/2019
that the claimant is unaware of the transfers made on her behalf and is unaware of the
purchases made with your card, in addition to not remembering your checking account
go and payment of said provisions (fifth fact), also collects information from a
bank entity (although erroneous) on the current account at the time of the
treatment (which was later modified) in which it is indicated that the
The claimant's account was canceled before the card was activated (sex-
to).
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 17/47
Although the Agency, unlike it has done on other occasions, decides not to transfer
give this information to my client. However, in other procedures, the Agency
decides to use its skills in the area of cooperation with managers, who
not sanctioning, so we can cite as an example the procedure No.: E / 02620/2019 and
Nº: E / 07245/2019 (…) ”.
6.- Of the diabolical test. On the principle of presumption of innocence (in dubio pro reo)
Thus treated the events that occurred in the present proceeding, it may be applied to the
In this case, the principle of presumption of innocence of article 130.1 of the Law
30/1992.
As indicated by the Supreme Court (STS 10/26/98) of the right to the presumption of
innocence (…) and the Constitutional Court Judgment of 02/20/1989 (…).
These same arguments are applied by the Spanish Agency for the Protection of
Data in its Resolutions, citing Resolution No. R / 01191/2009 (…) and the expe-
tooth No.: E / 04128/2017 (…).
In any case, it is mandatory to review in relation to the principle of presumption of inno-
that, to Administrative Penalty Law, due to its specialty, are applicable to
cation, with some qualification, but without exceptions, the inspiring principles of the
criminal law, the full potentiality of this principle of presumption of innocence being clear
cence. In this sense, the Constitutional Court, in Sentence 76/1990 (…).
According to this approach, it must be taken into account that they can only be san-
caused by acts constituting an administrative offense, natural persons and
legal entities that are responsible for them by way of fraud or fault. In addition,
It must be taken into account, in relation to this principle of presumption of innocence,
that article 53.2.b) of Law 39/2015, of October 1, on the Administrative Procedure
Common Administration of Public Administrations, includes this principle, saying that the
Those involved in an administrative procedure of a sanctioning nature have the right to
cha a: "To the presumption of non-existence of administrative responsibility while not
the opposite is proven ”.
Ultimately, the application of the principle of presumption of innocence prevents the imputation of a
administrative offense when the existence of
a proof of charge accrediting the facts that motivate this accusation. (…) "
7.- Of the principle of legitimate confidence. Criterion applied by the AEPD in previous reports
solutions
From this understanding of things, constitutional jurisprudence holds that
the principles of legal certainty and the interdiction of the arbitrariness of powers
Public authorities prevent judicial bodies from arbitrarily departing from precedents
own. Consequently, the principle of equality is violated, in its aspect of rights.
to equality in application of the Law, when the same judicial body, existing
substantial identity of the alleged fact prosecuted, departs from the criterion maintained
in previous cases, without a sufficient and reasonable justification that
justify the new position in the interpretation and application of the same legality.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 18/47
Likewise, the principle of protection of the legitimate expectations of individuals in the
scope of public law limits the activity of public power, to prevent it from
destroys without sufficient reason the confidence that his action may have created in the
citizens on the stability of a certain legal situation. Therefore, there is
violation of this principle when the Tax Agency initiates this procedure
given the antecedents exposed. In this regard we bring up the
Assignment No.: E / 01818/2019, (…).
8.- In relation to the violation of article 15 RGPD. Of the right of access.
In the basis of law III of the agreement to initiate this procedure, the
Agency details which are the facts that give rise to the violation of article 15
RGPD and which, in short, are: 1) The claimant on 06/24/19 sends a letter
certified where you request access to information about your personal data.2)
On 09/17/19, this Agency notifies the claimed entity of the inter-
put by the claimant. 3) My client contributes one of the conversations
you give on 05/17/2019 with the claimant that ... "?" 4) In this sense, my re-
presented provides a burofax sent on 10/17/2019 and a certified email with all the
information and documentation that is in the possession of my client.
The Agency concludes that “In the present case, the claimant, by certified letter
dated 06/24/19, he requested the claimed entity to inform him, in writing to the
postal address indicated, (not verbally or by electronic means), of all the information
mation related to your personal data, making use of the right of access that
attended. However, the claimed entity did not proceed to send the interested party the
training requested until 10/17/19 (3 and a half months after requesting it)
c), and after receiving notification of the claim from this Agency. "
Consequently, the Agency understands that my client has violated Article 15
RGPD and is sanctioned with article 72.1.k) of the LOPDGDD, considers
very serious, for the purposes of prescription, “The impediment or the obstruction or the
repeated attention to the exercise of the rights established in articles 15 to 22
of the Regulation ”.
From the wording of article 72.1.k) of the LOPDGDD, it is inferred that the offense is the
impediment or obstruction (what my client has not been able to carry out because
in fact has answered the claimant) or due to the repeated lack of attention to the exercise of
straight. The "reiteration" is defined in the dictionary of the Royal Academy of the Language
What: (…)
Although, as shown by the facts established in the agreement to initiate the
sanctioning procedure, the occasions in which my client has been delayed in the
Answer to the claimant, has been only 1, there has been no reiteration.
It is thus possible to deduce, in relation to the facts proven by the inspection and supported by
the documents attached here, that the opening of the present procedure san-
cionador bankruptcy the principles of typicity and legality and that, therefore, given the evidence
presented, this administrative act must be archived due to absence
responsibility of my client.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 19/47
The principle of typicity is a guarantee of the legal certainty to which the
citizen, to know at all times and with certainty, the behaviors that constitute
and in an administrative infraction, and at the same time, the sanction that they carry. For his
part, taking into account the principle of general legality of the Law, expressly recognized
by the EC (arts. 9.1 and 103.1), which supposes the full submission of the Administration
compliance with the law and the law, the subjection of the Administration to the normative block, the
This sanctioning procedure lacks any normative justification. (STC
145/2013)
The performance of my client does not conform at all to the typified element because: 1)
It has not prevented the answer to the exercise of the right of the claimant. 2) Nor has it
has hindered, it is more maintains the telephone contact with the same to clarify
her doubts and advise her on the appropriate processes to solve them. 3) Neither has left
to respond to your exercise of right, even if it is later than the indicated period, nor
much less has he reiterated any non-responsive behavior.
9.- Of the prescription of the offense
The facts previously related being thus, in the hypothetical case that my maintenance
the person who had committed any infraction, would be the one established in article 74.c) In-
fractions considered slight of the LOPDGDD, which indicates that: “c) Failure to attend to requests
citudes of exercising the rights established in articles 15 to 22 of the RGPD,
unless the provisions of article 72.1.k) of this law are applicable "
Although, taking into account that, the prescription of light sanctions is within the term
of 1 year and that my client answered on 10/17/2019, the present infraction that, insisted
mos my client has not committed, would have prescribed on 10/17/2020 or with the extension of the
state of alarm, on 05/12/2020.
The appropriate procedure for the lack of response to an exercise of the right to
According to article 63 LOPDGDD it is a Guardianship procedure, at least to give you
the possibility for my client to correct any errors, which he did as soon as he had
knowledge that the claimant complains about her lack of formal response.
And we emphasize that the infraction that the agency imposes on my client is the lack of a
formal requirement to pay attention to their right as the Agency itself points out to the
state in legal basis III that: “In the present case, the claimant, me-
By registered letter dated 06/24/19, he requested the claimed entity to inform him
mara, in writing to the postal address indicated, (not verbally or electronically)
nicos), of all the information related to your personal data, making use of the right
access chore who assisted him. However, the claimed entity did not proceed to send
to the interested party the information requested until 10/17/19 (3 and a half months after
of having requested it), and after receiving, from this Agency the notification of the claim
tion. "
Although, the RGPD or the LOPDGDD does not say anything about the formality in the lack of answers.
and neither does the Agency (nor the claimant itself) indicate anything about the accreditation
from my client to the conversations held with the aforementioned claimant for the
resolution of your case.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 20/47
10.-Of the lack of motivation. Of the principle of proportionality
This part must state that it does not find in the opening of this procedure
I provide any motivation on the part of the Administration in which it can accredit or
argue his defense, which leads to him being framed in a situation of independence
fension. In this way, this part understands, said this with all due respect and only
in terms of defense, that the actions of the Administration violate article 9.3.
CE lacking reasons or causes on which it is based when applying the standard.
The art. 9.3 of the EC establishes the principle of interdiction of the arbitrariness of the
public authorities. An action can be considered arbitrary when it lacks justification
cation. The Constitution therefore requires that all actions of the public powers be
present supported by justifying reasons that serve as a foundation. I know about it
derive at least two important consequences:
11.- Subsidiary petition. Reduction of penalty amounts. Application of the principle
pio of proportionality. Attention to the circumstances of the case.
Subsidiarily and despite the fact that this party does not agree with the infractions
and sanctions indicated by the Agency, requests the reduction to the minimum degree of the
sanctions and corrective measures established in article 76.2 of the LOPDGDD, of
in accordance with the provisions of article 83.2 k) RGPD, in addition to the indications
given by the Agency the following:
1) d) The possibility that the affected person's conduct could have led to the commission of
sion of the offense. Well, there is no police report, nor has the claimant been
to contact my client to be able to know your doubts or to be able to request
more clarifying information.
2) e) The existence of a merger by absorption process after the commission of the
infringement, which cannot be attributed to the absorbing entity. And so it has been with the
assignment of credits from Aktiv Kapital to PRA Iberia.
3) g) Have, when not mandatory, a data protection officer. Y
Thus, my client has a data protection delegate to whom the Agency does not even
ra has been addressed.
For its part and as we have indicated previously and based on the principle of equality
Before the law, we request the application of article 58.2.a) RGPD by the Agency
consisting of the warning to my client, as it has done so in proce-
These are previous ones that we have detailed in this writing:
"2. Each supervisory authority shall have all of the following corrective powers
indicated below: a) sanction any person responsible or in charge of the treatment
with a warning when the planned processing operations may infringe
the provisions of this Regulation ”. To the above facts, the
following FOUNDATIONS OF LAW (…)
12.- TESTIFICAL Request:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 21/47
Written answers by legal persons (article 381 LEC). That under cover
of article 381 of the Civil Procedure Law that is required of commercial companies:
A) Santander Consumer, to rule on the following issues: 1.
That they contribute the current account in which the amounts related to the
tion to this case. 2. That they provide the current account and the details of the transfers
€ XXX and € XXX which were subsequently transferred to my client.
B) To the bank / s resulting from the previous test, so that they can pronounce
ce on the following issues: 1. If you have the current account / s, contribute / s and
that identify their ownership. 2. If the payments and charges of the credit card occurred
credit of the present case. 3. Ownership and concepts of transfers of XXX and
XXX euros reported in the facts of this procedure.
ELEVENTH: On 06/01/21, the claimed entity is notified of the proposed
resolution, in which it is proposed that, by the Director of the Spanish Agency for Pro-
Data protection proceeds to sanction the entity PRA IBÉRICA, for infringement of
Article 6.1) of the RGPD, regarding the lack of diligence in the processing of data
claimant with a fine of 30,000 euros (thirty thousand euros) and for
fraction of article 15 of the RGPD, regarding the lack of diligence when facilitating
grant access to information on the claimant's personal data, with a fine
of 30,000 euros (thirty thousand euros).
TWELFTH: On 06/15/21, the claimed entity sends this Agency in writing
of allegations to the proposed resolution, in which it indicates, among others:
"FIRST.- Ratification of the first brief of allegations: To state that my representative
sitting is ratified in everything indicated in the first brief of allegations of the expe-
reference tooth, reiterating its content.
SECOND.- Of the violation of article 6.1.RGPD: Of the legality of the treatment. He-
chos new. From the checking account in which the payments were charged and the proof
of the payment made by the complainant.
More evidence has been requested and attempted to be collected than presented, but until
This moment he has not been able to contribute, although he has been able to collect them and contributes them in the
present writing. In this sense, it is provided as DOCUMENT No. 1, certificate of
the transferor entity, Santander Consumer, which certifies that the complainant changed the
current account with the Caixabank entity.
This new information proves that the current billing account was not
Ibercaja, but rather a Caixabank checking account, so the evidence collected is in-
complete and therefore it is necessary to complete it with this new information.
For his part, my client has been able to obtain the transfer receipt of € 250
made by the complainant herself. As it is proved in DOCUMENT Nº 2 in di-
The supporting document appears as the “ORDERING PARTY” of the transfer, the plaintiff itself.
and the current account from which the transfer comes is from a joint account.
Unicaja current (formerly Caja de España de Inversiones).
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 22/47
In this sense, it should be clarified that the fact that the complainant appears as
ORDERING OF the transfer necessarily implies that he had to identify
go to the bank from which the transfer was issued, that is, from
Unicaja. Most likely, the complainant herself went to the bank
to, once identified with your ID, order the transfer from your account
Unicaja to the account of my client.
This is not a question of a cash deposit or a card payment but a transfer
difference between current accounts that assumes that THE ORDERER HAS TO IDENTIFY
TIFIED. This Agency rejects the version stating, among other reasons that: “No
It is true, as the claimed entity states that, “(…) the claimant at no time
ment has denied the debt (…) ”, since the claim begins with the following:
following statement: “PRA IBERIA, is claiming a debt from a contract that
I do not know. Until 2013 third parties have been making transfers
banks in my name (…) ”. It should be clarified that my client was maintaining
conversations with the complainant to resolve their doubts and at no time
denied the debt and in relation to bank transfers made by third parties, it is
the document No. 2 attached, which reliably certifies that the ordering party
of the transfer of € XXX made to the account of my client, was made by the
pia complainant.
This new evidence provided is of vital importance to prove the veracity of the
allegations of this part and being information that concerns the complainant and
your bank, it is therefore necessary to extend the trial period to be able to
require information from CaixaBank to confirm that purchases and dispositions
transactions made with the Unión Fenosa credit card from 09/09/02 to
1/12/06 have been debited to the *** XXXX account and also confirmed by the Uni-
It was the complainant herself who ordered the transfer from her co-account.
Current to my client's account (*** XXXX) on 06/27/201.
THIRD.- On the legality of the treatment and the diligent action of my client.
Compliance with the criteria established by the AEPD.
My client has accredited with the documentation that he has provided in the file
that he has acted diligently because, although he cannot provide the signed contract
by the complainant, as the Agency insists, since it was carried out by telephone
nica, in accordance with current legislation, what it does provide is:
1) Notarial certificate that certifies the assignment of the credit signed with the assignor (San-
tander Consumer).
2) Confirmation from a Santander Consumer attorney that the telephone operation
nica was correctly hired, thus signing the approval of the concession of the
card.
3) Movements that prove the use of the aforementioned card, which is activated on 9
September 2002 through a payment at the Navalcarnero service station -
Cedip. For € 39 and the card continues to be used until it is canceled due to non-payment.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 23/47
4) The extracts from the aforementioned card from 09/01/2002 to 02/08/2006 prove
the use of the card up to 56 times for consumptions exceeding XXXX
euros, in the period of more than 3 years in which it has been active, although the entity ce-
dente only certifies the debit balance of receipts since 02/01/2006 for the amount
principal (without interest) of XXX euros, with which clearly payments have been made
in the card charge account.
5) The Santander Consumer certificate certifies the receipts pending payment, this
are, the receipts numbers 41 to 51 for a total nominal amount of XXX euros, being the
first of them on 02/01/2006 and the last one on 12/01/2006. That is, they paid
the receipts for the use of the credit card from 1 to 40 without any incident.
6) With the new evidence provided, it is proven that the consumer's charge account
The card's account was a CaixaBank checking account and not an Ibercaja account.
7) That the complainant has made transfers from a checking account to her
Unicaja entity name.
Given the previous evidence provided, this party understands that the employer has accredited
use of reasonable diligence in the credit accreditation on behalf of the complainant.
cient and, especially, in document No. 2 provided together with this brief, it is
accredits that the complainant knew the debt because on 06/28/2011 she ordered a transfer
rents from your Caja de España de Inversiones account (now UNICAJA).
Therefore, this part understands that the documentation presented certifies that my maintenance
dante has diligently complied with data protection regulations and likewise
Document 2 certifies that the complainant's knowledge of the existence
of the debt was earlier, in 2011, as it ordered the transfer of the amount of € XXX
to the account of my client, thus said document contradicts what is indicated in the
resolution stating that: “In the case at hand, the claimant, when
do you know that the entity PRA IBERICA is claiming a debt
that he does not recognize as his, he gets in touch, on 06/24/19, with the requested entity
granting access to your personal data and denouncing that the debt is yours and this,
as responsible for the processing of personal data,…. "
It should be clarified that the complainant NEVER filed a complaint at the police station of the
putting “personality impersonation” that he suggests in his writings and also my maintaining
Dante was clarifying with her the doubts she raised precisely by trying
clarify the use of the card, the fees paid and unpaid, the income made,
etc., although at no time did he indicate that there was an alleged "impersonation of
personality ”or fraudulent use of your data by third parties.
Even so, as far as my principal knows, the complainant has not presented the opportunity
A complaint to the commissioner to clarify whether in fact third parties have
They made income in his name and this despite the fact that he was sent all the documentation
that credits the debt. It is essential for this part to prove the veracity of what happened.
and this to demonstrate their diligence because as far as my client knows, the
The advertiser made a transfer from his account by previously identifying himself in
his bank, thus knew the existence of the debt and did not deny it in the
conversations held to clarify them. Despite the above, my man-
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 24/47
dante decides unilaterally to annul the file following the established criteria
by the Agency in its resolutions Nº: E / 01202/2016 FILE RESOLUTION
OF ACTIONS; RESOLUTION OF THE ACTION FILE of No.:
E / 01178/2020 and, file Nº: E / 00712/2019 with its also resolution of FILE
OF ACTIONS.
In these cases, the investigation actions are archived because those responsible
The treatment providers acted in the belief that whoever was hiring was who they claimed to be. Ade-
Furthermore, in these cases, the complainants filed a complaint with the Police for their
identity planting using your personal data, although in this case it does not happen
Thus, although my client prefers to make the decision to close the file so as not to
worsen their situation because being affected by partial tests is a serious
I violate the position of this part. Fortunately and despite my age
client has been able to gather evidence exonerating it from liability in the
Sentence procedure. But also in procedure Nº: E / 01462/2019, with results
do of FILE RESOLUTION, in which the same previous criterion is applied even
when the entity under inspection was unable to provide a copy of the signed contract,
However, this Agency considered adequate its action in the cancellation of the debt.
day, as my client has done when learning about the alleged impersonation of identity
of the claimant and without, until the moment of the agreement of the initiation of the proceeding,
sanctioning statement in which this Agency reveals it, could have done so
Well, I did not know.
This part does not share the judgment made by this Agency on the Basis of Rights.
Cho II, section 2, stating that: “Second, a clear lack of due diligence
day demonstrated by the claimed entity, in breach of the principle of exactitude
tud (article 5.1d.), since reasonable measures have not been adopted to sub-
prevail or rectify without delay personal data that are inaccurate with respect to
for the purposes for which they are treated, and this is so, because when the entity received the letter
of the claimant on 06/26/19, requesting access to the information and putting in
doubt the veracity of the debt, the entity, far from showing due diligence, did
disregarding said request, continues to demand payment of the debt and it is not until
after receiving the request from this Agency, on 09/17/19, when the entity, me-
diante burofax sends, on 10/16/19, the information that the claimant was requesting
citing for 3 months and 20 days. " There is no evidence to affirm
this body what it imputes to my client. Since the complainant raises
doubts about the existence of your debt, my client has conversations with
the same to clarify your doubts, not to claim the debt, it is not true that my
client “ignored” your request, rather the opposite, my client
takes your claim seriously and gave it a personalized treatment.
Therefore, this part does not understand why the Agency affirms without any proof that the
support that my principal claimed the debt and ignored the claim of
the complainant when it is not true, although it is convenient to argue a
lack of diligence that did not occur on the part of my client and thus without evidence
The Agency must state categorically that “… it cannot and should not be taken into account
deration of the allegations made by the claimed entity about its presumed performance
diligent action in this case. ”, which ultimately and in the absence of evidence what he wants
cir is that "the version of my client is not believed" although not all the ac-
carried out by my client, such as the submission of documentation at the time
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 25/47
moment in which he perceives his mistake and the cancellation of the debt the moment he knows
ce that the complainant claims that her identity was allegedly impersonated in the
payment of her debt and this even taking into account that the complainant does not provide the
ceptive police report.
FOUR.- Of the prescription of the alleged infringement of article 6.1.RGPD in light
of the new evidence provided.
The new evidence presented, that is, the supporting document provided as document No. 2
in which the complainant orders a transfer of € XXX to the accounts of my representative
sitting, shows that: 1) At least since 06/28/2011 the complainant knew the
debt and its claim by my client, this is how he orders the transfer from his account
from Unicaja to the account of my client.
2) In the concept of the transfer, the complainant indicates: “*** CONCEPT.1” that
corresponds to the numbering of the file that is being claimed and the five
first digits of your ID.
3) As previously explained, to make a transfer order from
an account to a third party, it is essential that the payer identify himself with his ID.
The offense being classified as very serious by article 72.1.b) of the LOPDGDD
(“The processing of personal data without the concurrence of any of the conditions of
treatment established in article 6 of the RGPD ”) and the term of
3-year prescription, by virtue of what is established in article 83.5, is accredited
with the new documentation provided that the offense has prescribed.
FIFTH.- On the principle of presumption of innocence (in dubio pro reo) in the assessment
of the evidence already presented and the new evidence provided. The tests above
provided are completed with the present ones and of the set of these they certify that the
complainant changed his checking account to activate his account card
from Ibercaja to CaixaBank.
Likewise, it is proven that the complainant herself identified herself and made a transfer
cia to my client's account from the Unicaja entity. Thus treated the facts
occurred in the present proceeding, the principle of
presumption of innocence of article 130.1 of Law 30/1992 establishes that “Only
The persons will be sanctioned for acts constituting an administrative offense.
physical and legal entities that are responsible for them even as a simple
non-observance. "
The Judgment of the Constitutional Court of 02/20/1989 indicates that “Our doctrine and
criminal jurisprudence have been holding that, although both can be considered
as manifestations of a generic favor rei, there is a substantial difference between
the right to the presumption of innocence, which develops its effectiveness when there is
an absolute lack of evidence or when the evidence does not meet the appropriate guarantees
sales and the jurisprudential principle in dubio pro reo that belongs to the moment of
assessment or evidentiary appreciation, and who has to judge when that activity
indispensable probativeness, there is a rational doubt about the real concurrence of
the objective and subjective elements that make up the criminal type in question. "
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 26/47
These same arguments are applied by the Spanish Agency for the Protection of
Data in its Resolutions, citing by way of example, Resolution No.
R / 01191/2009, of May 25, 2009, in which applying the previous judgments
resolved: “Ultimately, those principles prevent the imputation of an administrative offense
goes when a proof of charge has not been obtained and verified as proof of the
facts (…) applying the principle “in dubio pro reo” in case of doubt regarding a
concrete and determining fact, which requires in any case to resolve said doubt of the
most favorable way to the interested party “In file Nº: E / 04128/2017, RESOLU-
TION OF ACTION FILE, the Agency itself applies this criterion indicating-
do: In any case, it is mandatory to review in relation to the principle of presumption of
innocence that the Administrative Penalty Law, due to its specialty, is entitled to
application, with some qualification but without exceptions, the inspiring principles
criminal law, the full potentiality of this principle of presumption of innocence being clear
cence.
The Constitutional Court, in Sentence 76/1990, considers that the right to
assumption of innocence implies “that the sanction is based on acts or probable means
prosecutors or incriminators of the reproached conduct; that the burden of proof
It corresponds to the person who accuses, without anyone being obliged to prove their own innocence;
and that any insufficiency in the results of the tests carried out, freely va-
praised by the sanctioning body, it must be translated into an acquittal ”.
According to this approach, it must be taken into account that they can only be san-
caused by acts constituting an administrative offense, natural persons and
legal entities that are responsible for them by way of fraud or fault.
Likewise, it must be taken into account, in relation to this principle of presumption of
innocence, that article 53.2.b) of Law 39/2015, of October 1, of the Procedure
Common Administrative of Public Administrations, includes this principle, saying
that those interested in an administrative procedure of a sanctioning nature
They have the right to: “To the presumption of non-existence of administrative responsibility
as long as the opposite is not proven ”.
Ultimately, the application of the principle of presumption of innocence prevents the imputation of a
administrative offense when the existence of
a proof of charge accrediting the facts that motivate this accusation.
SIXTH.- Of the bankruptcy of the principle of typicality.
Infringement of article 15 classified as serious for not answering the claim in writing.
mation of the complainant. In the basis of law III of the agreement to initiate the
This procedure, the Agency details which are the facts that give rise to the
fraction of article 15 RGPD and that, in summary, are: 1) The claimant dated
06/24/19 sends a registered letter requesting access to the information that is
Open your personal data. 2) On 09/17/19, this Agency notifies the entity
claimed the complaint filed by the claimant through a transfer file
do of claim and request of information. 3) My client provides one of the
Versions maintained on 05/17/2019 with the claimant that shows that she is
clarifying the doubts of the complainant, that is, before sending the certified letter
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 27/47
every. 4) Likewise, my client sends an information letter on June 12, 2019
as shown on page 4 and 16 of the administrative file. In said letter
Identify the origin of the debt and its breakdown. 5) In this sense, my re-
presented provides a burofax sent on 10/17/2019 and a certified email with all the
information and documentation that is in the possession of my client.
This Agency considers, evaluating the evidence, that: “Well, in the present case, the
claimed entity did not proceed to provide the claimant with the requested information until
3 and a half months after requesting it with the aggravating circumstance that it was made,
even a month later, knowing that the claimant had put the facts in
knowledge of this Agency. "That is why it is considered that the performance
of the entity in this process is in accordance with the typified element established in the
Article 72.1.k of the LOPDGDD has therefore avoided the challenge to the exercise of rights
of the claimant and therefore has prevented the claimant from knowing, by
In writing, all the information that the entity has about your personal data, answer
only after learning that the facts had been made known.
to of this AEPD. "It should be noted that the point:" 3) My client provides one of the
conversations held on 05/17/2019 with the claimant who… “, is in-
complete in the brief of allegations so it is impossible to take it into consideration
for a correct answer ”. And it is true, my client replies late to the claim.
tion of the complainant on understanding BY ERROR that it was already being clarified
through telephone conversations but it cannot be judged that this error
It implies per se a behavior of IMPEDIMENT or OBSTACULATION, since it must clarify
It should be noted that no request from the Agency has been mediated, nor has the complainant
completed his application, my client simply perceives his error in the application
information that this Agency sends you as it is the first news you receive
after the request of the complainant and by which he realizes the mistake made.
From the wording of article 72.1k) of the LOPDGDD, it is inferred that the offense is the
impediment or obstruction - what my client has not been able to carry out because
in fact, he has answered the claimant and has proceeded to reply as soon as he has per-
cibido its error- or by the repeated lack of attention to the exercise of the right -not mediating
this case neither reiteration by the complainant nor requirement by the Agency-.
The “reiteration” is defined in the dictionary of the Royal Academy of the Language as: “1.
F. Action and effect of reiterates., ”For its part, reiterate, according to the dictionary, is defined
like: “1. tr. Say or do something again. U. t. c. prnl. " "Impediment" is defined in the
dictionary of the Royal Academy of the Language as: “1. tr. Obstacle, pregnancy or is-
torbo for something. " For its part, "Obstacle" is defined as the action and effect of
block. Which, in turn, is defined as “1. Prevent or hinder the achievement of
a purpose."
The fact is that my client realizes the error in the absence of a reply
when it receives the request for information from the Agency, therefore it proceeds to compile the
documentation of the debt and answers both the Agency and the complainant,
viewing all the documentation in order to correct your error and without the need for me-
requirement or reproach and this cannot be qualified as aggravating, since the
The Agency's request is the first time that my client has known
error made, an error that he acknowledges in his own answer to the complaint.
ciently and apologizes for it, it does not seem that this way of proceeding involves
that neither impediment nor hindrance.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 28/47
My client understands that the aggravating factor would be in any case if they persisted in not
to mitigate the documentation or if you receive a new request from the complainant or a
request of the Agency, but it was not like that, it did not mean any request or repro-
che, my client proceeds to answer the complainant on the first occasion in the
that you are aware of your error and as soon as you compile the debt documentation,
apologizing for the mistake made.
This part understands that there is no proof whatsoever that it has been impeded or
prevented the exercise of the complainant's rights and thus considers that the qualification
of very serious of the Agency bankruptcy the principles of typicity and legality. The beginning
of typicity is a guarantee of the legal security to which the citizen is entitled,
to know at all times and with certainty, the behaviors that constitute an in-
administrative fraction, and at the same time, the sanction that they carry. Attending to the principle
principle of general legality of the Law, expressly recognized by the Constitution
(arts. 9.1 and 103.1), which supposes the full submission of the Administration to the law and the
Law, the subjection of the Administration to the regulatory block, the present procedure
sanctioning action lacks any normative justification.
SEVENTH.- Of the classification of the offense and its prescription.
The facts previously related, the only thing they show is that my client in
in the event that he had committed any infraction (as there is a procedure of tu-
rights fabric that the Agency may have initiated in the present case), would be the
established in article 74.c) Infractions considered minor of the LOPDGDD, which indicates
ca that: “c) Failure to respond to requests to exercise the rights established in the
Articles 15 to 22 of Regulation (EU) 2016/679, unless the provisions
provided in article 72.1.k) of this organic law. " Although, taking into account that,
the prescriptions of the mild sanctions are within a period of 1 year and that my client
answered on 10/17/2019, the present infraction that, we insist, my client has not
entered, would have prescribed on 10/17/2020 or with the extension of the state of alarm, the
01/07/2021. In any case, the appropriate procedure for the lack of answer of
an exercise of right in accordance with article 63 LOPDGDD is a procedure
Protection of Rights, at least to give my client the possibility to sub-
nar any errors. As we indicated in the previous brief of allegations, the sanctions
Administrative acts are restrictive administrative acts of rights, since they are limited
of individual freedom (as stated in STC 42/87, of April 9), for that reason it is
It is essential that the Administration prove if the conduct of my client deserves
more reproach than that typified in the standard in attention to safety principles
legal and freedom (art. 25.1 CE).
EIGHTH.- Subsidiary petition.
Reduction of penalty amounts. Application of the principle of proportionality.
Attention to the circumstances of the case and to the new evidence presented. Subsidy-
and despite the fact that this party does not agree with the infractions and penalties
tions indicated by the Agency, requests the reduction to the minimum degree of the sanctions and
corrective measures established in article 76.2 of the LOPDGDD, in accordance with
the provisions of article 83.2 k) RGPD. For its part and based on the principle of equality
Before the law, we request the application of article 58.2.a) RGPD by the Agency
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 29/47
consisting of the warning to my client, as it has done so in proce-
These are previous ones that we have detailed in this writing: “2. Each con-
troll will have all of the following corrective powers listed below:
a) sanction any controller or processor with a warning
when the planned processing operations may violate the provisions of the
present Regulations. ”For all the above, I PLEASE THE INSTRUCTOR to have-
having submitted this brief of allegations admits it and taking into account what is in it
exposed, after the corresponding procedures, raise the Director of the Spanish Agency
Data Protection Policy Resolution declaring non-liability
entity of my client in relation to the facts that are imputed to him or, alternatively,
the application of article 58.2.a) RGPD. FIRST OTHER I SAY that being
of interest of this party the clarification of the facts of the present proceeding,
requests the extension of the trial period based on the new evidence provided by
this part and thus in accordance with what is specified in article 77 of the LPACAP, without
detriment to subsequent expansion and provision of as many documents as deemed necessary
interest, the following are requested: PUBLIC AND PRIVATE DOCUMENTARY. Consistent
in which documents of such a working nature are considered reproduced and authentic
tes on file.
TESTIFICAL: Written responses by legal entities: A) CaixaBank, for
to rule on the following issues: To confirm the charges of the
purchases and withdrawals made with the Unión Fenosa credit card such and
as they appear on pages 48 and 49 of the administrative file on behalf of the
advertiser from September 9, 2002 to December 1, 2006. B) Uni-
box, to rule on the following questions: To confirm that it was the
whistleblower who ordered the transfer from his checking account to the account
of my client on June 27, 2011, as accredited in document No. 2 ad-
together with this writing. Therefore, I REQUEST THE INSTRUCTOR to pick up
do and accepted the interest and request of this party in the clarification of the facts,
the evidence presented is accepted and carried out if so judged by the Agency in a
new probationary period ordering what is necessary for its realization ”.
THIRTEENTH: Of the actions carried out in this procedure, of
the information and documentation presented by the parties have been accredited
the following facts:
PROVEN FACTS
1º.- In the present case, of the process followed up to now, two
alleged breaches of the RGPD:
- On the one hand, the claimed entity is demanding the payment of a debt for the
use of a credit card, which the claimant denies having contracted,
Therefore, the entity could be carrying out an illicit treatment of the data
Claimant's personal information.
- On the other hand, the claimant denounces that, having contacted
the entity that is now demanding the payment of the debt, (PRA IBERICA),
requesting to exercise their right of access to the information they have about it,
has not received any kind of official reply in this regard, and they continue to demand
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 30/47
the payment of the debt that it denies to be its own, so that the entity could have
committed an infringement of the RGPD by not allowing access to the claimant.
2º.- At the request of this Agency, the entity SANTANDER CONSUMER FINANCE,
S.A. stated that, on 10/04/2000, the claimant contracted, via telephone, a credit card
credit marketed jointly with the entity GAS NATURAL FENOSA, providing
the contract form, where the personal data of the claimant and her
address, as well as the direct debit data, in an account belonging to
the IBERCAJA entity, but no other documentation is provided, as per
For example, the contract signed by the claimant, a copy of the DNI, or the recording itself
telephone, which could corroborate that the contracting of the credit card was
actually carried out by the claimant and not by a third party already
that not even the hiring sheet is signed by or authenticated by any
responsable.
This entity alleges in this regard that: “(…) given the age of the file, the
The remaining documentation related to the claimant could not be located (…) ”,
but it does provide several documents that in comparison with each other are
contradictory:
- Printing of credit card charges made since 09/09/2002
(card activation date), until 12/13/2004. There are no charges
after that date.
- The bank certifies that the return of the receipts of
the credit card passed to the collection, from the months of February to December of
year 2006 (one years later), for a total nominal amount of XXX euros, but
does not certify or send an impression of the charges made on the card in this
period, justifying only that: “that, in the contractual relationship of the
credit card there were several defaults on debts which originated
various recovery processes from the claimant ”. Not existing, therefore,
proof that they made charges on the credit card, nor in 2005
nor in 2006. It is also not certified when the credit card was discharged.
credit.
- The subsequent sale of said non-payment is certified, on 04/30/08, to the company
AKITV KAPITAL INVESTMENT PORTFOLIO A.G.
3º.- In the debt assignment contract between SANTANDER CONSUMER FINANCE and
AKTIV CAPITAL, released to the public on 04/30/08, includes, among other stipulations, the
following clause, to take into account:
“[…] V. That the volume of the Loan Portfolio, the heterogeneity of the
Credits that compose it and, in many cases, its seniority and / or its
origin of any of the credit institutions merged with the
Assignors make sure that they cannot guarantee that the Credit Data
are always complete or correct. In particular, the Assignors do not rule out
that some of the Credits that appear in the Loan Portfolio are not in
reality existing credits or legally enforceable by the Sellers or not
are transmissible, so all of them should be considered to all
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 31/47
effects such as doubtful credits. For the same reasons, the documentation
Physics related to the Credits that the Sellers have does not
It is necessarily complete or exhaustive, and there may be no documentation
physics regarding some of the Credits. The Assignee knows and accepts these
characteristics of the Credits, the Credit Data and the
physical documentation related to the Credits.
1.2. Exclusion of liability of the Sellers: (…) Additionally, after
the meetings between the Parties and the due diligence process carried out by the
Assignee, he knows and accepts that the Assignors do not guarantee that the
Data of the Credits are complete and exact, and that some of the Credits
may not exist for any reason (including your prior payment), not be
legally enforceable by the Sellers or have their transferability restricted
(…) ”.
4.- On 01/12/15, the global assignment of assets and liabilities was formalized from the company
AKTIV KAPITAL PORTFOLIO AS, OSLO, BRANCH IN ZUG ", broadcasting on
block all the portfolios acquired in Spain by universal succession of the first
entity in favor of "PRA IBERIA, S.L UNIPERSONAL".
5.- The claimant received a letter dated 06/12/19, sent by PRA IBERIA,
S.L. where they inform her of the “debt that she had with them as a result of the
acquisition of a debtor portfolio from SANTANDER CONSUMER
FINANCE through AKTIV KAPITAL PORTFOLIO AS. The letter states that the
date of the first non-payment and that they claim it, was 02/01/06.
6.- Given this information, on 06/24/19 the claimant sends a registered letter to PRA
IBERIA SL, requesting to exercise their right of access to the documentation that the
entity, in relation to the alleged debt, as it denies that it is its own.
7.- On 08/07/19, the claimant submitted a letter to this Agency where
informs that, “PRA IBERIA, is claiming a debt from a contract that
unknown. That until 2013 third parties have been doing
bank transfers in your name. That you have requested in writing, by phone and
certified mail to PRA IBERIA information about this incident, but as of today,
I have not received an answer by any means, and they continue to claim the debt with
interests."
8º.- In view of the facts presented in the claim and the documents
provided by the claimant, dated 09/17/19, this Agency addressed requirements
informative to the entity PRA IBERICA, SL. and the entity SANTANDER CONSUMER
FINANCE.
9.- On 10/17/19, the claimed entity sent a Burofax to the claimant
informing her, among other aspects, that: - “On September 9, 2002, the
credit card in your name. - That they received two transfers whose origin
It was a Santander Consumer account for payments made but that cannot
indicate the origin of said transfer since they did not occur directly in their
accounts ”.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 32/47
10.- Required from the entity IBERCAJA BANCO, S.A. to identify the owner of the
checking account where the credit card expenses were charged, it certifies
that, said account remained open from 06/29/2000 to 12/21/2001, to
name of the claimant.
11º.- Of all the documentation and information compiled in this file,
the following circumstances stand out:
a) .- The current account opened in IBERCAJA, where the receipts were charged
The credit card was only open from 06/26/2000 to
12/21/2001, on behalf of the claimant.
b) .- On 09/09/2002 (9 months after having canceled the account in
IBERCAJA) the credit card was activated in the bank SANTANDER
CONSUMER, in the name of the claimant including in the domiciliation
bank account opened once in IBERCAJA, which was already closed and
therefore out of use.
c) .- The bank SANTANDER CONSUMER, only justify
credit card charges from 09/09/2002 (activation date of the
card), until 12/13/2004. It does not justify charges after that date,
nor does it justify when he proceeded to cancel the credit card.
d) .- Notwithstanding the foregoing, SANTANDER CONSUMER affirms that the date of the
first default was 02/01/2006 and the date of the last default was 12/10/2006,
but it does not justify the charges made in this period of time. These
defaults are produced 5 years after having canceled the account
current in IBERCAJA.
e) .- the claimed entity (PRA IBÉRICA) affirms that it received two transfers
of SANTANDER CONSUMES, which indicated that it had received them on behalf of the
claimant, (dated 06/16/2008 for € XXX and dated 06/28/2011 for XXX
€.) But cannot justify the initial origin of them since they were produced
from the entity SANTANDER CONSUMER. For its part, the entity
SANTANDER CONSUMER states that: “given the age of the file, the
remaining documentation related to the claimant could not be located,
since the claims derived from it are found, at the
date, prescribed ”, therefore, it cannot be guaranteed that the transfers
made to pay the charges on the credit card were made
truly for the claimant as it denies.
12º Of the documentation provided in the period of allegations to the proposal of
resolution follows:
a) .- In the period of allegations to the resolution proposal, the claimed entity,
(PRA IBERICA) presents a certificate issued by the entity SANTANDER CONSUMER
FINANCE, in which the following is indicated verbatim:
“That, on April 30, 2008 and before the Madrid Notary Public, D. B.B.B.,
under the number of its protocol XXX, the aforementioned credit right was transferred with
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 33/47
the transaction number *** OPERATION.1 in favor of Aktiv Kapital Portfolio In-
vestment, A.G. (later AKTIV KAPITAL PORTFOLIO AS, OSLO, SU-
CURSAL EN ZUG and currently PRA IBERIA, S.L.U.); company that holds the
current right as the legitimate creditor of the assigned debt.
SECOND.- That, according to information contained in our systems, in the
credit operation number *** OPERATION.1, whose personal data cons-
so currently anonymized, they appear as the last direct debit data
bank the following: Bank *** BANK. 1 Agency ...: XXXX MOSTOLES -
*** ADDRESS 1: **** XXXX. Said data was provided by the client
by phone to activate your card.
Previously, at the time of hiring, that is, on 10/4/2000, the
checking account provided by the client was the following: *** 7095 corresponding
speaker to the Ibercaja entity.
THIRD.- That there is a payment from the customer for the number of operations
*** OPERATION. 1 dated 05/27/2008 for an amount of € XXX which was
transferred to PRA IBERIA, S.L.U.
And for the record for the appropriate purposes, I issue this certificate in
Madrid on June 11, 2,021 ”.
It also presents a receipt of the transfer received in the entity SANTANDER
whose main data are: Date: 06/28/2011; Originator: A.A.A .; Order Entity
company: CAJA ESPAÑA DE INVERSIONES, C.A; Concept: REF. *** REFERENCE-
CIA.1; Amount: XXX euros; Beneficiary of the transfer: B. Santander
In this transfer receipt, there are several important pieces of information to keep in mind.
ta in this case:
a) .- The references indicated in the "concept" section do not agree:
one part, the credit reference that was transferred from SANTNADER FINANCE
CONSUMER to the entity AKTIV KAPITAL PORTFOLIO is identified with the
code "XXXXXXXX", while the reference indicated in the concept of the
transfer made by the claimant to Banco de Santander is, “XXXXXXXX”,
both references differing in the digit "Q" and "K".
b) .- Nor in the certificate presented by the claimed entity, of the entity
SANTANDER FINACE CONSUMER, nor in the receipt of the transfer made
by the claimant to the Banco Santander entity, nothing is indicated to corroborate
that the claimant is the debtor of the defaults made on the credit card
credit in 2006.
c) .- As indicated in the transfer receipt, the claimant made it to fa-
vor of the entity B. Santander and not to the entity SANTANDER CONSUMER FI-
NANCE (entity that issued the credit card) or the entity AKTIV KAPI-
SUCH PORTFOLIO.
FOUNDATIONS OF LAW
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 34/47
I- Competition.
The Director of the Spanish Agency is competent to resolve this procedure
of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR in
the art. 47 of LOPDGDD.
II- Answer to the allegations to the Proposal for Resolution.
The joint assessment of the documentary evidence in the procedure brings to
knowledge of the AEPD, a vision of the denounced action that has been
strapped in the facts declared proven above related. However, on the
allegations presented by the claimed entity must indicate:
A.- Second point: “On the legality of the treatment. New facts. From account
current in which payments were charged and proof of payment made
by the complainant ”:
In order to give a full answer to this allegation, it should be remembered that, throughout
of the procedure it has been found that:
1º.- The entity SANTANDER CONSUMER FINANCE, S.A. stated that, on 10/04/2000,
the claimant contracted, via telephone, a credit card commercialized jointly
with the entity GAS NATURAL FENOSA, providing, at the request of this Agency,
the contracting form of said card, where the personal data of the
claimant and his address, as well as the direct debit data, in an account
current belonging to the IBERCAJA entity, but without the signature of the claimant who
give value to the document. Nor is any other documentation provided, such as, for
For example, a copy of the DNI, or the telephone recording of said contract, which could
corroborate that the credit card was actually contracted by
the claimant.
2º.- As justification of the above, the entity SANTANDER CONSUMER FINANCE
alleged to this Agency that: “(…) given the age of the file, the remaining
documentation related to the claimant could not be located (…) ”, although if
provides a list of the charges made on the credit card, in the period
between 09/09/2002 (card activation date), until
12/13/2004.
3º.- The entity SANTANDER CONSUMER FINANCE affirms afterwards that,
the return of the receipts of the credit card passed to the collection, of the months of
February to December 2006, for a total nominal amount of XXX euros, but not
certify or send a printout of the list of charges made on the card in said
period, that is, from 02/01/2006 to 12/31/2006.
The SANTANDER CONSUMER FINANCE entity did not provide any evidence that
Charges will be made on the credit card (list with the date of charge, the amount and
commercial establishment), from the year 2006, where he affirms that the
unpaid, as evidenced that charges were made during the years 2002 to
2004.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 35/47
4.- SANTANDER CONSUMER FINANCE sold the card debt, 452.59
euros, on 04/30/08, to the company AKITV KAPITAL INVESTMENT PORTFOLIO A.G.,
currently PRA IBËRICA SLU.
5.- In the period of allegations to the resolution proposal, the claimed entity,
(PRA IBERICA), presents a certificate issued by the entity SANTANDER
CONSUMER FINANCE, the text of which is indicated above.
From this last documentation provided by the claimed entity, data is verified
to take into account for the resolution of the procedure:
a) .- The certificate issued by the entity SANTANDER FINANCE CONSUMER,
textually indicates: “(…) credit operation number *** OPERATION.1,
whose personal data are currently anonymized (…) ”, without identifying,
therefore, with name, surname and ID, in favor of who was granted the
indicated credit operation.
b) .- The references indicated in the "concept" section do not agree:
one part, the credit reference that was transferred from SANTNADER FINANCE
CONSUMER to the entity AKTIV KAPITAL PORTFOLIO is identified with the
code "XXXXXXXX", while the reference indicated in the concept of the
transfer made by the claimant to Banco de Santander, not to Santan-
der Finance Consumer, is, "XXXXXXX", differentiating both references in
the digit "Q" and "K".
c) .- Nor in the certificate signed by the entity SANTANDER FINACE CONSU-
MER, nor in the receipt of the transfer made by the claimant to the entity
Banco Santander, there is no reference to the claimant being the
debtor of the defaults made on the credit card in 2006.
d) .- As indicated in the transfer receipt, the claimant made it to fa-
vor of the entity B. Santander and not to the entity SANTANDER CONSUMER FI-
NANCE (entity that issued the credit card) or the entity AKTIV KAPI-
SUCH PORTFOLIO.
Therefore, it is not possible, based on the documentation provided by the claimed entity
da, identify the claimant with the ownership of the credit card during the year
2006.
B) .- Point Three: "On the legality of the treatment and the diligent action of
my principal. Compliance with the criteria established by the AEPD.
In this section, the following points should be clarified:
- If it is true that there is a “Notarial Certificate that accredits the assignment of the credit
signed with the assignor (Santander Consumer) ”.
