The Spanish data protection authority issued a warning against an association for using personal data obtained from an external provider without being able to demonstrate the lawfulness of their initial collection, thus rendering the subsequent sending of a promotional thank-you postal mail illegitimate.

Facts and context

The Spanish data protection authority (AEPD) today published a decision issuing a warning against the Association of Mouth and Foot Painters, S.L. (APBP) for breaches related to the legal basis for processing data for postal prospecting purposes.

The case originated from a complaint by a person who received, on January 29, 2025, a personalized promotional postal mail from the association without having consented or having any prior relationship with it.

Reasons for the decision

• Obligation to have a lawful legal basis for processing (Article 6 of the GDPR): The authority found that the association sent a personalized postal mail which, although presented as a thank-you for a contribution of €8, contained clear promotional elements such as a QR code and links to its website and online store. The association invoked legitimate interest based on a prior commercial relationship. However, the investigation revealed that the postal data had initially been obtained from an external provider for a non-personalized mailing. The authority ruled that the association did not provide evidence that this initial collection was lawful and that the data subjects had been properly informed. In accordance with the accountability principle of Article 5(2) of the GDPR, it is the controller's responsibility to demonstrate compliance. A mere contractual guarantee from the provider is insufficient. Therefore, the unlawfulness of the initial processing tainted the legal basis of all subsequent processing, including the sending of the personalized mail.

Authority's decision

Consequently, the authority issued a warning to the Association of Mouth and Foot Painters, S.L. (APBP) for violation of Article 6(1) of the GDPR.

Lessons learned

This decision reminds that:

• The responsibility for the lawfulness of data obtained from an external provider lies with the controller, who must be able to actively demonstrate it.
• A mere contractual guarantee from a data provider is insufficient to prove the compliance of the initial processing and does not relieve the controller of their own verification obligations.
• The lawfulness of data processing must be established from its origin; an initial unlawfulness affects the validity of subsequent processing, even if based on another legal basis such as legitimate interest.
• A thank-you communication containing promotional elements (links to a store, encouragement to follow on social networks) cannot be considered purely administrative and requires an appropriate legal basis for prospecting.
• The implementation of corrective measures by the controller, although not removing the initial infringement, may be considered a mitigating factor by the supervisory authority when choosing the sanction.