Andorra Sole Proprietor Challenges Public Listing of Home Business Address

A citizen in Andorra has raised concerns with the Data Protection Agency (APDA) after discovering that the address of his home-based business was publicly listed on a website aggregating company data from around the world, including the Principat.

The individual, operating as a sole proprietor, argued that publishing his residential address violated data protection rules. The website in question displays basic details like company addresses for free, while charging for in-depth profiles, credit reports, financial statements, and shareholder information.

Andorra's Data Protection Law permits processing contact data for sole entrepreneurs and professionals when it relates solely to their business role or professional affiliation, provided it serves a legitimate interest that does not override the individual's fundamental rights—particularly if the person is a minor.

The APDA advised the complainant to first exercise his rights directly with the website operator and the data source. This involves requesting deletion, clarifying the legal basis and purpose of the data publication. The citizen reported no response despite using the site's contact form, prompting the agency to recommend sending a formal letter by post with acknowledgment of receipt.

Only after this step—and if the response is absent, inadequate, or unjustified—can the affected party file a formal complaint with the APDA for potential enforcement action. The entrepreneur expressed frustration, questioning why he must "prove they do not respond" and calling for direct agency intervention, especially since the issue likely affects numerous Andorran businesses. He also challenged the legal basis for disseminating such private data.

The APDA clarified that its remit covers personal data only. For entrepreneurs and professionals, it weighs legitimate interests against individual rights. Victor Roselló, a lawyer specialising in data protection, stated that when a company's registered address matches a private home, it qualifies as personal data because it identifies a physical person.

Roselló endorsed the APDA's process: contact the website, wait 30 days even without reply, then submit the file to the agency for a formal demand to remove the information.