The Spanish Data Protection Authority (AEPD) has published a closure decision of a procedure initiated against a telecommunications company, due to the impossibility of establishing with certainty its status as data controller for the reported facts.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a closure decision concerning the company DV TELECOM 2023, S.L. for lack of sufficient evidence to attribute breaches related to the collection of personal data during door-to-door canvassing.

The case originated from a complaint filed by a town hall, following a report from the local police regarding individuals collecting personal data without providing information or obtaining consent.

Reasons for the decision

The authority analyzed the facts in light of the information obligation but concluded the impossibility of attributing any violation to the company concerned:

• Impossibility to establish the status of data controller: Although the canvassers verbally claimed to work for DV TELECOM 2023, S.L., no material evidence (such as an employment contract or commercial mandate) could confirm this. Moreover, one of the individuals showed on his phone a database bearing the header of another company, which added to the confusion regarding the identity of the true data controller. In the absence of documentary evidence linking the canvassers to the company, it was impossible to attribute responsibility for the data processing carried out.

Faced with the lack of sufficient evidence and doubt about the identity of the data controller, the authority applied the principle of presumption of innocence and the principle "in dubio pro reo" (the doubt benefits the accused), in accordance with Spanish case law. The impossibility to notify the company, whose letters were returned with the mention "unknown" or "no longer operating at this address," also contributed to the inability to clarify the facts.

Authority's decision

Consequently, the authority pronounced the closure of the procedure against DV TELECOM 2023, S.L., due to lack of sufficient evidence to attribute breaches to it.

Lessons learned

This decision reminds that:

• The burden of proof of the violation lies with the supervisory authority; a mere allegation, even reported by the police, is not sufficient to establish the responsibility of a company in the absence of documentary evidence.
• The formal and proven identification of the data controller is an indispensable prerequisite for any sanctioning procedure; without this proof, no infringement can be attributed.