AEPD (Spain) - PS/00135/2020

AEPD - PS/00135/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 13 GDPR Article 55 GDPR Article 58(2) GDPR Article 83(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	3000 EUR
Parties:	SCHOOL FITNESS HOLIDAY & FRANCHISING, AYUNTAMIENTO DE MADRID - UNIDAD DE CONSUMO
National Case Number/Name:	PS/00135/2020
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	Agencia Española de Protección de Datos (in ES)
Initial Contributor:	Silvia López Arnao

Following a complaint from the Madrid City Council's Health Services Bureau, the Spanish DPA imposed a fine on a gym center for the abusive clauses in the contracts with its clients, which did not comply with the duty to inform the affected person about the treatment of his/her personal data in accordance with Article 13 GDPR.

English Summary

Facts

The gym center had already been required by the Spanish DPA to make the necessary adjustments in its contracts to respect the GDPR requirements. One year and 5 months after the Madrid City Council's Health Services Bureau required the entity, twice, to modify the abusive clauses contrary to data protection regulations and 8 months after this Agency first requested their modification, the entity started to proceed to modify the contracts. Some old clauses in breach of the GDPR were still active.

Holding

The Spanish DPA imposed a fine of EUR 5000 on the gym for the omission of the duty to inform the affected person about the treatment of their personal data in accordance with Article 13 GDPR. The center paid EUR 3000; the reduction was given because of voluntary payment and acknowledging the facts (after waiving a further appeal against the DPA's decision).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

DECISION R/00301/2020 ON TERMINATION OF PROCEEDINGS FOR PAYMENT
VOLUNTEER
In sanction procedure PS/00135/2020, conducted by the Agency
Spanish Data Protection Agency to SCHOOL FITNESS HOLIDAY & FRANCHISING,
S.L.U., having regard to the complaint lodged by the CITY COUNCIL OF MADRID - UNIT OF
CONSUMPTION, and based on the following,
BACKGROUND
FIRST: On June 16, 2020, the Director of the Spanish
Data Protection agreed to start sanctioning procedure against SCHOOL FITNESS
HOLIDAY & FRANCHISING, S.L.U. (hereinafter, the Respondent), by means of the
that is transcribed:
<<
Procedure No.: E/00135/2020
935-240719
AGREEMENT TO INITIATE DISCIPLINARY PROCEEDINGS
Of the actions carried out by the Spanish Data Protection Agency before
SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. with CIF: B82887514, (in
hereinafter referred to as "the respondent"), pursuant to the claim made by the
MADRID CITY COUNCIL (HEALTH SERVICES AND
CONSUMPTION) (hereinafter referred to as "the Claimant"), and on the basis of the following:
FACTS
The Madrid City Council's Health Services and Consumer Affairs Department has
Two letters of complaint were sent to this Agency against the entity claimed by the
same facts. These two writings have led to the opening, in this Agency, of
two investigation files: E/0065/2019 and E/3498/2019.
A) With regard to Procedure E/0065/2019:
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
2/22
FIRST: On 26/11/18, it was entered into this Agency in writing by
the claimant, which, among other things, indicated
"Inspection visits were made by the Technical Services for Quality and Consumption at
establishment and reference holder on 16/04/18 and 09/05/18, was noted and
required the commercial company issued for the purpose of correcting irregularities of
unfair terms in the contract presented, in particular in the following terms:
(...) NINTH: All members are obliged to show their ID card to
requirements of the centre's employees, both at the entrance and during
your stay on the premises. Non-observance of this rule will make it impossible to
access to or stay in the gymnasium until this is remedied
requirement. Upon acceptance of the contract, each member will be required to read
the biometric parameters of your fingerprint that will be used for
acceptance of it and later for its entry and exit from the centres,
through the mechanism provided for this purpose. In accordance with Article 5(1) of
Law 15/1999, the member is informed that the data corresponding to the employer
The biometrics to be provided will be included in an automated file called
"customers and suppliers" that will be used for access by users of the
gymnasium and that in no case will be given to third parties. The reading of the data
The biometrics do not involve the recording of the fingerprint and the data obtained are not
in no way treatable as a fingerprint. The obligation to show the ID card,
without specifying valid reasons for requiring the employees, when for
acceptance of the contract and for the entry and exit of the centres the
reading the biometrics,
(...) TWELVE: By signing this contract the partner grants
authorisation for the company to use all the
images, photographs, videos, voice files, graphic material, etc., (in
the images) in which it is involved, or part of them, and include
your data in a file duly registered with the Spanish Agency of
Data Protection, in accordance with the provisions of the Organic Law
15/1999 of 13 December on the Protection of Personal Data.
Likewise, the partner authorizes the communication or transfer of the images to
persons whom the company deems appropriate, for the same purpose indicated
in the previous section, expressly informing you that in some cases
international data transfers shall be carried out for such assignment. At
These data may be communicated to third parties, without any
additional consent on your part, provided that this communication is limited
to this end. 
The partner grants this authorization with a wide territorial and temporal scope,
so the company may use the images, or part of them, in
all the Spanish territory and in all the countries of the world without limitation
geographical location of any kind. The partner grants this authorization for the
use of the images in which it appears, or part of them, in the
scope and purposes of both communication and dissemination of the activity of the
company. as of any other project, understood this one in its most
The aim of the project is to promote the development of a wide range of activities, including, but not limited to, the promotion of
the company's activities, in its own centres, its website and in
any other means that the company considers, and can be exploited in
all the means known at present and those that could be developed
in the future, all with the sole exception and limitation of those
uses or applications that could be detrimental to the right to honour, morality
and public order, as provided for in the legislation in force in each
country.
This authorization is understood to be given free of charge. The partner exempts
the company expressly disclaims all liability for any use that
can make a third of the images, outside the territorial scope.
material object of this contract. The right of image is regulated in
Organic Law 1/1982. of 5 May. on civil protection of the right to
Honor. to personal and family intimacy and to one's own image. All of them in case
are fundamental rights protected in Article 18(1) of the
Spanish Constitution. These are inalienable, unrenounceable and
imprescriptible. The indispensable principle for the
treatment of the image, the express and unequivocal consent of the owner
to obtain, reproduce or publish by any means or medium the image of
a person. Art. 2.2, Art. 6 LO 1/1982 the holder of the right has granted the
effect their express consent". Clause between the general condition that
does not allow the express and unequivocal consent of the image owner
(lack of transparency), not being expressed formally and explicitly. Clause
The treatment of one's own image is linked to the will of the
employer, Art. 85.3 TRLGDCU, which imposes with the exemption of
liability to the company. the waiver or limitation of the
consumer and user, Art. 86.7 TRLGDCU, which imposes the declarations of
acceptance or conformity or adherence of the consumer to a consent
of which he has not had the opportunity to take real knowledge of his
rights and the consequences of such declarations or the consequences of such
can affect. Art. 89.1 TRLGDCU. The responsible body being the AEPD,
60 gives you a copy of the present conditioned to the effect of the
appropriate actions within the scope of its competences.
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
4/22
THIRTEENTH: In accordance with the provisions of Organic Law 15/1999 of
Protection of Personal Data (LOPD), the data provided by the
partner, including those corresponding to the biometric pattern, will be
incorporated to! file "clients and suppliers" whose holder is SCHOOL
FITNESS HOLIDAY FRANCHISING S.L.U., domiciled in Las Rozas
(28290) Las Rozas, Madrid, calle Rozabella nº 6. Europa Business Park.
For this purpose, the data provided by the partner/& is considered to be
certain... The biometric pattern data
FOURTEENTH: The partner authorizes the company to assign its rights and
obligations to a third party. This assignment shall not alter the
rights and obligations of the partners".
SECOND: In accordance with article 65.4 of the Organic Law 3/2018, of 5
December, on Personal Data Protection and guarantee of the digital rights that
has provided for a mechanism, prior to the admission of the complaints to be
to the Spanish Data Protection Agency, consisting of transferring
to the Data Protection Delegates appointed by the persons responsible or
the processors, or to them when they have not been designated, with a date
09/01/19 the claim submitted to the claimed entity was transferred to
to proceed with its analysis and to respond to the complainant and this Agency.
THIRD: On 22/02/19, this Agency received a written statement of allegations,
submitted by the entity in question, in which it set out, inter alia, the following:
"Condition adapted to data protection regulations. In the request for information we are asked to modify clauses nine, twelve, thirteen and fourteen to adapt them to Regulation 679/2016 of 27 April
(RGPD). In compliance with the requirements, we have proceeded to modify said conditions and to adapt them to the regulations in force. In proof of this we send you as
DOC 1 of this writing copies the conditionals in their new terms.
To give greater protection and security to the customer and ensure that acceptance is free,
voluntary, informed and unambiguous of the specific processing of their data, a specific annex has been introduced in addition to the amendments to the clause called
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
5/22
"data protection sheet" which is signed by all new registrations whether they are face-to-face
or via the web. A copy of this form is attached as DOC 2.
