AEPD (Spain) - EXP202201681

AEPD - EXP202201681 (PS/00345/2022)
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 12 GDPR Article 13 GDPR Article 37(5) GDPR Article 34(1)(a)
Type:	Complaint
Outcome:	Upheld
Started:	21.12.2021
Decided:
Published:
Fine:	14000 EUR
Parties:	COLEGIO OFICIAL DE ARQUITECTOS DE GRANADA
National Case Number/Name:	EXP202201681 (PS/00345/2022)
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Sainey Belle

The Spanish DPA fined a controller €5,000 due to the conflicts of interest in the exercise its DPO's tasks. In addition, it issued a fine of €8,000 for lack of information on its website and €1,000 for the use of third-party analytical cookies without consent.

English Summary

Facts

On 21 December 2021, a data subject filed a complaint with the Spanish alleging a number of data protection violations by the Official College of Architects of Granada, the controller.

In particular, the data subject argued that: a) the controller failed to inform the supervisory authority about the appointment of its DPO, pursuant to Article 34(1)(a) LOPDGDD; b) there was a conflict of interest between the functions performed by the person appointed to the position of DPO; c) there was a lack of adequate information in the controller's privacy policy; d) the controller was using non-essential cookies on its website without obtaing consent.

The DPA opened an investigation on the controller and notified it to present its defense. In response, the controller recognized that it was necessary to adapt its privacy and cookies policy, but claimed to be already conducting audits and implementing corrective measures. Regarding the alleged conflict of interests, the controller maintained that it was a mere presumption, not concretely demonstrated. However, it reported that it appointed a new person for the position.

The DPA proceeded with the investigations and visited the controller's website to collect evidence.

Holding

The DPA highlighted the relevance of the DPO for ensuring compliance with data protection regulations. It recalled this position is regulated in Articles 37 to 39 GDPR, provisions that were interpreted by Article 29 Working Party in the Guidelines on Data Protection Officers. In addition to advice, the DPO fulfills other important functions such as carrying out DPIAs and internal inspections and being the point of contact with the supervisory authority. To adequately perform these tasks, independence is essential. In this sense, Article 38(3) GDPR provides that the DPO shall not receive instructions, be dismissed or or punished by the controller/processor for exercising its functions.

As a general rule, conflicting positions within an organisation may include senior management positions (such as chief executive officer, chief operating officer, chief financial officer, chief medical officer, head of the marketing department, head of human resources or head of the IT department), but also other positions lower down in the organisational structure if such positions lead to the determination of the means and purposes of the processing of personal data. For instance, a conflict of interest may arise if a DPO is asked to represent the controller or processor in court in data protection cases.

In the case at hand, the DPA found that the position held by the person appointed as the DPO was incompatible with the performance of these tasks as it could lead to the determination of the purposes and means of data processing. Therefore, it found a violation of Article 38(6) GDPR.

Furthermore, the DPA confirmed that the complaints sheet available on the controller's website did not provide all the necessary information required by Article 13 GDPR.

Finally, the DPA emphasized that, in its Opinion 4/2012 on cookie consent exemption, the Article 29 WP considered that cookies such as “user input cookies” (those used to fill in forms or to manage a shopping basket); “authentication” or “user identification cookies” (session); “user security cookies (those used to detect erroneous and repeated attempts to connect to a website)”; “media player session cookies”; “load balancing session cookies”; “user interface customization cookies”; and some plugins to exchange social content do not require consent to be used. However, after browsing the website, the DPA concluded that the controller installed analytical third-party cookies that were not described in its policy, which is not covered by the consent exemption. For this reason, the DPA found a violation of Article 22(2) LSSI.

In light of the above violations, DPA has imposed the following fines:

- €5,000 for the violation of Article 38(6) GDPR;

- €8,000 for the violation of Article 13 GDPR;

- €1,000 for the violation of Article 22(2) LSSI.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/60








     Procedure No.: EXP202201681 (PS/00345/2022)

               RESOLUTION OF THE SANCTION PROCEDURE


Of the actions carried out by the Spanish Data Protection Agency before
the OFFICIAL COLLEGE OF ARCHITECTS OF GRANADA, with CIF.: Q1875003D,
owner of the website, www.coagranada.es/ (hereinafter "the claimed party"), in
by virtue of the claim filed by A.A.A., (hereinafter, "the claiming party"),
for the alleged violation of data protection regulations: Regulation (EU)

2016/679, of the European Parliament and of the Council, of 04/27/16, regarding the Protection
of Natural Persons with regard to the Processing of Personal Data and the
Free Circulation of these Data (RGPD) and Organic Law 3/2018, of December 5,
Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD),
and Law 34/2002, of July 11, on Services of the Information Society and

Electronic Commerce (LSSI) and attending to the following:

                                  BACKGROUND

FIRST: On 12/21/21, he entered this Agency, through the Council of
Transparency and Data Protection of the Junta de Andalucía, document presented by

the claimant, in which he indicated, among other things, the following:

       "It has been observed how the College repeatedly fails to comply with the
       current regulations on the protection of personal data,
       thus endangering the privacy of the data of the members and therefore

       Your rights.

