The Spanish Data Protection Authority (AEPD) has sanctioned a company for registering a person in a payment incident file without being able to justify the existence of a contract underpinning the alleged debt.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against DRSMILE IBERIA, S.L. (including the imposition of a €7,000 fine) for breaches related to the lack of a legal basis for registering a person in a credit information system.

The case originated from a complaint by an individual concerning their improper registration in the ASNEF payment incident file at the initiative of the company, while the complainant denied ever having contracted the orthodontic treatment at the origin of the alleged debt.

Grounds for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that the company requested the registration of the complainant in the ASNEF credit information system for an unpaid debt of €1,890. The investigation revealed that no documentation proved the existence of a contractual relationship justifying this debt. In the absence of a contract, the company could not rely on a valid legal basis for this processing, thus violating Article 6(1) of the GDPR. The authority also noted that even the general terms provided by the company, besides being subsequent to the facts, did not inform about the possibility of such registration in case of non-payment.

Authority's decision

Consequently, the authority imposed a fine of €7,000 on DRSMILE IBERIA, S.L.

Furthermore, the authority ordered the company to prove, within one month, that it informed ASNEF of the inappropriate nature of the complainant's registration and requested its deletion, unless it can justify a legal basis.

Lessons learned

This decision reminds that:

• Registering a person in a payment incident file requires indisputable proof of the existence of a certain, liquid, and due debt, based on a proven contractual relationship.
• The absence of any valid contractual documentation deprives the data controller of any legal basis for data processing related to the recovery of an alleged debt.
• In accordance with the principle of proactive accountability, it is the data controller's responsibility to document and be able to demonstrate at any time the legal basis on which each data processing is based.