DPA case PS/00044/2020 – Complaint Upheld (Spain, 2020)

The decision is the consequence of a complaint submitted by a Spanish citizen stating that, when he requested the defendant a copy of the deed corresponding to his house, the defendant required a copy of the national ID card of the claimant, but it did not offer him any information clauses regarding the circumstances of the data processing activity nor on the security measures used in order to keep the copy of the national ID card. The defendant promised that it would call the claimant to clarify such aspects, but this did not happen until two months later, when the defendant was newly required by the claimant. In that moment, the defendant sent the information clauses to the claimant, but it did not clarify any security measures; additionally, the defendant redirected the claimant to his data protection officer, who finally told the claimant that there was no need to inform him, with basis on Article 32 of the Spanish Law 10/2010 of April 28th on Money Laundering Prevention. The defendant answered to the first AEPD investigation requests (i) confirming that it did not offer the data protection information to the claimant until almost two months later, (ii) that it offered him the possibility of exercising his data rights, but that he only required a verification on the data protection information clause, that (iii) it considered that there was no need to inform the claimant on the basis of the money laundering legislation, and that (iv) the office of the defendant complied with the security measures specified at the ISO 27001, and it later added the following: (iv) a processing activities registry, the appointment of a DPO and the corresponding information clause at the invoices sent to its clients. The AEPD started the corresponding sanction procedure, and the defendant answered again insisting on the fact that public notaries are not obliged to offer data protection information based on the Spanish money laundering legislation. Thus, the AEPD understood tha