AEPD (Spain) - PS/00070/2020

AEPD - PS/00070/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(a) GDPR Article 6(1)(f) GDPR Article 58(2)(b) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	PS/00070/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) held that publishing an unredacted copy of a local court judgment on Facebook breached Article 5(1)(a) GDPR.

English Summary

Facts

The respondent published on his personal Facebook page an unredacted copy of a judgment from a local court case in which he was a co-defendant in his capacity as Mayor. The claimant, an employee of the Mayor’s Municipality, was also a party in the case, and could be identified from the personal information featured in the judgment published.

Dispute

Did the publication of the judgment breach the GDPR?

Holding

The AEPD held that the respondent’s actions violated the GDPR Article 5(1)(a) requirement that processing must be lawful, fair and done in a transparent manner, because “no lawful basis was accredited to the processing”. They also stated that the claimant had a right for data associated with the development of his job to not to be used in a surprising manner nor on social networks. (Part III Fundamentos de Derecho).

The AEPD rejected the respondent’s claim that the processing was based on the lawful basis of legitimate interest under Article 6(1)(f), as the processing of the claimant’s data was unnecessary since it could have been redacted before publishing the judgment. For this reason the respondent also failed the legitimate interest balancing test, with the “lasting effect” of the processing on the claimant overriding the respondent’s entitlement to process the personal data. (Part IV Fundamentos de Derecho).

Finally, the AEPD issued the respondent with a reprimand, citing GDPR Recital 148, where it states that “if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.” (Part V Fundamentos de Derecho).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                               1/14











     Procedure Nº: PS / 00070/2020
938-300320


                RESOLUTION OF SANCTIONING PROCEDURE


       Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following

                                  BACKGROUND


FIRST: A.A.A. (hereinafter, the claimant) on 09/19/2018 filed
claim before the Spanish Data Protection Agency against B.B.B. (in
forward, the claimed). The reasons on which the claim is based are that the
claimed performs the functions of Mayor of *** LOCALIDAD.1, and in his

condition of such, was co-defendant along with the City Council in a procedure in
the Social Court. The defendant has exposed the *** DATE.1 on his page of
FACEBOOK the sentence integrates with all personal data and the rest of
the circumstances associated with the matter, being able to access it any
person.


       Provides printing of the FACEBOOK page of the claimed in which
Some comments stand out and the full sentence is attached. In the sentence the
claimant is a plaintiff against the City Council and the defendant, as

Mayor of the municipality.

SECOND: After processing the claim to the CITY COUNCIL OF *** LOCALITY. 1
(Mayor) in the sanctioning procedure (PS / 00430/2018), on 02/04/2020, was issued
resolution of the director of the AEPD, agreeing: “DECLARE, in accordance with

the provisions of article 90.1 of the LPCAP the non-existence of liability for
the CITY COUNCIL OF *** LOCALIDAD.1 (MAYOR) in the alleged infraction of the
Article 6.1.f) of the RGPD. "





















C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/14








         In its foundation of law III it was indicated:


         “The making available through the FACEBOOK platform of the sentence
cia integra containing personal data of the claimant, a colleague
of this and the circumstances surrounding the case, visible to anyone, regardless of
zeros, implies the imputation to the CITY COUNCIL OF *** LOCALIDAD.1 of an infraction
tion of article 6.1, f) of the RGPD for data processing through an au-
tomatizado, which through the social network allows adding or uploading documents, such as the

judgment.

         It is observed that without the intermediation of the platform of the social network, no
If it had been possible to access and know the data that appeared in the sentence

Inc. The City Council is the owner of files that contain personal data
among others those related to the development of labor relations.

         However, in this case, it does not appear that the City Council had intervened

in any way in the setting of means or purposes of the treatment nor can it be said that
The mayor will act officially as spokesperson or person in charge of the treatment of that
but rather that the Mayor as the holder of the sentence document, in a private environment
As was his FACEBOOK page, he fully exposed the sentence. Although it
did to respond to the claims of the claimant, who did not mention ex-

The name of the Mayor was expressly displayed on the B.B.B. website, and not on the
of the townhall. The treatments carried out by the
City Council and the natural persons who act within it according to the instructions
imparted, of which even belonging to its structure they treat the same
margin of the instructions given or for their own benefit. Although on the page of
FACEBOOK in which the sentence was exposed indicated his status as Mayor,

it is proper to the Mayor, not as such a condition, but in a private capacity. In this case, the
responsibility for the use of the same is of said natural person as responsible for the
treatment, not the City Council.


         Article 28 of Law 40/2015, of 1/10, on the legal regime of the public sector
co states:

       "1. They can only be sanctioned for acts constituting an infringement
administrative natural and legal persons, as well as, when a law
Recognize the capacity to act, the affected groups, the unions and entities without

legal personality and independent or autonomous patrimonies, which are
responsible for them by way of fraud or fault. "
       The conduct that consists of referring, in a social network, web page

created and fed by B.B.B., personal data should be considered treatment of
data, which according to technical and computer procedures involve performing
the operations necessary to make your content accessible to people
that are connected to the Internet, through the FACEBOOK platform, these being
operations carried out, in an automated way.
        Since the principles of the field of criminal law are applicable, with certain

tices, in the administrative sanctioning field, and according to the proven facts,
leaving further admitted by B.B.B. who presented the sentence as a defense to the


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/14








attacks that contained the claims of the claimant, it is not possible to impute the
infraction to the City Council and declare that it has committed the same.
       Given that the events that gave rise to the claim take place on 09/12/2018,

and due to their seriousness, they are not prescribed, so we will proceed to initiate
lie against the person of B.B.B .. "

THIRD: As actions within the claim that motivated the
PS / 00430/2018 that are incorporated herein, included:


    “In view of the facts and the documents provided by the claimant, when
claimed, a copy of the claim is sent through the AEPD, so that
send:

    1. Copy of the communications and the adopted decision that has been sent to the

        claimant regarding the transfer of this claim.
    2 Report on the causes that have motivated the incidence that has originated the
        claim.
   3. Report on the measures adopted to prevent incidents from occurring
       Similar.


       On 11/23/2018, the CITY COUNCIL states in its response with
signature of the Mayor, B.B.B., the claimed one, indicating:

    1) The claimant provides services for the City Council and has filed a decision
        sends before the Social Court requesting the termination of his employment contract
        under derived from article 50 of the Workers' Statute, due to
        workplace harassment, and repeated breaches of the City Council, requesting a
        compensation of € 50,000 for moral damages. The content of the sentence

        reveals the vicissitudes in the claimant's relationships with a partner and
        other personal circumstances of the claimant in the provision of services
        such as moving to another plant and reassigning tasks between employees.
        The defendant states that the day after the sentence is notified,
        09/12/2018, the claimant on his FACEBOOK wall published a message from
        that a copy is provided in which it begins “it is sad to have to go to trial to

        that two days before it, the defendant does what he should have done-
        five months earlier, which has largely led to the demand being
        dismissed. I already knew when I filed the claim the difficulty of proving
        a situation of harassment at work, especially in a public administration
        but if I had not gone to court, possibly this matter would be involved

        in an unresolved drawer, and my personal and professional dignity questioned by
        written, which in no way can he admit ... It has been made clear that my
        behavior as an employee and co-worker has been correct ”.
        He is grateful for the neighborhood support and ends by stating that he is going to present himself at the
        next elections.


               In view of these comments, the respondent states:

       to. He presented the sentence before the claimant's intention to misrepresent the
       content and failure of the same that was unfavorable.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/14








               In the same social network FACEBOOK made a statement in which
       begins by stating that “a person linked to the City Council is trying
       to manipulate local public opinion with falsehoods and half truths with

       relation to a labor matter. Said person filed a labor lawsuit
       against the City Council and against me on 06/22 ”, refers to the name and surname
       two, which are contained in the ruling of the sentence, and points out that because it is illustrative
       goes and “to prove the facts more than the malicious manifestations
       without any proof ”“ I accompany in this message the sentence integrates ”by understanding
       der that it indicates that there is no indication of professional injury or

       attack on your dignity. Together with these comments, the sentence ex-
       put, of which provides a full copy.

               It states in it that there is legitimacy for it derived from the ar-
       Section 6.1. c) and 6.1.e) and at the individual level 6.1.f) of the RGPD due to the serious

       sations that it poured in its demand and of the 69 and 70 bis 3 of the LBRL.

       b. It adds that the publicity of personal data, such as the situation
       The claimant's occupational and health status have been disclosed by the claimant himself
       complaining to many residents of the Council considering that it rules out the event
       tual illegality of the treatment object of the claim.


       c. In addition, there was a clear public interest as shown by the fact that
       submitted signatures of citizens in support or in the interests of the claimant
       (Provide copies of them).


    2) From the reading of the judgment of 09/11/2018, it is clear, among others
        elements:

            - Lawsuit is filed against the City Council and D. B.B.B. as
         defendant, in the sentence they also refer to this as Mayor.


            - In proven facts, a colleague from the rector's work is identified
         clamoring and details the situation of conflict and tension between the two, the harassment and
         harassment that the employee claims to suffer and the request for measures to
         sell the situation that the claimant made to the City Council. The
         actions of the Mayor bringing together complaints from both employees, the

         reassignment of tasks and relocation to the second floor of the plaintiff, and
         the interviews. The status of the applicant in IT situation is mentioned
         from 03/23/2018 "due to anxiety disorder, which continues". It contains
         the Mayor's agreement of 04/12/2018 for the reassignment of tasks.


            - On the basis of law, the judge indicates that the plaintiff intends to
         of the termination of the contract based on workplace harassment. Enter to assess happiness
         question.

            - On legal grounds it is indicated that “there is no existence of

         any decisive indication of any situation of harassment, persecution
         degradation or attack on the personal and labor dignity of the plaintiff ”” or
         “The Mayor here sued as the author of the persecution that the
         plaintiff denounces, after the briefs presented by the parties on 25 and

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/14








         01/30 met with them ... it is indicated that the Mayor intended to try
         solve the confrontation ”. The claim is dismissed.


          3) Provide a copy of the document delivered to the claimant on 11/22/2018 in the
which details explanations of the reasons for which the judgment is dismissed.
I send the request that he makes to the AEPD. "

Likewise, in PROVEN FACTS of PS / 00430/2018, there were:


1) “The claimant, labor employee, administrative assistant of the City Council of
*** LOCALIDAD.1 filed on 06/25/2018 a lawsuit before the Social Court
against D. B.B.B. and the City Council of *** LOCALIDAD.1 requesting the termination of the
labor relationship for violation of their rights and compensation of 50 thousand euros for
damages. The lawsuit ended with a ruling dated 09/11/2018. In the sentence

reference is made to D. B.B.B. as Mayor, Chief of Staff and his resolutions
dictated. The lawsuit “dismisses the one presented by the claimant, acquitting
the defendants of the claims made against them ”.

2) The sentence assesses the alleged workplace harassment by the claimant, the bad relations
with a partner of the claimant, who is identified by names and surname

two, writings presented by her to the Mayor referring to the work environment with the
claimant, the claimant's change of plant as a result of a meeting of the
Mayor with the parties on 02/02/2018. The judgment determines that there is no
evidence of any decisive indication of any situation of harassment, persecution,
Damage or attack on the personal and labor dignity of the plaintiff "To the Mayor, here

defendant as the author of the persecution that the plaintiff denounces… .meet
with them ... and that the plaintiff stated that he did not want to be on the ground floor,
so much does not explain what type of retaliation that is when you are acceding to what
the actor himself requested “there is not the slightest indication that there has been a
Mayor's conduct aimed at persecuting or harming the complainant, rather everything

contrary." In the ninth proven fact, it is indicated that the plaintiff “went to the situation
tion of TI due to anxiety disorder on 03/23/2018, in which it continues ”.

