AEPD (Spain) - PS/00438/2019: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS/00...") |
m (Ar moved page AEPD - PS/00438/2019 to AEPD (Spain) - PS/00438/2019) |
||
| (3 intermediate revisions by 2 users not shown) | |||
| Line 54: | Line 54: | ||
}} | }} | ||
The Spanish DPA (AEPD) imposed a fine of €10000 on the web page banderacatalana.cat for a violation of | The Spanish DPA (AEPD) imposed a fine of €10000 on the web page banderacatalana.cat for a violation of Articles 13, 6(1)(a) and 8 GDPR as well as Article 7 of the Spanish Law on Personal Data Protection (LOPDGDD). | ||
== English Summary == | ==English Summary== | ||
=== Facts === | ===Facts=== | ||
The Spanish controller of the web page banderacatalana.cat, informs on its website that a minimum age of 13 is required to subscribe to the company newsletter and, at the same time, also informs that the legal basis for the processing of personal data is consent (Article 6(1)(a) GDPR) given while registering to the newsletter. | The Spanish controller of the web page banderacatalana.cat, informs on its website that a minimum age of 13 is required to subscribe to the company newsletter and, at the same time, also informs that the legal basis for the processing of personal data is consent (Article 6(1)(a) GDPR) given while registering to the newsletter. | ||
Article 8(1) GDPR establishes the age at which a minor can legally give consent at 16 and provides that Member States can set a lower age as long as it is not less than 13 years. | Article 8(1) GDPR establishes the age at which a minor can legally give consent at 16 and provides that Member States can set a lower age as long as it is not less than 13 years. | ||
Based on this article, the Spanish law on the protection of personal data (LOPDGDD), in its article 7, sets the age at 14 years. | Based on this article, the Spanish law on the protection of personal data (LOPDGDD), in its article 7, sets the age at 14 years. | ||
=== Dispute === | ===Dispute=== | ||
Does providing incorrect information on the legal basis of the processing activity constitute a violation of Article 13 GDPR? | Does providing incorrect information on the legal basis of the processing activity constitute a violation of Article 13 GDPR? | ||
=== Holding === | ===Holding=== | ||
The Spanish DPA found that wrongly informing on the age required for a child's consent to be lawful, was a violation of article 13 GDPR in relation to articles 6(1)(a) and 8 GDPR and article 7 of Spanish Law LOPDGDD. | The Spanish DPA found that wrongly informing on the age required for a child's consent to be lawful, was a violation of article 13 GDPR in relation to articles 6(1)(a) and 8 GDPR and article 7 of Spanish Law LOPDGDD. | ||
For this reason, with the power conferred by article 58(2) GDPR, the Spanish DPA imposed a fine of €10000 aggravated by article 83(2)(b) GDPR (intentional or negligent character of the infringement) and article 83(2)(k) GDPR in relation with article 76(f) of Spanish Law LOPDGDD which refers to the affectation of the rights of minors. | For this reason, with the power conferred by article 58(2) GDPR, the Spanish DPA imposed a fine of €10000 aggravated by article 83(2)(b) GDPR (intentional or negligent character of the infringement) and article 83(2)(k) GDPR in relation with article 76(f) of Spanish Law LOPDGDD which refers to the affectation of the rights of minors. | ||
The Spanish DPA, with the power conferred by article 58(2)(d), also ordered the controller to delete the wrongful privacy policy from the website. | The Spanish DPA, with the power conferred by article 58(2)(d), also ordered the controller to delete the wrongful privacy policy from the website. | ||
== Comment == | ==Comment== | ||
''Share your comments here!'' | ''Share your comments here!'' | ||
== Further Resources == | ==Further Resources== | ||
''Share blogs or news articles here!'' | ''Share blogs or news articles here!'' | ||
== English Machine Translation of the Decision == | ==English Machine Translation of the Decision== | ||
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. | The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. | ||
Latest revision as of 14:40, 13 December 2023
| AEPD - PS/00438/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1)(a) GDPR Article 8(1) GDPR Article 13 GDPR Article 7 LOPDGDD |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 14.12.2020 |
| Fine: | 10000 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS/00438/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA (AEPD) imposed a fine of €10000 on the web page banderacatalana.cat for a violation of Articles 13, 6(1)(a) and 8 GDPR as well as Article 7 of the Spanish Law on Personal Data Protection (LOPDGDD).
English Summary
Facts
The Spanish controller of the web page banderacatalana.cat, informs on its website that a minimum age of 13 is required to subscribe to the company newsletter and, at the same time, also informs that the legal basis for the processing of personal data is consent (Article 6(1)(a) GDPR) given while registering to the newsletter. Article 8(1) GDPR establishes the age at which a minor can legally give consent at 16 and provides that Member States can set a lower age as long as it is not less than 13 years. Based on this article, the Spanish law on the protection of personal data (LOPDGDD), in its article 7, sets the age at 14 years.
Dispute
Does providing incorrect information on the legal basis of the processing activity constitute a violation of Article 13 GDPR?
Holding
The Spanish DPA found that wrongly informing on the age required for a child's consent to be lawful, was a violation of article 13 GDPR in relation to articles 6(1)(a) and 8 GDPR and article 7 of Spanish Law LOPDGDD. For this reason, with the power conferred by article 58(2) GDPR, the Spanish DPA imposed a fine of €10000 aggravated by article 83(2)(b) GDPR (intentional or negligent character of the infringement) and article 83(2)(k) GDPR in relation with article 76(f) of Spanish Law LOPDGDD which refers to the affectation of the rights of minors. The Spanish DPA, with the power conferred by article 58(2)(d), also ordered the controller to delete the wrongful privacy policy from the website.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
