Wenance Lending de España S.A. – €72,000 Fine (Spain, 2024)

On 21 August 2020, the data subject saw a job posting online. In order to apply for this position, the data subject was requested to send a selfie of them holding their ID card. After that, they received a request by the controller, a fintech company, to pay back a €200 loan. Since the data subject believed they had never entered in a loan agreement with the controller, they contacted the latter. The controller informed the data subject that on 21 August 2020 it had received a loan request from them and transferred the amount to a bank account. The loan contract had been signed through an electronic signature. In addition, on 12 August 2022 the data subject asked the controller to delete their data. The controller did not reply to the request. As for the deletion request, the controller later argued that it could not delete the data since the contract was still in force. First, the DPA investigation showed that the data subject was victim of a fraud. The data subject sent their picture and ID card to the defrauder. With this documents the latter digitally signed the loan contract with the controller. Therefore, the data subject never expressed their willingness to enter in such an agreement with the controller. Second, the DPA noted that the anti-fraud measures taken by the controller were insufficient. More specifically, the controller argued that one of these measures is that the amount of money cannot be transferred to accounts that have been opened for less than 3 months. However, in the case at hand, the controller transferred the money even though the account had been opened only one day before the loan contract was signed. Thirdly, the DPA pointed out that this lack of checks led to the transfer of the money to a bank account not owned by the data subject. The DPA added that, in Spain, a bank transfer is successful even if the name in the bank transfer form is different from the account’s actual holder name. Therefore, the DPA found that the controller had processed personal data without a proper legal basis, since the data subject had never entered in a contract with the controller. For these reasons, it found a violation of Article 6(1) GDPR. Fourthly, as for the deletion request, the DPA noted that the controller should have replied to the request even if it believed that the request should have been rejected. Therefore, it found a violation of Article 12 GDPR. On these grounds, the DPA issued a €72,000 fine.