A legal hole opens to the public the personal data of tens of thousands of freelancers

Alba Sierra searched for herself on Google one day. To her surprise, she saw that one of the first entries in the search engine offered the option to “consult the CIF, address and telephone number” of her. She clicked on the link and entered a business information portal. There were her ID, her postal code, personal address, telephone number and email, as well as a comment about her economic solvency. Her data was available to everyone. And there they are, in fact. Anyone who knows her name can report to her house or call her.

Alba Sierra is the fictitious name of a freelance worker (she is a graphic designer) very careful with her digital trail and jealous of her privacy. That is why she was so surprised to see that this information, which she tries never to share, is publicly accessible. She began to investigate it as part of a postgraduate project on Technopolitics and Law in the Digital Age at the University of Barcelona. That was the germ of a report that Xnet has completed, an activist organization for the defense of digital rights. Their conclusions: there is a systemic exposure of the personal data of self-employed workers, which are even commercialized without their knowledge. And the most affected categories are some of the lowest income.

The Xnet team held a meeting with the Spanish Agency for Data Protection (AEPD) a few weeks ago, in which they informed them of the investigation they were developing. The Agency is now waiting to receive the complete report, which the organization will present to it this week in the form of a question mark. After studying it, it will be “analyzed to see how the issue should be addressed,” say AEPD sources.

How does such intimate information about people become so visible? The data journey begins from the moment someone registers as a freelancer. To do this, you must register in the census of economic activities of the Tax Agency, which requires providing your name, ID, telephone number, email and address, among others. Those who work at home, either voluntarily or because they cannot afford an office or coworkingThey must give their address and personal number. Hence, Xnet has confirmed that the self-employed with lower incomes are more exposed than the rest.

The Treasury then transfers this data to the Chambers of Commerce, which prepare a public census of companies and turn it into a directory prepared by Camerdata, a company dependent on the chambers. There you can consult and buy data from Spanish companies to “carry out commercial actions”, identify new customers, etc. The self-employed are companies, so they are also included in that database.

Some specialized search engines, such as Einforma or Axesor, buy these databases, process them and offer them to their clients. It is on one of those platforms that Alba Sierra found her address and ID. The first consultations are usually free, but for the others you have to pay. The price ranges between 9 and 40 euros. That’s the cost of getting the personal information of freelancers who work at home.

The exposure of personal data is not illegal (self-employed workers are required to notify an address), but it has perverse consequences: by being self-employed, some individuals have their private information visible to anyone.

How many people are in this situation? Xnet calculates that around a million people with an income equal to or less than 1,000 euros per month have options to find their personal data on the Internet. It is an estimate. The researchers have worked with databases from Einforma and Axesor, two of the main business information platforms, and have come to obtain an approximate number of how many freelancers they have on file: some 1.4 million. The income filter leaves the million figure. What cannot be known is how many of them have their personal address registered as a place of work (and therefore on the public radar).

They did see that, in some of the activities or headings of the self-employed, the number of records that the platforms have exceeds that of the self-employed registered, according to the INE. “That’s because, sometimes, the platforms continue to offer data from freelancers who have already unsubscribed,” explains Simona Levi, founder and director of Xnet and coordinator of the report.

Privacy and right to information

The personal data of many freelancers is available on the internet, among other things, because they can be. “Companies such as Axesor or Einforma do not commit any illegality: their activity is protected by European regulations and by the Spanish Law on the Reuse of Public Sector Data,” says Borja Adsuara, a lawyer and expert consultant in digital law. Many of these companies are represented in the Multisector Information Association, Asedie, which in 2018 was awarded by the AEPD itself for its “good practices in privacy and protection of personal data”.

Levi believes that the marketing of this data does not conform to the Law. “We believe that the law is being broken because when you give your data to the Treasury you are not informed that they are going to go to the Chamber of Commerce and that they will end up in consulting firms. The General Data Protection Regulation (GDPR) obliges the affected person to be told what their data is going to be used for, ”stresses the activist.

The ease of obtaining data from individuals contrasts with the growing obstacles surrounding the search for information from other companies. The Court of Justice of the EU has recently ruled that public access to company ownership records supposes “an interference with fundamental rights”, respect for private life and the protection of personal data, issues that are guaranteed in the EU Charter of Fundamental Rights. “The comparison between the CJEU ruling and the immediate reaction of many countries, which have closed their records, and how the data of those who work with little income are exposed for years is shocking,” says Levi.

Xnet proposes a series of legislative modifications to prevent the data of the self-employed from being exposed. It also requests that self-employed workers with incomes of less than 3.5 times the Public Indicator of Multiple Effects Income or Iprem (about 2,000 euros gross), of whom it is assumed that they cannot afford an office, are not forced to use for such purposes, your home address.

You can follow THE COUNTRY TECHNOLOGY in Facebook Y Twitter or sign up here to receive our weekly newsletter.