The Spanish data protection authority rejected a complaint concerning a right to erasure, considering that the data controllers had acted in accordance with their obligations by deleting data when possible and requesting supporting documents for the remaining data, a request that remained unanswered by the complainant.

Facts and context

The Spanish data protection authority (AEPD) issued a decision rejecting a complaint against the Directorate General of the Civil Guard and the Directorate General of the Police regarding the exercise of the right to erasure of criminal records.

The case originated from a complaint by an individual who, after several requests to erase their criminal records, considered that their request had not been fully satisfied by the two authorities.

Reasons for the decision

The authority examined whether the data controllers had properly responded to the complainant's requests, based on Spanish legislation applicable to processing for the purposes of prevention and detection of criminal offenses, which derives from the transposition of Directive (EU) 2016/680. The analysis concluded no breach.

• No breach of the obligation to respond to a request for erasure (Article 17 of the GDPR): The authority found that the two entities involved had processed the complainant's requests. The Directorate General of the Police confirmed having erased the records and notified the complainant. The Directorate General of the Civil Guard erased part of the data for which supporting documents had been provided but dismissed the requests related to other entries because the complainant had not provided the required documents to prove the validity of their erasure request, which led to the lapse of the procedure. The authority therefore considered that the data controllers had acted in accordance with their legal obligations.

Authority's decision

Consequently, the authority rejected the complaint filed against the Directorate General of the Civil Guard and the Directorate General of the Police.

Lessons learned

This decision reminds that:

• The data subject bears the burden of providing the necessary supporting documents to back their erasure request, especially when it concerns specific data such as criminal records.
• A data controller may legitimately close a rights exercise request procedure if the data subject does not provide the additional information required to assess its validity.
• The competence of a data protection authority is strictly limited to the application of the legislation in this area and does not allow it to intervene in disputes falling under other legal frameworks (such as defamation) or to order other institutions (such as courts) to produce documents.