Website sells personal data of 36 million Spaniards

Obtaining the personal details of a resident of Spain has never been easier. For the cost of 210 euros, anybody in the country can buy an access code to a database containing the personal information of 36 million people in the country.

The electoral roll and municipal registers are both sources of great value to debt-collection companies in times of financial crisis, when arrears spike. Locating debtors is one of the main hurdles third-party debt collectors face. In many cases, between the signing of a contract and a non-payment, people change address, telephone number or leave the country. In order to track them down, these companies can consult public archives such as the Mercantile Register or the Property Register.

Since 2004, an Alicante businessman has offered a service to all those wishing to find somebody. For a 210-euro fee from an authorized computer, or up to 1,400 euros for a flat rate, José Vicente Lucas offers access to a website that until recently was named Saberlotodo.com (literally, "know everything").

"Thanks to my database you can locate the new address of a titleholder or find out who he or she lives with," says Lucas, who styles himself as a "judicial investigator."

The Spanish Data Protection Agency (AGPD) has received a deluge of complaints from people who have been tracked down by companies without their knowledge. Since 2007, the AGPD has fined Saberlotodo several times for divulging personal details without third party consent. The total amount of the fines imposed stands at 3.5 million euros. The website was ordered to shut down as it was created without the consent of those affected, in contravention of articles six and eleven of the Data Protection Law, which state that the ceding of personal details requires the "unequivocal consent of the affected person."

Lucas has appealed these decisions on a technicality: that the sanctions should be directed at him as the owner of the website and not against the Saberlotodo company. The High Court, though, backed the ruling of the AGPD.

Lucas did not stop there. He simply changed the name of the company to Trumbic and continued to offer the database to companies. When a user visits Saberlotodo.com, there is a banner directing customers to Trumbic.com, as well as a contact number.

Lucas says that at present there are 190 companies signed up to his service whose consultations net him around 300,000 euros a year. The AGPD is now going after the new website and could fine Lucas up to 600,000 euros. But for four years, the details of 36 million Spaniards have been for sale.

"We are the only people that can legally locate people," says David Sanmartín, director of the Grupo Has private detection agency and secretary general of the Professional Association of Private Detectives. Sanmartín is well aware of the existence of Lucas' enterprise, with which Spain's private detectives are engaged in an open battle. He points out that if a company in Spain wishes to find the whereabouts of a titleholder it must do so by hiring a private detective agency.

Spain is, along with Portugal, the only EU country in which the debt collection sector is not regulated. There is no registry of companies dedicated to this business but there are thought to be around 800. The lack of regulation affords them carte blanche in their methods, which include bombarding a debtor and his family or workplace with phone calls and even personal visits, all on the very edge of legality.