They listed you on ASNEF over a debt you dispute

The case, in five lines

What is brought

A request for erasure and for restriction of processing addressed to the credit information system and to the creditor, plus a civil action in protection of your honour claiming damages for the harm caused.

Before which court

The AEPD (the Spanish data protection authority) on the administrative side and, to obtain compensation, the Civil section of the Tribunal de Instancia (the first-instance court), since Article 82 of the Regulation refers claims to the competent courts.

Deadline

The action protecting your honour lapses four years after you were in a position to bring it. In parallel, the data cannot be kept for more than five years from the date the obligation fell due.

Who can bring it

The individual whose data appear in the system. Both the entity running the register and the creditor that supplied the entry answer to that person as joint controllers.

Financial risk

If the debt turns out to be certain and properly notified, the claim is dismissed and you may bear the costs. The amount for non material harm is set by the court and does not always match what was claimed.

The presumption of lawfulness falls if a single requirement fails

Article 20 of Organic Law 3/2018 does not authorise default registers outright: it presumes the processing lawful, and only unless proved otherwise, when every requirement it lists is met. The data must come from the creditor or from someone acting on the creditor's behalf, must relate to debts that are certain, due and payable, and the creditor must have warned of the possible listing in the contract or when demanding payment.

That structure is what turns the matter into a case rather than a complaint. It is enough to show that a single one of those conditions was not met for the presumption to fall away and the processing to be left without cover. You do not have to prove bad faith on the creditor's part or argue the merits of the contract: you have to show that the entry went into the register without meeting the rule that allowed it in.

The same article adds that the presumption does not cover cases where the register links the credit information to additional data obtained from other sources in order to profile the debtor, in particular through credit scoring techniques. If your file includes a score built that way, the register's defence weakens further, and it is worth asking for a copy of that information in the very first letter.

Having challenged the debt before the listing disarms the register

Point (b) of Article 20.1 requires the data to relate to debts whose existence or amount has not been the subject of an administrative or judicial claim by the debtor, or of a binding alternative dispute resolution process between the parties. Anyone who challenged the debt before being listed does not have an undisputed debt, and a disputed debt has no place in the system.

That is why the date of the letter of complaint is the piece that decides many of these matters. An email to the company, a stamped official complaint form or a letter to the competent authority, all dated before the listing, put the creditor in the position of having placed on a register an amount that was already being formally disputed.

Article 20 also requires the system to notify you of the listing, to inform you that you may exercise the rights in Articles 15 to 22 of the Regulation within thirty days of the debt being notified to the system, and to keep the data blocked during that period. If you found out through the bank and not through a notification, that failure adds to the others.

The AEPD can find in your favour without paying you a euro

Complaining to the AEPD works to get the entry removed and to have the controller reproached, but the authority does not hand out compensation to those affected. The money lies behind a different door: Article 82 of the Regulation gives anyone who has suffered material or non material damage from an infringement the right to compensation from the controller or the processor.

That same article closes the easy exits. The controller is exempt only if it proves that it is not in any way responsible for the event giving rise to the damage, and where several took part in the same operation each answers for the whole loss so that the person affected is actually paid. They may afterwards apportion between themselves the share that falls to each.

That is why the administrative complaint and the civil claim are not alternatives but parts of one strategy. The AEPD's decision, when it arrives, is an excellent document for the civil proceedings, and the civil proceedings are the only place where credit harm turns into a sum that somebody has to pay you.

You do not have to prove the harm: the law presumes it

Article nine of Organic Law 1/1982 says something that shifts the burden of proof: harm is presumed whenever the unlawful interference is established. Once the improper listing is proved, you do not additionally have to show that you suffered. The argument moves to the amount, not to whether there was damage at all.

Compensation extends to non material harm, assessed by reference to the circumstances of the case and the seriousness of the injury actually caused, taking into account the reach or audience of the medium through which the interference occurred. In a credit register that reach is measured by the number of lenders that looked up your name and by how long you were listed.

