Canary Island Cars, S.L. – Court Ruling (Spain, 2021)

Court Ruling
Agencia Española de Protección de Datos26 February 2021Spain
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

A Spanish car rental company mixed up customer information, leading to a wrongful traffic fine. The court found the company didn't verify identities properly. This case emphasizes the need for accurate data handling to avoid legal issues.

What happened

Canary Island Cars mixed up customer information, leading to a traffic fine being wrongly issued to the wrong person.

Who was affected

A customer of Canary Island Cars whose personal details were incorrectly used for another person's traffic fine.

What the authority found

The Spanish court ruled that the car rental company failed to verify customer identities properly, violating GDPR's accuracy principle.

Why this matters

This case shows the importance of accurate data management and identity verification in customer transactions. Businesses should implement robust checks to prevent similar errors.

GDPR Articles Cited

Art. 5(1)(d) GDPR
Decision AuthorityAN
Reviewed AuthorityAEPD (Spain)
Full Legal Summary
Detailed

In the appealed AEPD's decision, [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018], two customers had the same name, what caused a failure when verifying customer details, what caused Canary Islands Cars, a rental car company, to incorrectly use the information of customer A to create a car rental contract for customer B, who then committed a traffic offence. Subsequently, the details of customer A were incorrectly passed on to the Directorate General for Traffic (DGT). Once the DGT contacted the complainant, she/he realised that the contract that Canary Island Cars provided to the DGT for the purposes of issuing the fine was dissimilar to the one she/he had initially signed. Based on the mismatch of information, the complainant appealed the fine upon receiving it. The AEPD noted the following in decision [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018]: "Knowing that there may be different names and surnames, the defendant has elements to verify identity by the national ID number (DNI), number that matches that of the driving licence, customer number or printing of the copy of the contract, among others. Although these verifications are normally carried out by the employees, it should be noted that in this case they were not carried out. If any of the three elements had been verified, the defect could have been detected in its origin. In other words, the identification document must be required at the right time to make the procedure effective”. The car rental company decided to appeal the case before the Spanish National High Court (Audiencia Nacional). In their appeal to this resolution, Canary Islands Cars argued that the accuracy principle had not been breached because the associated name was correct. The car rental company alleged that this was a human error and a fortuitous event. It also argued that the sanction imposed was disproportionate. Was the resolution of the AEPD decided in error? Should the appeal of Canary Is

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Canary Island Cars, S.L. in ES

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

26 February 2021

Authority

Agencia Española de Protección de Datos

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Canary Island Cars, S.L. - Spain (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: