In a judgment dated 21 May 2014, the Supreme Court stated that an entity responsible for the debtors register (ASNEF) and the applicant for the inclusion of an individual in such register had violated an individual’s right to honour. By including and maintaining the individual in the register, as a result of a debt held with the applicant, as well as requesting €5,000 compensation for moral damages, their right to honour had been unlawfully inhibited.
In the case, the Court highlighted that use of personal data requires the consent of the subject. An exception allows personal data to be used without consent of the concerned party, but only when necessary for the satisfaction of a legally-recognised ‘legitimate interest’. In this regard, Section 29.2 of the Spanish Data Protection Act provides such an exception with regard to the data on breach of money liabilities provided by the creditor without the consent of the concerned party. However, this exception does not imply that the requirements can be lowered in terms of quality of data, neither setting restrictions nor additional obstacles for the rights of information, opposition, cancellation and rectification by the concerned party.
The judgments issued at prior instances considered that “the verification of existence, certainty and expiration of disputed debts are not within the competence of the responsible of the register as it exceeds its powers”, however the Supreme Court recalled that the data controller was responsible for communicating to the data subject that his data had been included in the file. Therefore, they were obliged to ensure the quality of the data and accordingly cancel or modify any data which was irrelevant, inaccurate or incomplete. Accordingly, ASNEF as the controller of the data in the register of debtors, should have satisfied the right of rectification or cancellation of the data subject, and may not limit his responsibility to transfer the application to the creditor so he decides how to act and, as a result, follows his instructions, leading to a standardized response to the plaintiff denying the cancellation.
Furthermore, the Court stated that the data should have never been included in the register of debtors. Apart from being truthful and accurate, the data must be appropriate and relevant, which was not the case in this instance. The Court noted that the Spanish Data Protection Acts only permits registration and transfer of personal data that is necessary for assessing the financial solvency of the interested parties. As a consequence, a debt that is not paid because the so-called debtor objects to its origin and enforceability is not sufficiently decisive to evaluate the financial solvency of the affected, even where the judgment finds for the claimant in a prospective claim; or because the reason for the failure to comply with the payment is not the insolvency of the debtor but his disagreement with the existence or enforceability of the debt.
Therefore, the Court recognized the violation of the fundamental right to the protection of personal data of the subject and the intrusion on his right to the honour as a result of the undue registration of his data in the register of debtors, condemning jointly and severally to the responsible of the aforementioned register and the applicant including the payment of a compensation for damages.