AEPD (Spain) - PS/00040/2020: Difference between revisions

Latest revision as of 13:50, 13 December 2023

AEPD - PS/00040/2020

Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	17.02.2021
Published:
Fine:	None
Parties:	AYUNTAMIENTO DE GATA
National Case Number/Name:	PS/00040/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) sanctioned a city hall for not satisfying a data subject's access request to his personal data concerning the payment of local taxes.

English Summary

Facts

A data subject requested the City hall of Gata to get access to his personal data used to calculate a local tax for water use and asked about the origin and the recipients of that data back in 2018. At the time, the City hall of Gata partly fulfilled the request by giving access to some of the data related to one of the elements of the local tax that is managed by the City hall and pointed that the rest of the data was processed not by the City hall but by the administration of the Autonomous Community. The data subject requested access to his data again in 2019 to the City hall of Gata and to the administration of the Autonomous Community. The Autonomous Community replied but the City hall considered that it didn't need to reply to the data subject request as the Autonomous Community had already done it.

Dispute

Can the controller consider that the right to access of a data subject is satisfied when another controller satisfies an access request related to same personal data?

Holding

The Spanish DPA held that even though the personal data of the data subject were the same for the City hall and for the Autonomous Community, the City hall had the obligation to satisfy the access request too independently of whether the Autonomous Community had already replied to the data subject. The City hall facilitated the access to his data by the data subject in the course of the investigation process of the Spanish DPA and therefore the Spanish DPA decided to only issue a warning to the City hall.

Comment

The main issue debated here is that the two administrative entities (City hall and Autonomous Community) used the same data to calculate the taxes to be paid by the citizen. The taxes referred to in this dispute are two, one that is due to the City hall and another one that is due to the Autonomous Community, i.e. a local tax and a provincial tax. However, the data use to calculate both taxes is the same (water consumption) and they are collected by the City hall than then shares the data with the Autonomous Community. The City hall considered that it didn't need to reply to the data subject request as the Autonomous Community had already done it. However, the Spanish DPA decided that both entities needed to reply to the request.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/13

 Procedure No.: PS / 00040/2020

RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and in
based on the following

BACKGROUND

FIRST: A.A.A. (hereinafter, the claimant) filed a claim on 05/29/2019
before the Spanish Agency for Data Protection (AEPD) against CITY COUNCIL OF
GATA with NIF P1008500I (hereinafter, the claimed one). For having exercised the right to

access to your data regarding the water supply rate on 04/12/2019, without obtaining
answer.

It states in the claim:

1) In that same request to exercise the right, it was emphasized that the
claimed “in July 2018 access to data from the register of the fee for service provision
of water supply, which works in the claim of the AEPD E / 06811/2018, which was
filed by the submission of information on the sanitation fee, despite the
evidence of the photocopies attached to the information sent containing data from the
affected as a taxpayer of the water register and GOBEX canon, referring to the collection

quarterly periodical of the water supply rate and therefore the information was not provided
requested nor did this Agency protect the affected party ”.

2) That on 05/03/2019, upon request for the right of access to the data of the canon of
sanitation in the Junta de Extremadura “an appeal was filed against the

inadmissibility of processing the claim, E / 03514/2019 ”, attaching a letter from the Head of
Tax Management Service of 03/04/2019, by which the right of access to the
requested data ”from which he deduces that the City Council communicated that the affected person is
taxpayer of the water supply fee.

As can be seen in that appeal, the claimant indicated “the first news that was received
that he was listed as a taxpayer in the water supply and
sanitation occurred when the water and GOBEX fees for the first quarter were delivered
of 2018, being verbally informed by the official that she had changed
taxpayer, without any information or administrative act to justify them ", accompanies
copy of the receipts for the first quarter of 2018. ”The receipts for

water and GOBEX canon corresponding to the collection procedures of the second and
third quarter of 2018 ”. Attach as annex 1 the data provided by the Head of
Tax management service of the Board, regarding the data of the affected party communicated
by the City Council with the self-assessments of the sanitation fee.

28001 - Madrid 6 sedeagpd.gob.es 2/13

The letter communicates the data that have been communicated by the City Council of Gata with
the declarations and self-assessments of the sanitation fee presented before them.

