The Spanish authority fines an insurer for processing the data of a victim of identity theft, highlighting that insufficient identity verification measures during remote subscription invalidate the legal basis for processing. The implementation of corrective measures during the procedure led to a very substantial reduction of the initially envisaged fine amount.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a sanction decision against MUTUA MADRILEÑA AUTOMOVILISTA SOCIEDAD DE SEGUROS A PRIMA FIJA (including the imposition of a fine of €5,000) for breaches related to the absence of a legal basis for processing the data of a person who was a victim of identity theft.

The case originated from a complaint by a person who discovered that a car insurance policy had been taken out in their name, without their knowledge, by a third party impersonating them.

Grounds for the decision

• Obligation of lawfulness of processing (Article 6(1) of the GDPR): The authority found that the insurance company processed the complainant's personal data (name, first name, national identity document number) without a valid legal basis. The company claimed the necessity of processing for the performance of a contract to which the data subject was party, pursuant to Article 6(1)(b) of the GDPR. However, the authority ruled that this legal basis was inapplicable because the complainant, a victim of identity theft, was never actually party to the insurance contract fraudulently taken out by a third party. The breach directly results from the company's negligence, which failed to implement adequate identity verification measures during the telephone subscription, relying only on the information provided by the caller and confirmation by text message (SMS). The authority relies on the case law of the Spanish Supreme Court (notably the ruling of 13 December 2021, cassation appeal no. 6109/2020) which establishes that the fraudulent intervention of a third party does not exempt the data controller from liability if it has not implemented sufficient control and verification measures to ensure that the contracting person is indeed who they claim to be.

Authority's decision

Consequently, the authority imposed a fine of €5,000 on MUTUA MADRILEÑA AUTOMOVILISTA SOCIEDAD DE SEGUROS A PRIMA FIJA.

Furthermore, the authority ordered the company to block the complainant's personal data within three months from the date the decision becomes final.

Lessons learned

This decision reminds that:

• The responsibility for processing data without a legal basis lies with the data controller, even in cases of identity theft by a third party, if identity verification measures during remote subscription are deemed insufficient.
• The legal basis of performance of a contract (Article 6(1)(b) of the GDPR) can only be invoked if the existence of a valid contract with the data subject is established, which is impossible in cases of undetected identity theft.
• The implementation of effective corrective measures during the procedure, such as a new identity verification system, can be considered by the authority as a decisive factor to significantly reduce the amount of the fine.