AEPD (Spain) - PS/00129/2022

AEPD - PS-00129-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 83(5) GDPR Article 32 GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	PS-00129-2022
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	PS-00129-2022 (in ES)
Initial Contributor:	sh

The Spanish DPA dropped an investigation due to time limitation periods for infringments outlined in national law.

English Summary

Facts

The claimant became aware, in the course of a separate judicial process, of an electoral crime consisting of adding people to a census with the purpose of obtaining votes. The claimant filed a complaint to the AEPD stating that between December and November 2018, a candidate registered 40 people in the municipality of Cacabelos. The complainant complained that the candidate should not have had access to information on the municipal census.

The candidate replied to the AEPD that there was no proof that he had access to the census. Even if there would be, Article 73 of the LOGPD would time bar his infringement as it occurred too many years ago.

The AEPD launched an investigation and determined that the candidate was at the time part of the government team of the City Council of Cacabelos, and so had access to all types of information related to the census. Despite being part of the team he was not authorised to access the census. During this period, the candidate acknowledged that he had registered 37 people for the census. The AEPD launched sanctioning procedures against the city council for an infringement of Article 32 GDPR.

Holding

The AEPD dropped the case due to the time limitations outlined in Article 72 and 73 LOGPD.

The access to the municipal census data by the candidate should have taken place after 30 March 2019 for the infringement not to be considered time-barred. Since there is no record of the exact date and it cannot be demonstrated that the acts that constitute the infringement were carried out in the three years prior to the agreement to initiate the sanctioning procedure, the principle of in dubio pro reo (in case of doubt in favor of the accused) requires the proceedings to be closed on the understanding that the infringement could have been time-barred at the time when the initiation of the proceeding was agreed upon.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/8








     File No.: PS/00129/2022



                RESOLUTION OF SANCTIONING PROCEDURE

From the procedure instructed by the Spanish Data Protection Agency and based
to the following

                                  BACKGROUND



FIRST: D. A.A.A. (hereinafter, the complaining party) dated February 21,
2022 filed a claim with the Spanish Data Protection Agency. The
The reasons on which the claim is based are the following:


That the complaining party has been aware, within a judicial process, of
the complaint made by D. B.B.B., (…) of the Group of Socialist Voters of
Cacabelos, before the Ponferrada Area Prosecutor's Office on May 16, 2019, for a
electoral crime consisting of mass registration with the purpose of obtaining
votes in a candidacy, declaring D. B.B.B. that you have been able to verify:

-
       - That in the months of December and November 2018,
register about forty people in the municipality of Cacabelos, (…).

       - That in the applications for registration in the registry, the same signature appears in all

documents. Note that the name of the declarant does not appear in these applications,
only the DNI corresponding to the registered person.

The complaining party provides a copy of the document sent by D. B.B.B. to the Prosecutor's Office
Ponferrada Area and minutes of the Ponferrada Zone Electoral Board by which

agrees that the allegations of D. B.B.B. exceed the jurisdiction of the Board,
being able to go to court.

The complaining party states that D. B.B.B. cannot access the information
municipal register, from which a violation of data protection emerges,
ignoring the "modus operandi" and all the authors involved in the alleged

infringement.

SECOND: On March 30, 2022, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning proceedings against the CITY COUNCIL OF
CACABELOS, with NIF P2403100G (hereinafter, the claimed party), in accordance with the

provided in articles 63 and 64 of Law 39/2015, of October 1, of the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of article 5.1.f) of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), typified in the
article 83.5 of the RGPD, and for the violation of article 32 of the RGPD, classified in the

article 83.4 of the GDPR.

The aforementioned initiation agreement was notified to the claimed party, in accordance with the regulations
established in the LPACAP, on March 30, 2022.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/8









THIRD: With the registration date of April 1, 2022, the claimed party
requested a copy of the file, as well as an extension of the deadline to present

allegations.

On April 4, 2022, the file was sent to the requested party, granting the
at the same time a new deadline to present allegations.

FOURTH: The claimed party presented a written statement of allegations on April 26, 2022,

in which, in summary, he stated:

1.- There is no proof that D. B.B.B. had access to registry documentation
municipal, which when it indicates that “it has been able to verify” is a mere manifestation
staff.


2.- That in the event that there was any infraction, it would be prescribed,
in accordance with article 73 of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights (hereinafter,
LOPDGDD), which establishes that serious infractions will expire after two years.


It indicates that "even without knowing the exact date of the events, but in any case, before
May 2019 (date of the complaint before the Prosecutor's Office) and having issued an agreement
of initiation and notified to this party in April 2022 (art. 75 of the LOPDGDD) the
agreement to initiate the sanctioning procedure, it is more than evident that
“The 2 years passed very long.”


FIFTH: On April 29, 2022, it is agreed to open a practice phase of
proof. It is also agreed to incorporate into the file, for purposes of evidence, the
claim that gave rise to the sanctioning procedure and its attached documentation and
the allegations to the initiation agreement of PS/00129/2022 presented by the party

claimed.

The following evidentiary procedures are carried out:

to. In response to the claim:


1. In the same letter dated May 30, 2022 in which the
opening of the testing phase, you are required to submit a report on the following
extremes:

       - Who can access registration applications and registry data

municipal.

       - What security measures have you adopted to access the municipal registry.

       - If between the months of November and December 2018 there were people who

registered in (…), and if applicable, how many registrations there were in the aforementioned
place.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/8








2. On May 13, 2022, a response was received from the claimed party to the
requested proof, in which it reports:


       - Which public employees could access, in the months of November and
December 2018, to applications for registration through the SWAL program
(Web System for Local Administration)

       - Which public employees could access, in the months of November and
December 2018, to the municipal registry data through the SWAL program with

in order to obtain registration certificates.

       - Regarding the security measures adopted to access the Register
Municipal:


               a) In relation to requests made in paper format,
They are currently kept in a locked closet in the offices of the
Municipal secretary.

               b) In relation to the data from the Municipal Register existing in format
digital, they are compiled through the SWAL computer program. To access

This program requires registration with a username and password that is assigned
individually to each public employee and with restricted permissions.

       - That, except for error or omission, between the months of November and December
In 2018, 37 people were registered in (…).


b. Before the complaining party:

1. On May 12, 2022, a copy of documentation was required from the complaining party
proving that there has been improper access to the municipal registry of Cacabelos,

provided that it is documentation that was not presented in the claim
initial.

2. With the registration date of May 19, 2022, the complaining party
presents:


- Copy of the document presented by D. B.B.B. before the Ponferrada Area Prosecutor's Office on
May 16, 2019.

- Copy of the agreement of the Ponferrada Zone Electoral Board dated May 13
of 2019, where the incidence related to the presentation of written documents (...) of the

Group of Socialists of Cacabelos (B.B.B.), as well as ***CARGO.1 D.
C.C.C.

- Copy of the complaint decree of the Ponferrada Area Prosecutor's Office presented to the
Investigative Court of Ponferrada on October 3, 2019.


- Copy of the 28 registration documents in the Municipal Register of Cacabelos, which
They have the data of 37 people registered in ***ADDRESS.1 of
Cacabelos, corresponding to (…).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/8









- Copy of the testimonial recording of D. B.B.B. before the Court of Instruction No.
Ponferrada on December 17, 2019 within the Previous Procedures of the

Abbreviated Procedure 0000XXX/2019.

c. Before D.B.B.B.:

1. The Investigator of the sanctioning procedure agrees on April 29, 2022
request D.B.B.B. information regarding:


       - How have you learned about the registration of about 40 people in
the municipality of Cacabelos, specifically in (…), between the months of November and
December 2018.


       - How have you been able to verify that in the applications for registration in the registry
municipality of Cacabelos that has reported to the Public Prosecutor's Office, "the same
signature on all documents, the name of the declarant does not appear and only
Accompanies with said application a DNI corresponding to the registration”, as
stated in the document that he registered in the Ponferrada Area Prosecutor's Office on December 16
May 2019.


2. Since the notification of the aforementioned test by
incorrect address, on July 22, 2022, the City Council of
Cacabelos to indicate the address for the purposes of D.B.B.B. notifications.


On July 28, 2022, the Cacabelos City Council sent the address of D. B.B.B.
which appears in the municipal register.

3. On August 18, 2022, the Investigator of the sanctioning procedure requested D.
B.B.B. information regarding:


       - How and when did you become aware of the registration of some 40
people in the municipality of Cacabelos, specifically in (…), between the months of
November and December 2018.

       - How and when have you been able to verify that in the applications for registration in the

municipal register of Cacabelos that has been reported to the Public Prosecutor's Office, “records the
same signature on all documents, the name of the declarant does not appear and
Only a DNI corresponding to the
registered”, as stated in the document that he registered with the Area Prosecutor's Office
from Ponferrada on May 16, 2019.


4. On August 29, 2022 D. B.B.B. submitted a document in which it indicates:

“- I have been aware of the registration of about 40 people (…), in the
first months of the year 2019.


- I have been able to review the different requests in the first months of 2019.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/8








- By those dates, (first months of 2019), the person who subscribes, (...), formed
part of the government team, of the Cacabelos City Council, for which he had access
to all types of information related to it.”


SIXTH: On September 12, 2022, a proposed resolution was formulated,
proposing that the Director of the Spanish Data Protection Agency
order the filing of this sanctioning file to the CITY COUNCIL OF
CACABELOS, with NIF P2403100G, due to the facts that are the subject of this
prescribed sanctioning procedure, in accordance with current legislation.


SEVENTH: The proposed resolution has been notified in accordance with the established rules
In the LPACAP, the claimed party has not presented a written statement of allegations.



In view of everything that has been done, by the Spanish Data Protection Agency
In this procedure, the following are considered proven facts:

                                PROVEN FACTS

FIRST: In the first months of 2019, D. B.B.B., member of the

government of the Cacabelos City Council, agreed to the requests of
registration of 37 people in ***ADDRESS.1 of Cacabelos, corresponding
to (…).

SECOND: On February 21, 2022, the claimant filed

claim before the Spanish Data Protection Agency denouncing that it has
had knowledge, within a judicial process, that D. B.B.B., as
representative of the Group of Socialist Voters of Cacabelos, has agreed to
data from the municipal register of Cacabelos.


                           FOUNDATIONS OF LAW

                                           Yo

In accordance with the powers that article 58.2 of the RGPD grants to each authority of
control and according to what is established in articles 47 and 48.1 of the LOPDGDD, it is

competent to initiate and resolve this procedure the Director of the Agency
Spanish Data Protection.

Likewise, article 63.2 of the LOPDGDD determines that: “The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions

in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures.”

                                          II


The claim that gave rise to the sanctioning procedure was presented on 21
February 2022, starting through a start agreement of March 30, 2022.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/8








During the probationary period, D. B.B.B. acknowledged that he agreed to the requests of
registration of 37 people in ***ADDRESS.1 of Cacabelos, corresponding
to (…) in the first months of 2019.


That is, despite having proven that an unauthorized person has had
access to personal data from the municipal register of the City Council of
Cacabelos, after completing a very complete test and the instruction of the
procedure aimed, among other issues, at determining the date of commission of
the facts, it has not been possible to determine exactly what is the exact day of the

commission of the facts.

Article 83.4, section a) of the RGPD, under the heading “General conditions for the
imposition of administrative fines” provides that:


“Infringements of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of a maximum of EUR 10 000 000 or,
In the case of a company, an amount equivalent to a maximum of 2% of the
global total annual business volume of the previous financial year, opting for
the largest amount:


a) the obligations of the controller and the processor in accordance with articles 8, 11, 25 a
39, 42 and 43;”

Indicating article 73 of the LOPDGDD, for the sole purposes of the limitation period
the next:


Article 73. Infractions considered serious.

“Based on what is established in article 83.4 of Regulation (EU) 2016/679,
are considered serious and will prescribe after two years the infractions that involve a

substantial violation of the articles mentioned therein and, in particular, the
following:

(…)

f) The lack of adoption of those technical and organizational measures that result

appropriate to guarantee a level of security appropriate to the risk of the treatment,
in the terms required by article 32.1 of Regulation (EU) 2016/679.”

Every time D. B.B.B. has had access to the municipal registry data in the
first months of 2019, as repeatedly stated without specifying further,

and the agreement to initiate this sanctioning procedure was initiated and notified
to the claimed party on March 30, 2022, the facts are prescribed in
regarding the violation of article 32 of the GDPR.

On the other hand, article 83.5, section a) of the RGPD, under the heading “Conditions

general rules for the imposition of administrative fines” provides that:

“Infringements of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of a maximum of EUR 20 000 000 or,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/8








In the case of a company, an amount equivalent to a maximum of 4% of the
global total annual business volume of the previous financial year, opting for
the largest amount:


a) the basic principles for the treatment, including the conditions for the
consent in accordance with articles 5, 6, 7 and 9;”

Indicating article 72 of the LOPDGDD, for the sole purposes of the limitation period
the next:


"1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that involve
a substantial violation of the articles mentioned therein and, in particular, the
following:


a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679.”

It is proven in this sanctioning file that the events occurred
in the first months of 2019, without it having been possible to prove a greater

accuracy of such event despite the evidence carried out, so there is doubt
reason that the alleged violation of article 5.1.f) of the RGPD has expired.
For this reason, access to municipal registry data by D. B.B.B.
should have taken place after March 30, 2019 for the violation not to
is considered prescribed.


Thus, not recording the exact date of commission of the events for the purposes of the
calculation of prescription, and it cannot be demonstrated that the facts that make up the
infringement were carried out in the three years prior to the agreement to start the
sanctioning procedure, the principle in dubio pro reo (in case of doubt in favor of the

accused) forces the procedure to be archived upon understanding that the infraction could have
prescribed at the time the initiation of the procedure was agreed upon.

Therefore, in accordance with applicable legislation, the Director of the Agency
Spanish Data Protection RESOLVES:


FIRST: ARCHIVE the procedure PS/00129/2022 initiated by the CITY COUNCIL
DE CACABELOS, with NIF P2403100G.

SECOND: NOTIFY this resolution to the CITY COUNCIL OF
CACABELOS, with NIF P2403100G.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Data Protection Agency within a period of one month to
count from the day following the notification of this resolution or directly

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/8








contentious-administrative appeal before the Contentious-administrative Chamber of the

National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the

referred Law.

Finally, it is noted that in accordance with the provisions of art. 90.3.a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the

interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the

cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the

notification of this resolution would terminate the precautionary suspension.


                                                                                 938-120722
Sea Spain Martí
Director of the Spanish Data Protection Agency


































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es