The data contained in the data base of the Junta de Extremadura are contained
referring to said canon. The data includes the invoice number, the date of issue of
the invoice, the beginning of the invoiced period, which is 3 months, and the amount, together with the NIF.

The self-assessments are also attached with the settlement and receipt number, of each
detailed quarter.

3) That before your claim in the Agency of 03/10/2019, for no response of the claim-
in your right of access to the personal data of the file corresponding to the canon
sanitation of the C.A. of Extremadura transferred to the Junta de Extremadura, with

do of inadmissibility on E / 04018/2019 of 04/09/2019, on 05/08/2019 he filed an appeal
replacement. in which it was revealed that the request was not repeated, neither by term nor
for the data previously requested, evidencing the falsity of the information of the
fee provided at the time in response to the request for access to data at the rate of
water supply by providing the aforementioned letter of 03/04/2019 and the fee receipts, where
the canon is passed on, delivered by the City Council to the affected party, with which it was accredited

that the City Council communicated that the affected party is a taxpayer of the supply rate of
water and that your data is subject to treatment ”.

By documentation contained in E files mentioned by the claimant, in
chronological order:

6811/2018
3514/2019, and
4018/2019

and its resources, requests they be contributed to the present ", and" it is proven that the
GATA city council never provided access to the data of the affected party, processed in
relationship with the rate of water supply while declaring that the affected is
taxpayer of the water supply rate and as such delivers the receipts, bills of
the rate on which the canon that the Extremadura Board of Directors pays semiannually affects. "

Provides:

a) Copy of the letter addressed to the complained party, dated 04/12/2019, exercising their right to
access to the water supply rate data, adding that “no data is requested from the

GOBEX sanitation fee, having reliable evidence that the City Council
has communicated to the Junta de Extremadura that the affected party is a taxpayer. "

SECOND: In view of the facts reported in the claim and the documents

provided by the claimant, the claim is transferred to the defendant on 07/19/2019 so that
accredit the response to the claimant, the decision and the measures adopted so that no
repeat similar incidents.

28001 - Madrid 6 sedeagpd.gob.es 3/13

The shipment consists of "acceptance date 07/22/2019" and in the absence of a response,
reiterates 12/18/2019, appearing accepted, without any response being received.

On 02/05/2020, the admission for processing of the claim was agreed.

THIRD: With respect to the previous files alleged, it should be mentioned that
incorporate to the present, the documentation that works and generated in relation to the
following:

File E / 6811/2018:

It is an inadmissibility agreement for processing of 10/8/2018

The aforementioned resolution is related to the document that originates it, presented by
the claimant with registration date of 08/27/2018, registration number *** REGISTRATION.1, in the
which indicated:

a) “In writing dated 07/20/2018, the right of access to data was requested

corresponding to the standard of rate for the provision of water supply service. Manifests
which attaches a copy of the application document in annex 1. It is appreciated that said annex does not appear.

“On 08/14/2018, the Mayor's Office Resolution 2018-204 of 08/09 is notified

granting access to the data related to the register of the sanitation fee of the
GOBEX. A copy of the resolution is attached as annex 2. " It is appreciated that this annex does not appear.

"On the same date, information is received on some of the data relating to the registry

of the GOBEX sanitation fee, which is accompanied by some data sheets of some
computer file referring to two properties in which a lot of data would be missing and the
provided would be insufficient, contradictory unintelligible in some cases, and the
coding and equivalence system of the computer application for its interpretation.
Attach annex 3 a copy of a document ”. It is appreciated that this annex does not appear.

“It is impossible that the origin of the data of the sanitation fee is the IBI or the
census of inhabitants, since the regulation of the canon, Law 2/2012, indicates that its
origin is the standard of the water supply rate. "

It considers that “the data of the register of the fee for the benefit has not been accessed
of the water supply service. "

- The decision of inadmissibility was appealed by the claimant, which was processed in the

RR / 00763/2018, of 12/4/2018, being dismissed.

File 3514/2019, inadmissibility for processing.

In the claimant's claim letter, she requested 03/12/2019 in the absence of

in response to your right of access exercised on 02/04/2019 in front of, in this case, the
Directorate General of Taxes of the Ministry of Finance and Public Administration of the
Junta de Extremadura on the data of the sanitation fee of the CCAA of
Extremadura loaned by the City Council of Gata to the Junta de Extremadura.

28001 - Madrid 6 sedeagpd.gob.es 4/13

It is appreciated that what the claimant now claims is directed against the City Council,
although this file is mentioned and taken into account in order to be related. The

claim was inadmissible for processing on 03/28/2019.

Appealed, on appeal RR 354/2019 was resolved on 07/09/2019
being dismissed, highlights, in fact “On May 3, 2019, the affected party has
submitted a document, registered with the Agency on 05/06/2019, in which it shows
disagreement with the resolution, arguing that the inadmissibility agreement violates the

right of access guaranteed by article 13 of the LOPDGDD and article 15 of the RGPD.

While in Law I, it is indicated “Subsequently, the appellant
presented on 03/19/2019 a letter desisting from the claim made on March 12
of 2019 with pre-registration code 201903100-008600-00851, indicating that: “With date

of March 12, 2019, in writing, of March 4, from the Chief of the Tri-
revenue and income from the General Directorate of Taxes, a response is received to each request
access of those affected who gave rise to the aforementioned claims. That it proceeds to desist
of the claims, understanding that the right of access is satisfied… ”.

In this appeal, the claimant provided information on accessing her data

provided by the Junta de Extremadura on the sanitation canon dated 8
March 2019, which includes the invoice: date, number, expiration, invoice period-
do, amount NIF. It also provides as annexes the taxpayer copy of receipts
“Aguas y canon Gobierno Extremadura” from different quarters of 2018.

File 4018/2019, inadmissible for processing on 04/09/2019, entry date 03/12/2019.

The complaint writing states that: “On 02/04/2019, the
Gata City Council access to personal data from the CA sanitation fee
of Extremadura assigned to the Board, and having received no response, it is presented

claim writing. "

The inadmissibility agreement indicates that “In the present case, it is appropriate to indicate that
The documentation in file E / 00519/2019 shows that the request for
Access made on 02/04/2019 reiterates another request made by the affected party on 07/20/2018,
which was processed by the Gata City Council through file number 234/2018 and re

released through the resolution of 08/09/2018, granting by virtue of the aforementioned act access
to the requested information. Thus, after the analysis carried out on the previous documents,
previously mentioned and the concurrent circumstances, there are no rational indications of
the existence of an infringement of the data protection regulations. "

Against the agreement, an appeal for replacement is filed with the number
RR / 365/2019 that on 07/30/2019 dismisses the petition.

File E / 00519/2019, about a letter dated 12/12/2018, the complainant being B.B.B. . (pa-
dre of the representative of the claimant in this proceeding, as indicated in the

clamor)

In the claim, he states that “On 03/08/2018 he requested access to his data on
the municipal water supply rate and the data given to the Extremadura council on

28001 - Madrid 6 sedeagpd.gob.es 5/13

the sanitation canon of the Autonomous Community of Extremadura ", and since no response was obtained,
formulate claim.

Attach a copy of the document submitted to the City Council.

In the response that the defendant had in the file, it is indicated that it was not
The petition has been tested since it is not the owner of any record of files in the sanitation fee.
of the Junta de Extremadura. It adds that the representative of B.B.B. and C.C.C. Is daughter
of both, and that the “mayor's office has already granted the right of access to the representative,

by A.A.A., mother of the representative as the current owner of the data that is “related to
you to the sanitation fee ”.

It also provides a brief 08/09/2018 summary “sending a report on the claim
presented by D.D.D., on behalf of A.A.A. on access to character data

protected "The resolves indicate that" access to personal data is granted.
sonal what concerns him that is being dealt with in this City Council regarding the register of
GOBEX sanitation fee ”.

Another access brief from D B.B.B. figure with departure date of 02/25/2019, also references
attached to the “GOBEX sanitation fee”.

Faced with the agreement, an appeal for reconsideration RR / 00288/2019 was filed that was dismissed
Tue on 12/17/2019.

FOURTH: On 06/03/2020, the Director of the Spanish Agency for Data Protection

agreed to initiate a sanctioning procedure for the claimed party, in accordance with the provisions of
Articles 63 and 64 of Law 39/2015, of 1/10 of the Common Administrative Procedure of the
Public Administrations (hereinafter, LPACAP), for the alleged violation of article 15
of the RGPD, in accordance with article 83.5 b) of the RGPD.

Against the initial agreement, no allegations are made by the defendant.

FIFTH: On 11/26/2020, the instructor of the procedure agreed to open a
test practice period, taking actions E / 06880/2019 as incorporated.

The claimed person is requested to respond to the following request for information:

1. Indicate the relationship between the rate of water supply, how to obtain the
data for its management, and specifically in this case, of the claimant (collection and information
to the claimant of the data processing) and in the same sense, on those used for the

“GOBEX sanitation fee”, providing if they have information on the
treatment of these data was given to the claimant.

2. Report how the data for the “GOBEX sanitation fee” are transferred,

periodicity and other aspects for the collection of said canon. Data transferred from the
claimant, for the management of the “GOBEX sanitation fee”.

3. Report, if always and in any case, the existence of the water supply rate
conditions and must exist for the second to occur, the “GOBEX sanitation fee”, and

28001 - Madrid 6 sedeagpd.gob.es 6/13

if the second only exists when there is a water supply, or registration in the water standard,
which implies the "rate of water supply."

4. Indicate if the settlements for water consumption of the claimant in estimates
direct reading of meter consumption will not constitute elements that are part of the
the rate of water supply.

5. Reasons why the water supply rates of *** DIRECCION.1, go from

ownership of B.B.B. A.A.A ..) and because at a given moment, the first ceases to be the
data owner.) and if the new owner is informed of the data processing, providing a copy
of said writing.

6. The claimant indicated that in writing dated 07/20/2018 a right of access was requested

to the data corresponding to the standard of fee for the provision of water supply service and
that entity replied on 08/14/2018, mayoral resolution 2018-204 of 08/09
granting access to the data related to the register of the sanitation fee of the
GOBEX. Reasons why if the claimant has also requested the aforementioned on 04/12/2019
access, on neither of the two occasions have they been provided, on one occasion they
of “GOBEX sanitation fee”, in the last one it is unknown if such access has been given.

7. Submit the data that you have regarding the water supply rate of the
current claimant, and those existing in the years 2017 to the present.

The defendant did not answer.

SIXTH: On January 5, 2021, a resolution proposal of the following literal is issued

“That the Director of the Spanish Agency for Data Protection sanctions
GATA CITY COUNCIL, for a violation of article 15 of the RGPD, in accordance with

with article 83.5 b) of the RGPD. "

Allegations were received on 01/20/2021, of the following tenor:

-It indicates that it is a town of less than a thousand inhabitants and limited resources, so
contracted with an expert company in Data Protection to advise the

exercise of rights.

-He states that he has given effect to the exercise of the right of access of the claimant of the rate
water supply. They contribute:

 Acknowledgment of dispatch by the postal service to the claimant's representative.

 Written letter addressed to the claimant's representative as a reference to the number of
file that appears in the postal service dispatch in which it responds to the exercise of the

right of access to the water supply rate signed on 01/20/2021 which includes the
information regarding the processing of personal data.

28001 - Madrid 6 sedeagpd.gob.es 7/13

PROVEN FACTS

1) The claimant asked the claimant for their data associated with the processing of the tax rate.
water supply on 04/12/2019 and what data related to said water supply rate
water has yielded, and to which entities, without obtaining a response. The petition is framed in the
right of access of the interested party of article 15 of the RGPD. In none of the cases did he obtain
an answer.

It should be noted that in a previous guardianship, dated 08/14/2018, the defendant gave him the
access to data relating to the GOBEX sanitation fee register, according to
the claimant states.

2) Related to said request, the claimant knows that her data is subject to
treatment by the CCAA of Extremadura due to its management of the canon of
water sanitation, or GOBEX sanitation fee, a tribute of the
Autonomous Community of Extremadura (Law 2/2012 of 06/28) and exercised its right to
accessed 02/04/2019. In the information provided to you, it is considered as

taxpayer (taxpayer).

3) The data of the claimant of "GOBEX sanitation fee" were communicated by the
claimed, as stated in the response that the CCAA Extremadura, owner of the
sanitation fee gave the claimant the right of access exercised the
02/04/2019.

4) In the course of this procedure, the defendant provided a copy of the document that had
The response to the petition dated 04/12/2019 was sent to the claimant, containing the
basic informative elements about access to your data.

FOUNDATIONS OF LAW

I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of the
Spanish Agency for Data Protection is competent to resolve this procedure.

II

It defines the RGPD in its article 4:

"Controller" or "controller": the natural or legal person, authority

public, service or other body that, alone or together with others, determines the ends and means
of the treatment; if the law of the Union or of the Member States determines the purposes and

28001 - Madrid 6 sedeagpd.gob.es 8/13

means of treatment, the person responsible for the treatment or the specific criteria for their
appointment may be established by the law of the Union or of the Member States; "

This procedure is limited to the claim derived from the non-response to the exercise
of access to the data of the water supply rate of the claimant that are the subject of
requested treatment. Accessory aspects related to the sanitation fee are excluded
of the GOBEX that are reflected and previously mentioned because they can be related to the

all rate.

Law 2/2012, of 06/28, on urgent measures in tax, financial and gaming matters
the Autonomous Community of Extremadura (B.O.E. no. 166, dated 07/12/2012 and D.O.E.
no. 125, dated 06/29/2012, and Decree 157/2012, of 08/03, which approves the Regulation
of the Sanitation Canon of the Autonomous Community of Extremadura (Official Gazette of
Extremadura no. 151, dated 08/06/2012) are the rules related to the canon of
sanitation as a tribute of the CCAA of Extremadura. The sanitation fee is

an indirect tax, of a real nature, which is levied on the availability and
use of water Its purpose is to enable the financing of infrastructures
Hydraulic supported by the Autonomous Community of any nature
corresponding to the integral water cycle (art 33 of the Law). They should also be cited from the
Law:

"Article 36. Taxpayers

1. They are taxpayers, as taxpayers, natural or legal persons, and the
entities referred to in article 35.4 of Law 58/2003, of December 17 (RCL 2003,

2945), holders of the contract for the provision of the water supply service, both for the
simple fact that connected homes, offices or premises can have such
service and the use they make of said supply.

In this case, they will be considered taxpayers, as substitutes for the
taxpayer, the supplying entities.

Article 46. Impact

1. In the event of supply by supplying entity, it must have repercussions
the entire amount of the canon on the taxpayer, who is obliged to bear it.

4. The procedure for the collection of the sanitation fee in the voluntary period will be

unit with the one followed for the collection of the rights that the supplying entity
correspond to the water supply service. The act of approval of the
document that authorizes the collection of rights derived from the service of
water supply and the notice of collection will also refer to the canon of
sanitation.

Article 47. Self-assessment

1. The taxpayer's substitutes will be obliged to present a self-assessment in the
form and terms that are determined by regulation. Models will be approved by

order of the competent Ministry in finance matters.
Article 51. Compatibility with other tax figures

28001 - Madrid 6 sedeagpd.gob.es 9/13

The sanitation fee regulated in this provision is compatible with any
another tribute related to the use of water. In particular their compatibility is declared
with the tax figures contemplated in the state water legislation and with the taxes

in this matter that may be required by local entities. "

Taxpayer as taxpayer is the subject who performs the taxable event, that is, the person
that performs the action that is subject to some tax, which in this case indicates that it would be
the claimant, and substitutes for the taxpayer, the taxpayers who, due to the imposition of the

law and instead of the taxpayer, they are obliged to fulfill the main tax obligation,
as well as the inherent formal obligations. Unless the law indicates otherwise, the substitute
may demand from the taxpayer the amount of the tax obligations satisfied (article
36 of the General Tax Law).

Therefore, different legal positions are presented regarding the management of the supply rate.
nistro of water, responsibility of the supplying entities, generally the City Council
or concessionaire of the same, against the sanitation fee, which is a tribute to the

Junta de Extremadura, although the City Council intervenes in its management as indicated in
Regulatory Law and development regulations.

Thus, it is appreciated that the canon and rate of water supply are different tax objects,
with different purposes and data controllers from different public administrations,
Although there are internal relations between both administrations with the objective of
canon tion. It has a specific regulation by the CCAA of Extremadura, which by relapsing
in the supply of water, requires collaboration in the management of data processing.

The City Council collects the data for the management of its water supply rate and from
of this collection, carries out treatment operations related to the purpose with which the

itself, including those specified in the law regulating the canon and development standards,
which include collaboration in the management of the canon. This implies, among other aspects,
At the same rate of water supply, the part of the sanitation fee and the self-regulation
tax clearance. The City Council, when it is a supplying entity, is responsible
state in a differentiated way on the invoice or receipt: the tax base, the rates and per-

centages as well as the tax quota of the canon. It does not seem appropriate to determine that in
treatment operations carried out by the claimed data are differentiated and separated by
the tasks to which they are destined, but rather, they form a chain of treatments with
a single purpose, destined to the management and collection of the sanitation fee in its different
These aspects, which are understood by legal provision in the same invoice as the rate

water supply. This is how both concepts appear on the receipt given the intimate connection
That is clear from its management and for configuring it in this way the applicable regulations. It not
means that the defendant uses some data for the water supply rate and others
for the canon, but at the level of treatment operations, they correspond to the same
purpose that is foreseen in the regulations for the establishment and development of the canon, and is the
Purpose of the data processing of the claimed person.

III

Recital 61 of the GDPR indicates:

"Information on the processing of their data must be provided to interested parties
personal data at the time they are obtained from them or, if obtained from another source,

28001 - Madrid 6 sedeagpd.gob.es 10/13

a reasonable time, depending on the circumstances of the case. If personal data
can be legitimately communicated to another recipient, the interested party must be informed
at the time they are communicated to the recipient for the first time. "

The facts presented are constitutive by the defendant of a violation of the
Article 15 of the RGPD that establishes:

1. The interested party will have the right to obtain from the data controller confirmation of
whether or not personal data concerning you is being processed and, in this case, the right to
access to personal data and the following information:

a) the purposes of the treatment;

b) the categories of personal data in question;

c) the recipients or categories of recipients to whom they were communicated or will be

communicated personal data, in particular recipients in third parties or organizations
international;

d) if possible, the foreseen period of conservation of personal data or, if not
possible, the criteria used to determine this period;

e) the existence of the right to request from the person in charge the rectification or deletion of data
personal data or the limitation of the processing of personal data relating to the interested party, or to
object to such treatment;

f) the right to file a claim with a supervisory authority;

g) when the personal data have not been obtained from the interested party, any
information available on its origin;

h) the existence of automated decisions, including profiling, to be
refers to article 22, sections 1 and 4, and, at least in such cases, significant information
on the applied logic, as well as the importance and expected consequences of said

treatment for the interested party. "

Article 12.2.3 and .4 of the RGPD indicates:

"2.The data controller will facilitate the interested party to exercise their rights in
under Articles 15 to 22. "

"3. The data controller will provide the interested party with information regarding their
proceedings on the basis of a request pursuant to Articles 15 to 22, and, in
In any case, within one month of receipt of the request. Said term
it may be extended for another two months if necessary, taking into account the complexity and
the number of requests. The person in charge will inform the interested party of any of said

extensions within a month from receipt of the request, indicating the
reasons for the delay. When the interested party submits the request by electronic means, the
Information will be provided by electronic means whenever possible, unless the
interested party request that it be provided in another way.

4. If the person responsible for the treatment does not act on the request of the interested party, he will inform him

without delay, and no later than one month after receipt of the request, of the
28001 - Madrid 6 sedeagpd.gob.es 11/13

reasons for their failure to act and for the possibility of filing a claim before a
control authority and to exercise legal actions. "

This right of access is independent of the right of access to documentation in a
administrative procedure when the condition of interested party is held, regulated by the
LPACAP, and this is derived from the wording of article 13 of the aforementioned Law, and the mention in the
Article 53 of the rights of the interested parties.

The defendant did not answer the claimant about the data of which the defendant holds the
responsibility, clearly expressed by its definition, and also by its exclusion.

Within the right of access to data, you must not only offer information on the origin, but also
also to whom has yielded them.

IV

Indicates article 83.5. "Violations of the following provisions will be sanctioned,

according to paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the volume
total annual global business of the previous financial year, opting for the one with the highest
amount:

b) the rights of the interested parties in accordance with articles 12 to 22; "

Article 83.7 of the RGPD indicates:

“Without prejudice to the corrective powers of the control authorities by virtue of the
Article 58 (2), each Member State may lay down rules on whether it can, and
to what extent, impose administrative fines on public authorities and bodies
established in said Member State "

Article 58.2 of the RGPD provides the following: “Each supervisory authority will have
all of the following corrective powers listed below:

a) punish any person responsible or in charge of the treatment with warning

when the treatment operations have infringed the provisions of this
Regulation;

d) order the person in charge of the treatment that the operations of
treatment are in accordance with the provisions of this Regulation, where appropriate,

in a certain way and within a specified time;

In this sense, the defendant has accredited the measure consisting of giving access to the
claimant, who as responsible for the treatment should have complied in his day, being the
request for the concrete and specific request, without prior execution of that

specific and concrete access to what is requested by said person in charge.

The Spanish legal system has chosen not to penalize entities with a fine

28001 - Madrid 6 sedeagpd.gob.es 12/13

public, as indicated in article 77.1. c) and 2. 4. 5. and 6. of the LOPDDGG: “1. The
regime established in this article will be applicable to the treatments of which are
managers or managers:

c) The General Administration of the State, the Administrations of the communities
autonomous entities and the entities that make up the Local Administration.

2. When the managers or managers listed in section 1 commit
any of the infractions referred to in articles 72 to 74 of this organic law, the

The competent data protection authority will issue a resolution sanctioning
the same with warning. The resolution will also establish the measures that
It is appropriate to adopt so that the conduct ceases or the effects of the infraction that are
would have committed.

The resolution will be notified to the person in charge or in charge of the treatment, the body of which

hierarchically depends, where appropriate, and those affected who had the status of
interested, where appropriate.

4. The resolutions that
fall in relation to the measures and actions referred to in the sections
previous.

5. They will be communicated to the Ombudsman or, where appropriate, to similar institutions of
the autonomous communities the actions carried out and the resolutions dictated to the
under this article.

6. When the competent authority is the Spanish Data Protection Agency, this

will publish on its website with due separation the resolutions referring to the
entities of section 1 of this article, expressly indicating the identity of the
responsible or in charge of the treatment that had committed the infringement. "

The infringement committed has been corrected, but its file does not correspond, but its
statement because it has occurred once the procedure was opened, verifying the
itself, without any corrective measure being imposed.

Therefore, in accordance with the applicable legislation,

the Director of the Spanish Agency for Data Protection RESOLVES:

FIRST: IMPOSE the CITY COUNCIL OF GATA, with NIF P1008500I, for a
infringement of article 15 of the RGPD, in accordance with article 83.5 b) of the RGPD, a

warning sanction.

SECOND: NOTIFY this resolution to the GATA CITY COUNCIL.

THIRD: COMMUNICATE this resolution to the OMBUDSMAN, of

in accordance with the provisions of article 77.5 of the LOPDGDD.

FOURTH: In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

28001 - Madrid 6 sedeagpd.gob.es 13/13

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the Director of
the Spanish Agency for Data Protection within one month from the day
following notification of this resolution or directly contentious appeal

administrative before the Contentious-Administrative Chamber of the National Court, with
in accordance with the provisions of article 25 and paragraph 5 of the fourth additional provision
of Law 29/1998, of 07/13, regulating the Contentious-Administrative Jurisdiction, in the
period of two months from the day following notification of this act, as

provided for in article 46.1 of the aforementioned Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, you may
provisionally suspend the final administrative resolution if the interested party manifests
his intention to file a contentious-administrative appeal. If this is the case, the

The interested party must formally communicate this fact by writing to the Agency
Spanish Data Protection, presenting it through the Electronic Registry of the
Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the
remaining records provided for in art. 16.4 of the aforementioned Law 39/2015, of 1/10. As well

must forward to the Agency the documentation that proves the effective filing of the
Sponsored links. If the Agency was not aware of the filing
of the contentious-administrative appeal within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.

938-131120
Mar Spain Martí
Director of the Spanish Agency for Data Protection

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es

@@ Line 28: / Line 28: @@
-|Party_Name_1=
+|Party_Name_1=AYUNTAMIENTO DE GATA
 |Party_Link_1=
 |Party_Name_2=