- It is not true that “a representative of Santander Consumer certifies that the operation
telephone ration was contracted correctly, thus signing the approval of
the granting of the card ”since the certificate issued contains verbatim:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 36/47
“(…) Said data was provided by the client via telephone for the
activation of your card (…) ”.
- Only the use of the card is credited from the year 2002 to the
12/13/2004, and not until 02/08/2006 as claimed by the claimed entity, therefore
that it is not possible to affirm that there was use of the card during 2006,
as such and as defended by the claimed entity.
- The entity does not certify any charge on the card for the years 2005 and 2006, only
mind certifies receipts pending payment (numbers 41 to 51) for an amount
Total nominal amount of XXX euros from February to December 2006.
Furthermore, if this were true, that the last certified payment of the card was the
02/08/2006, as stated by the claimed entity, it is not logical to claim
then receipts returned from that date until 12/01/2006.
- The Santander Consumer entity affirms that there are receipts pending
payment, that is, receipts numbers 41 to 51 for a total nominal amount of
452.59 euros, the first of them being from 02/01/2006 and the last of them being
12/01/2006, but does not provide a list of the charges made on the card (fe-
cha, amount and commercial establishment) as it does in the charges made
used during the years 2002 to 2004.
Regarding the fact that the claimant now indicates that, “(…) Therefore, it understands this
part that the documentation presented certifies that my client has complied with
closely with the data protection regulations (…) ”, one must disagree with this
This assertion, bearing in mind that, the claimed entity is responsible for the burden of
prove that the consent of the owner of the data being processed has been obtained-
ment or that, at least, it has adopted the necessary measures required in the
diligent compliance, both in the collection of personal data and in the
subsequent treatment of the same, (considering (42) of the RGPD), the facts here
brought confirm a serious lack of due diligence of the entity claimed in the
compliance with their obligations regarding data protection, since a compliance
diligent action in the management of the processing of personal data would be to demonstrate
that the principles relating to the treatment of the data collected in the article are complied with.
Article 5 of the GDPR. A circumstance that in this case has not occurred.
Well, in the case at hand, not enough evidence has been provided that
confirm that the claimant was the one who actually signed the credit card contract.
to, nor by the entity SANTANDER CONSUMER FINANCE, which alleged in its day that:
"Given the age of the file, the remaining documentation related to the claimant
could not be located, since the claims derived from it are
find, to date, prescribed ”, nor by the entity PRA IBERIA, which alleges that the
The only data it has on the claimant are those provided by the entity SANTA-
NER CONSUMER FINANCE.
On the other hand, there is a clear lack of due diligence demonstrated by the entity re-
claimed, in the breach of the principle of accuracy (article 5.1d.), since there is no
have taken reasonable measures to have them suppressed or rectified without delay
personal data that is inaccurate with respect to the purposes for which it is processed
so, and this is so, because when the entity received the claimant's letter on 06/26/19,
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 37/47
requesting access to information and questioning the veracity of the debt, the
entity, far from showing due diligence, ignored said request, continued
demanding payment of the debt and it was not until he received a request from this
Agency, on 09/17/19, when, through burofax, it sent the claimant the information
that she had been requesting it for 3 months and 20 days.
The claimed entity defends itself stating that: “(…) they have been in
contact with the claimant to resolve her doubts (…) ”. However, it does not provide
proof concludes having agreed to what was requested by the claimant before receiving the
requirement of this Agency.
C) .- Point four: On the prescription of the offense
These allegations cannot be taken into consideration because, as has been stated,
To previously, it has not been verified that the transfer made by the claim
maintain the entity BANCO SANTNADER on 06/28/2011, out for the payment of the debt
gives the credit card in question, since, first, the card is contracted
in a different entity, that is, in the entity SANTANDER CONSUMER FINANCE
and not in BANCO SANTANDER, together with the fact that the references indicated in the two
documents do not match. On the one hand, the credit reference that was transferred from
SANTNADER FINANCE CONSUMER a AKTIV KAPITAL PORTFOLIO the code is listed
"XXXXXXXX", while the reference indicated in the concept of the transfer that
The claimant made the BANCO SANTANDER figure: "XXXXXXXX", differentiating
both references in the digit "Q" and "K"
On the other hand, according to the information and documentation in the file,
the first notice that the claimant has of the doubt they claim is on 06/12/19,
when you received a letter sent by PRA IBERIA, S.L. where they inform her of the
alleged debt that it owed to them as a result of the acquisition of a
debtor portfolio from SANTANDER CONSUMER FINANCE through
AKTIV KAPITAL PORTFOLIO AS, filing a claim with this Agency on
08/07/19, so, in this case, the prescription of the offense as alleged
the claimed entity.
D) .- Fifth point, "On the presumption of innocence of the claimed entity",
Specify at this point that, the extensive jurisprudence of the Supreme Court, inasmuch as
to this fundamental principle, to once again influence the claimed entity that said principle
imposes on the administration an action that, in the first place, could be summed up as
not to proceed with generic complaints and avoid investigations that, due to being suspended,
tempted in claims lacking a minimum indicative support, could lead to
I get unnecessary performances.
Therefore, the effectiveness of this principle is displayed when, there is an absolute lack of
evidence or when those obtained are not chargeable or do not meet the due guarantees.
That is, in case of doubt, due to insufficient evidence, the accused will be favored,
(STC. 44/89, of February 20).
STS 1218/2004 of November 2 makes the following distinction between Presumption of
Innocence and the “in dubio pro reo” (First Law Foundation):
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 38/47
(…) 1º A first of an objective nature that could be classified as a verification of the existence of
whether or not of true tests, a phase in which in turn it would be necessary to differentiate two
different operations: a) specify whether in carrying out the evidentiary proceedings,
have adopted and observed the basic procedural guarantees and b) specify whether, in addition,
Such evidentiary proceedings objectively suppose or provide incriminating elements.
rivers or cargo.
2º A second phase of a predominantly subjective character, for which it would be necessary to
Servar “strictu sensu”, the usual name for “evaluation of the result or content
integral part of the evidence ”, weighing conscientiously the various evidentiary elements,
on the basis of which the conscience of the Court is freely formed.
In the first phase the presumption of innocence would operate and in the second the principle "in
dubio pro reo ”. Thus the presumption of innocence unfolds within the framework of the charge
evidence and supposes (STC. 31.5.85) that it is not the accused who is responsible for
show that he is innocent in the face of the accusation against him, but rather that he is
who maintains it, who is responsible for proving the imputation through the corresponding
such evidence, (...) that can objectively be regarded as prosecution evidence: (...)
For its part, the "in dubio pro reo" principle, presupposing the prior existence of the
presumption of innocence, develops in the field of the strict evaluation of the
evidence, from the assessment of the demonstrative effectiveness by the Court of first instance to
who is responsible for their assessment to form their conviction about the truth of the facts
(art. 741 LECr.). In this same sense, we find the SsTS 277/2013 of February 13
brero, 936/2006 of October 10 and 346/2009 of April 2 ”.
This does not occur in the present case, since from the proven facts, indicated above-
mind, the existence of conclusive evidence proving the existence of
of infringements of the RGPD by the claimed party and, on the other hand, of the documentation
information provided by the parties involved in the process gather sufficient information
that allows an evidentiary appreciation of the infringement.
E) .- Sixth point, "On the bankruptcy of the principle of typicality".
At this point, the claimed entity acknowledges that “(…) my principal responds late to
the claim of the complainant when understanding BY ERROR that it was already being
clarifying through telephone conversations (…) ”, but alleges that“ (…) but
This error cannot be judged to imply IMPEDIMENT behavior per se or,
OBSTACULIZATION as it should be clarified that no requirement has been mediated
of the Agency nor the complainant has reiterated her request, simply my client
you perceive your error in the information request letter sent by this Agency
as it is the first notice received after the request of the complainant and by the
who realizes the mistake made (…) ”.
Well, the facts that occurred in the present case must be restated:
1º.- On 06/24/19 the claimant sent a certified letter to the claimed entity where
requested to exercise the right of access recognized in article 15 of the RGPD. In
Said request indicated the following: “Please give me a written reply as
as soon as possible at the following postal address:… "
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 39/47
2º.- On 08/07/19, the claimant presents a document in this Agency indicating in the
same, among others, that “(…) I have requested in writing, by phone and by mail
certified to PRA IBERIA information about this incident, but as of today, I have not
received an answer by no means, and they continue to claim the debt with
interests."
3º.- On 09/17/19, informs the claimed entity of the complaint
filed by the claimant in this Agency and requires it to report on
a series of aspects related to the claim.
4th.- On 10/17/19 the claimed entity sends a burofax to the claimant with the matter
“Answer claim”, where they indicate, among others that: “Very Mrs. Our:
We have received the claim with the reference indicated above from the Agency
Spanish Data Protection and, in response to it, we will detail
the information you request from us. We previously apologize for not answering
formally, because we erroneously understood that both your claim and the
requested information was clarified in our telephone conversations (…) ”.
5º.- The allegations that the claimed entity uses to justify the delay in the
The answer to the request for access made by the claimant is that: “From the
05/17/2019 we are in contact with the claimant to resolve her doubts about the
card and the payments made from it, this being the main reason for your
claim. Specifically, we bet as document number SEVEN one of the
conversations held with the claimant that, when referred to her manager, did not
the recording continued, although it does prove that we are informing and clarifying
by phone with the claimant what she requests, therefore, we understood
mistakenly that we were answering all your questions personally and it was not
necessary to answer formally (…) "
As established in article 12 of the RGPD, the person responsible for the treatment is obliged
to provide the interested party with all the information requested in accordance with, in this case, the ar-
Article 15 of the RGPD. The information will be provided in writing or by other means, including
sive, if applicable, by electronic means and only, when requested by the interested party,
the information may be provided verbally and provided identity is proven
of the interested party by other means.
