Canary Island Cars, S.L. – Court Ruling (Spain, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Spanish car rental company mixed up customer information, leading to a wrongful traffic fine. The court found the company didn't verify identities properly. This case emphasizes the need for accurate data handling to avoid legal issues.
What happened
Canary Island Cars mixed up customer information, leading to a traffic fine being wrongly issued to the wrong person.
Who was affected
A customer of Canary Island Cars whose personal details were incorrectly used for another person's traffic fine.
What the authority found
The Spanish court ruled that the car rental company failed to verify customer identities properly, violating GDPR's accuracy principle.
Why this matters
This case shows the importance of accurate data management and identity verification in customer transactions. Businesses should implement robust checks to prevent similar errors.
GDPR Articles Cited
In the appealed AEPD's decision, [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018], two customers had the same name, what caused a failure when verifying customer details, what caused Canary Islands Cars, a rental car company, to incorrectly use the information of customer A to create a car rental contract for customer B, who then committed a traffic offence. Subsequently, the details of customer A were incorrectly passed on to the Directorate General for Traffic (DGT). Once the DGT contacted the complainant, she/he realised that the contract that Canary Island Cars provided to the DGT for the purposes of issuing the fine was dissimilar to the one she/he had initially signed. Based on the mismatch of information, the complainant appealed the fine upon receiving it. The AEPD noted the following in decision [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018]: "Knowing that there may be different names and surnames, the defendant has elements to verify identity by the national ID number (DNI), number that matches that of the driving licence, customer number or printing of the copy of the contract, among others. Although these verifications are normally carried out by the employees, it should be noted that in this case they were not carried out. If any of the three elements had been verified, the defect could have been detected in its origin. In other words, the identification document must be required at the right time to make the procedure effective”. The car rental company decided to appeal the case before the Spanish National High Court (Audiencia Nacional). In their appeal to this resolution, Canary Islands Cars argued that the accuracy principle had not been breached because the associated name was correct. The car rental company alleged that this was a human error and a fortuitous event. It also argued that the sanction imposed was disproportionate. Was the resolution of the AEPD decided in error? Should the appeal of Canary Is
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Canary Island Cars, S.L. in ES
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
26 February 2021
Authority
Agencia Española de Protección de Datos
GDPRhub ID
gdprhub-court-3336About this data
Cite as: Cookie Fines. Canary Island Cars, S.L. - Spain (2021). Retrieved from cookiefines.eu
Last updated: