The Spanish data protection authority has archived a sanction procedure against a bank concerning the registration of a client in a payment incident file, considering that the bank had complied with the prior information obligation and that the debt was due at the time of registration, making the processing lawful.

Facts and context

The Spanish data protection authority (AEPD) has today published a decision to archive a sanction procedure against BANCO SANTANDER, S.A., concerning a registration in a credit information system.

The case originates from a complaint filed by a natural person on August 12 and 28, 2023, contesting their registration on February 5, 2023, in the BADEXCUG payment incident file for a debt related to a mortgage loan declared due by the bank on December 21, 2021.

Reasons for the decision

The authority examined the lawfulness of the complainant's data processing, which consisted of their registration in the payment incident file. After initially archiving the complaint and then reopening the procedure following the complainant's appeal, the authority finally concluded there was no infringement.

• Absence of breach of the obligation to have a legal basis for processing (Article 6(1) of the GDPR): The authority considered that the registration of the complainant's data in the BADEXCUG file was lawful. It found that the bank had provided proof of a payment warning sent on January 31, 2020, informing the complainant of the possibility of including their data in credit information systems in case of non-payment. The authority considered that the debt was certain, liquid, and due at the time of registration, February 5, 2023. The complainant's subsequent actions, including a payment offer on February 1, 2023, and a judicial deposit made on April 24, 2023, were not deemed sufficient to challenge the lawfulness of the processing at the time it was carried out.

Authority's decision

Consequently, the authority decided to archive the sanction procedure initiated against BANCO SANTANDER, S.A.

Lessons learned

This decision recalls that:

• Sending a prior warning informing the debtor of the possibility of registration in a credit information system in case of non-payment is an essential condition to establish the lawfulness of such processing.
• The lawfulness of registering a debt in a payment incident file is assessed at the time of registration; subsequent debtor actions, such as a payment offer or judicial deposit, do not necessarily retroactively call into question the validity of the initial processing if the debt was then due.
• The communication of data to a provider acting as a processor for debt collection management does not constitute a transfer of data to a third-party controller but processing on behalf of the original controller.