They list you as a defaulter for disputing your revolving card

The case, in five lines

What is brought

Two routes run together: the right to erasure under article 17 of the GDPR and restriction of processing under article 18(1)(a), exercised against both the lender and the register operator, plus a civil claim for protection of honour under Organic Act 1/1982 seeking cessation, cancellation and damages for moral harm.

Before which court

The Civil section of the Tribunal de Instancia (the first instance court) for the claimant's domicile hears the honour claim, with the Ministerio Fiscal (the public prosecutor) taking part and appeal to the Audiencia Provincial (the provincial appeal court). In parallel, a complaint goes to the Agencia Española de Protección de Datos (the Spanish data protection authority).

Deadline

The action against unlawful interference lapses four years after it could have been brought (article 9(5)), and while the entry remains live in the register the interference continues. The data may not stay on file more than five years from the date the obligation fell due, and are blocked for the thirty days following notification of the debt to the system.

Who can bring it

The person recorded in the register, and each co holder or guarantor who appears separately, because the right to honour is personal, non waivable and imprescriptible. If the holder died without being able to claim, the action passes to the persons designated by the Act and the damages form part of the estate.

Financial risk

If your protest was verbal, or arrived after the entry was made, the lender will argue the debt was certain when it was reported and the case gets harder. Acknowledging the debt in writing, or paying part of it to get the entry removed, also counts against you. A dismissed honour claim opens the door to an order to pay costs.

A debt challenged through an official channel is no longer certain

Article 20 of Organic Act 3/2018 only presumes processing lawful where the data concern debts that are certain, due and payable, and whose existence or amount has not been the subject of an administrative or judicial claim by the debtor, or of a binding alternative dispute resolution procedure between the parties. One word decides the case: claim. And the article also decides by which route, because a letter to the finance company itself is none of the three things it lists, however well acknowledged it was.

A complaint to the customer service department is the first rung, not the last. Article 30 of Act 44/2002 requires that it be made in writing first before you can turn to the complaints service of the Banco de España (the Spanish central bank), which is what leaves the administrative trace that matters here. That service decides by reasoned report, with no standing as a reviewable administrative act, so it does not bind the lender, but it fixes the date on which the debt became disputed. A complaint to the data protection authority and a claim to set the contract aside serve the same purpose and go further.

The same article requires the creditor to have informed the person concerned, in the contract or when demanding payment, of the possibility of inclusion in such systems, naming the ones it takes part in. Many finance companies register an entry without ever having demanded payment, or send the demand to an address they know has changed. That defect on its own destroys the presumption of lawfulness and makes the processing unlawful.

And the allocation of responsibility leaves no room for excuses: paragraph 2 makes the operator of the system and the creditor joint controllers, and adds that it falls to the creditor to ensure the requirements for inclusion are met, answering for the debt's non existence or inaccuracy. Whoever makes the entry, answers for it.

Two requests at once: delete the entry and flag it as contested

Erasure under article 17 of the GDPR obliges the controller to delete without undue delay where the personal data have been unlawfully processed or are no longer necessary for the purposes for which they were collected. A disputed debt falls under the first head, because the entry never met the requirements. That is the principal request and it is what puts your credit record back to normal.

Restriction under article 18(1)(a) goes into the same letter and covers the interim period: it applies where the data subject contests the accuracy of the personal data, for a period enabling the controller to verify that accuracy. Its practical effect is spelt out in article 20 itself: the system will inform anyone entitled to search it of the mere existence of that circumstance, without disclosing the specific data, while the request is being decided.

Translated into what matters to you: the bank that searches will not simply see an unpaid debt, it will see that the entry is contested. That is the difference between an outright mortgage refusal and a file that stays open while the matter is decided.

The route that brings money is honour, not the regulator's penalty

A complaint to the supervisory authority is useful and we file it, but it ends in a fine paid to the Treasury, not in compensation for you. The money comes through the civil courts, which is why both routes run in parallel rather than one instead of the other.