In the case that does not occupy, in the letter sent by the claimant, it was specified literal-
mind: “I beg you to reply in writing as soon as possible in the following
postal address:… ”. Situation that did not occur until the claimed entity
received notification from this Agency that the claimant had put in
knowledge of this Agency the facts.
Article 12.3 continues to indicate that: “The person responsible for the treatment will provide the interested party with
This information regarding their actions within a maximum period of one month from
the receipt of the request ”.
Therefore, in the present case, the claimed entity did not proceed to facilitate the claim
keep the requested information up to 3 and a half months after requesting it
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 40/47
with the aggravating circumstance that it was made, even a month later, to learn that the claim
Mante had brought the facts to the attention of this Agency.
For all these reasons, it is considered that the entity's performance in this process is
in accordance with the typified element established in article 72.1.k of the LOPDGDD
Therefore, it has avoided the challenge to the exercise of the right of the claimant and therefore has
hindered the claimant from knowing, in writing, all the information that the
dad had about your personal data, answered only after knowing that
the facts had been made known to this AEPD.
It should be noted that the claimed entity still does not complete the point where it claims
that: “3) My client provides one of the conversations held on 05/17/2019 with
the claimant that… “, so it is still impossible to take it into consideration
as claimed by the claimed entity.
F) .- Point seven: "On the classification of the offense and its prescription".
According to article 74 of the LOPDGDD, a minor infraction is considered to prescribe a year:
"The remaining infringements of a merely formal nature of the aforementioned articles
in paragraphs 4 and 5 of article 83 of Regulation (EU) 2016/679 and, in particular,
the following: (…) c) Failure to respond to requests for the exercise of established rights.
two in articles 15 to 22 of Regulation (EU) 2016/679, unless it results from
application of the provisions of article 72.1.k) of this organic law.
According to article 72 of the LOPDGDD, it is considered very serious and prescribed infractions.
The infractions that imply a substantial violation of the
articles mentioned therein and, in particular, the following: (…) k) The impediment
or the obstruction or the repeated neglect of the exercise of the rights established
two in articles 15 to 22 of Regulation (EU) 2016/679.
Therefore, and based on what has already been stated in the previous section, the performance of the
The claimed quality must be considered included in the typified element established in the
article 72.1.k of the LOPDGDD by preventing access to the claimant's information,
until he learned that there was a claim filed in this Agency.
cia, thereby demonstrating a total lack of diligence owed to the entity.
Therefore, it is not possible to take into consideration the argument of the entity in the
which defends that the offense committed is prescribed based on the application of article
Assignment 74 of the LOPDGDD, since the application of this article does not fit, but rather the application
of article 72.1.k) how this has been demonstrated.
G) Eighth point: “On the reduction of the penalty amounts. Application of the
principle of proportionality. Attention to the circumstances of the case and the new
you go evidence presented. Subsidiary
a) .- On: “the possibility that the affected person's conduct could have induced the
commission of the offense, as there is no police report, nor has the claimant been
put in contact to be able to know your doubts or to be able to request more information ",
cannot be taken into consideration since it is established that the claimant did attempt
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 41/47
contact the entity to have access to the existing information in the
entity, without this request being attended to.
b) .- On: “the existence of a merger process by absorption after the commission
of the infringement, which cannot be attributed to the absorbing entity. And so it has happened
with the assignment of credits from Aktiv Kapital to PRA Iberia ”, it cannot be taken into account
ration this claim, since the claim is not filed before the merger
against AKTIV KAPITAL, but against the action carried out by PRA IBERICA.
c) .- On: “the fact of having, when not obligatory, a delegate of
data protection ”, cannot be taken into consideration since the infractions committed
These days have nothing to do with the existence or not of a DPD in the entity, even
could be considered as aggravating to the extent that the
lack of due diligence of the entity in terms of data protection and one of the
essential functions of DPOs in companies is precisely to avoid this lack of
diligence.
d) .- On: “the application of article 58.2.a) RGPD by the Agency consistent
in the warning, based on the principle of proportionality of the sanctions ”, no
can be taken into consideration, since the infractions committed by the entity together
with the aggravating factors applied, of the same relevance as other sanctions imposed
charges by this Agency to other offenders, thereby breaking the precedent administra-
trative.
Regarding the new evidence presented, to emphasize here again, what was stated above
tea
It has been found, throughout the entire procedure that:
the entity SANTANDER CONSUMER FINANCE, S.A. stated that, on 10/04/2000, the
claimant contracted, via telephone, a credit card commercialized jointly
with the entity GAS NATURAL FENOSA, providing, at the request of this Agency,
the contracting form of said card, where the personal data of the
claimant and his address, as well as the direct debit data, in an account
belonging to the IBERCAJA entity, but without the signature of the claimant. Either
provides any documentation, such as, for example, a copy of the DNI, or the recording
telephone number of the contracting, which could corroborate that the contracting of the card
credit was actually made by the claimant.
As justification for the foregoing, the entity SANTANDER CONSUMER FINANCE
alleged to this Agency that: “(…) given the age of the file, the remaining
documentation related to the claimant could not be located (…) ”, although if
provides a list of the charges made on the credit card in the period
between 09/09/2002 (card activation date), and 12/13/2004.
SANTANDER CONSUMER FINANCE affirms that the return of the
credit card receipts passed to collection, from the months of February to December
of the year 2006, for a total nominal amount of XXX euros, but does not certify or send
printing of the list of charges made on the card in said period, that is,
from 02/01/2006 to 12/31/2006.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 42/47
The SANTANDER CONSUMER FINANCE entity does not provide evidence that
will make charges on the credit card (list with the date of charge, the amount and the
commercial establishment), from the year 2006 that he claims were unpaid, as he did
with the years 2002 to 2004. It is also not certified when the credit card was discharged.
credit.
In this transfer receipt, there are several important pieces of information to keep in mind.
ta in this case:
a) .- The references indicated in the "concept" section do not agree: for one
part, the credit reference that was transferred from SANTNADER FINANCE CONSU-
MER to the entity AKTIV KAPITAL PORTFOLIO is identified with the code “XXXX-
XXXX ”, while the reference indicated in the concept of the transfer that carried out the
claimant to Banco de Santander is, "XXXXXXXX", differentiating both references
in the digit “Q” and “K”.
b) .- Nor in the certificate presented by the claimed entity, of the entity SANTAN-
DER FINACE CONSUMER, nor in the receipt of the transfer made by the claimant
to the Banco Santander entity, nothing is indicated to corroborate that the claimant is the
debtor of the defaults made on the credit card in 2006.
c) .- As indicated in the transfer receipt, the claimant did so in favor of
the entity B. Santander and not the entity SANTANDER CONSUMER FINANCE (entity
entity that issued the credit card) or the entity AKTIV KAPITAL PORTFOLIO.
H) .- Regarding the requested testimony,
It is considered that the documentation provided by the parties, including the fi-
is sufficient to be able to elucidate whether or not there is a violation of the
people in terms of data protection and this has been demonstrated throughout
this proposed resolution, based on the acts carried out by the entity claiming
given, in its lack of due diligence and in the evidence provided by the parties
tes, incriminators of the conduct reproached to the entity. This is so because the
Sentence administrative sanctioning procedure is initiated after having carried out the AEPD
intense inspection work, which has been documented as part of the
tooth and that substitutes enough test for this instruction.
However, the foregoing, the aforementioned so many times, Article 24.2 of the EC, applies to
Also in this case, it recognizes the right of the claimed entity “to use all
two the pertinent means of proof for his defense ”, leaving to his discretion the power
present as many means of evidence as it deems pertinent throughout the procedure.
Therefore, the witness evidence requested by the claimed entity is considered not
is necessary in this case, rejecting the request for the taking of evidence as unnecessary
cesaria, under the provisions of article 77.3 of the LPACAP.
III
In the present case, two violations of the GDPR are being claimed. On the one hand, it
denounced that the claimed entity has been demanding the payment of a debt for the
use of a credit card, which the claimant denies having contracted. For another
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 43/47
On the other hand, it was also reported that, having contacted the entity
claimed to exercise their rights of access to the information they possess about it
because he did not recognize the debt that they were claiming, he did not receive any type of
answer in this regard until you filed a claim with this Agency.
Well, in this sense, the RGPD deals in its article 5 with the principles that
They must govern the processing of personal data and mentions among them that of "lici-
tud, loyalty and transparency ”. The precept provides that: “1. The personal data will be:
a) Treaties in a lawful, loyal and transparent manner with the interested party; "
For its part, article 6 of the RGPD, details in its section 1 the cases in which
the processing of third party data is considered lawful: “1. The treatment will only be
I quote if he meets at least one of the following conditions: a) the interested party gave his consent
sentiment for the processing of your personal data for one or more specific purposes
citics; b) the treatment is necessary for the performance of a contract in which the
the party is part of or for the application at his request of pre-contractual measures;
(…) "
Bearing in mind that, the claimed entity has the burden of proving that it has
the unequivocal consent of the owner of the data being processed or
that, at least, has adopted the measures required by diligent compliance with the
obligation imposed by the RGPD, both in the collection of personal data
as in the subsequent treatment of them, there is a serious lack of diligence
company of the claimed entity in compliance with the obligations imposed by the
personal data protection regulations. A diligent compliance with the
principle of legality in the processing of third party data would require that the person responsible
treatment is in a position to prove it, (principle of proactive responsibility
va), a situation that, up to now, has not occurred, since the evidence presented
days, both by the entity SANTANDER CONSUMER FINANCE, and by PRA IBE-
RIA, are not conclusive that the claimant hired the credit card and that
therefore, it allows the processing of your personal data.
