Erasure of your data from a credit blacklist (fichero de morosos) over a disputed debt

Legal basis and things to bear in mind

• The processing of default data by a common credit information system is only presumed lawful when all the requirements of article 20.1 of Ley Orgánica 3/2018, on the Protection of Personal Data and the guarantee of digital rights, are met at the same time. It is enough for one of them to fail for the entry to stop being covered by that presumption.
• One of those requirements is that the debt must be certain, due and payable, and that neither its existence nor its amount has been the subject of an administrative or judicial claim by the debtor, nor of an alternative dispute resolution procedure binding on both parties (article 20.1.b). That is why the written document does not go into whether you owe the money or not: it maintains that the amount cannot appear while it is under challenge.
• The creditor institution should have warned you of the possibility of including you in these systems, stating which ones it takes part in, either in the contract itself or when demanding payment from you (article 20.1.c). If neither of those two things is on record, the inclusion loses the protection of the presumption.
• The controller of the credit file must notify you of the inclusion and inform you of the rights recognised in articles 15 to 22 of Regulation (EU) 2016/679 within thirty days of the debt being reported to the system, and during that deadline the data remains blocked (article 20.1.c, final paragraph, of Ley Orgánica 3/2018).
• The data may only be kept while the default persists, with a maximum limit of five years from the date on which the obligation fell due, and not from the date on which the entry was made (article 20.1.d). It is common for the data to still be showing once that limit has been passed.
• In addition to the erasure under article 17 of Regulation (EU) 2016/679, we ask for the restriction of processing under article 18.1.a), which protects anyone who contests the accuracy of a piece of data. While your application is being decided, the system is obliged to inform anyone consulting it of the mere existence of that circumstance, without disclosing the specific data (article 20.1.e of Ley Orgánica 3/2018). That is the part that takes effect sooner, because erasure is slow.
• Whoever receives the application has one month to reply, a deadline that can be extended by two further months when the case is complex, and in that event they are obliged to tell you within the first month. It is worth knowing from the outset: silence does not amount to acceptance, and if they do not reply the next step has to be taken.
• The creditor institution and the controller of the credit file answer as joint controllers of the processing, and it is for the creditor to guarantee that the requirements for inclusion are met, being answerable for data that does not exist or is inaccurate (article 20.2 of Ley Orgánica 3/2018). That is why the written document is addressed to both of them on the same day, and not only to the credit file.
• If the entry that worries you is in the Central de Información de Riesgos (CIRBE) of the Banco de España, it is not a credit blacklist: what it records are the risks declared by the institutions, and rectification is requested from the institution that declared the data. We would warn you of this before sending anything.
• This service covers the claim to the institution and to the controller of the credit file. If they refuse the erasure, there are later steps that are contracted separately: the claim to the Agencia Española de Protección de Datos (the Spanish data protection authority) and, if the data has caused you harm, a claim for compensation under article 82 of Regulation (EU) 2016/679. We will tell you in writing which one applies in your case.