AEPD (Spain) - PS/00110/2020

AEPD - PS/00110/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 7 GDPR Article 6(3) of the Spanish Law on Data Protection and Digital Rights Guarantee (LOPDGDD)
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	16.10.2020
Fine:	n/a
Parties:	Add Event Staff, S.L.
National Case Number/Name:	PS/00110/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	Miguel Garrido de Vega

The Spanish DPA (AEPD) decided to impose a warning on Add Event Staff, S.L. for infringing of Article 7 GDPR by not gathering consent separately for different processing activities related to job search and commercial purposes.

English Summary

Facts

The decision is the consequence of a complaint submitted by a Spanish citizen stating that he registered to a job fair organized by the defendant, but that the web form required him to consent not only the participation at such fair, but also to receive commercial communications and even the transfer of such data to third parties; when he requested the defendant to only use his consent for the participation purpose, the defendant answered that it was not possible and that, as it was a free event, the claimant was obliged to receive commercial communications if he chose to participate at the event.

Dispute

The defendant answered to the first AEPD investigation requests stating that: (i) no rights of the claimant were breached, as the processing activities are based on his consent, (ii) the claimant was fully informed at the privacy policy on the need to process his data for the participation, and that the possibility of receiving commercial communication was also specified, (iii) in any case, the commercial emails duly contain the possibility to unsubscribe from them. The AEPD started the corresponding sanction procedure, and the defendant answered again stating that: (i) the participation on the event had one single purpose, which was to communicate the attendants with the companies with a networking objective, and that (ii) the defendant is managing the change of its forms in order to adopt the corresponding measures.

Holding

Thus, the AEPD understood that the defendant has infringed Article 7 of the GDPR and Article 6(3) of the Spanish Law on Data Protection and Digital Rights Guarantee (LOPDGDD), according to which, (i) commercial communications are a different purpose than attendance to a job fair, so consents for both activities shall be obtained separately, and (ii) the execution of an agreement cannot be subject to the fact that the data subject consents other processing activities not strictly related to performance, development and control of the contract relationship. Consequently, the AEPD decided to impose a warning to the defendant and, additionally, required the defendant to correct the situation in the period of one (1) month since this resolution.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Page 1
1/10 Procedure Nº: PS / 00110/2020938-0419RESOLUTION OF SANCTIONING PROCEDUREIn the sanctioning procedure PS / 0110/2020, instructed by the Spanish Agency forData Protection, to the entity, ADD EVENT STAFF, SL with CIF .: B85042737 (inhereinafter, “the claimed entity”), by virtue of the complaint presented by D. AAA,(hereinafter, “the claimant”), and based on the following,BACKGROUNDFIRST: On 10/25/19, you had a written entry in this Agency, presented bythe claimant, in which he stated, among others, the following:"These companies do a free event called" job fair. " When II try to register, they force me to give my data so that they can send me advertising bothyours as a third party, and they also oblige me to transfer my data to third parties. I communicatenique with them through *** EMAIL.1 so that they would register me without having togive up my data and they tell me no, if I don't want to, I don't go, because I'm freeobliged to receive commercial information from their companies such as companies thatthey will give my data. At no time do they give me the option not to send me publicitygive and not give my data ".SECOND: In view of the facts set forth in the claim and the documentsprovided by the claimant, the Subdirectorate General for Data Inspection proceededto carry out actions for its clarification, under the protection of the powers of investigationgranted to the control authorities in article 57.1 of the Regulation (EU)2016/679 (General Data Protection Regulation, hereinafter RGPD). Thus, withdated 11/27/19, an information request is addressed to the claimed entity.THIRD: On 12/23/19, you had a written entry in this Agency, presented bythe claimed entity, where it informs, among others, of the following:"A copy of the communication via email sent to the claimant is attached, in accordance with thethat we consider, that no right concerningpersonal coughs; as it is a legitimate exercise, based on the ineffective consentquvoco, processing certain personal data required to attend and participate inthe event Job Fair in the Digital Era (hereinafter, FEED) organized by ADDEVENT, and thereby, in turn, allow participants to send them messagescommunications related to its activity.Make it clear that the communication provided to the AEPD by the claimant in his claimmation, regarding the communications crossed via email, is not entirely complete,there, now that this part is provided as Document No. 1, the full text bothof the claimant as the response to their requests by ADD EVENT. In whento the content of the response by ADD EVENT, in short to say, asIt is deduced from its text that the collection of personal data required wasrequired to participate in FEED. In the claimant's case, he intended to do sothrough the "FEED candidate contact" form on the web*** URL.1 ( *** URL.2 ).C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 2