       The first of the facts on which the present claim is formulated,
       refers to the absence of communication from the Data Protection Officer
       of the Official College of Architects of Granada to the Council of Transparency and

       Data Protection of Andalusia. Remember that according to the law
       current (Art. 34.1.A. of the LOPDGDD) the Professional Associations are
       obliged to designate a Data Protection Officer and therefore
       notification to the competent body, in this case the Council of
       Transparency and Data Protection of Andalusia.


       Likewise, and in relation to the appointment of Delegate for the Protection of
       Data, according to the accompanying document (Document
       nº1), the Governing Board of the College, in a session held on April 11,
       2019 adopted the following agreement: "Appoint *** POSITION 1 of the College
       Architects Officer as Data Protection Delegate for the College

       of Architects”

       Regardless of whether the appointment could violate the requirements
       fixed by art. 37.5 of the GDPR, related to the qualities and knowledge of the
       DPD, what does seem evident is that said appointment could

       contravene the postulates of the Working Group of Art. 29 when in its
       document "Guidelines on Data Protection Delegates" indicate
       that the organization must guarantee the absence of conflict of interest in the
       figure of the DPD whenever it provides other functions, noting that "the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/60








       DPD cannot hold a position in the organization that leads him to determine the
       purposes and means of processing.

       At the web address https://coagranada.es/quejas-y-reclamaciones/
       corresponding to the website of the Official College of Architects of Granada,

       There are two links for downloading the respective forms for the
       formulation of complaints and claims, being able to observe in said
       printed (Documents No. 2 and 3) the existence of a privacy policy that does not
       meets all the requirements of the arts. 12 and 13 of the GDPR and what
       is more serious, it is indicated as Responsible for the Treatment to the
       *** POSITION 1 of the College, an issue that generates clear misinformation in

       interested parties, since as you know the body to which I am addressing the
       Responsible for the Treatment is not ***POSITION.1 but the College itself
       Official Architects of Granada, which can generate an obvious
       confusion and misinformation to stakeholders. It is even more serious, when the
       position of DPD and the GDPR falls on the same person, the ***POINT.1 of the

       School.

       The web page https://coagranada.es/ presents an informative notice about
       cookies that violates the latest guidelines of the AEPD since according to
       indicates in said informative notice that the mere use of the website implies the
       Acceptance for the installation of cookies.


       The privacy policy of the website of the Official College of Architects of
       Granada, which is available at the following web address
       (https://coagranada.es/politica-de-privacidad-y-tratamiento-de-datos/
       (Document No. 4) has the following deficiencies: 1.- The data is not indicated
       Contact information for the Data Protection Officer. 2.- Incorrect application of

       the legitimizing basis of consent in section 5 of the policy, by
       choose this basis as the one that legitimizes the processing of personal data
       derived from the sending of emails, without stating a mechanism of
       expression of consent that meets the established requirements
       by current legislation. 3.- There is no clear and unequivocal identification of the
       legitimizing bases of data processing, since in section 3 of

       said policy literally states "Consent will always be required
       for the processing of your personal data that may be for one or more
       specific purposes about which prior information will be given with absolute
       transparency". However, later in section no. 6 of the web,
       other legitimizing bases other than consent are detailed, producing
       confusion about the true legitimizing bases applied by the entity.


       Likewise, it was possible to appreciate the existence of privacy policies not
       adapted to current regulations (eg visa application form that is
       attached as Document No. 5).


       Finally, it is wished to state that, as stated in the
       letter addressed to the Official College of Architects of Granada on 03-23-
       2021 (Document No. 6), there are well-founded reasons to believe that the
       disciplinary proceedings conducted by the College do not enjoy the
       corresponding technical and organizational measures that guarantee the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/60








       confidentiality and integrity of the personal data contained in the
       themselves, since there is no record of incorporation of documents or
       proceedings to the file.

