Banking Law and Reputation Management Rights in Spain

1. Introduction

In Spain, reputation management rights in banking arise from the interaction of several legal areas rather than from one single “banking reputation” statute. The main protections concern:

• the right to honour (derecho al honor);
• protection of personal data and credit information;
• correction or deletion of inaccurate information;
• confidentiality of banking and customer information;
• protection of consumers against misleading or abusive communications;
• banks' obligations when reporting customers to credit-information systems;
• the bank's own ability to protect its corporate reputation.

The central legal tension is between reputation/privacy rights and legitimate interests such as freedom of expression, credit-risk assessment, fraud prevention, regulatory reporting and financial transparency.

2. Constitutional foundation

The Spanish Constitution provides the basic framework.

Article 18.1 of the Spanish Constitution

It protects:

• honour;
• personal and family privacy;
• one's own image.

For banking relationships, Article 18 becomes particularly relevant where a bank:

• records adverse information about a customer;
• communicates alleged payment defaults to third parties;
• reports a customer to a credit-information system;
• publishes information concerning alleged financial misconduct;
• processes personal information affecting a person's reputation.

Article 20

Article 20 protects freedom of expression and freedom to communicate truthful information.

Therefore, reputation protection is not absolute. Courts must balance reputation against freedom of information and expression.

A bank cannot normally justify an inaccurate statement merely by saying that it was commercially necessary. Conversely, a customer cannot automatically suppress accurate information simply because it damages their reputation.

3. Organic Law 1/1982: Protection of Honour

A major statute is Organic Law 1/1982 of 5 May, concerning civil protection of honour, personal and family privacy and one's own image.

It provides civil remedies against unlawful interference with honour.

In banking matters, potential problems can arise where information communicated by a bank:

• falsely accuses a customer of misconduct;
• portrays a person as an unreliable debtor without adequate basis;
• disseminates unnecessarily damaging information;
• communicates allegations to people who have no legitimate need to receive them.

Possible remedies include:

1. cessation of the interference;
2. prevention of future interference;
3. restoration of the injured person's reputation;
4. publication of the judgment in appropriate circumstances;
5. compensation for damages.

4. Reputation and credit-information systems

One of the most important banking applications concerns credit-information files.

Spanish banks may legitimately process information concerning payment defaults and creditworthiness, but the processing must satisfy data-protection requirements.

The key European framework is:

• GDPR (Regulation (EU) 2016/679);
• Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD).

Historically, Spain also had specific rules concerning solvency files, particularly under the former Organic Law 15/1999.

The important principle is that a credit-information system should not become a mechanism for placing inaccurate or improperly reported information into circulation.

5. Article 20 GDPR and credit-information systems

Article 20 GDPR is not itself the principal Spanish rule governing credit files; more relevant provisions include:

• Article 5 — principles of processing;
• Article 6 — lawful bases;
• Article 15 — access;
• Article 16 — rectification;
• Article 17 — erasure;
• Article 18 — restriction;
• Article 21 — objection.

For banks, this means that customer information must be:

Accurate

Incorrect information should not remain in the system.

Relevant

The information must have a legitimate relationship with the purpose for which it is processed.

Limited

Banks should not process or disclose more information than is necessary.

Current

Outdated information can create unlawful reputational consequences.

6. ASNEF and other credit files

Spanish banking disputes frequently involve credit-information systems such as ASNEF.

A customer may challenge inclusion where, for example:

• the debt does not exist;
• the debt has already been paid;
• the amount is incorrect;
• the debt is genuinely disputed;
• the creditor has not complied with statutory requirements;
• the information is inaccurate or outdated.

This is particularly important because inclusion in a credit file can affect:

• obtaining a mortgage;
• receiving consumer credit;
• opening or maintaining certain financial relationships;
• business financing;
• commercial credibility.

Thus, a technically incorrect credit-file entry can have consequences extending beyond privacy into the person's economic reputation.

7. Constitutional Court jurisprudence

STC 139/1995

The Spanish Constitutional Court has treated the right to honour as protecting a person's social reputation and consideration by others.

The important banking-law principle is that an institution cannot freely disseminate statements that objectively damage a person's reputation without considering their truthfulness and legal justification.

STC 49/2001

The Court further developed the relationship between honour and freedom of expression/information.

The distinction between facts and opinions/value judgments is important.

A factual allegation can be assessed for truthfulness. A pure value judgment is treated differently.

This distinction becomes significant when a financial institution communicates information about a customer's conduct.

8. Supreme Court case law: credit files

The Spanish Supreme Court has developed extensive jurisprudence concerning inclusion in solvency files.

STS 174/2018, 23 March

This decision is particularly relevant to the treatment of debt information and the right to honour.

The Supreme Court's jurisprudence emphasizes that inclusion in a solvency file is not merely an administrative event. Because such inclusion can damage a person's reputation and economic standing, statutory and data-protection requirements must be respected.

A creditor therefore cannot treat credit-file reporting as an unrestricted collection technique.

9. STS 245/2019, 25 April

The Supreme Court continued developing the requirements applicable to the processing of adverse credit information.

The jurisprudence stresses the importance of:

• existence of the debt;
• accuracy of the information;
• compliance with applicable requirements;
• legitimate purpose;
• proportionality.

The broader lesson for banks is that credit reporting must be substantively justified and procedurally compliant.

10. STS 672/2020, 11 December

The Supreme Court again considered disputes concerning information appearing in solvency files and its relationship with the right to honour.

Spanish case law generally distinguishes between:

legitimate reporting of genuine payment information

and

improper use of a credit file to pressure or stigmatize a debtor.

This distinction is extremely important for banking compliance departments.

11. The “pertinent debt” principle

A particularly important concept in Spanish jurisprudence is whether the debt is sufficiently certain and pertinent for inclusion in a solvency file.

The issue is not simply:

“Does the bank claim that the customer owes money?”

Instead, the legal analysis can require examination of whether the debt is genuinely established and whether the reporting mechanism is being used appropriately.

Where the underlying obligation is seriously disputed, courts may scrutinize the legitimacy of the reporting.

12. Procedural compliance matters

Spanish banking institutions should therefore maintain evidence showing:

1. the underlying contractual relationship;
2. the existence of the obligation;
3. the amount claimed;
4. the payment history;
5. notices sent to the customer;
6. the basis for reporting;
7. the date of reporting;
8. requests for rectification;
9. deletion or correction where appropriate.

A failure in these procedures can transform an ordinary debt dispute into a data-protection and honour claim.

13. Reputation and banking confidentiality

Reputation management also intersects with banking confidentiality.

Banks hold highly sensitive information concerning customers, including:

• account balances;
• transactions;
• loans;
• investment activity;
• financial difficulties;
• identification information.

Disclosure outside legally permitted circumstances can create:

• data-protection liability;
• contractual liability;
• confidentiality issues;
• reputational harm.

The GDPR principle of data minimisation is especially relevant.

Banks should therefore distinguish between:

information necessary for legitimate banking/regulatory purposes

and

information unnecessarily disclosed to third parties.

14. Corporate reputation of banks

The protection also works in the opposite direction.

A bank itself may have reputation interests.

Spanish law recognises protection of the honour of legal persons in appropriate circumstances.

For example, a bank may potentially challenge a false factual allegation that seriously damages its commercial reputation.

However, banking institutions operate in a heavily regulated environment. Criticism by:

• customers;
• journalists;
• consumer organisations;
• shareholders;
• academics;
• regulators;

may fall within protected expression or information.

The crucial question is therefore whether the communication is:

• factual or opinion-based;
• truthful or false;
• relevant to a matter of public interest;
• unnecessarily defamatory;
• supported by an adequate factual basis.

15. Banking complaints and reputation

A customer complaining about a bank does not automatically commit unlawful reputational interference.

For example, statements such as:

“The bank charged me a fee that I believe was not permitted by my contract”

are substantially different from an unsupported factual accusation of criminal conduct.

Banks should therefore be cautious about threatening customers with reputational or defamation proceedings merely because customers make complaints.

16. Reputation management and debt collection

Debt collection presents a particularly sensitive area.

A bank or collection agency may legitimately contact a debtor about an outstanding obligation.

But the collection process should not unnecessarily expose the debtor's financial situation to:

• neighbours;
• colleagues;
• unrelated relatives;
• employers;
• other customers.

Disclosure to third parties can create significant privacy and honour issues.

17. Data Protection and the AEPD

The Spanish Data Protection Agency (AEPD) plays an important supervisory role.

A customer can exercise GDPR rights against the bank, including:

Access

Request information about personal data being processed.

Rectification

Request correction of inaccurate information.