Article 7(7) of Organic Act 1/1982 treats as unlawful interference the imputation of facts or the expression of value judgements, through acts or words, that in any way harm another person's dignity by damaging their reputation or self esteem. Publishing in a register consulted by the entire financial sector that you are a defaulter, when the debt is disputed, is precisely that imputation of facts.

Article 9(3) is what turns the case around: loss is presumed whenever unlawful interference is established. You do not have to prove that you suffered, nor quantify a specific loss. Once the improper entry is shown, harm is taken as given and the argument moves to how much, not whether.

How the amount they must pay is assessed

Article 9(3) itself sets the criteria: damages extend to moral harm, assessed in the light of the circumstances of the case and the gravity of the injury actually caused, taking into account the reach or audience of the medium through which it occurred. Applied to a credit register, that means four concrete variables: how long the entry was live, across how many registers at once, how many institutions searched it, and which transactions fell through as a result.

Third party searches are the gold standard evidence, and the law gives you access to them. Article 15 of the GDPR lets you learn the recipients or categories of recipient to whom the data were disclosed, and article 20 requires that, where an application for a contract is refused as a result of the search, whoever carried out that search informs the person concerned of its outcome. That refusal letter is the evidence that raises the figure.

On top of the honour award comes compensation under article 82 of the GDPR, covering material and non material damage suffered through an infringement of the Regulation, whose paragraph 4 allows you to pursue any one controller for the whole: where several controllers were involved in the same processing operation, each is liable for the entire damage so as to ensure effective compensation for the data subject.

If the debt was sold to a fund, the buyer is just as liable

A sale to a debt recovery fund cleans nothing. The assignee that keeps the entry alive becomes the creditor for the purposes of article 20, and with it takes on the duty to ensure the conditions for inclusion are met and to answer for the debt's non existence or inaccuracy. If the debt was already disputed when it was bought, it was bought disputed and cannot be published.

It is also worth checking the date of assignment, because article 1526 of the Civil Code provides that the assignment of a credit, right or action has no effect against third parties until its date is deemed certain. And if the defence has already been filed, article 1535 opens up: where a litigious credit is sold, the debtor may extinguish it by reimbursing the assignee the price paid, the costs and the interest, within nine days of the assignee demanding payment.

Funds buy portfolios at a small percentage of face value. That article turns the real purchase price into a figure well worth knowing, and explains why it is rarely produced in court unless ordered.

Three different clocks running at once

First, the clock on the entry: the action against unlawful interference lapses four years after the entitled person could have brought it, under article 9(5). While the entry stays live the injury keeps being inflicted, but once it is cancelled the clock runs in earnest and does not stop.

Second, the clock on setting aside the revolving contract, which has none: nullity for usury or for lack of transparency is radical and neither lapses nor prescribes, so the contract can be attacked even if it was signed fifteen years ago.

Third, the clock on the money overpaid, which is the shortest and the one that slips away: article 1964(2) of the Civil Code gives personal actions five years from the moment performance can be demanded, and in revolving credit that period runs payment by payment, so only the sums paid in the five years before the claim are recoverable. If the count crosses the 2020 suspension of time limits, eighty two days are added. That is why the written claim goes out as early as possible, quite apart from being what strips the debt of its certainty.

How we run the case, step by step

1. 1

   We ask the register and the lender for everything held on you

   We exercise the right of access under article 15 of the GDPR against both: date of entry, amount, who reported it, the source of the information and, above all, the recipients to whom it was disclosed. That list of searches is what later quantifies the harm.

2. 2

   We put on official record that the debt was already disputed

   We gather and date the complaint to the customer service department, the proof of sending and the reply, and on that basis we escalate the complaint to the Banco de España complaints service. If the protest was only by telephone, we repeat it at once by a means that leaves a record, because what holds the case up is the certain date of that claim and the fact that it sits on an official file.

