Caixabank Payments & Consumer EFC, EP, S.A.U. – €70,000 Fine (Spain, 2024)

On 24 November 2021, a data subject filed a complaint with the Spanish DPA (AEPD) after she attempted to obtain a loan from Caixabank Payments & Consumer EFC, EP, S.A.U. (the controller) but was denied because credit reporters noted a debt related to an application for an Ikea credit card, which is credited by the controller. However, the data subject was a victim of identity theft -- she did not contract for an Ikea credit card and the contract supposedly executed for the card in fact contained personal data (phone number, email address, home address, bank account, business name and signature) that did not correspond to her. Ikea Ibérica, S.A. provides documentation for applying for credit at the request of its customers. The contract and processing of the data is instructed by the controller, which acts as the creditor and ultimately processes the data subject’s personal data. The Ikea credit card at issue in this case was activated by an Ikea vendor on 13 January 2020. By June of 2020, the debt on the card amounted to €690.25. The debt was recorded with ASNEF, a credit default reporter. The debt was then discharged by the controller and sold to Kruk España S.L. as part of a debt portfolio, who later sold it to InvestCapital, Ltd. On 14 December 2023, the AEPD issued a decision finding that the controller violated Article 6(1) GDPR when it processed the data subject’s personal data without any legal basis and issued a fine of €70,000. It noted that the controller's processing began with the fraudulent contracting of the Ikea credit card which it assigned to the data subject, continued with the transfer of the data subject’s personal data to ASNEF as part of a credit report for a debt that did not correspond to her, and ended with the sale of the debt to Kruk. The AEPD rejected the applicability of [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Article 20 LOPDGDD] (Spain’s national implementation of the GDPR), which articulates a presumption of legal basis where data refers to debts which are certain, due and payable, because the debt in this case did not correspond to the data subject and thus did not meet these requirements. The AEPD also dismissed the applicability of Article 6(1)(f) GDPR as a legal basis because the controller did not establish that its legitimate interests prevailed over the rights and interests of the data subject. Finally, the AEPD rejected the controller’s attempts to pass culpability onto KRUK and InvestCapital, noting that they acquired a debt portfolio from the controller and relied on the appearance of the accuracy of the assigned credits. Thus, their obtaining of the debt could not constitute a violation of Article 6(1) GDPR. On 14 November 2023, the controller filed an internal appeal with the AEPD. It restated the arguments it made in response to the initial complaint. It also raised arguments of non bis in idem and absence of guilt, claiming that at the time of the debt’s transfer it had no knowledge of the fraudulent use of the claimant’s data and thus could not bear responsibility for the theft. The AEPD dismissed the appeal and upheld its finding of an Article 6(1) GDPR violation and €70,000 fine. It reiterated that because the debt in this case did not correspond to the claimant, it was not certain, due or payable, meaning that the presumption of legality provided in [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Article 20 LOPGDGDD] cannot apply in this case. Legitimate interest under Article 6(1)(f) GDPR is also not a valid legal basis in this case, as there is no evidence that the controller considered the balance between its legitimate interests and the rights and interests of the data subject. The AEPD emphasised that the data subject’s data continued to be processed without legal basis until its effective deletion. It rejected the controller’s arguments that it deleted the data as soon as it became aware of an alleged fraud or forgery, noting that in fact the data was removed from the controller’s systems as a result of the sale of the debt, not as a result of a deletion request. The AEPD rejected the controller’s argument that none could be sanctioned without fault, finding that the controller was at fault in this case. It considered the controller negligent in failing to carry out an appropriate verification of the contracting data subject’s identity. Indeed, in this case, the majority of the information provided by the identity thief was false and not attributable to the data subject. The AEPD found that none of the measures adopted to verify accuracy of the information provided were aimed at verifying the data subject’s identity. Instead, the controller's focus was on ensuring the loan would go to an existing bank account – whosoever’s that may be. The AEPD clarified that this does not mean that a controller is responsible for preventing an illegal or criminal act such as identity theft from occurring. However, where it is a necessary diligence for the controller to comply with its obligations concerning protections of personal data, both with regard to the requirement of consent as well as the principle of truthfulness and accuracy of data, then a controller must implement measures aimed at verifying that the person the controller is contracting with is in fact the holder of the identity documentation provided. Finally, the AEPD reiterated that the fault in this case lay with the controller and not with any of the debt buyers because they purchased the data as an acquirer in ‘good faith’ and thus cannot be found to have violated Article 6(1) GDPR.