AEPD (Spain) - EXP202103039

AEPD - PS/00618/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 13 GDPR 72 (1)(h) LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:	27.09.2021
Decided:	16.08.2022
Published:	16.08.2022
Fine:	5,000 EUR
Parties:	RODALI GESTIÓN INMOBILIARIA, S.L Private Party
National Case Number/Name:	PS/00618/2021
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Carmen Jurado Taboada

The Spanish DPA imposed a €5,000 fine on a real-state agency for violating Article 13 GDPR because the contract for the purchase of property did not include a clause informing the customer how her personal data gathered in that contract was handled.

English Summary

Facts

The data subject purchased property from Rodali Gestión Inmobiliaria (controller), a real estate agency. She signed a contract to make a reservation of the property. This document included her personal data. The contract neither included a clause nor was the data subject otherwise informed on how her personal data would be processed. When the data subject discovered this, she filed a complaint with the DPA.

The DPA tried to notify the controller about both the complaint and the start of a sanctioning procedure for the alleged infringement of Article 13 GDPR, but was unsuccesful. The notifications were repeatedly rejected and returned.

Holding

The DPA noted that when a controller obtains personal data, it must provide the data subject with all information regarding their processing activities pursuant to Article 13 GDPR. In the present case, the controller omitted this obligation. The DPA therefore held that the controller violated Article 13 GDPR by neither informing the data subject nor including any clause about the processing of personal data in the contract.

The DPA found that since the main activity of the controller was direcltly linked to the processing of personal data, the controller was required to have a higher level of rigorousness, professionalism and, consequently, responsibility regarding the processing.

Because of this aggravating circumstance, the DPA imposed a fine of €5.000. The DPA further ordered the controller to bring its operations into compliance with Article 13 GDPR and thus making sure to inform its clients about the processing of their data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/7








     Procedure No.: PS/00618/2021(EXP202103039)

                RESOLUTION OF PUNISHMENT PROCEDURE


Of the actions carried out ex officio by the Spanish Agency for the Protection of
Data before the entity, RODALI GESTIÓN INMOBILIARIA, S.L. with CIF: B45811353,
(hereinafter "the claimed party"), for the alleged violation of the regulations of
data protection: Regulation (EU) 2016/679, of the European Parliament and of the
Council, of 04/27/16, regarding the Protection of Natural Persons in what

regarding the Processing of Personal Data and the Free Circulation of these Data
(RGPD) and Organic Law 3/2018, of December 5, on Data Protection
Personal and Guarantee of Digital Rights (LOPDGDD), and attending to the
following:


                                   BACKGROUND

FIRST: On 09/27/21, he entered this Agency, a brief presented by
Mrs. A.A.A., (hereinafter, "the complaining party"), in which it indicated, among others, that,
At the time of making the reservation for the purchase of a flat with this Agency, he did not fill in
no clause nor was she informed of the processing of her personal data.


Along with the written claim, a copy of the contract is provided: “Documentation of
Property Offer” dated 11/13/19, where the personal data of the
claimant, as well as, the data of the Real Estate and where the management is agreed, for
part of the Real Estate of the purchase of a property.


SECOND: On 10/18/21 and 10/29/21, this Agency transferred the
claim to the party complained against so that it could respond to it,
in accordance with the provisions of article 65.4 of the LOPDGDD Law. attempts to
notification resulted in the following:


    - According to a certificate from the Electronic Notifications Service and Address
       Electronic, the shipment made to the claimed entity, on 10/18/21, through
       of the electronic notification service "NOTIFIC@", was rejected in
       destination on 10/29/21.


Although the notification was validly made by electronic means, assuming
carried out the procedure in accordance with the provisions of article 41.5 of the LPACAP, by way of
informative, a copy was sent by mail that was reliably notified in
date 11/10/21, being the recipient of this, Ms. BBB ***NIF.1 In said notification,
he was reminded of his obligation to interact electronically with the Administration,

and they were informed of the means of access to said notifications, reiterating that, in
thereafter, you will be notified exclusively by electronic means.

THIRD: On 12/23/21, by the Director of the Spanish Agency for
Data Protection agreement is issued for the admission of processing of the claim

submitted by the claimant, in accordance with article 65 of the LPDGDD Law, to the
not receive any response to requests made from this Agency.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/7








FOURTH: On 02/18/22, by the Director of the Spanish Agency for
Data Protection, the initiation of the sanctioning procedure against the party
claimed, for the alleged infringement of article 13 of the RGPD, as there are indications of the

lack of information offered to customers about the processing of their data
personal, when these are obtained directly from them, imposing a
initial penalty of 5,000 euros (five thousand euros), based on the provisions of art. 64.2 b)
of Law 39/2015, of October 1, of the Common Administrative Procedure of the
Public Administrations (LPACAP). However, attempts to notify the
agreement to initiate the sanctioning file obtained as a result:


    - According to a certificate from the Electronic Notifications Service and Address
       Electronic, the shipment made to the claimed entity, on 02/22/22, through
       of the electronic notification service "NOTIFIC@", was rejected in
       destination on 03/05/22.


    - According to a certificate from the State Post and Telegraph Society, the shipment
       made to the claimed entity, on 05/30/22 through the service of
       Postal notification from Correos, was returned to destination with the legend of
       “unknown” on 06/08/22.


FIFTH: After the period granted for the formulation of allegations to the
agreement to initiate the procedure, it has been verified that no allegation has been received
any by the claimed party.

Article 64.2.f) of Law 39/2015, of October 1, on Administrative Procedure

Common Public Administrations (hereinafter LPACAP) -provision of which
the respondent was informed in the agreement to open the proceeding,
establishes that, if allegations are not made within the stipulated period on the content
of the initiation agreement, when it contains a precise statement about
imputed responsibility, may be considered a resolution proposal. In the

present case, the agreement to initiate the disciplinary proceedings determined the
facts in which the imputation was specified, the infraction of the RGPD attributed to the
claimed and the sanction that could be imposed. Therefore, taking into account that
the party complained against has made no objections to the agreement to initiate the file and
In accordance with the provisions of article 64.2.f) of the LPACAP, the aforementioned agreement of
beginning is considered in the present case resolution proposal


                                PROVEN FACTS

Of the actions carried out in this procedure and of the information and
documentation presented by the claimant, it has been proven that:


First: At the time of signing the contracts by which the Real Estate becomes
charge of the management of the purchase of a property, does not inform in any document
about the management of your personal data. The document that is provided together with the
claim, "Property Offer Document" dated 11/13/19, appear the

personal data of the claimant, as well as the data of the Real Estate, but not
there is no clause where the management of personal data is reported
obtained by the real estate.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/7








                           FOUNDATIONS OF LAW

       I-Competition


It is competent to initiate and resolve this Sanctioning Procedure the Director of
the Spanish Agency for Data Protection, by virtue of the powers established in
Article 58.2 of the RGPD and in the LOPDGDD Law.

       II- Summary of the facts:


In the present case, the claimant indicates that, at the time of signing the contract for
in which the Real Estate Agency was in charge of managing the purchase of a property, not
signed or was informed at any time about the management of their personal data.


       III- About the infraction committed due to the lack of information about the treatment
       of personal data:

Recital 61) of the RGPD establishes that:

       “Interested parties must be provided with information on the treatment of their

       personal data at the time it is obtained from them or, if obtained
       from another source, within a reasonable time, depending on the circumstances of the
       case. If the personal data can be legitimately communicated to another
       addressee, the interested party must be informed at the time the
       communicated to the recipient for the first time. The data controller that

       plans to process the data for a purpose other than that for which they were collected
       must provide the data subject, prior to such further processing,
       information about that other purpose and other necessary information (...)”.

In this sense, article 12.1 of the RGPD establishes, on the requirements that must be

comply with the information that the data controller must make available to
interested parties, the following:

       "1. The person responsible for the treatment will take the appropriate measures to facilitate
       to the interested party all the information indicated in articles 13 and 14, as well as
       any communication under articles 15 to 22 and 34 relating to the

       treatment, in a concise, transparent, intelligible and easily accessible form, with a
       clear and plain language, in particular any information directed
       specifically a child. The information will be provided in writing or by other
       means, including, if applicable, by electronic means. When requested by
       interested party, the information may be provided verbally provided that it is

       prove the identity of the interested party by other means (...)”.

And for its part, article 13 of the RGPD, details the information that must be provided to the
interested when the data is collected directly from him, establishing the
Next:


       “1. When personal data relating to him is obtained from an interested party, the
       responsible for the treatment, at the moment in which these are obtained,
       will facilitate:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/7









       a) the identity and contact details of the person in charge and, where appropriate, of their
       representative; b) the contact details of the data protection officer,

       in your case; c) the purposes of the treatment to which the personal data is destined
       and the legal basis of the treatment; d) when the treatment is based on the
       article 6, paragraph 1, letter f), the legitimate interests of the person in charge or of a
       third; e) the recipients or categories of recipients of the data
       personal, if any; f) if applicable, the intention of the controller to transfer
       personal data to a third country or international organization and the existence or

       absence of an adequacy decision by the Commission, or, in the case of
       transfers indicated in articles 46 or 47 or article 49, paragraph 1,
       second paragraph, reference to the adequate or appropriate guarantees and the
       means to obtain a copy of them or to the fact that they have been loaned.


       2. In addition to the information mentioned in section 1, the person in charge of the
       treatment will facilitate the interested party, at the moment in which the
       personal data, the following information necessary to guarantee a
       fair and transparent data processing: a) the period during which the
       will keep the personal data or, when it is not possible, the criteria
       used to determine this term; b) the existence of the right to request the

       data controller access to personal data relating to the
       interested, and its rectification or deletion, or the limitation of its treatment, or to
       oppose the treatment, as well as the right to data portability; c)
       when the treatment is based on article 6, paragraph 1, letter a), or the
       Article 9, paragraph 2, letter a), the existence of the right to withdraw the

       consent at any time, without affecting the legality of the
       treatment based on consent prior to its withdrawal; d) the right to
       file a claim with a control authority; e) if the communication
       of personal data is a legal or contractual requirement, or a requirement
       necessary to sign a contract, and if the interested party is obliged to provide

       personal data and is informed of the possible consequences of
       not provide such data; f) the existence of automated decisions, including the
       profiling, referred to in article 22, sections 1 and 4, and, when
       least in such cases, meaningful information about the applied logic, as well
       as the significance and anticipated consequences of such processing for the
       interested".


Therefore, in the case at hand, the lack of information on the treatment of
personal data when obtaining the personal data of the clients supposes, for
part of the person in charge of the treatment, the violation of article 13 of the RGPD.


In this sense, article 72.1.h) of the LOPDGDD, considers it very serious, for
of prescription, “the omission of the duty to inform the affected party about the treatment
of your personal data in accordance with the provisions of articles 13 and 14 of the RGPD”

This infraction may be sanctioned according to the provisions of article 83.5.b) of the

RGPD, where it is established that: “Infringements of the following provisions are
shall be sanctioned, in accordance with section 2, with administrative fines of 20,000,000
EUR maximum or, in the case of a company, an amount equivalent to 4%
as a maximum of the overall annual total turnover of the financial year

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/7








above, opting for the highest amount: a) the rights of the interested parties to
tenor of articles 12 to 22”.


The balance of the circumstances contemplated, with respect to the infractions
committed, by violating the provisions of its article 13 of the RGPD, allows to set a
fine of 5,000 euros (five thousand euros).

In accordance with the precepts indicated, in order to set the amount of the penalty to
impose, it is considered appropriate to graduate the sanction in accordance with the following

aggravating criteria established in article 76 of the LOPDGDD:

    - The link between the activity of the offender and the performance of treatment of
       personal data, (section b), considering the level of implementation of the
       entity and the activity it develops, in which data is involved

       of thousands of interested parties, having as its main activity, the
       purchase and sale of furniture and real estate, promotion of buildings, works and
       reforms. financial broker. consultancy, administration, services to
       companies, appraisal and appraisal, all these services related to property
       real estate. This circumstance determines a higher degree of demand and
       professionalism and, consequently, the responsibility of the entity in

       relation to the processing of personal data.

IV.- Regarding the corrective measures to be implemented:

Article 58.2. of the RGPD, establishes, on the corrective powers that each

control authority may require the offender, among whom is, in his
section d): "(...) order the person responsible or in charge of processing that the
processing operations comply with the provisions of this Regulation,
when appropriate, in a certain way and within a specified period”.

Therefore, it is appropriate to impose, in accordance with the provisions of the cited article, the
following corrective action:


    - Implement a mechanism in the management of the services performed by the
       Real estate where customers are informed of the treatment that will be carried out
       your personal data, in accordance with the provisions of article 13 of the
       GDPR.


In view of the foregoing, the following is issued:

                                     RESOLVES:

FIRST: IMPOSE RODALI GESTIÓN INMOBILIARIA, S.L. with CIF:
B45811353, a fine of 5,000 euros (five thousand euros), for violation of article

13 of the RGPD, by not conveniently informing customers of the purposes for which
allocate the personal data obtained from them.

SECOND: ORDER the entity RODALI GESTIÓN INMOBILIARIA, S.L. with CIF:
B45811353, which, within a month from the notification of this

resolution, take the necessary measures to implement a mechanism in the
management of the services performed where clients are informed of the treatment that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/7








will be made of your personal data, in accordance with the provisions of article 13
of the GDPR.


THIRD: NOTIFY this resolution to the entity RODALI GESTIÓN INMO-
BILIARIA, S.L. and inform the complaining party of the result.

Warn the sanctioned party that the sanction imposed must be made effective once it is
enforce this resolution, in accordance with the provisions of article 98.1.b)
of Law 39/2015, of October 1, of the Common Administrative Procedure of the Ad-

Public Administrations (LPACAP), within the voluntary payment period indicated in article
68 of the General Collection Regulations, approved by Royal Decree 939/2005,
of July 29, in relation to art. 62 of Law 58/2003, of December 17, me-
upon deposit in the restricted account Nº ES00 0000 0000 0000 0000 0000, opened
on behalf of the Spanish Agency for Data Protection at CAIXABANK Bank,

S.A. or otherwise, it will be collected in the executive period.

Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
will be until the 20th day of the following month or immediately after, and if
is between the 16th and last day of each month, both inclusive, the term of the payment

It will be valid until the 5th of the second following month or immediately after.

In accordance with the provisions of article 82 of Law 62/2003, of December 30,
bre, of fiscal, administrative and social order measures, this Resolution is
will make public, once it has been notified to the interested parties. The publication is made

will be in accordance with the provisions of Instruction 1/2004, of December 22, of the Agency
Spanish Data Protection on the publication of its Resolutions.

Against this resolution, which puts an end to the administrative procedure, and in accordance with the
established in articles 112 and 123 of the LPACAP, the interested parties may interpose

have, optionally, an appeal for reconsideration before the Director of the Spanish Agency
of Data Protection within a period of one month from the day following the notification
fication of this resolution, or, directly contentious-administrative appeal before the
Contentious-administrative Chamber of the National High Court, in accordance with the provisions
placed in article 25 and in section 5 of the fourth additional provision of the Law
29/1998, of 07/13, regulating the Contentious-administrative Jurisdiction, in the

two months from the day following the notification of this act, according to
the provisions of article 46.1 of the aforementioned legal text.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the interested party

do states its intention to file a contentious-administrative appeal. If it is-
In this case, the interested party must formally communicate this fact in writing
addressed to the Spanish Agency for Data Protection, presenting it through the Re-
Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/], or to
through any of the other registers provided for in art. 16.4 of the aforementioned Law

39/2015, of October 1. You must also transfer to the Agency the documentation
that proves the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious-administrative appeal


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/7










tive within two months from the day following the notification of this

resolution, would end the precautionary suspension.

Sea Spain Marti

Director of the Spanish Agency for Data Protection.
































































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es