 3) The claimant exhibited on his FACEBOOK page, associated with his name and
surnames a message on 09/12/2018 at 18:21 indicated "Today is a great day" in which
states that “It is sad to go to trial so that two days before the trial the defendant

do what you should have done 5 months earlier, which has largely motivated
that the claim be dismissed ”, without explaining what it refers to, it continues by stating
that “he knew that when he filed the lawsuit it would be difficult for him to prove the harassment in the
work ", which" is clear that his behavior as an employee and colleague
has been correct ”, that“ he has been working as a public employee for 18 months ”,

thanks the neighborhood support received and announces that he is going to enter politics ”.

4) After seeing the complainant, Mayor of *** LOCALIDAD.1, the announcement of the complainant
on the same social network FACEBOOK, on a page with the name B.B.B.,
without any reference to the City Council, he presented a written reply entitled “CO-

OFFICIAL MUNICATE ”stating that“ some people linked to the City Council
They are trying to manipulate public opinion with falsehoods and half truths.
lime in relation to a labor issue that should never have left the walls
of the consistory ”.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/14









        He indicates that said person filed his claim on 06/22/2018 against him and the
City Hall, accusing him of workplace harassment and asking for compensation. Appoint the

verbatim of the judgment with the name of the claimant. He states that in the face of the demonstrations
malicious intent, exposes the entire sentence. Add to your writing with your name
and surnames, the position of Mayor of *** LOCALIDAD.1

4) The defendant states that he removed the sentence during the processing of the
This procedure, upon receipt of the initiation agreement. "


FOURTH: On 03/9/2020, the director of the AEPD agreed:

        "INITIATE SANCTIONING PROCEDURE of APERCIBIMENTO to B.B.B.,
for the alleged violation of article 5.1.a) of the RGPD, in accordance with article 83.5.a) and

58.2.b) and d) of the aforementioned RGPD. "

FIFTH: On 06/12/2020, the defendant presents the following allegations:

-The exposure occurred due to the serious accusations of workplace harassment, non-compliance-
repeated coughs of the City Council, violation of fundamental rights contained

in the lawsuit and also in view of the misrepresentation of the content of the
The claim that the complainant stated in his letter on the social network Facebook on 09/12.
It considers that there is a legitimate interest of the Mayor to publish the sentence that
the non-existence of such allegations.


-The total and complete exposition of the sentence is also justified, in terms of the
data storage by:

- article 6.1. c) of the RGPD since it is a legal competence and obligation to inform the
neighbors by local Corporations, which is provided for in the law on the basis of the
moan local.

-Article 6.1 f) of the RGPD, when the legitimate interest of the person in charge concur. Indicates that
The claims of the claimant affected his honor and his own image and rights.
fundamental reasons and that in view of the very serious allegations, the disclosure of

the judgment must prevail over the claimant's right to data protection.

-It states that once the electoral process held in May 2019 was concluded, it did not persist
aunt and the public interest in the publication of the judicial decision in question, reason
whereby when the requirement of the agreement that the
06/06/2019, the copy of the aforementioned sentence was removed from the Mayor's Facebook wall.



SIXTH: The resolution proposal was issued on 08/07/2020 with the literal: “That for the
Director of the Spanish Agency for Data Protection is sanctioned with
warning to B.B.B., with NIF *** NIF.1, for a violation of article 5.1.a) of the

RGPD, in accordance with article 83.5 a) of the RGPD. "

    No allegations are received against it.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/14








                                 PROVEN FACTS



1) The claimant, worked as labor personnel, administrative assistant in the Town Hall-
location of *** LOCALIDAD.1, and filed on 06/25/2018 a lawsuit before the
the social against D. B.B.B. and the City Council of *** LOCALIDAD.1 requesting the extinction
employment relationship for violation of their rights and compensation of 50 thousand

euros for damages. The lawsuit ended with a ruling dated 09/11/2018. In the
sentence refers to D. B.B.B. as Mayor, Chief of Staff and their
resolutions passed. The lawsuit “dismisses the one presented by the claimant, absolving
seeing the defendants of the claims made against them ”.