According to the evidence available at this time, the
Those exposed represent a violation of article 6.1 of the RGPD, having tried
the personal data of the claimant without standing.
For its part, article 72.1.b) of the LOPDGDD, considers very serious, for the purposes of
prescription, "The processing of personal data without the concurrence of any of the
tions of legality of the treatment established in article 6 of the RGPD ”.
This offense may be punished with a fine of a maximum of € 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for the
of a higher amount, in accordance with article 83.5.b) of the RGPD.
In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In this case, it is considered that the sanction to be imposed should be adjusted according to
with the following aggravating criteria established in article 83.2 of the RGPD:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 44/47
- The duration of the offense, taking into account the scope or purpose of the
treatment operation in question, as well as the damages caused to the
interested party, (section a).
The facts that are the subject of the claim are attributable to a lack of diligence on the part of the
you of the claimed entity, (section b).
- Basic personal identifiers, personal data, are affected.
(section g).
- The obvious link between the business activity of the claimed entity
and the processing of personal data of clients or third parties, (section k).
For its part, article 76.2 of the LOPDGDD, establishes that, in accordance with the provisions
seen in article 83.2.k) of the RGPD, it will be taken into account, as aggravating factors
of the sanction, the following:
- The continuing nature of the offense, (section a).
- The linking of the activity of the offender with the performance of treatment of
personal data, (section b).
The balance of the circumstances contemplated in article 83.2 of the RGPD, with respect to
Regarding the infringement committed by violating the provisions of article 6.1 of the RGPD,
allows setting a penalty of 30,000 euros, (thirty thousand euros).
IV
Regarding the complaint that the claimant makes when indicating that they were not attended, for
part of the claimed entity their access rights, indicate that, as established in the
Article 12 of the RGPD: 1.- The person responsible for the treatment will take the appropriate measures
nas to provide the interested party with all the information indicated in articles 13 and 14, as well as
as with any communication pursuant to articles 15 to 22 and 34 relating to the treatment of
concise, transparent, intelligible and easily accessible form, with a language
clear and straightforward, particularly any information specifically directed at a child.
The information will be provided in writing or by other means, including, if applicable, by
electronic media. When requested by the interested party, the information may be provided
verbally provided that the identity of the interested party is proven by other means.
2.The person in charge of the treatment will facilitate the interested party the exercise of their rights in
pursuant to articles 15 to 22. In the cases referred to in article 11, paragraph 2,
The person in charge will not refuse to act at the request of the interested party in order to exercise their
rights under Articles 15 to 22, unless you can show that you are not in
conditions of identifying the interested party.
3.The data controller will provide the interested party with information regarding their ac-
proceedings on the basis of an application pursuant to Articles 15 to 22, and, in any-
whichever case, within a period of one month from the receipt of the request. Said term
it may be extended for another two months if necessary, taking into account the complexity
age and number of requests. The person in charge will inform the interested party of any
of said extensions within a period of one month from receipt of the request, indicating
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 45/47
Finding the reasons for the procrastination. When the interested party submits the request by means
electronic means, the information will be provided by electronic means whenever possible, to
Unless the interested party requests that it be provided otherwise.
On the other hand, sections 1 and 3, of article 15 of the RGPD, on the right of ac-
cease of the interested party, establish respectively that: 1.The interested party shall have the right
to obtain from the data controller confirmation of whether or not they are being treated
personal data concerning you and, in such case, right of access to personal data
data and the following information: a) the purposes of the treatment; b) the categories of
personal data in question; c) the recipients or categories of recipients
to whom the personal data was or will be communicated, in particular
recipients in third parties or international organizations; d) if possible, the term
planned storage of personal data or, if this is not possible, the criteria used
lized to determine this term; e) the existence of the right to request the respon-
know the rectification or deletion of personal data or the limitation of the treatment of
personal data relating to the interested party, or to oppose said treatment; f) the right
chooses to file a claim with a supervisory authority; g) when the data
personal data have not been obtained from the interested party, any information available on
its origin; h) the existence of automated decisions, including the preparation of
profiles, referred to in article 22, paragraphs 1 and 4, and, at least in such cases,
meaningful training in applied logic, as well as the importance and consequences of
planned events of said treatment for the interested party. (…),
3.The person responsible for the treatment will provide a copy of the personal data object of
treatment. The person in charge may receive for any other copy requested by the
earned a reasonable fee based on administrative costs. When the interest
have submitted the application by electronic means, and unless it requests that
provided otherwise, the information will be provided in an electronic format for common use.
bad.
In accordance with the evidence available, the facts presented suggest that
nin the violation of article 15 of the RGPD, in application of article 12 of the aforementioned
Regulation, since the entity did not act diligently by making access impossible
to the information requested about your personal data, in a timely manner.
For its part, article 72.1.k) of the LOPDGDD, considers very serious, for the purposes of
prescription, “The impediment or the obstruction or the repeated non-attention of the
exercise of the rights established in articles 15 to 22 of the Regulation ”.
This offense may be punished with a fine of a maximum of € 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for the
of a higher amount, in accordance with article 83.5.b) of the RGPD.
In accordance with the indicated precepts, in order to set the amount of the sanction to
impose in the present case, it is considered that the sanction should be graduated in accordance with
with the following aggravating criteria established in article 83.2 of the RGPD:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 46/47
- The duration of the offense, taking into account the scope or purpose of the
treatment operation in question, as well as the damages caused to the
interested party, (section a).
- The facts that are the subject of the claim are attributable to a lack of diligence
of the part of the claimed entity, (section b).
- Basic personal identifiers, personal data, are affected.
(section g).
- The obvious link between the business activity of the claimed entity
and the processing of personal data of clients or third parties, (section k).
For its part, article 76.2 of the LOPDGDD, establishes that, in accordance with the
provided for in article 83.2.k) of the RGPD, it will be taken into account, as factors
aggravating penalties, the following:
- The continuing nature of the offense, (section a).
- The linking of the activity of the offender with the performance of treatment of
personal data, (section b).
The balance of the circumstances contemplated in article 83.2 of the RGPD, with
Regarding the offense committed by violating the provisions of Article 15 of the
RGPD, allows setting an initial penalty of 30,000 euros, (thirty thousand euros).
V
Therefore, according to the criteria set out, it is considered appropriate to impose on the entity
claimed a total penalty of 60,000 euros (sixty thousand euros), for the infractions
Article 6.1) of the RGPD (30,000 euros) and 15 of the RGPD (30,000 euros).
Therefore, in accordance with the foregoing, by the Director of the Spanish Agency
Data Protection Policy,
RESOLVES:
FIRST: IMPOSE the entity, PRA IBERIA, S.L. with CIF .: B80568769, a san-
30,000 euros (thirty thousand euros), for violation of article 6.1) of the RGPD, res-
pecto of the illicit treatment of the personal data of the claimant and 30,000 euros
(thirty thousand euros) for violation of article 15 of the RGPD, regarding the lack of diligence
gence when facilitating access to information on the personal data of the
claimant.
SECOND: NOTIFY this resolution to the entity PRA IBERIA, S.L. and IN-
TRAIN the claimant on the result of the claim.
THIRD: Warn the sanctioned person that the sanction imposed must be effective
once this resolution is enforceable, in accordance with the provisions of the
Article 98.1.b) of Law 39/2015, of October 1, on the Administrative Procedure Co-
of the Public Administrations (LPACAP), within the voluntary payment period that
points out article 68 of the General Collection Regulations, approved by Royal De-
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 47/47
Creto 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by entering the restricted account No. ES00 0000 0000 0000
0000 0000, opened in the name of the Spanish Data Protection Agency in the
Banco CAIXABANK, S.A. or otherwise, it will be collected in periods
executive do.
Received the notification and once executive, if the date of execution is found
between the 1st and the 15th of each month, both inclusive, the deadline for making the vo-
luntario will be until the 20th day of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediate business month.
In accordance with the provisions of article 82 of Law 62/2003, of December 30-
of fiscal, administrative and social order measures, this Resolution is
will be made public, once it has been notified to the interested parties. The publication is made-
It will be in accordance with the provisions of Instruction 1/2004, of December 22, of the Agency
Spanish Data Protection Agency on the publication of its Resolutions.
Against this resolution, which puts an end to administrative proceedings, and in accordance with
established in articles 112 and 123 of the LPACAP, the interested parties may interpose
ner, optionally, appeal for reconsideration before the Director of the Spanish Agency
of Data Protection within a period of one month from the day following the notification
fication of this resolution, or, directly administrative contentious appeal before the
Contentious-administrative Chamber of the National Court, in accordance with the provisions
set out in article 25 and in section 5 of the fourth additional provision of the Law
29/1998, of 07/13, regulating the Contentious-administrative Jurisdiction, in the
or two months from the day following the notification of this act, according to
the provisions of article 46.1 of the aforementioned legal text.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the interested party
do manifests its intention to file a contentious-administrative appeal. Of being
In this case, the interested party must formally communicate this fact in writing
addressed to the Spanish Agency for Data Protection, presenting it through the Re-
Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/], or to
through any of the other records provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also forward the documentation to the Agency
that certifies the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious-administrative appeal
trative within two months from the day following notification of this
resolution, would terminate the precautionary suspension.
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
