The Spanish data protection authority closed a sanction procedure initiated against an energy supplier, considering that proof of an attempted notification by postal mail was sufficient to dismiss the breach of the prior information obligation for registration in a payment incident file, pursuant to the principle of presumption of innocence.

Facts and context

The Spanish data protection authority (AEPD) published a decision to close a procedure against the company COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. (CURENERGÍA) concerning the lawfulness of the registration of a customer's data in a credit information system.

The case originated from a complaint filed by an individual on 16 February 2025, who contested the registration of her data in a payment incident file without prior notification and for a debt she considered partly time-barred and therefore inaccurate.

Reasons for the decision

The sanction procedure had been opened for an alleged violation of Article 6(1) of the GDPR. However, the authority's analysis led to its closure for the following reasons:

• Lawfulness obligation of processing (Article 6 of the GDPR): The authority examined whether the registration of the complainant in the credit information file on 18 July 2022 was based on a valid legal basis. The company provided proof that it had sent a payment reminder on 17 June 2022 by postal mail to the complainant's correct address. Although the mail was returned with the note "not collected at the post office," the authority considered that the notification attempt had been properly made. Relying on the principle of presumption of innocence and the principle in dubio pro reo (doubt benefits the accused), which apply in administrative sanction matters, the authority concluded that the burden of proof lay with it. The elements provided by the company created reasonable doubt about the materiality of the infringement, so the authority could not establish a breach with certainty.

Authority's decision

Consequently, the authority ordered the closure of the sanction procedure against COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.

Lessons learned

This decision reminds that:

• In a sanction procedure, the burden of proof lies with the supervisory authority; in case of reasonable doubt about the materiality of the alleged facts, the principle in dubio pro reo must lead to the closure of the case.
• The prior information obligation for registration in a payment incident file can be considered fulfilled as long as the creditor can prove having made an attempt to notify at the debtor's last known address, even if the latter does not receive it due to their own fault.
• Rigorous documentation of communication attempts with the data subjects, notably by means allowing to attest to the sending and attempted delivery, is an essential piece of evidence to defend against an allegation of breach of an information obligation.