In relation to existing contracts and for their adaptation to the new regulations
have adopted the following measures, which are currently being implemented
due to the volume of customers: (iii) Subscription of annex communicating the change
of the conditions of the contract relating to data protection and communication of information
of data protection. It is being carried out on a face-to-face basis in the gyms. Referral of electronic communication to all clients informing them of the need to
to expressly accept the consent for the processing of your data. Personal request to subscribers by means of access control (lathes) for the subscription of the "Data Protection" file and collection of their signature either on paper or on tablet support. All measures are in the implementation phase and will take some time to be fully effective since: The campaign of
mailing has been poorly received by subscribers Not all subscribers go to
to the gym every day."
FOURTH: Dated 01/03/19, by the Director of the Spanish Agency of
Data Protection, a decision was taken to close the proceedings in the framework of the file, E/0065/2019, considering that it was not appropriate to initiate a sanctioning procedure since the complaint presented by the respondent had been dealt with.
A) With regard to Procedure E/03498/2019
FIFTH: On 26/09/19, the second document submitted by the complainant entered into this Agency, which resulted in the opening of file E/3498/2019 in
which, among other things, was indicated:
It is verified in these last inspections that the issued commercial continues
issuing with the consumers and would use the same and identical predisposed contract, as the reasoned alleged violation of the recognized rights of data protection in the campaign of inspection and Control of Gyms 2018.
Received the letter from the AEPD dated 01.03.19, which informs of the
The commercial company will correct the conditions and adopt corrective measures in the areas of its competence, resolving the issue of the filing of actions. This Consumer Unit must proceed to inform again
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
6/22
the AEPD of what was found in the supply of information by the reported company
inaccurate or false and failure to comply with remedial requirements.
Having studied the file, originated by the actions of the Technical Services of
Quality and Consumption Inspection of this Latino District in the 2019 Gymnasium Inspection and Control Campaign, and the documentation attached to it, is checked
that the expedited merchant continues to issue with consumers and
the same predisposed contract as the one that is the reason for the inhibition in the
Inspection and Control Campaign for Gyms 2018, for the inclusion of clauses
abusive in the terms of the contract presented to the file, according to the Royal
Legislative Decree 1/2007, of 16 November, approving the Consolidated Text of the
General Law for the Defense of Consumers and Users and other complementary laws (TRLGDCU), according to the analysis of the Districts and evaluation of the institute
Municipal Consumption.
SIXTH: In accordance with article 65.4 of the Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights that
has provided for a mechanism, prior to the admission of the complaints to be
to the Spanish Data Protection Agency, consisting of transferring
to the Data Protection Delegates appointed by the persons responsible for or in charge of the processing, or to the latter when they have not been appointed, on 24/10/19,
The complaint was forwarded to the entity in question for analysis and response to the complainant and this Agency.
SEVENTH: On 26/11/19, this Agency received a written statement of allegations, presented by the entity complained of, in which it set out, among other things, the following
"On February 20, 2019 this company replied to the Subdirectorate General of
Inspection of the AEPD reporting that we had proceeded to the adaptation of the
We will send you a copy of the new conditions together with the data protection sheet and we will communicate the measures taken.
that we had adopted and that these were in the implementation phase.
Specifically, we explained that specific actions were being carried out
and the time required to do so indicating that:
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
7/22
In relation to existing contracts and for their adaptation to the new regulations
have adopted the following measures, which are currently being implemented
due to the volume of customers:
- Signing of an addendum communicating the modification of the conditions of the contract regarding data protection and communication of the protection sheet
of data. It's being conducted on-site at the gyms.
- Electronic communication is sent to all clients informing them of the
need to expressly accept consent for the treatment of
your data.
- Personal request to subscribers through access control (volumes) for the subscription of the card, "Data Protection" and collection of your
sign either on paper or on tablet
All measures are in the implementation phase and will take some time to be fully effective as the mailing campaign has been poorly received
by the subscribers Not all subscribers come to the gym every day. The control
in lathes is done in blocks of people to avoid collapsing accesses.
The adaptation works that have been carried out between February 2019
and current events are as follows:
- Modification of the clauses on the website for online contracting - > We have proceeded to modify the clauses of the general conditions and the
data protection on the website so that online recruitment is
equipped with all the guarantees and adapted to the new regulations. We accompany screen capture as DOC 2.
- Acquisition of all new tablets with the appropriate software for the capture of signature of new subscribers and the capture of signature of subscribers who already had contract by subscription of annex to the main contract.
We accompany invoices for the new tablets as DOC 3
- Cloud software implementation on central storage server with
secure communication between the administrative centre and the operational centres (a
total of twenty gyms). We accompany the invoice of the computer consultant
which updates the management software as DOC 4
As of today, we can certify that the implementation campaign has been completed in
all its phases successfully, both in central services and in each of the VEINC/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
8/22
TE (20) HOLIDAY GYM gymnasiums. 
It is worth noting in this report our surprise to see that the complainant has
was the Consumer Department of the Madrid City Council, from its
Aluche. And we say this because our company is in communication with the Department of Consumer Affairs of Madrid City Council Chamartin district located in Calle del
Príncipe de Vergara nº 140 to whom we have gone precisely to ask for help
so as not to breach any legal obligations in the field of consumer protection.
We can say that part of the process of implementing the new conditions has been to hold meetings with people from that Department of Consumption in the Chamartin district, who have helped us to specify much better the
terms and conditions to avoid that our company is committing irregularities or infringements in this matter.
It should be noted that on November 5, 2019, we held a meeting with
to inform them of this unpleasant situation and to indicate to us the
timely guidelines in case we were committing any irregularities. In particular, to
This meeting was attended by the Technical Advisor coordinating the 21 districts of
Madrid, the Head of the Unit of Sanctioning Procedures, the
Prince of Vergara District Consumption and Holiday Gym Representatives.
Today we are waiting to receive the approval of the said Office
the contract that the AEPD signed on March 1, 2009, with the
2019 archived for agreeing to the proposed conditionality. In short, no
irregularity has been committed by this company, although we must acknowledge that the
implementation process has been slower than projected.
We have been asked to provide copies of the latest contracts from September 2019 and so
we provide, indicating that they do not meet the requirements because
are contracts signed in the gymnasium and as a result the software operating with the new system and conditions has not been operational until the end of October
2019. A copy of these contracts is enclosed as DOC 5.
To demonstrate that the company has properly implemented the new conditionC/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
9/22
We have attached as AOC 6 a copy of the last contracts signed in the month
November, where we can see that our obligations have been fulfilled.
In short, we assume the delay in implementation, but we demonstrate that we have fulfilled our obligations to adapt.
The following sections of the DCO 6 submitted with the pleading are checked:
"All members are obliged to identify themselves sufficiently at the request of the centre's employees, in order to be able to verify the identity, if applicable, of the member who has breached the rules. The
Failure to comply with this rule will make it impossible to access or remain in the
gymnasium as long as this requirement is not met. Upon acceptance of the contract
Each member who wishes to do so will be required to read the biometric parameters of his/her fingerprint that will be used for entry and exit from the centres, through the mechanism provided for this purpose. The member is informed that the data
corresponding to the biometric pattern provided will be used for the access of the users of the gym and that in no case will be given to third parties.
The reading of the biometric data does not imply the recording of the fingerprint and
The data obtained are in no way treatable as fingerprints.
(...) TWELVE. By signing this contract, the partner grants permission for the company to use all the images indiscriminately.
photographs, videos, voice files, graphic material, etc., (from now on the images) in which it intervenes, or is part of them. Likewise, the partner
authorizes the communication or transfer of the images to the persons that the company considers appropriate. with the same object indicated in the previous section, informing him expressly that in some cases for this transfer
will perform international data transfers. In particular, these data
may be communicated to third parties, without any additional consent by their
party, provided that this communication is limited to this purpose. The partner grants this authorization with a wide territorial and temporal scope, so that the
The company may use the images, or part of them, throughout the territory
and in all the countries of the world without geographical limitation of any
class. The partner grants this authorization for the use of the images in
those that appear. or part of them. in the field and purposes both of communication and dissemination of the company's activity, as well as any other
The project is understood in its broadest form, intended, inter alia, but not limited to the promotion of the company's activities, in its
The company's own centres, its website and any other media considered by the company, can be exploited in all the media known at present and those that may be developed in the future, with the sole exception and limitation of those uses or applications that may attempt to
right to honour, morals and/or public order, as provided for in
the legislation in force in each country. This authorization is understood to be made with
free of charge. As a consequence of the assignment, the member expressly exempts the company from any liability for any use that may
to make a third party of the images, outside the territorial, temporal and material scope of this contract. All this under the protection of the provisions of the Law
Organic Law 1/1982, of 5 May, on the Civil Protection of the Right to Honour, at
Personal and family intimacy and self image. as well as the RGPD and others
applicable data protection regulations.
THIRTEENTH: In accordance with the provisions of current regulations
in Personal Data Protection, the company informs that the
data of the partners will be incorporated into the processing system owned by
the company HOLIDAY M. OESTE, S.L, with registered office at Calle Rozabella, nº 6, 28290, Las Rozas de Madrid, Madrid, for the purpose of processing
of the clients' database, to facilitate the management and control of the services provided by HOLIDAY M. OSTE, S.L as well as for communications
commercial and promotional advertising. In compliance with the
In accordance with current legislation, the company informs that the data will be kept for the period of time strictly necessary ' to comply with the precepts mentioned above on the basis of legitimate interest. As long as the partner does not communicate the contrary, it will be understood that their data have not been modified, committing themselves to notify any variation and giving the company their consent to use them for the mentioned purposes. The company informs
that it will process the data in a lawful, fair, transparent, adequate, relevant, limited, accurate and up-to-date manner. It therefore undertakes to adopt
all reasonable steps to ensure that these are promptly removed or rectified where they are inaccurate. In accordance with your rights under the
current regulations on data protection, the partner may exercise the rights
access, rectification, treatment limitation, deletion, portability and
opposition to the processing of your personal data, as well as the consent given for the processing of the same, by addressing your request
to the legal department of HOLIDAY M. OESTE, SL. at the address Calle Rozabella, nº 6, 28290, Las Rozas de Madrid, Madrid, or to the e-mail
***EMAIL.1.You may also contact the competent Control Authority
to make any claim it deems appropriate in the event that
considers that its data protection rights are infringed (Regulation
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
11/22
EU 2016/679 of 27 April 2016).
The customer can expressly accept the use of the biometric register for access to the gymnasium. The biometric reading does not involve the recording of the fingerprint
and the data obtained are in no way treatable as fingerprints. In information technology (IT), "biometric authentication" or
"Computer biometrics" is the application of mathematical and statistical techniques to an individual's physical or behavioural traits for authentication, i.e. to "verify" his identity. The data will be used to fulfil the provision of services contracted by the partner, as well as
commercial management and the sending or communication of advertising or information of a commercial nature or satisfaction surveys by any means. At
If the member wishes to receive advertising or commercial information, he/she must check the box corresponding to the acceptance of the contract. The acceptance
of the contract implies the partner's consent to the communication of its
personal data to any company of the group HOLIDAY GYM. in order to allow the access to the gyms. in addition to the above mentioned purposes.
FOURTEENTH: The member authorizes the company to transfer its rights and obligations to a third party. By means of this cession the rights and obligations of the members will not be able to be modified".
EIGHTH: In view of the facts reported, in accordance with the evidence
the Data Inspection of this Spanish Agency for the Protection of
Data considers the above, does not comply with current regulations, so
that the present penalty proceedings should be initiated.
LEGAL GROUNDS
I
In accordance with the powers granted by Article 58.2 of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and the free
circulation of these data (RGPD), applicable from 25 May 2018, recoC/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
12/22
The Director of the Spanish Data Protection Agency is competent to settle this complaint in accordance with Article
12.2, sections i) and j) of Royal Decree 428/1993, of 26 March, which approves the Statute of the Data Protection Agency (RD 428/1993) and the
First transitory of the Organic Law 3/2018, of December 5, of Protection of Personal Data and guarantee of the digital rights (LOPDGDD).
In accordance with the provisions of Article 55 RGPD, the Spanish Data Protection Agency
Data Protection is competent to perform the functions assigned to it
in Article 57, including that of enforcing the Regulation and promoting
raising awareness of data controllers and processors about the
obligations incumbent upon them, as well as to deal with complaints submitted by a
and investigate the reason for them.
II
In the present case, it should be noted that, prior to the opening
of the present sanctioning file (PS/135/2020), had been previously processed
an investigative file for the same facts, in this Agency,
(E/0065/2019), during which time the entity in question was transferred for analysis and response. It was also requested to inform
of the measures they would take to avoid similar situations in the future.
The process of all the proceedings in the two cases has been as follows:
1.- On 16/04/18 and 09/05/18, the Technical Services for Quality and Consumption of the
The Madrid City Council made inspection visits to the complained entity, detecting a series of irregularities in the clauses of the contract that they were making with the clients and that were in breach of data protection regulations.
2.- On 26/11/18, the Technical Services of Quality and Consumption of the Madrid City Council notified this Agency of the facts detected in these inspections.
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
13/22
3.- On 09/01/19, this Agency requested the entity in question
information on the reported events.
4.- On 22/02/19, the entity complained of affirms that they had already modified the
Unfair terms in the contract with customers, in particular terms that have been denounced for not being adapted to the new RGPD (the ninth, twelfth, thirteenth and fourteenth).
5.- On 01/03/19, this Agency closed the preliminary investigation proceedings (E/0065/2019), considering that the request had been correctly dealt with.
On 26 September 19, this Agency received a new complaint from
of the Technical Services for Quality and Consumption of the Madrid City Council, indicating that in the last inspections carried out on the issued company, there had been
to check again that it continues to issue the same biased contract.
7.- On 24/10/19, this fact was transferred to the entity in question so that
to proceed with its analysis and to respond to this Agency.
On 26/11/19, this Agency received a written statement of allegations, submitted
by the entity in question, claiming that:
- In relation to the old contracts, already existing until February
2019, the clauses denounced were eliminated and a new
writing them. But its adaptation had not been completed in its entirety, since, as it was carried out in person, and due to the large number of members distributed among the 20 gyms that the entity has in the Community of Madrid, many of whom do not attend the centers regularly, this process was taking a long time.
In the contracts signed from February 2019 to October 2019, the entity claims that "they did not meet the requirements because the
operating software installed on the entity's computer network has not been
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
14/22
operational until the end of October 2019", which is the same date as the
receipt of the second request by this Agency.
- For contracts signed from November 2019 onwards, the following is provided
A copy of the same, being able to verify the modification of the denounced clauses and their adaptation to the new RGPD.
It is noted that the complained entity became aware of the irregularities in its contracts with customers in April/May 2018, through the minutes of
The inspection was carried out by the Madrid City Council's Health Services Department, which was also required to remedy the deficiencies and adapt the
terms that are abusive to current data protection regulations.
Later, in February 2019, this Agency required him to remedy
the irregularities detected. On that occasion, the claimed entity stated that,
He responded to the injunction and proceeded to eliminate the unfair terms reported and to
to draft new ones in accordance with the RGPD, but it is not until November
2019, after having received the second request from this Agency, (the
24/10/19), when, according to the entity, the new contracts are definitively implemented.
Consequently, one year and 5 months after the Madrid City Council's Health Services Department required the entity, twice, to modify the abusive clauses contrary to data protection regulations and 8 months
After this Agency first requested their modification, the entity complained of, proceeds to modify the contracts. If we add to this the fact that many of the old contracts, made before November 2019, with the old clauses are still active, the facts denounced are clearly contrary to those stipulated in the RGPD.
III
The facts set out could constitute an infringement, attributable to the
claimed, for violation of Article 13 of the GPRS, which establishes the
information to be provided to the person concerned at the time of collection of
your personal data, indicating in the same that:
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
15/22
"1. Where personal data relating to a data subject are collected, the
The person responsible for the processing, at the time when these are obtained, will provide
all the information below:
(a) the identity and contact details of the person responsible and, where appropriate, his
representative;
(b) the contact details of the Data Protection Officer, if any;
(c) the purposes of the processing for which the personal data are intended and the legal basis
of the treatment;
(d) where the processing is based on Article 6(1)(f), interest
legitimate of the person responsible or of a third party;
(e) the recipients or categories of recipient of the personal data, in their
case;
(f) where appropriate, the controller's intention to transfer personal data to a third party
country or international organization and the existence or absence of a
adequacy of the Commission, or, in the case of transfers indicated in the
Articles 46 or 47 or the second subparagraph of Article 49(1), reference to
adequate or appropriate safeguards and the means to obtain a copy of these or
to the fact that they're on loan.
In addition to the information mentioned in paragraph 1, the person responsible for the
processing shall provide the data subject, at the time the data are obtained
the following information necessary to ensure the processing of data
loyal and transparent:
(a) the period of time for which personal data are kept or, where not
possible, the criteria used to determine this deadline; 
(b) the existence of the right to ask the controller for access to the
personal data relating to the data subject, and the rectification or deletion of such data or their limitation
of their treatment, or to object to the treatment, as well as the right to portability
of the data;
(c) where the processing is based on Article 6(1)(a) or Article
9(2)(a) the existence of the right to withdraw consent in
at any time, without affecting the lawfulness of processing based on the
consent prior to withdrawal;
(d) the right to lodge a complaint with a supervisory authority;
(e) whether the communication of personal data is a legal or contractual requirement or a
requirement to enter into a contract, and whether the person concerned is obliged to provide
personal data and is informed of the possible consequences of not
provide such data;
 (f) the existence of automated decisions, including profiling, to be
referred to in Article 22(1) and (4) and, at least in such cases, information
The importance and consequences of the new system for the development of the
provided for such processing for the data subject.
Where the controller plans the further processing of data
for a purpose other than that for which they were collected, will provide the
information on that other purpose prior to such further processing
and any additional relevant information within the meaning of paragraph 2.
4.The provisions of paragraphs 1, 2 and 3 shall not apply when and where the
insofar as the information is already available to the person concerned'.
On the other hand, Article 72.1.h) of the LOPDGDD, considers very serious, for the purposes of
the omission of the duty to inform the affected person about the treatment of
your personal data in accordance with Articles 13 and 14 of the GPRS'.
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
17/22
In accordance with the above-mentioned precepts, and without prejudice to the
instruction of the procedure, for the purpose of fixing the amount of the penalty to be imposed in
in this case, it is considered that the penalty to be imposed should be graduated in accordance with
with the following criteria established by Article 83.2 of the RGPD:
a).- As aggravating criteria:
- The nature, gravity and duration of the infringement, taking into account the
nature, scope or purpose of the processing operation concerned,
as well as the number of stakeholders affected and the level of damage and
damages they have suffered. In our case, the claimed entity was aware
from May 2018, through the City Council inspections
the existence of abusive terms in the contract he signed with
customers (section a).
- Intentionality or negligence in the infringement. In the present case we are
in the event of negligent action, since it is not until the second requirement of this
Agency, when the entity complained of modifies the clauses contrary to the
new RGPD, (paragraph b).
- The categories of personal data affected by the infringement.
The data processed are of a markedly personal nature and therefore
person identifiers, (section g).
- The manner in which the supervisory authority became aware of the infringement. The
The way in which this AEPD has been made aware of has been through the communication
of the infringement by the Madrid City Council, (section h).
(b) As mitigating criteria:
- Measures taken by the controller or processor to mitigate
the damages suffered by the parties concerned, since it has been found that
modified the contract adapting it to the current RGPD, (section c).
The non-existence of a previous infringement committed by the person responsible or the person in charge
of the processing, for the same facts, (paragraph e).
- The degree of cooperation with the supervisory authority in order to remedy
to the infringement and to mitigate any adverse effects, (paragraph f).
The balance of the circumstances referred to in Article 83(2) of the RGPD, with
with regard to the infringement committed in breach of the provisions of Article 13 thereof allows
set a penalty of 5,000 euros, (five thousand euros).
Therefore, on the basis of the above, by the Director of the Agency
Spanish Data Protection,
AGREED:
START: PENALTY PROCEDURE to the entity SCHOOL FITNESS
HOLIDAY & FRANCHISING, S.L. with CIF: B82887514, for the infringement of Article 13
of the RGPD, punishable in accordance with the provisions of art. 83 of the said regulation.
APPOINT: Mr. A.A.A. as Instructor and Ms. B.B.B. as Secretary,
indicating that any of them may be challenged, if appropriate, in accordance with
established in Articles 23 and 24 of Law 40/2015 of 1 October on the Legal System
of the Public Sector (LRJSP).
INCORPORATE: to the sanctioning file, for evidential purposes, the claim
filed by the claimant and his documentation, the documents obtained and
generated by the Subdirectorate General for Data Inspection during the
investigations, all of which are part of the present administrative file.
WHAT: for the purposes of Article 64.2(b) of Law 39/2015 of 1 October, on
Common Administrative Procedure of Public Administrations, the sanction that
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
19/22
The fine would be 5,000 euros (five thousand euros), without
prejudice to the outcome of the investigation.
NOTIFY: the present agreement to initiate sanctioning proceedings to the entity
SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L., granting you a period of
hearing within ten working days to make the allegations and to present the
evidence that you deem appropriate.
If, within the stipulated period, he does not make any allegations to this agreement to begin with, the same
may be considered as a motion for resolution, as set out in Article
64.2(f) of Law 39/2015 of 1 October on the Common Administrative Procedure of
the Public Administration (hereinafter LPACAP).
In accordance with Article 85 of the LPACAP, if the
penalty to be imposed other than a fine, may acknowledge its responsibility within the
period granted for the formulation of arguments to the present agreement of beginning; the
which will be accompanied by a 20% reduction in the penalty to be imposed in
the present procedure, equivalent in this case to 1,000 euros. With the application of
of this reduction, the penalty would be set at
procedure with the imposition of this penalty.
Similarly, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed penalty, which
will result in a reduction of 20% of the amount of the payment, equivalent in this case
at 1,000 euros. With the application of this reduction, the penalty would be set at
4,000 and its payment will imply the termination of the procedure.
The reduction for the voluntary payment of the penalty can be cumulated with that for
apply for recognition of liability, provided that this recognition
of the responsibility becomes apparent within the time allowed for formulating
allegations to the opening of the procedure. The voluntary payment of the amount referred to
in the preceding paragraph may be made at any time prior to the resolution. At
in this case, if both reductions were to be applied, the amount of the penalty would be
established at 3,000 euros (three thousand euros).
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
20/22
In any case, the effectiveness of either of the two above-mentioned reductions will be
conditional upon the withdrawal or waiver of any action or remedy in the
administrative sanction against sanction
If you choose to pay any of the above amounts voluntarily
previously, you will have to make it effective by paying it into the account nº ES00
0000 0000 0000 0000 open on behalf of the Spanish Agency for the Protection of
Data in the CAIXABANK, S.A. Bank, indicating in the concept the number of
reference of the procedure in the heading of this document and the
cause of reduction of the amount claimed.
Likewise, you must send the proof of payment to the Subdirectorate General of
Inspection to continue the procedure in accordance with the quantity
admitted.
The procedure will last a maximum of nine months from the
date of the agreement to initiate or, where appropriate, the draft agreement to initiate.
Once this period has elapsed, the agreement will expire and, consequently, the
actions; in accordance with the provisions of Article 64 of the LOPDGDD.
Finally, it is noted that in accordance with Article 112.1 of the LPACAP,
No administrative appeal is possible against this act.
Mar Spain Martí
Director of the Spanish Data Protection Agency.
>>
 SECOND: On July 2, 2020, the claimant paid the
3,000 by making use of the two reductions provided for
C/ Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
21/22
in the above transcribed Inception Agreement, which implies recognition of the
responsibility.
THIRD: The payment made, within the period granted to make allegations to
the opening of the procedure, entails the waiver of any action or appeal in
administrative sanctioning and acknowledgement of responsibility in relation to
the facts referred to in the Agreement to Initiate.
LEGAL GROUNDS
I
By virtue of the powers conferred on each authority in Article 58(2) of the GPRS, the
control, and in accordance with Article 47 of Organic Law 3/2018, of 5
December, Protection of Personal Data and Guarantee of Digital Rights (in
(hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency
is competent to penalise infringements committed against it
Regulations; infringements of Article 48 of Law 9/2014 of 9 May, General
of Telecommunications (hereinafter referred to as LGT), in accordance with the
Article 84.3 of the GLT, and the infractions defined in articles 38.3 c), d) and i) and
38.4 d), g) and h) of Law 34/2002, of 11 July, on services of the company of the
information and electronic commerce (hereinafter referred to as the ISESA), as provided for in
43.1 of the said Act.
II
Article 85 of Law 39/2015 of 1 October on Administrative Procedure
Commonwealth of Independent States (hereinafter LPACAP), under the heading
"Termination in sanctioning proceedings" provides the following:
"1. Penalty proceedings are initiated if the offender acknowledges his
responsibility, the proceedings may be terminated with the imposition of the penalty
as appropriate.
2. Where the penalty is solely pecuniary in nature or where it is
impose a financial penalty and a non-pecuniary penalty but has been justified
the impropriety of the second, voluntary payment by the alleged perpetrator, in
any time before the resolution, will imply the termination of the procedure,
except as regards the restoration of the altered situation or the determination of the
compensation for damages caused by the commission of the infringement.
3. In both cases, when the penalty is solely of a pecuniary nature,
the body competent to decide on the procedure shall apply reductions of, at
at least 20 % of the amount of the proposed penalty, which may be cumulated
with each other. These reductions shall be determined in the notification of
initiation of the procedure and its effectiveness shall be conditional upon the withdrawal or
waiver of any action or appeal in administrative proceedings against the sanction.
The percentage of reduction provided for in this paragraph may be increased
by regulation.
As noted,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: TO DECLARE the termination of procedure PS/00135/2020, of
in accordance with Article 85 of the LPACAP.
SECOND: NOTICE this resolution to SCHOOL FITNESS HOLIDAY &
FRANCHISING, S.L.U..
In accordance with the provisions of Article 50 of the LOPDGDD, this
The decision will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure as prescribed by
Article 114(1)(c) of Law 39/2015 of 1 October on Administrative Procedure
The interested parties may lodge an appeal with the
administrative litigation before the Administrative Chamber of the
Audiencia Nacional, in accordance with Article 25 and paragraph 5 of
the fourth additional provision of Law 29/1998 of 13 July 1998, regulating the
Contentious-Administrative Jurisdiction, within two months of
day following notification of this act, as provided for in Article 46(1) of
referred to Law.
Mar Spain Martí
Director of the Spanish Data Protection Agency