     The sentence assesses the alleged workplace harassment by the claimant, his bad response

relationships with a partner, who is identified with names and surnames, written
presented by her to the Mayor regarding the work environment with the claimant, the
change of plant of the claimant as a result of a meeting of the Mayor with
the parties on 02/02/2018. The judgment determines that there is no evidence
any determinant of any situation of harassment, persecution, degradation or attention

to the personal and labor dignity of the plaintiff "To the Mayor, here defendant
as the author of the persecution that the plaintiff denounces… .meet with them… and
that the plaintiff stated that he did not want to be on the ground floor, therefore
explains what kind of retaliation this is when you are acceding to what the ac-
tor requested “there is not the slightest indication that there has been a conduct of the

Mayor aimed at persecuting or harming the plaintiff, rather the opposite. " In
the ninth proven fact, it is indicated that the plaintiff “went to the IT situation by
anxiety disorder on 03/23/2018, in which it continues ”.


2) The claimant exhibited on his FACEBOOK page, associated with his name and

surnames a message on 09/12/2018 at 18:21 indicated "Today is a great day" "It's sad
go to trial so that two days before the trial the defendant does what he had to
have done 5 months before, which has largely motivated the demand to be
dismissed ”, without explaining what he refers to, he continues by stating that“ he knew that when
filed the lawsuit, it would be difficult for him to prove the harassment at work ”, which“ is clarified

Your behavior as an employee and co-worker has been correct.
to ”, who“ has been working as a public employee for 18 months ”, appreciates the support of the neighbors
nal received and announces "that he is going to enter politics." After viewing the claimed ad
of the claimant in the same social network FACEBOOK, on a page that contains
with his name, B.B.B., without any reference to the City Council, presented a letter of

response entitled "OFFICIAL COMMUNICATION" noting that "by some people
linked to the City Council is trying to manipulate with falsehoods and means
local public opinion regarding a labor issue that should not have been
never left the walls of the consistory ”.

       He indicates that said person filed his claim on 06/22/2018 against him and the

City Hall, accusing him of workplace harassment and asking for compensation. Appoint the
verbatim of the judgment with the name of the claimant. He states that in the face of the demonstrations
malicious intent, exposes the entire sentence. Add to your writing with your name
and surnames, the position of Mayor of *** LOCALIDAD.1.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/14








3) The defendant states that he / she removed the sentence, during the processing of the
You procedure, "upon receipt of the initiation agreement."




                            FOUNDATIONS OF LAW

                                             I


        By virtue of the powers that article 58.2 of the RGPD recognizes to each
control authority, and as established in arts. 47 and 48.1 of the LOPDGDD, the
Director of the Spanish Data Protection Agency is competent to resolve
this procedure.



                                             II

        First of all, the jurisprudential doctrine of the
Constitutional Court in this matter that configures the right to the protection of
data as an autonomous fundamental right, differentiated from the fundamental right

to privacy. It thus states in its Judgment 292/2000 the following:

       “In this way, the object of protection of the fundamental right to protection
data is not reduced only to the intimate data of the person, but to any type of
personal data, whether or not intimate, whose knowledge or use by third parties may

affect their rights, whether or not they are fundamental, because its object is not only the
individual privacy, for this is the protection that art. 18.1 CE grants, but
personal data. Therefore, it also reaches those data
public personnel, that by the fact of being, of being accessible to the knowledge of
anyone, they do not escape the power of disposition of the affected person because it is guaranteed by

right to data protection. Also for this reason, the fact that the data is of a
Personal does not mean that only those related to private or intimate life have protection
of the person, but the data covered are all those that identify or
allow the identification of the person, being able to serve for the preparation of their profile
ideological, racial, sexual, economic or of any other nature, or that serve to
any other utility that in certain circumstances constitutes a threat

for the individual. "

        The aforementioned Judgment 292/2000 also determines the content of the right
to the protection of personal data, indicating in its legal basis 7:


        “From all that has been said, it follows that the content of the fundamental right to
data protection consists of a power of disposition and control over data
personal data that empowers the person to decide which of these data to provide to
a third party, be it the State or an individual, or which third parties can collect, and that
it also allows the individual to know who owns this personal data and for what,

being able to oppose that possession or use. These powers of disposition and control
on personal data, which constitute part of the content of the right
fundamental to data protection are legally specified in the power of
consent to the collection, obtaining and access to personal data, its subsequent

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/14








storage and treatment, as well as its use or possible uses, by a third party, be it the
State or an individual. And that right to consent to knowledge and treatment,
computer or not, of personal data, requires as complements
indispensable, on the one hand, the ability to know at all times who has the
these personal data and what use is being submitted, and, on the other hand, the power

object to that possession and uses.

       In short, they are characteristic elements of the constitutional definition of law.
fundamental to the protection of personal data the rights of the data subject to consent
about the collection and use of your personal data and knowing about them. And they result
essential to make this content effective the recognition of the right to be

informed of who owns your personal data and for what purpose, and the right to be able
oppose such possession and use by requiring whoever corresponds to put an end to the
possession and use of data. That is, demanding from the owner of the file that
report what data you have about yourself, accessing your appropriate records and
seats, and what destination they have had, which also reaches possible assignees; and,

where appropriate, require you to rectify or cancel them. "

                                           III

       The RGPD defines in its article 4:

1) "personal data": any information about an identified natural person or
identifiable ("the interested party"); an identifiable natural person shall be considered any person
whose identity can be determined, directly or indirectly, in particular by means of

an identifier, such as a name, an identification number, data from
location, an online identifier or one or more elements of the identity
physical, physiological, genetic, psychic, economic, cultural or social of said person; "

  2) "treatment": any operation or set of operations carried out on
personal data or sets of personal data, whether by procedures

automated or not, such as collection, registration, organization, structuring,
conservation, adaptation or modification, extraction, consultation, use,
communication by transmission, broadcast or any other form of authorization of
access, collation or interconnection, limitation, deletion or destruction;

 4) "file": any structured set of personal data, accessible in accordance with

 to certain criteria, whether centralized, decentralized or distributed in a
 functional or geographic;

  7) "data controller" or "controller": the natural or legal person,
public authority, service or other body that, alone or together with others, determines the
purposes and means of treatment; whether the law of the Union or of the Member States

determines the purposes and means of the treatment, the person responsible for the treatment or
Specific criteria for their appointment may be established by Union law
or from the Member States;

       The defendant exposes a sentence integrated with the data of an employee of the
Town Hall on the social network FACEBOOK. It does not follow that in the provision of the

data and its disclosure to third parties through the social network has intervened
other will than that of the claimed on a particular page, when in the sentence the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/14








claimed his position accommodated that of the procedural party in the trial (co-claimed
next to the Town Hall).

       The post exposed by the claimed in said social network supposes a treatment

automated, which using the FACEBOOK infrastructure reveals some
facts and data that allow the claimant to be identified through the integra
sentence set forth, together with the various circumstances that are
relate, among others, the development of their employment, or the allusion to third parties to the
that is identified as happening in the story of it.


       The claimed, in a private capacity, with his name and surname on FACEBOOK
expresses not only their opinions, but also adds the claimant's data that
voluntarily and consciously selects to upload to said network knowing the effects
multipliers that can have their visibility, and also holding a public position
so that you can undoubtedly be qualified as the person responsible for the treatment at

decide the purpose and the means of data collection and processing
personal data used in the reference framework it represents and above. East
The preceding frame does not cite personal data.

       The defendant who is part of a public institution, even if he spills his
opinions on a private and particular network where you appear as a particular user, could

have fought freedom of expression in another way, without the need for exposure
integrates of a sentence. In front of the claimant's quote on FACEBOOK, it is deducted
that does not expressly mention the respondent and the response regarding the protection of
data that affects those of the claimant, must be proportional, considering in addition to
that the defendant has an institutional relationship with the City Council. Not being in

In no way provided the full and integrated exposition of the sentence with the vision
of fully identifiable personal data, not only of the affected but of third parties
that appear in it. This claimed, interested party in the judicial process, as
public office that shares his condition, openly exposed in his user network of
FACEBOOK the sentence that it uploads and maintains a not short period of

time, even after the claimant's request that reaches him in the form of transfer
of the claim by this Agency.

       In the use of the data of the affected party, there must be a legitimate basis
provided for in article 6.1 of the RGPD, there are several. The fundamental right of
claimant, so that their data is not used in a surprising way, or in networks

associated with the development of their task, when it comes to countering
the defendant the declarations of the defendant suppose an illegal use of said
data, not adequate, necessary, or justified.

       It does not justify the presentation of the sentence integrated into the social network FACEBOK that
integrates the imputation of article 5.1.a) of the RGPD that indicates:


  1. The personal data will be:

a) treated in a lawful, loyal and transparent manner in relation to the interested party ("lawfulness,
loyalty and transparency ”);


       The use of the claimant's data on FACEBOOK is a use that has not been
consented by its owner, and no legitimate basis is accredited in the treatment of said
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/14








data in relation to the response to the complainant's comment that the complainant
should have offered.

                                           IV

         When the claimed act says to act on behalf of the City Council that holds
competences in matters of information to citizens, seeking to give a
official statement, it should be noted that he used an account on FACEBOOK from his

ownership, in which your data appeared, without any reference to the City Council.
Even if the defendant went to the judicial procedure as Mayor, the bases
legal entities that legitimize data processing vary from being a public entity and
pursue general interests that a private individual may have.

      For this purpose, recital 47 of the RGPD on the

legitimate interest, which indicates: "The legitimate interest of a data controller,
including that of a person in charge to whom personal data may be communicated, or of a
third, it may constitute a legal basis for the treatment, provided that no
the interests or rights and freedoms of the interested party prevail, taking into
account for the reasonable expectations of data subjects based on their relationship with the

responsable. Such a legitimate interest could occur, for example, when there is a relationship
relevant and appropriate between the data subject and the controller, such as in situations
those that the interested party is a client or is at the service of the person in charge. In any case,
the existence of a legitimate interest would require a careful assessment, even if
a data subject can reasonably foresee, at the time and in the context of the

collection of personal data, which may be processed for this purpose. In
In particular, the interests and fundamental rights of the interested party could
prevail over the interests of the data controller when proceeding to the
processing of personal data in circumstances in which the interested party does not
reasonably expect further treatment to take place. Since it corresponds
the legislator establish by law the legal basis for the processing of personal data

by public authorities, this legal basis should not apply to the
treatment carried out by public authorities in the exercise of their functions ”.

       Although referring to the legitimate interest of the previous regulations, for having a
doctrinal fixation in various judgments, paragraph 95 of the

judgment of 07/29/2019, of the Court of Justice of the European Union (“CJEU”),
matter "Fashion ID" that on the legitimate interest of article 7, letter f) of the directive
95/46, establishes three cumulative requirements for a data processing
personal data is lawful, namely, in the first place, that the person responsible for the treatment or the
third party or third parties to whom the data is communicated pursue a legitimate interest; in

second, the need to process personal data for the satisfaction
of the legitimate interest pursued, and, thirdly, the requirement that they not prevail
the fundamental rights and freedoms of the interested party (judgment of 05/04/2017,
Rīgas satiksme, C-13/16, EU: C: 2017: 336, paragraph 28).

       The protection regime of the interested party in the RGPD against the person responsible for the

treatment that intends to use your personal data based on a legitimate interest is
more intense in the RGPD than in the LOPD, since if in the latter, to allow the
legitimate interest, it was enough that "their rights or freedoms were not violated", in the
RGPD regime, it is enough that your interests, rights or freedoms prevail
about said legitimate interest. Note that the word interests is added, in front of the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/14








violation of the rights or freedoms previously necessary in the LOPD and that
no violation is necessary, but it is enough that your interests, rights
or freedoms are affected, even slightly, provided that said interest

prevails over the alleged legitimate interest. The sole argument of the claimed for
maintaining the legitimate interest is that he answered the accusations, not nominative,
but if it was understood against the city council, understanding they were serious and false.

       Regarding the concurrence of legitimate interest, it is considered that it could be
that the defendant had an interest in answering denying the news, but could

have it done through the City Council. The particular interest of the natural person was not
with which the defendant went to the court. His actions were not aired.
sonal but the mediated actions in the exercise of their position.

       On whether the treatment is necessary for the purpose or purposes, it is repeated

that the facts could have been made known by anonymizing all the ca-
personal character and data that would make any person identifiable, therefore no
it was neither necessary nor proportional.

       On the element that "rights and freedoms do not prevail
fundamental of the interested party ”. The right to data protection may assign to

other rights, however, the fact of the criticism that “every public power must
assume, whether true or not, you should not respond in this case through a social network
particular of the claimed person that fully exposes their data and makes known
clearly circumstances of your daily work life. The right cannot prevail
of the defendant because in the face of the opinion of the claimant the exposition of

data is a surprising treatment, not balanced and that produces some effects
durable in proportion to the use that the data has been kept in a social network,
in this case if he even cautiously withdrew them when he received the letter from
the AEPD when he receives the transfer as Mayor of the AEPD.


       In this case, the existence of any legitimate interest on the part of
neither of the claimant, nor is it considered as an official way of making known
information by a City Council. This allegation is therefore rejected


                                            V


       Article 83.5 a) of the RGPD, considers that the infringement of “the basic principles
costs for the treatment, including the conditions for consent under the
Articles 5, 6, 7 and 9 ”is punishable, in accordance with section 5 of the aforementioned article.
Article 83 of the aforementioned Regulation, with administrative fines of € 20,000,000 as

maximum or, in the case of a company, an amount equivalent to a maximum of 4%
total annual turnover of the previous financial year, opting-
I know for the highest amount. "


      Article 58.2 of the RGPD indicates: "Each control authority will have all
the following corrective powers listed below:
       b) punish any person in charge or in charge of the treatment with warning

when the processing operations have infringed the provisions of this
Regulation;
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/14








       Regarding the statute of limitations for infractions, the LOPDGDG establishes
a period of three years in article 72.1:


  "1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:


  a) The processing of personal data violating the principles and guarantees
established in Article 5 of Regulation (EU) 2016/679. "


      Recital 148 of the RGPD indicates that in order to impose the common measure

appropriate corrective action, particular attention should be paid to the nature, severity and duration
offense, or any relevant prior offense, and any other circumstances
aggravating or mitigating circumstance. For natural persons, instead of sanction me-
A fine may be imposed.



       Therefore, in accordance with the applicable legislation


        the Director of the Spanish Agency for Data Protection RESOLVES:

FIRST: IMPOSE a penalty of warning to B.B.B., with NIF *** NIF.1, for
an infringement of article 5.1.a) of the RGPD, as determined by articles 83.5 a)

and 58.2.b) of the RGPD.

SECOND: NOTIFY this resolution to B.B.B.

THIRD: Against this resolution, which ends the administrative procedure in accordance with
art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the

LPACAP, the interested parties may optionally file an appeal for reversal
before the Director of the Spanish Agency for Data Protection within a period of
month from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of

the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.

       Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the

LPACAP, the final resolution may be suspended in an administrative way
If the interested party expresses his intention to file a contentious appeal-
administrative. If this is the case, the interested party must formally communicate this
made by writing to the Spanish Agency for Data Protection,
Presenting it through the Electronic Registry of the Agency

[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest
records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. As well
must forward to the Agency the documentation that proves the effective filing
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/14










of the contentious-administrative appeal. If the Agency is not aware of the
filing of the contentious-administrative appeal within a period of two months from the
day after the notification of this resolution, would terminate the

precautionary suspension.

Mar Spain Martí

Director of the Spanish Agency for Data Protection


























































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es