Erasure

Request deletion where the legal conditions are satisfied.

Restriction

Ask that processing be restricted in appropriate circumstances.

Objection

Object to certain forms of processing.

These rights are particularly important where banking data affects the customer's credit reputation.

18. Banking regulatory dimension

The Banco de España also plays an important role in customer protection and banking supervision.

Its responsibilities differ from those of the AEPD.

A useful distinction is:

A reputation dispute may therefore involve more than one institution.

19. Case-law principles for banks

Spanish jurisprudence produces several practical principles.

Principle 1 — Accuracy

Banks should not circulate inaccurate customer information.

Principle 2 — Legitimate purpose

Credit reporting must serve a genuine credit-information purpose.

Principle 3 — Proportionality

Even accurate information should not automatically be disclosed everywhere.

Principle 4 — Procedural compliance

Failure to satisfy reporting requirements can create liability.

Principle 5 — Reputation is legally protected

Economic reputation can form part of the protected sphere of honour.

Principle 6 — Truth matters

A truthful and properly communicated factual statement receives stronger legal protection than an unsupported allegation.

Principle 7 — Freedom of expression matters

Banks cannot suppress legitimate criticism simply because it is commercially inconvenient.

20. Example banking dispute

Imagine that a customer disputes a €4,000 bank charge.

The bank nevertheless reports the customer as a delinquent debtor.

The customer argues that:

• the charge is disputed;
• the contractual basis is unclear;
• the information is damaging their ability to obtain financing.

The legal analysis would potentially involve:

Contract law → existence of the debt

↓

GDPR/Spanish data protection → legality and accuracy of processing

↓

Credit-file rules → legitimacy of inclusion

↓

Article 18 Constitution → right to honour/privacy

↓

Civil jurisprudence → possible damages

The bank should therefore be able to demonstrate the legal and factual basis for its reporting.

21. Remedies available to an affected customer

Depending on the circumstances, the customer may seek:

A. Rectification

Correction of inaccurate banking information.

B. Erasure

Removal of unlawfully processed information.

C. Restriction

Temporary restriction while accuracy or legality is determined.

D. Administrative complaint

A complaint to the AEPD may be appropriate for data-protection issues.

E. Civil action

A claimant may seek protection of the right to honour and damages.

F. Compensation

Where legally established, compensation may cover relevant economic and/or non-economic harm.

22. Compliance framework for Spanish banks

A robust reputation-management framework should contain:

Customer-data governance

→ accurate records
→ controlled access
→ retention rules
→ correction procedures

Credit reporting

→ verify debt
→ verify amount
→ verify reporting conditions
→ document notices
→ promptly correct errors

Communications

→ factual accuracy
→ proportionality
→ confidentiality
→ limited disclosure

Complaints

→ internal review
→ evidence preservation
→ escalation
→ correction where justified

Litigation

→ preserve records
→ assess Article 18/20 interests
→ coordinate legal and compliance teams.

23. Key case-law list

For research purposes, the following Spanish jurisprudence is particularly useful:

1. STC 139/1995 — constitutional protection of honour.
2. STC 49/2001 — honour and freedom of expression/information.
3. STS 174/2018, 23 March — credit information and right to honour.
4. STS 245/2019, 25 April — solvency-file reporting and reputation.
5. STS 672/2020, 11 December — adverse credit information and honour/data protection.
6. Supreme Court jurisprudence on solvency files (ficheros de morosidad) — development of the requirements concerning certainty, accuracy, proportionality and legitimate reporting.

Because Spanish Supreme Court jurisprudence in this area is extensive and fact-sensitive, the precise holding of each judgment should be checked against the particular type of credit-file or reputation dispute before relying on it in litigation.

24. Conclusion

Reputation management rights in Spanish banking law operate at the intersection of constitutional honour rights, GDPR/data-protection law, credit-information regulation, banking confidentiality and freedom of expression.

For banks, the most significant practical risk is the improper circulation of adverse information about customers, particularly through credit-information systems. A bank needs more than a commercial reason for reporting a customer: it must have a legally supportable basis, accurate information and appropriate procedures.

For customers, the principal protections are the ability to challenge inaccurate, unlawfully processed or improperly disseminated financial information, including through data-protection rights and protection of the constitutional right to honour.

The case law therefore establishes a balance: legitimate credit-risk information may be communicated, but inaccurate, disproportionate or improperly reported information can produce data-protection and reputation liability.