The claim document is accompanied by the following relevant documentation for the

present procedure:

    - Copy of the document that A.A.A., collegiate ***COLEGIADO.1, sends to the
       claimant, on 08/30/21, where, among others, you can read:

           or "(...) The Governing Board of the College in its session held on

               April 2019 adopted, among others, the following agreement: "(AIG)
               04.11.19/08.- DESIGNATE THE *** POSITION. 1 OF THE OFFICIAL ASSOCIATION
               OF ARCHITECTS AS DELEGATE OF PROTECTION OF
               DATA FOR THE SCHOOL OF ARCHITECTS.” therefore i can
               inform you that, currently, the Data Protection Officer of the

               Official College of Architects of Granada is his *** POSITION. 1 D.
               B.B.B. (…)”.

    - Copy of the "Complaint Sheet" of the Official College of Architects of
       Granada where you can read, among others, the following information with
       Regarding the data protection policy:


           o Official College of Architects of Granada. Plaza de San Agustin Nº3,
               18001 Grenada. General Secretary . Area of Attention to the Collegiate and
               to user. The data collected will form part of the File of the
               COAGRANADA, being Responsible for ***POINT.1 of the same, to

               who will have to address in writing in the case of exercising the rights
               of access, opposition, rectification and cancellation, in accordance with the
               L.O.P.D.

    - Copy of the "Visa Application" addressed to the Dean of the Official College of
       Architects of Granada, where you can read, among others, the following

       Information regarding the data protection policy:

           o In accordance with the provisions of LO 15/1999 on Data Protection of
               Personal character, the existence of a file is reported
               automated whose purpose is the provision of the requested service. The

               Applicants expressly consent to the
               treatment and transfer of existing data in the automated file
               to the various Spanish Official Colleges of Architects and to other
               administrative bodies, for the purposes related to the function of
               visa. Signatories may exercise the right of access,
               rectification, opposition and cancellation in writing before the C.O.A. of

               Granada, with address at Plaza de San Agustín Nº 3, 18001 Granada,
               email coagranada@coagranada.org

SECOND: On 03/03/22, in accordance with the provisions of article 65.4
of the LOPDGDD Law, by this Agency, said claim was transferred


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/60








to the claimed party, to proceed with its analysis and report, within a period of
month, about what was stated in the claim document.


THIRD: On 04/01/22, the claimed party filed a response brief
to the request made by this Agency, in which, among others, it stated:

       "Specifically, the claimant refers to the text of the Legal Notice of
       First Layer in relation to the Cookies Policy, which, as of the date of the
       claim, 12/21/21, showed: https://coagranada.sedelectronica.es/

       “We use cookies to ensure that we give the best user experience
       on our website. If you continue to use this site we will assume that you agree
       agreement I accept.”

       This First Layer Legal Notice was located at the bottom of the screen,

       and the formula to obtain consent was exclusively by pressing the
       "I accept" button, that is, by means of an unequivocal action carried out by the
       user. However, when you continue browsing, the Initial Notice of
       First Layer kept appearing in case the user wanted to
       consult the Cookies Policy, which was found in the link located in the
       expression highlighted in orange we will assume that you agree. In its

       moment, it was interpreted that, by continuing to browse, the user was showing
       according to the notice provided.

       On March 29, 2022, this College contacted the company
       specialized in data protection adaptation services, the entity

       "PSN Sercon S.L.U.", which has analyzed and made a preliminary report on
       potential irregularities on the COA website, report attached
       to this document as annex I (INITIAL ANALYSIS OF THE OFFICIAL SCHOOL WEB
       OF ARCHITECTS OF GRANADA) in which the main
       non-compliances detected in a first approximation to the process of

       regularization and adaptation to the current regulatory framework on data protection
       and other legislation applicable to the COA Granada website.

       The work to adapt the Privacy Policy has already begun
       of the COA Granada website and its Cookies Policy, as can be
       check on the links:


        https://coagranada.es/politica-de-privacidad-y-tratamiento-de-datos/
        https://coagranada.es/politica-sobre-recogida-y-tratamiento-de-cookies/

       They indicate that work is being done to update and adapt them to

       current legislation. Efficacy controls referred to the Privacy Policy
       Privacy, the COA Granada, with the assistance of the entity PSN Sercon SLU,
       Currently they are the following:

        A redesign of the Privacy Policy and its Registry is being carried out

       of Treatment Activities following the criteria of the Document "Informe
       on Internet Privacy Policies, Adaptation to the GDPR”, 2018- AEPD.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/60








        An annual audit program has been established, in line with the
       principle of proactive responsibility of art. 24.1 of the GDPR


       In relation to the measures adopted for the adequacy of the use of
       cookies to the applicable regulations on data protection, since
       The First Layer of Cookies Notice has been modified, following the
       guidelines of the Document "Guide on the use of Cookies", published by the
       AEPD 2020.