3. 3

   We exercise erasure and restriction in the same letter

   We seek erasure under article 17 as the principal request and restriction under article 18(1)(a) for however long it takes to resolve, so that anyone searching sees the entry is contested. It is addressed at once to the register operator and to the lender that reported the debt.

4. 4

   We complain to the supervisory authority if they do not cancel

   If the deadlines pass with no cancellation, we file a complaint with the Agencia Española de Protección de Datos with the full file. It awards no compensation, but it puts the breach on record and usually speeds up cancellation while the court claim is prepared.

5. 5

   We sue for honour and join the attack on the contract

   The claim seeks a declaration of the interference, its cessation, cancellation in every register and quantified damages, against the lender, the register operator and the assignee fund if there is one. The same document attacks the revolving credit for usury and for lack of transparency.

6. 6

   We check the cancellation reached everywhere

   We search every register again a few weeks later and ask for confirmation that the entry was deleted and that those who received it were told. Deletion in one register and not the others leaves the problem exactly as alive as before.

The law that applies

• Art. 20 de la LO 3/2018 (LOPDGDD). Processing by common credit information systems is presumed lawful only where the data concern debts that are certain, due and payable whose existence or amount has not been the subject of an administrative or judicial claim by the debtor nor of a binding alternative dispute resolution procedure, and where the creditor gave notice of possible inclusion in the contract or when demanding payment. It makes the register and the creditor joint controllers and makes the latter answerable for the debt's non existence or inaccuracy. BOE-A-2018-16673
• Art. 30 de la Ley 44/2002. The complaints services of the Banco de España deal with complaints and claims from users of financial services alleging breaches of the rules on transparency and customer protection, and decide them by reasoned report which in no case counts as a reviewable administrative act. To be admitted, the claim must be shown to have been put first in writing to the customer care department of the institution complained of. BOE-A-2002-22807
• Art. 15 del RGPD. Gives the right to obtain from the controller confirmation as to whether data concerning you are being processed and access to them, including the recipients to whom they were disclosed, the envisaged storage period and, where the data were not obtained from you, any available information about their source. 32016R0679
• Art. 17 del RGPD. Requires the controller to erase the data without undue delay where they have been unlawfully processed or are no longer necessary for the purposes for which they were collected and, where it made them public, to take reasonable steps to inform controllers processing those data of the erasure request. 32016R0679
• Art. 18 del RGPD (apartados 1.a y 2). Allows restriction of processing where the data subject contests the accuracy of the data, for a period enabling the controller to verify it, and bars restricted data from being processed for anything beyond storage or the pursuit of legal claims. 32016R0679
• Art. 82 del RGPD. Recognises the right to compensation for material or non material damage suffered through an infringement of the Regulation, and where several controllers took part in the same operation each is liable for the entire damage so as to ensure effective compensation for the data subject. 32016R0679
• Art. 7.7 de la LO 1/1982. Treats as unlawful interference the imputation of facts or the expression of value judgements, through acts or words, that in any way harm another person's dignity by damaging their reputation or self esteem. BOE-A-1982-11196
• Art. 9 de la LO 1/1982. Protection covers immediate cessation of the interference, restoration of the previous position and compensation for the damage. Loss is presumed whenever unlawful interference is established, and moral harm is assessed by reference to the circumstances of the case, the gravity of the injury and the reach of the medium. The actions lapse four years after they could have been brought. BOE-A-1982-11196
• Art. 1.3 de la LO 1/1982. The right to honour, to personal and family privacy and to one's own image is non waivable, inalienable and imprescriptible, and any waiver of the protection provided by the Act is void. BOE-A-1982-11196
• Art. 1964.2 CC. Personal actions with no special period prescribe after five years from the moment performance can be demanded, which is the period limiting how much of the revolving overpayment can be recovered. BOE-A-1889-4763
• Art. 1535 CC. Where a litigious credit is sold, the debtor may extinguish it by reimbursing the assignee the price paid, the costs and the interest, within nine days of the assignee demanding payment. A credit is litigious from the moment the defence is filed. BOE-A-1889-4763

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions