AEPD (Spain) - PS/00126/2020

AEPD - PS/00126/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 22(2) LSSI
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	22.03.2021
Fine:	3000 EUR
Parties:	FURNISHYOURSPACE SL
National Case Number/Name:	PS/00126/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEDP) fined FURNISHYOURSPACE SL €3,000 for infringing the Spanish Law regulating cookies after an investigation launched due to a complaint referred by the Berlin DPA, for offering unclear information and not giving the option of rejecting the cookies.

English Summary

Facts

The Spanish DPA was referred a complaint filed with the Berlin DPA regarding a Spanish furniture company offering their services in Spain, France and Germany. The AEPD launched an investigation and analysed the cookie banners and the cookies privacy policy of the three websites corresponding to the mentioned three countries.

The AEPD discovered that the cookie banners did not give the option of rejecting the cookies in the first layer. Additionally, the first layer provided unclear information, saying that "we use cookies to optimize the users' experience", and proving a link for more information that redirects the user to their privacy policy, in which they inform of certain aspects of the cookies.

Dispute

Does this infringe the Spanish Act transposing the e-Privacy Directive?

Holding

The AEPD held that there had been an infringement of Article 22(2) of the Information Society Services Act, transposing the e-Privacy Directive, due to the fact that there was no option to reject the cookies and that the information offered in the banner and through the privacy policy was unclear.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/6








     Procedure No.: PS / 00126/2020
938-051119
                RESOLUTION OF SANCTIONING PROCEDURE

In the sanctioning procedure PS / 00126/2020, instructed by the Spanish Agency for

Data Protection, before the entity, FURNISHYOURSPACE SL., With CIF:
B67094375 owner of the web pages, www.muebledesign.com, (web page in
Spanish language); www.iconmobel.de, (website in German language) and
www.meublesconcept.fr (website in French), hereinafter, “entity
claimed ”, for alleged infringement of Law 34/2002, of July 11, on Services of the

Information Society and Electronic Commerce (LSSI), based on the following:

                                  BACKGROUND

FIRST: Through the "Internal Market Information System" (IMI), regulated

by Regulation (EU) nº: 1024/2012, of the European Parliament and of the Council, of 25
October 2012, (IMI Regulation), whose objective is to promote cooperation
administrative cross-border, mutual assistance between Member States and the
exchange of information, was received in this Spanish Agency for the Protection of
Data (AEPD), a claim, dated 11/15/18, made by an interested party before
the Berlin Commissioner for Data Protection and Freedom of Information

(Germany).

SECOND: In view of the facts presented, the General Subdirectorate of Inspection
of Data proceeded to carry out actions for its clarification, under the protection of the
investigative powers granted to the control authorities in article 57.1 of the

Regulation (EU) 2016/679 (RGPD) in file E / 1458/2019. So dated
04/08/19, you access the web pages of the claimed entity in which the
cookie policy, checking the following aspects:

Main Pages (first layer),


a.1.) On the website, www.muebledesign.com, a page written in Spanish, there is:
at the bottom of it, a banner, with the following message:

   “Our store uses cookies to improve the user experience. If you continue
                  by using this site, you accept the use of cookies "

                         <<accept>> - << more information >>

a.2.) On the website, www.iconmobel.de, page written in German, exists in the
lower part of it, a banner, with the following message:


 “Unser Shop verwendet Cookies, um die Benutzererfahrung zu verbessern. Wenn Sie
   diese Seite weiterhin nutzen, akzeptieren Sie die Verwendung von Cookies ”. ICH
                      <<AKZEPTIERE>> << More information >>

Whose translation into Spanish is:


  “Our store uses cookies to improve the user experience. If it continues
                     By using this site, you agree to the use of cookies.
                         <<OK>> - << More information >>
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6








a.3.) On the website, www.meublesconcept.fr, page written in French, exists in
the bottom of it, a banner, with the following message:

   “Notre boutique uses cookies for améliorer l'expérience utilisateur. If you
           Continue to use the site, you accept the use of cookies.

                      << J'ACCEPTE >> - << Plus d'informations >>

Whose translation into Spanish is:

  “Our store uses cookies to improve the user experience. If it continues
                    By using this site, you agree to the use of cookies.

                         <<Accept>> - << More information >>.

Information pages on "Cookies Policies" (second layer):

b.1.) Through the link << more information >> on the website

www.muebledesign.com, it redirects to the "Privacy Policy" page, where
The following aspects of cookies are reported, among others:

"The cookies used by this website are small text files
stored in the computer. In accordance with Article 22 of Law 34/2012
Information Society Services, these have the sole purpose of

manage user authentication, provide requested services and
transmit information over the network.

The user has the possibility to prevent the installation of "cookies" on his hard drive. The
browser must be configured to notify you before saving cookies on
the hard drive or delete those that are already stored. User can set to

your browser which cookies are allowed and which are not. In addition, the user can
allow so-called session cookies, which are automatically deleted once
session ended. It is also possible to delete cookies manually in
any moment. Please note that rejecting cookies on our website
may prevent or severely restrict access to our services. See the
instructions and the manuals of your browser if you want to know more about the handling of

cookies".

b.2) Through the << more information >> link on the website www.iconmobel.de,
This redirects to the "Privacy Policy" page, where it is informed, in language
German, of the characteristics of cookies, in the same terms indicated
previously in Spanish.


b.3) Through the link << plus d'informations >>, on the website
www.meublesconcept.fr, it redirects to the "Privacy Policy" page, where
informs, in French, of the characteristics of cookies, in the same
terms indicated above in Spanish language.


THIRD: In view of the facts denounced and in accordance with the evidence
available, on 06/05/20, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against the claimed entity,


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6








for violation of article 22.2) of the LSSI, punishable in accordance with the provisions of the
art. 39) and 40) of the aforementioned Law, regarding its Cookies Policy.
FOURTH: On 06/16/20, the entity was notified of the initiation of the file

claimed, which has not submitted to this Agency, any written allegations,
within the period granted for this purpose.

                                 PROVEN FACTS

1.- Regarding the Cookies Policy of the reported web pages, it has been

found that:

a.- Main Pages (first layer),

a.1.) On the website, www.muebledesign.com, a page written in Spanish, there is:

at the bottom of it, a banner, with the following message:

   “Our store uses cookies to improve the user experience. If you continue
   By using this site, you accept the use of cookies - "accept" - "more information".

a.2.) On the website, www.iconmobel.de, page written in German, exists in the

lower part of it, a banner, with the following message, (translated into
Castilian):

  “Our store uses cookies to improve the user experience. If it continues
       By using this site, you agree to the use of cookies. I ACCEPT- More information "


a.3.) On the website, www.meublesconcept.fr, page written in French, exists in
the lower part of it, a banner, with the following message, (translated into
Castilian):


  “Our store uses cookies to improve the user experience. If it continues
      By using this site, you agree to the use of cookies. I ACCEPT- More information ”.

b.- Information pages on "Cookies Policies" (second layer), it is reported
de, what are cookies and what are they for.


On the management that can be done on them, the web pages report:

“The user has the possibility to avoid the installation of" cookies ". The browser must
be configured to be notified before cookies are saved to your hard drive or
delete those that are already stored. The user can set in his browser

which cookies are allowed and which are not. In addition, the user can allow the
so-called session cookies, which are automatically deleted once the
session. It is also possible to delete cookies manually at any time ”.

                            FOUNDATIONS OF LAW


                                             I
The Director of the Spanish Agency is competent to resolve this procedure
of Data Protection, in accordance with the provisions of art. 43.1 of the LSSI.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6









                                             II
Of the actions carried out, in relation to the "Cookies Policy", of the pages

reported websites, it is found that, in the first layer (home page), the banner
about cookies provides information that is not very concise or intelligible. When using
expressions such as, “Our store uses cookies to improve the experience of
user ”(…), induce confusion, distorting the clarity of the message.

When accessing the second layer (Cookies Policy), through the link, “more

information ”, they are redirected to the page https://www.muebledesign.com/content/terminos-
and-conditions-of-use divided into several sections. In the "Cookies" section,
provides information about what are or the types of cookies that exist, but is not
gives any information about the cookies that are loaded on the terminal equipment, if
are their own or those of third parties, the function they perform or the time they remain

active on the terminal equipment. Nor is it possible for the user to have a mechanism that
allow to reject all cookies.

For the management of cookies, it is only indicated: “The user has the possibility of
prevent the installation of "cookies" on your hard drive. The browser must be configured
so that you are notified before saving cookies on your hard drive or deleting cookies

that are already stored. The user can establish in his browser which cookies
are allowed and which are not. In addition, the user can allow so-called cookies
session, which are automatically deleted after the session ends. It is also
it is possible to delete cookies manually at any time ”. But not even
enables a link to the different browsers to manage cookies or informs

on how you can delete cookies manually at any time.

                                             III
These facts are constitutive of an infringement, attributable to the defendant, for
violation of the article of article 22.2 of the LSSI, according to which:


“Service providers may use storage devices and
data recovery on recipients' terminal equipment, provided that
they have given their consent after it has been provided to them
clear and complete information on its use, in particular, on the purposes of the
data processing, in accordance with the provisions of Organic Law 15/1999, of 13

December, protection of personal data.

When technically possible and effective, the consent of the recipient to
accept the data processing may be facilitated by using the parameters
from the browser or other applications.


The foregoing will not prevent possible storage or access of a technical nature to only
in order to carry out the transmission of a communication over a communication network
electronic devices or, to the extent strictly necessary, for the provision of
an information society service expressly requested by the

addressee".

This offense is classified as "slight" in article 38.4 g), of the aforementioned Law, which
considers as such: “Use data storage and recovery devices

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6








when the information has not been provided or the consent of the
recipient of the service in the terms required by article 22.2. ”, which may be
sanctioned with a fine of up to € 30,000, in accordance with article 39 of the aforementioned

LSSI.

After the evidence obtained in the preliminary investigations phase, it is considered that
the sanction to be imposed should be graduated in accordance with the following criteria that
establishes art. 40 of the LSSI:


    - The existence of intentionality, an expression that must be interpreted as
       equivalent to degree of guilt according to the Judgment of the
       National Court of 11/12/07 relapse in Appeal no. 351/2006,
       corresponding to the entity denounced the determination of a system of
       obtaining the informed consent that conforms to the mandate of the LSSI.


    - Period of time during which the offense has been committed, since it is the
       claim November 2018, (section b).

Based on these criteria, it is deemed appropriate to impose on the claimed entity
a penalty of 3,000 euros (three thousand euros), for the violation of article 22.2 of the

LSSI.

Therefore, in accordance with the foregoing, by the Director of the Agency
Spanish Data Protection,


                                      RESOLVES

IMPOSE: to the entity, FURNISHYOURSPACE SL., With CIF: B67094375 owner of
the web pages, www.muebledesign.com; www.iconmobel.de and
www.meublesconcept.fr, a penalty of 3,000 euros (three thousand euros), for the infraction

of article 22.2) of the LSSI.

REQUEST: to the entity FURNISHYOURSPACE SL. so that within a month
from this act of notification, proceed to include in the web pages of your ownership,
a mechanism that allows rejecting all cookies. In addition, you must report the
cookies that are installed and not install cookies without previously accepting the

consent. For which you can follow what is indicated in the Guide on Cookies,
edited by the Spanish Agency for Data Protection, in November 2019.

NOTIFY: this resolution to the entity FURNISHYOURSPACE SL.


Warn the sanctioned person that the sanction imposed must be effective once it is
executive this resolution, in accordance with the provisions of article 98.1.b)
of Law 39/2015, of October 1, on the Common Administrative Procedure of the
Public Administrations (LPACAP), within the voluntary payment period indicated in the
Article 68 of the General Collection Regulations, approved by Royal Decree

939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by entering the restricted account number ES00 0000 0000 0000 0000
0000, opened in the name of the Spanish Data Protection Agency at the Bank


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6








CAIXABANK, S.A. or otherwise, it will be collected in a period
executive.


Received the notification and once executive, if the date of execution is found
Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment
volunteer will be until the 20th of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediate business month.


In accordance with the provisions of article 82 of Law 62/2003, of 30
December, of fiscal, administrative and social order measures, the present
Resolution will be made public, once it has been notified to the interested parties. The
Publication will be carried out in accordance with the provisions of Instruction 1/2004, of 22
December, of the Spanish Agency for Data Protection on the publication of its

Resolutions.

Against this resolution, which puts an end to administrative proceedings, and in accordance with
established in articles 112 and 123 of the LPACAP, the interested parties may
file, optionally, an appeal for reconsideration before the Director of the Agency
Spanish Data Protection within a period of one month from the day

following notification of this resolution, or directly contentious appeal
administrative before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and paragraph 5 of the provision
Additional fourth of Law 29/1998, of 07/13, regulating the Jurisdiction
Contentious-administrative, within two months from the next day

notification of this act, as provided in article 46.1 of the aforementioned text
legal.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the

interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/],
or through any of the other records provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also forward the documentation to the Agency

that certifies the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious appeal-
administrative within a period of two months from the day following the notification of the
This resolution would terminate the precautionary suspension.


Mar Spain Martí
Director of the Spanish Agency for Data Protection.









C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es