The Spanish Data Protection Agency (AEPD) has issued a decision issuing a warning against JULIA SERVICIOS PSICOMÉDICOS SL for a breach related to the lack of a legal basis for sending commercial prospecting by postal mail.

Facts and context

The case originated from a complaint by an individual who received, on May 3, 2024, an advertising postal mail from the company, operating under the name CENTRE MÉDICAL ALTASA. This mail, which used logos and typography that could be confused with an official communication from the Directorate General of Traffic (DGT), informed the complainant of the imminent expiration of their driving license and offered services for its renewal.

Grounds for the decision

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that the company had processed the complainant's personal data (name, surname, address) to send a commercial offer. To justify this processing, the company invoked legitimate interest, based on a prior professional relationship dating back to July 1, 2009, when the complainant had renewed their license at its center. The AEPD rejected this argument, considering that a commercial relationship ended fifteen years ago could not constitute a valid legal basis for new processing for prospecting purposes in 2024. The authority emphasized that the communication was clearly commercial in nature and that in the absence of consent or any other relevant legal basis provided for in Article 6(1) of the GDPR, the processing was unlawful.

Authority's decision

Consequently, the authority issued a warning to JULIA SERVICIOS PSICOMÉDICOS SL.

Furthermore, the authority ordered the company to implement, within three months, the necessary measures to ensure that any processing of personal data is based on a valid legal basis, such as the express and specific consent of the data subjects.

Lessons learned

This decision reminds that:

• A past commercial relationship cannot indefinitely justify data processing for prospecting purposes based on legitimate interest, especially after a long period of inactivity.
• The assessment of legitimate interest must imperatively take into account the reasonable expectations of the data subjects, which diminish with the time elapsed since the last contact.
• The qualification of a communication (informative or commercial) depends on its actual content and purpose, not on the designation given by the data controller to try to legitimize it.