The judicial protection that article describes does not stop at money. It covers every measure needed to end the interference, including a declaration that it took place, its immediate cessation, restoration of the earlier position and, where honour is at stake, publication of the judgment at the losing party's expense with at least the same reach the interference had.

Five years as the ceiling and thirty days of blocking: two clocks

Article 20 sets a maximum of five years from the date the obligation fell due, and only while the default persists. An old debt still showing after that ceiling is there with no legal cover, even if it genuinely exists. It is therefore worth calculating the due date before anything else, because sometimes that alone settles the case.

The second clock is the right to restriction of processing. When it is exercised before the system by contesting the accuracy of the entry under Article 18.1.a) of the Regulation, the register must tell anyone entitled to consult it of the mere existence of that circumstance, without giving the specific data, while your request is decided. That letter stems the harm while the merits are fought.

The third clock is yours, and it is the one that runs out quietly. Actions against unlawful interference lapse four years after the person entitled was in a position to bring them. This is a lapse period, not a limitation period: it is not interrupted by letters or by complaints to the company, and once it has run there is no way back.

How we run the case, step by step

1. 1

   Reconstruct what is on the register and since when

   We exercise the right of access against both the system and the creditor to obtain the exact entry, the date it was added, its origin, the recipients and the enquiry history. Without that picture there is no telling which Article 20 requirement was breached.

2. 2

   Serve the creditor and the register at the same time

   One letter does not serve both. Each receives its own, seeking erasure and, in the alternative, restriction of processing on the ground that the accuracy of the entry is contested, so that the register warns anyone consulting it of that circumstance.

3. 3

   Complain to the AEPD if they do not withdraw it

   Once the deadline for a reply has passed the matter goes to the authority, with each breached Article 20 requirement pointed out one by one. That complaint forces the entry out and leaves a ruling that can be used later before the civil court.

4. 4

   Quantify the harm with the actual refusals

   We gather the finance refusals, the extra cost of the credit you did obtain and the number of lenders that looked up your name. Article 20 requires whoever consulted the system to tell you if the contract was refused or never concluded as a result of that enquiry.

5. 5

   Sue in the civil courts for interference with honour

   The claim seeks a declaration of the interference, its cessation, restoration of the earlier position and compensation. It is filed before four years have run from the moment the action could be brought, joined with the claim for damages under Article 82 of the Regulation.

6. 6

   Enforce what you win and close the trail

   Once judgment is obtained we check that the entry really disappears, that the creditor does not report it again and that notice of the erasure reaches every recipient the data were passed to, and we seek publication of the judgment where appropriate.

The law that applies

• Art. 20 LOPDGDD. It presumes processing by common credit information systems lawful, unless proved otherwise, only if the data come from the creditor, the debt is certain, due, payable and not challenged by the debtor, the listing was disclosed, the person is notified with thirty days of blocking, five years from the due date are not exceeded and enquiries are limited to those with or seeking a paying relationship. The creditor answers for the entry being non existent or inaccurate. BOE-A-2018-16673
• Art. 82 RGPD. It gives anyone who has suffered material or non material damage from an infringement of the Regulation the right to compensation from the controller or the processor. Exemption applies only on proof of not being in any way responsible for the damaging event, and where several take part in the same operation each answers for the whole loss, without prejudice to apportionment between them afterwards. 32016R0679
• Art. 17 RGPD. It requires the controller to erase data without undue delay where they are no longer necessary for the purposes, where consent is withdrawn with no other basis, where an objection succeeds or where they have been unlawfully processed. If the controller made them public it must take reasonable steps to inform others processing them of the request to erase links and copies. 32016R0679
• Art. 9 LO 1/1982. Judicial protection against unlawful interference covers a declaration that it occurred, immediate cessation, restoration of the earlier position, prevention of further interference, compensation and recovery of any profit obtained. Harm is presumed once the interference is proved, compensation reaches non material harm by reference to its seriousness and reach, and the actions lapse four years after they could be brought. BOE-A-1982-11196

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions