AEPD (Spain) - TD/00164/2020

AEPD - TD/00164/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 12 GDPR Article 17 GDPR 12 LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	12.01.2021
Published:
Fine:	None
Parties:	Associació Catalana per la Participació Política
National Case Number/Name:	TD/00164/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Francesc Julve Falcó

The Spanish DPA (AEDP) accepted a complaint against 'Associació Catalana per la Participació Política' as the organisation failed to respond to a citizen's request for suppression (Article 17 GDPR).

English Summary

Facts

The complainant exercised a right of deletion against the respondent, but his request has not received the legally established response.

The AEPD admitted the complaint for processing and granted the respondent entity the option to present allegations within fifteen days.

The respondent did not reply to the AEPD and did not prove that it had responded to the claimant's request for deletion.

Dispute

Is the lack of response an infringement of the data subject's right to erasure (Article 17 GDPR)?

Holding

The AEPD upheld the complaint and urged the respondent to reply to the complainant within ten working days, stating whether it had complied with the right of erasure or whether it had refused the request for erasure, stating its reasons.

In the event of non-compliance, the AEPD considers that this could lead to a sanction, in accordance with article 58(2) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                               1/5










     File No.: TD / 00164/2020



                          RESOLUTION NO: R / 00011/2021

Considering the claim made on March 7, 2020 before this Agency by A.A.A. ,(to

from now on the complaining party), against ASSOCIACIÓ PER LA PARTICIPACIÓ
POLICY TO CATALUNYA, (from now on the claimed part), for not having been
duly attended to your right of deletion.

The procedural actions provided for in Title VIII of the Law have been carried out.
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of

digital rights (hereinafter LOPDGDD), the following have been verified


                                      ACTS


FIRST: The complaining party exercised the right of deletion against the complained party, without
that your request has received the legally established reply. It contributes diverse
documentation related to the claim filed with this Agency and about the
exercise of the right exercised.



SECOND: Once the procedure provided for in article 65.4 of the LOPDGDD has been completed,
The claim was admitted for processing and the claimed entity was granted
hearing, so that within fifteen business days the allegations that
deemed convenient.


The claimed entity has not replied to this Agency nor has it proven that there is
responded to the request for the exercise of rights that was presented by the
complaining party.



                           FOUNDATIONS OF LAW


FIRST: The Director of the Spanish Agency for

Data Protection, in accordance with the provisions of section 2 of article 56 in
in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of
natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter, RGPD); and in article 47 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of

digital rights (hereinafter LOPDGDD).

SECOND: Article 64.1 of the LOPDGDD, provides that:
    "one. When the procedure refers exclusively to the lack of attention of

    a request to exercise the rights established in articles 15 to 22 of the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/5








     Regulation (EU) 2016/679, will start by agreement of admission for processing, which is
     adopt in accordance with the provisions of the following article.
     In this case, the period to resolve the procedure will be six months from

     From the date the claimant was notified of the agreement to
     admission for processing. After this period, the interested party may consider
     estimated your claim. "

THIRD: Article 12 of Regulation (EU) 2016/679, of April 27, 2016,
General Data Protection (RGPD), provides the following:

     "one. The person in charge of the treatment will take the appropriate measures to facilitate the
     interested party all information indicated in articles 13 and 14, as well as any
     communication pursuant to articles 15 to 22 and 34 regarding the treatment, in
     concise, transparent, intelligible and easily accessible form, with clear language and
     straightforward, particularly any information specifically directed at a child. The

     Information will be provided in writing or by other means, including, if applicable,
     by electronic means. When requested by the interested party, the information may
     provided verbally provided that the identity of the interested party is proven by
     other media.
     2. The person in charge of the treatment will facilitate the interested party the exercise of their
     rights under Articles 15 to 22. In the cases referred to in the

     Article 11, paragraph 2, the controller shall not refuse to act at the request of the
     interested party in order to exercise their rights under articles 15 to 22,
     unless you can show that you are unable to identify the
     interested.
     3. The person responsible for the treatment will provide the interested party with information regarding their

     proceedings on the basis of a request pursuant to Articles 15 to 22, and,
     in any case, within one month from receipt of the request.
     This period may be extended for another two months if necessary, taking into account
     count the complexity and number of requests. The person in charge will inform the
     interested party of any of said extensions within a period of one month from the

     receipt of the request, indicating the reasons for the delay. When the
     interested party submit the request by electronic means, the information is
     will facilitate by electronic means when possible, unless the interested party
     request that it be provided in another way.
     4. If the person responsible for the treatment does not comply with the request of the interested party,
     will inform without delay, and no later than one month after receiving the

     request, the reasons for not acting and the possibility of submitting a
     claim before a control authority and to exercise legal actions.
     5. The information provided by virtue of articles 13 and 14 as well as all
     communication and any action carried out pursuant to articles 15 to 22 and
     34 will be free. When the requests are manifestly unfounded

     or excessive, especially due to its repetitive nature, the person responsible for the
     treatment may:
     a) charge a reasonable fee based on the administrative costs incurred
     to facilitate information or communication or carry out the requested action, or
     b) refuse to act on the request.

     The data controller will bear the burden of proving the character
     manifestly unfounded or excessive of the request.
     6. Without prejudice to the provisions of article 11, when the person responsible for the
     treatment has reasonable doubts regarding the identity of the person

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/5








    physicist making the request referred to in articles 15 to 21, may request
    that the additional information necessary to confirm the identity of the
    interested.
    7. The information that must be provided to the interested parties by virtue of articles
    13 and 14 may be transmitted in combination with standard icons that allow

    provide easily visible, intelligible and clearly legible a
    adequate overview of the planned treatment. The icons that are
    submitted in electronic format will be machine readable.
    8. The Commission shall be empowered to adopt delegated acts of conformity
    with Article 92 in order to specify the information to be submitted to
    through icons and the procedures for providing standard icons. "


FOURTH: Article 12 of the LOPDGDD determines the following:
    1. The rights recognized in articles 15 to 22 of the Regulation (EU)
    2016/679, may be exercised directly or through a legal representative or
    voluntary.

    2. The person responsible for the treatment will be obliged to inform the affected party about the
    means at your disposal to exercise the rights that correspond to you. The
    means must be easily accessible to the affected person. The exercise of
    Right may not be denied for the sole reason of choosing the affected by another
    medium.
    3. The person in charge may process, on behalf of the person in charge, requests for

    exercise made by those affected of their rights if so established in the
    contract or legal act that binds them.
    4. Proof of compliance with the duty to respond to the request to exercise
    Your rights formulated by the affected party will fall on the person responsible.
    5. When the laws applicable to certain treatments establish a
    special regime that affects the exercise of the rights provided for in Chapter

    III of Regulation (EU) 2016/679, the provisions of those will be followed.
    6. In any case, the holders of parental authority may exercise on behalf of
    and representation of minors under fourteen the rights of access,
    rectification, cancellation, opposition or any other that could
    correspond to them in the context of this organic law.
    7. The actions carried out by the person in charge of the

    treatment to meet requests for the exercise of these rights, without
    prejudice to the provisions of articles 12.5 and 15.3 of the Regulation (EU)
    2016/679 and in sections 3 and 4 of article 13 of this organic law. "

FIFTH: Article 17 of the RGPD provides that:
    "one. The interested party shall have the right to obtain without undue delay from the person responsible

    of the treatment the deletion of the personal data that concerns him, which
    will be obliged to delete without undue delay the personal data when
    any of the following circumstances concur:
    a) the personal data is no longer necessary in relation to the purposes for which
    that were collected or otherwise treated;

    b) the interested party withdraws the consent on which the treatment of
    in accordance with Article 6 (1) point (a) or Article 9 (2) point
    a), and it is not based on another legal basis;



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/5








     c) the interested party objects to the processing in accordance with article 21, paragraph 1, and
     no other legitimate reasons for the treatment prevail, or the interested party
     object to the processing pursuant to Article 21 (2);

     d) the personal data has been unlawfully processed;
     e) personal data must be deleted to fulfill an obligation
     legal established in the Law of the Union or of the Member States that
     apply to the person responsible for the treatment;
     f) the personal data have been obtained in relation to the offer of services of
     the information society mentioned in article 8, paragraph 1.

     2. When you have made the personal data public and are obliged, by virtue of
     the provisions of section 1, to delete said data, the person responsible for the
     treatment, taking into account the available technology and the cost of your
     implementation, adopt reasonable measures, including technical measures, with a view to
     inform those responsible who are treating the personal data of the

     request of the interested party to delete any link to these personal data,
     or any copy or replica thereof.
    3. Sections 1 and 2 will not apply when the treatment is necessary:
     a) to exercise the right to freedom of expression and information;
     b) for the fulfillment of a legal obligation that requires the treatment of
     data imposed by the law of the Union or the Member States that

     applies to the person responsible for the treatment, or for the fulfillment of a mission
     carried out in the public interest or in the exercise of public powers conferred on the
     responsable;
     c) for reasons of public interest in the field of public health in accordance
     with article 9, paragraph 2, letters h) and i), and paragraph 3;

     d) for archival purposes in the public interest, scientific research purposes or
     historical or statistical purposes, in accordance with article 89, paragraph 1, in the
     To the extent that the right indicated in paragraph 1 could make it impossible to
     seriously impede the achievement of the objectives of such treatment, or
     e) for the formulation, exercise or defense of claims. "


SIXTH: In the case analyzed here, the complaining party exercised its right to
deletion and after the period established in accordance with the aforementioned regulations,
your request did not obtain the legally required response.

The aforementioned standards do not allow the request to be ignored as if it were not

had raised, leaving it without the answer that must be issued by the
responsible, even in the event that there is no data of the interested party in the
files of the entity or even in those cases in which it does not meet the
stipulated requirements, in which case the recipient of said request also comes
obliged to request the correction of the deficiencies observed or, where appropriate,

deny the request with reasons indicating the reasons why it is not applicable
consider the right in question.

Therefore, the request that is formulated obliges the person in charge to give an express response, in
In any case, using any means that justifies the receipt of the

reply.
Given that a copy of the necessary communication that must be addressed to the
claimant informing him of the decision he has taken regarding the
request to exercise rights, the claim that originated the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/5








present procedure.



Considering the cited precepts and others of general application,
the Director of the Spanish Agency for Data Protection RESOLVES:


FIRST: ESTIMATE the claim made by A.A.A. and urge ASSOCIACIÓ
FOR POLITICAL PARTICIPATION IN CATALUNYA with NIF G67207472, so that, in
within the ten business days following notification of this resolution,
Send the complaining party a certification stating that you have attended the
right of deletion exercised by the latter or is reasonedly denied indicating the

causes for which the requested deletion does not proceed. The actions carried out
As a consequence of this Resolution, they must be communicated to this
Agency in the same period. Failure to comply with this resolution could lead to
commission of the offense typified in article 72.1.m) of the LOPDGDD, which is

sanction, in accordance with art. 58.2 of the RGPD.

SECOND: NOTIFY this resolution to A.A.A. and ASSOCIACIÓ PER LA
POLITICAL PARTICIPATION IN CATALUNYA.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the

Interested parties may file, optionally, an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
count from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the

National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.



                                                                                 1034-080719
Mar Spain Martí
Director of the Spanish Agency for Data Protection















C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es