2/10That is, as a prior step to any communication of personal data - such andas reflected in the privacy policy - it had to be accepted, and the owner was warnedinterested, that it was a necessary requirement to be able to attend FEED, sincethat otherwise the consequence would be the impossibility of their participation. In thisIn this sense, it must be taken into account that the purpose of FEED was to communicatenication of job applicants with participating companies (exhibitors) whoThey are looking for professionals, hence the legitimate need to have personal datanecessary to be able to put in contact to both parties.The claim of the claimant to want to attend FEED without providing the identification datafication that was requested for it, and its refusal not to receive communications from theparticipants in said event; in response to his refusal, he was indicated in response to his requesttud, that it was a free event that had to do with employment and networking,whose purpose was that whoever attended could be contacted by the exhibitorsprofessionals (participating companies), so it was indicated that the purpose of attending was part-to participate and that without facilitating contact, their attendance was meaningless. And as for reci-bir commercial communications from participants, make mention ofthat, in the Privacy Policy texts, which could be accessed as a stepprior to providing any personal data (see: *** URL.2 that links to the policyprivacy policy *** URL.3 , the possibility of receiving communications referring torents to the services of the exhibitors and / or the person in charge.As indicated in the previous point, by the owner responsible for the weba series of measures were available and have been available to avoid incidents such as thehappened, in fact, there is no record of having received any other to date. So:1.- At the time there was a Privacy Policy in which it was reportedpreviously to those interested in participating, clearly, and in accordance with the regulationsof application in data protection, about: who was responsible for the treatment,the requested data, the purpose, the legitimacy, the transfer to third parties and how to obtaininformation on who these were, the rights of the interested party, etc., and also,that concerns this claim, it was reported that the communication of thepersonal data was a necessary requirement to be able to attend and participate in FEED, andthat otherwise the consequence would be the impossibility of carrying out their participationpation in the event Via *** URL.2 link to *** URL.32.- A system of opposition to data processing was available at an initial momentcial, by means of the communication of an e-mail address to which theinterested parties to exercise said right, according to the following text: You are informed thatyou may exercise the rights of Access, Rectification, Suppression, Limitation,Portability and Opposition, by sending an e-mail to the address *** EMAIL.1 attachingProof of identity and indicating in the communication the right you wantexercise. Via *** URL.2 to *** URL.33.- A text and a control system were available for sending communicationsby ADD EVENT regarding commercial actions such as invitations tonew calls for FEED, with the following content:"BASIC INFORMATION ON DATA PROTECTION. In accordance and incompliance with the provisions of article 13 of Regulation (EU) 2016/679 and in the ar-C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 3
3/10Article 11 of Organic Law 3/2018, on Protection of Personal Data and guarantee ofdigital rights, we inform you that the contact information used for theThis communication, as well as those necessary for the exercise of the relationshipfessional, will be subject to treatment by ADD EVENT STAFF SL and / orADD TRADE SHOW SYSTEMS SL and / or VIVE FUTURA SYSTEMS SL with the finali-the maintenance and fulfillment of the professional relationship and provision of servicesservices derived from it, including the sending of informative communications,commercial or courtesy. Without prejudice to this, you are informed that you may exercisethe rights of Access, Rectification, Suppression, Limitation, Portability, and Oppositiontion, no longer be the subject of automated individual decisions, by sending an e-mail tothe address *** EMAIL.1 attaching proof of identity and indicating in the co-munication the right you wish to exercise.Likewise, we inform you that, in accordance with the provisions of Law 34/2002 on Ser-vices of the Information Society and Electronic Commerce, if you do not wantto receive future commercial communications simply reply to this com-e-mail, writing in the subject of the same the word "Baja" and your address ofmail and other data will be excluded from our database for this purpose.This message and its attachments are intended exclusively for its recipient,may contain confidential information subject to professional secrecy. No thisReproduction or distribution allowed without the express authorization of ADD EVENTSTAFF SL and ADD TRADE SHOW SYSTEMS SL and / or VIVE FUTURA SYSTEMSSL If you are not the recipient of this information, please let us know atthe sender's address for the removal of your email address, not copyingnor by delivering this message to anyone else and proceeding to its destruction. You can con-See additional and detailed information on Data Protection on our page.na web: *** URL. 3. In other words, the possibility of opposing the treatment of data is offeredpromotional purposes through a simple and free procedure, both in themoment of data collection as in each of the commercial communicationscials that are sent to the interested party ”.No damage has been caused to the claimant, since no recourse was even reachedbar the only information that was requested in the section "candidate contact", nameand email address, and did not receive any commercial communicationby ADD EVENT or the participants in the FEED event ”.FOURTH: On 06/10/20, the Director of the Spanish Agency for the Protection ofData agreed to initiate a sanctioning procedure against the claimed entity, by virtue ofthe powers established, for breaching the provisions of article 7.4 of the RGPD, whenoblige, the claimed entity, to people interested in attending the job fairthat organizes, to give consent for your data, not only to be processedby her to send advertising, but may also be transferred to third partiesthird-party companies for the same purpose, (sending advertising), punishable in accordance withprovided in art. 83 of the aforementioned RGPD, with an initial penalty of APERCIBIMIENTO.FIFTH: Notified the initiation agreement, the claimed entity, by means of a letter of faith-cha 06/18/20, made, in summary, the following allegations:"The execution of the contract (attendance at the event,"pleo ”), to which the claimant consents to the processing of personal data for the purpose ofC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 4
4/10lities that are not related to the development or control of the event, you must consentto be sent advertising by third-party companies once the event has ended.c, In summary, if consent is not given to transfer the data to third partiesthird-party companies to send you commercial advertising, the provision of the service is deniedmain, which is to attend the organized event on employment ”.Without the intention of reiterating what has already been stated and proven in the brief ofsitting at the time, but for clarification, so of importance to the he-may have, we would like to reiterate a fact that contradicts what is indicated in saidResolution, since it is precisely the opposite of what is indicated:1. Attendance at the event was related - solely and exclusively - to a final-it was that the assistants - who are applicants for em-pleo - with participating companies (exhibitors), who in turn are looking for professionalsthem. Therefore, the purpose was only one, it was a job fair and netwo-rking.2. Hence the legitimate need to have the personal data necessary tobe able to access the event and be able to give the companies the data of the people participatingpantes so that they could contact, with that sole and exclusive purpose and witha consent, we understand, sufficiently informed and free.Apart from the foregoing, the AEPD is informed that ADD EVENT STA-FF, SL is taking the appropriate measures, with the intention of reviewing and adaptingthe protocols for collecting user data ”.SIXTH: Consulted the web page *** URL.3 , on 06/23/20, it was verified that it offerstraining on:- The person responsible for the treatment- Regarding the purpose of the treatment and conservation, it is indicated that:“The proper organization and management of events and the service of the Business FairUse in the Digital Era FEED The communication of information and contactto businessmen or professionals with potential employees.ting by direct email for services similar to those contracted by us-ted, unless you have objected to such processing initially or in common.subsequent communications, to achieve the legitimate interests of promotingcoughs and services in which you may be reasonably interested.Have images (videos and / or photographs) of the events that take place in theDigital Era FEED Employment Fair The personal data provided is containedwill be valid as long as the owner of the same remains linked to us by re-contractual relationship, for a period of 2 years from the last confirmationConsenting us to process your data. Subsequently, the data will be deletedin accordance with the provisions of the data protection regulations, which implies yourblocking, being available only at the request of Judges and Courts, Defenderof the People, Public Prosecutor's Office or the competent Public Administrations, duringthe limitation period of the actions that could derive and, after this,it will proceed to its complete elimination ”.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 5
5/10- Regarding the legitimacy of the treatment, it is indicated that:"The basis for treating your personal data is the execution of the contract andthe services provided by ADD EVENT STAFF SL, as well as the complianceestablishment of a legal obligation. Also treatment for marketing purposes isnecessary to achieve the legitimate purpose of the person responsible for the treatment of yourcommercial stalls. You can always oppose the treatment by communicating itvia email. Providing personal data for these purposes is op-tional, but failure to provide such data would make it impossible to activate theRequested services".- Regarding the recipients of assignments or transfers, it is indicated that:"The personal data necessary to provide the service will be shared byour suppliers when the activity requires it, in which case it will beformed of the recipients, the purpose and the time of conservation of your data;and when it is required in compliance with a legal obligation by the Ad-Ministry of Justice and the Spanish Agency for Data Protection ”.- The rights of the interested persons- The origin of the data- Privacy Policy- Regarding the information and consent of the interested party, it is indicated that:"By reading this Privacy Policy, the client, contact,user of our website or any third party (hereinafter, the interested party) ofWhoever ADD EVENT STAFF SL has their personal data is leftinformed of how the data that you provide to us is collected, processed and protected throughvia: The existing contact form on our website *** URL.1By any other means enabled by us to maintain with you any-any of the purposes that we describe below. Depending on thespecific purpose for which the treatment is intended and when so required in compliance withof the applicable regulations (RGPD), we will request your prior and unequivocalI express consent. For example, the contact form on our websiteallows the explicit consent, as required by article 7 of theRGPD ”.- Regarding the obligation to provide personal data, it is indicated that:“The data requested in the contact form that we provide in ouranother website or by the various means enabled, in general, are thenecessary to fulfill the purposes of our services(eg: attendance or participation in our events such as the Employment Fair inthe Digital Era, sending promotional communications, advertising onour services, events, or subscription to our newsletter). Therefore ifthey are not provided or it is not done correctly, your requests will not be addressedtitions.C / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 6
6/10- Regarding the purpose of the processing of personal data, it is indicated that:"The personal data collected will be processed by ADD EVENT STAFF SL withtrain for the following purposes: Management and organization of events, congresses andfairs. The proper organization and management of the Job Fair service inthe Digital Era FEED The communication of information and contact ofbusinessmen or professionals with potential employees. Have images(videos and / or photographs) of the events that take place at the Era Employment FairDigital FEED Sending of communications, through electronic means and / or withwith the aim of: Provide information on possible changes in theservice, quality or security systems for the user. Send billing co-corresponding to our products or services purchased. Send information,advertising about conferences, campaigns, events and other activities carried out by ADDEVENT STAFF SL or in which it collaborates. Whenever any communication is madecation of this type will be addressed exclusively to those interested parties who havepreviously authorized its reception. Management of conducting surveys, opi-nions and / or evaluations regarding your satisfaction with the products,services and in general the relationship it maintains with ADD EVENT STAFF SL Cum-compliance with the obligations that correspond to ADD EVENT STAFF SL forlegal mandate. In certain circumstances we will need to process your datapersonal to comply with certain legally established obligations.- Regarding the transfer of images, it is indicated that:“By participating in the events, congresses and fairs of ADD Event Staff SL, you canto be photographed or recorded for the realization of a photo report, video report-heh that will be broadcast on the social media of ADD Event Staff. You for so-to, assign their rights to ADD Event Staff SL. in these events organized byADD Event Staff SL For all of which, you expressly AUTHORIZE ADD Event StaffSL to the use of their personal image resulting from said photographic sessionfor the aforementioned purpose, under the provisions of the Organic Law1/1982, of May 5, of Civil Protection of the Right to Honor, to Personal Privacysonal and Family and the Own Image, without said authorization being subject tono temporary term nor is it restricted to the national scope of any country. Blisssession is free. You can revoke this assignment at any-any time by sending an e-mail to: *** EMAIL.1 attaching a photocopy of yourDNI. Contact information: postal address, mobile or landline phone, and email addresselectronic.Academic training data. (Curriculum); Professional experience data. (Cu-rrculo); Other information: Languages, driving license. If the interested party provides datapersonal third parties (representative, others), declares to have their prior consentfeeling and undertakes to pass on the information contained in thisPrivacy Policy, exempting ADD EVENT STAFF SL from any responsibilitysability in this sense. However, we may carry out the verificationsthat we deem appropriate to verify this fact, adopting the measures ofdue diligence that corresponds, in accordance with the data protection regulationscough of a personal nature ”.- Time will be kept your personal data- What is the legitimacy for the processing of your personal dataC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 7
7/10- To which recipients will your personal data be communicated- Responsibility of the interested party- Security measures.SEVENTH: On 06/24/20, the test practice period began, accord-dose: a) .- to consider reproduced for evidentiary purposes the complaint filed by theAdvertiser and its documentation, the documents obtained and generated that formpart of the file and b) .- consider reproduced for evidentiary purposes, the allegationsto the agreement to initiate PS / 00110/2020, presented by the denounced entity.EIGHTH: On 08/06/20, the requested person is notified of the proposed resolution in which it is proposed that, by the Director of the Spanish Protection Agencytion of Data is sanctioned with "APERCIBIMIENTO" for an infraction of article 7)of the RGPD, in accordance with the provisions of article 58.2) of the aforementioned RGPD.NINTH: Following the notification of the proposed resolution, notype of allegations to the proposed resolution, in the time allotted for that purpose.PROVEN FACTS1º.- As reported, to access the job fair organized by the entityclaimed, attendees are obliged to give their personal data so that they can send themthen publicity, both from the claimed entity and from the other participating companies.participants at the event or even third-party companies.2º.- The claimed entity indicated, in its first allegations, sent to this Agencycia on 12/23/19 that:“(…) As a prior step to any communication of personal data - as statedreflected in the privacy policy - it had to be accepted, and the interested party was warned,that it was a necessary requirement to attend FEED, sinceOtherwise the consequence would be the impossibility of their participation. In this sense it hastaking into account that the purpose of FEED was to communicate tojob seekers with participating companies (exhibitors) who in turn seekprofessionals, hence the legitimate need to have the necessary personal datanecessary to put both parties in contact ”.(…) And as for receiving commercial communications from the participants-tes, to mention that in the Privacy Policy texts, which could beaccess as a previous step to the contribution of any personal data (see: *** URL.2 thatlinks to the privacy policy *** URL.3 , the possibility of receiving co-communications regarding the services of the exhibitors and / or the person in charge (…) ”.3.- Once this file has been initiated, in the allegations phase, the entity complains aboutMada, in writing to this Agency on 06/18/20, indicates, among others, that:“(…) Attendance at the event was related - solely and exclusively - to a finalquality, which was that the attendees - who are business applicants - could communicatepleo - with participating companies (exhibitors), who in turn are looking for professionalsthem. Therefore, the purpose was only one, it was a job fair and netwo-rking.Hence the legitimate need to have the personal data necessary toder access the event and be able to give companies the data of the people participatingC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 8
8/10pantes so that they could contact, with that sole and exclusive purpose and witha consent, we understand, sufficiently informed and free ”.Apart from the foregoing, the AEPD is informed that ADD EVENT STA-FF, SL is taking the appropriate measures, with the intention of reviewing and adaptingthe protocols for collecting user data ”.4.- According to the information published on the website of the claimed entity*** URL.3 , consulted by this Agency on 07/27/20, indicates that:“The purpose of the treatment and conservation of the personal data obtained from theparticipants will be used for the proper organization and management of events and serviceof the FEED Job Fair in the Digital Era, and the contact of em-presarios or professionals with potential employees. But it also indicates that the dataThe personal coughs of those attending job fairs will be used for: “Actions ofdirect email marketing for services similar to those contracted byyou, unless you have objected to such processing initially or in communicationsubsequent cations, to achieve the legitimate interests of promoting products andservices in which you may be reasonably interested and have availableimages (videos and / or photographs) of the events that take place at the Trade Fairpleo Digital Age.FOUNDATIONS OF LAWIThe Director of the Spanish Agency is competent to resolve this procedureof Data Protection, in accordance with the provisions of art. 58.2 of the GDPR inthe art. 47 of LOPDGDD.IIThe joint assessment of the documentary evidence in the procedure brings to the conclusionknowledge of the AEPD, a vision of the denounced action that has been reflectedIt gives in the facts declared proven above related. However, on the allegationstions presented by the claimed entity at the initiation of the file, indicate whatfollowing:As can be seen, both from the complaint presented by the claimant, and from theallegations presented by the claimed entity and above all, as indicated bythis, in the "privacy policy", of its website, *** URL.3 , in relation to the final-the treatment and conservation of personal data obtained from the participantsparticipants in organized job fairs, in principle, the personal data of theParticipants are used to organize and manage the event, as well as to facilitateestablish contact between businessmen and assisting professionals with potential entrepreneurspleated.Regarding this purpose, and based on the provisions of article 6.1.b) of the RGPD, theProcessing of the data obtained from the attendees is considered lawful, as it is necessaryyear for the execution of the contract in which the interested party is a party, as is in thiscase, attendance at the event (job fair), in exchange for contactingemployers and let them know you.However, from the information provided by the claimed entity on its pageweb, *** URL.3 , the personal data obtained from the participants in the trade fairsemployment, will also be used for : “direct email marketing actionsC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 9
9/10to, unless you have objected to such processing initially or in communicationsubsequent actions, to achieve the legitimate interests of promoting products andservices in which you may be reasonably interested "and" haveimages (videos and / or photographs) of the events that take place in the business fairspleo ”.These purposes, which have nothing to do with the job search, must have theexplicit consent of the interested party, applying in this case, what is stipulated in theArticle 6.1.a) of the RGPD, where it is indicated that the processing of data onlyIt will be lawful, if it is obtained from the free, specific and informed consent of the interested party.do, accepted by clear affirmative action.This affirmative act could be by checking a box on the website orin the form that must be completed when registering for the event or any other declarationration or conduct that clearly indicates that the interested party accepts the proposedprocessing of your personal data, in this case to send advertising, record-Image creation or any other act unrelated to the ultimate objective of the job fair.This consent must be given for each and every one of the activities outside themain act, object of the event,Finally, as indicated in article 6.3 of the LOPDGDD: " It may not be subject tothe execution of the contract to which the affected party consents to the processing of personal dataend for purposes not related to the maintenance, development orcontrol of the contractual relationship ” .Therefore, if a person is interested in attending an event, a job fairin our case, where applicants are contacted with job providersand you do not want to give your personal data, it is lawful that the organizer does not allow your assistancesince these data, whose legal basis is the performance of a contract, will be usedzados for the purpose for which the event is held. Another thing is yes, the data obtainedThey are also used for another purpose that is not the main one, as in this case, for thecommercial advertising of the participating companies or the recording of imagesof the act for promotional or other external purposes, in which case the consentfree, express and affirmative consent of the interested party.In view of the above, the following is issued:RESOLVES :APPEAR: to the entity ADD EVENT STAFF, SL with CIF .: B85042737 for violationof article 7 of the RGPD.REQUIRE: the entity ADD EVENT STAFF, SL so that, within a month, tocount from the notification of this resolution, adapt your protocols for collectingdata that allow users to give free consent for their data to belater treated for purposes other than always attending organized events.two, in accordance with the provisions of the RGPD.NOTIFY: this resolution to ADD EVENT STAFF, SLC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es
Page 10
10/10In accordance with the provisions of article 50 of the LOPDPGDD, this Re-solution will be made public once it has been notified to the interested parties.Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of theLOPDPGDD, and in accordance with the provisions of article 123 of the LPACAP, theThe parties may optionally file an appeal for reconsideration before the Directorof the Spanish Agency for Data Protection within a month fromthe day after notification of this resolution or directly contentious appealadministrative before the Contentious-Administrative Chamber of the National Court,in accordance with the provisions of article 25 and section 5 of the additional provisionFourth nal of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-administrative, within two months from the day after the notificationtion of this act, as provided in article 46.1 of the aforementioned Law.
Mar España Martí
Director of the Spanish Agency for Data Protection.