       An audit of existing cookies on the website of the
       COA Granada, with the use of the tools recommended by the
       National Institute of Cybersecurity, INCIBE, https://www.incibe.es/protege-tu-
       company/blog/are-cookies-and-show-them-website for, later,
       carry out an analysis of its usefulness, necessity and validity. The result of

       this analysis is in the process of elaboration.

       Likewise, the mechanism to collect the
       consent, replacing it with a banner with the indications established
       by the applicable regulations: ownership of the website, purpose of cookies,
       existence of third-party cookies and the possibility of configuring cookies,

       rejection and acceptance of them.

       The Official College of Architects of Granada, through its Governing Board
       chaired by the Dean who signs this document, recognizes the
       need to adapt the cookie policy and its privacy policy. Is by

       For this reason, on March 30 of this year, it was decided to start
       immediately of the work of adequacy and adaptation of the aspects
       required by that AEPD in order to comply with the provisions
       both in the LOPDGDD, as well as in the RGDP and the LSSI.


       Consequently, by virtue of all of the foregoing, and given that the
       COAGranada, is in the process of implementing the measures
       corrective measures on its own initiative, respectfully requests that the
       FILE of the Claim that has given rise to File 202201681
       This has been the criteria maintained by the Spanish Agency for the Protection of
       Data in its Resolution R/00461/2019 -Procedure No.: A/00013/2019.

       “Well, in view of the aforementioned circumstances, it is considered necessary
       emphasize that the National Court, in its Judgment of November 29,
       2013, (Rec. 455/2011), Sixth Legal Basis warns, regarding
       the legal nature of this figure, which despite referring to the warning
       regulated in article 45.6 of Organic Law 15/1999, of December 13,

       Protection of Personal Data (LOPD) has full application to the
       warning regulated by the LSSI, which "does not constitute a sanction" and which is
       It deals with "corrective measures for the cessation of the constitutive activity of the
       infraction" that replace the sanction. The Judgment understands that the article
       45.6 of the LOPD (these considerations must be understood as done, so

       here it concerns article 39 bis, 2 of the LSSI) confers on the Spanish Agency
       of Data Protection a "power" different from the sanctioner whose
       exercise is conditioned to the concurrence of special circumstances
       described in the precept

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/60









       In congruence with the nature attributed to awareness -as a
       alternative to the sanction when, given the circumstances of the case, the subject

       of the infringement is not deserving of that- whose object is the imposition of
       corrective measures, the aforementioned SAN concludes that when the measures
       pertinent corrective measures had already been adopted, what is appropriate in Law
       It will be to agree on the File of the proceedings.

       In the present case, taking into account that the corrective measures that

       would proceed to impose were already adopted on its own initiative, and that it has been
       verified that cookies are not currently installed on the analyzed website,
       in harmony with the pronouncement of the National Court included in the
       SAN of 11/29/2013 (Rec. 455/2011) must agree to file the
       proceedings of this proceeding”.


       It is also worth mentioning Resolution R/03132/2016, of December 19, of that
       Spanish Data Protection Agency-Procedure No.: A/00411/2016-:
       “In congruence with the nature attributed to awareness as a
       alternative to the sanction when, given the circumstances of the case, the subject
       of the infringement is not deserving of it, the Judgment of the Hearing

       The cited National concludes that when the corrective measures object of the
       warning had already been adopted by the offender, what is appropriate in
       The right is to agree to file the proceedings.

       In view of the pronouncement contained in the Judgment of the Hearing

       National of 11/29/2013 (Rec. 455/2011), subsequently reinforced in its
       Judgment dated 06/10/2014 (RJCA 2014, 571) (Rec. 166/2013), references
       to the cases in which the subject responsible for the infringement has adopted
       the appropriate corrective measures to remedy the situation created, and in
       harmony with what has been indicated, the proceedings must be filed

       practiced.”. And, likewise, the Resolutions of that AEPD R/02863/2016 of
       December 14 - Procedure No.: A/00242/2016-, R/02906/2015 of December 17
       November- Procedure No.: A/00172/2015- or R/00001/2015 of 145 of
       January- Procedure No.: A/00289/2014.

       The Judgment of the National Court (Chamber of Administrative Litigation,

       Section 1) of November 29, 2013 - JUR 2014\14399-established the following:
       "However, given that it was proven that the denounced by initiative
       itself had already adopted a series of corrective measures , which it communicated to
       the Spanish Data Protection Agency, and that it had verified that
       the data of the complainant were no longer locatable on the website of the accused, the

       Spanish Data Protection Agency did not consider it appropriate to impose on the
       denounced the obligation to carry out other corrective measures, therefore
       that it did not agree to any requirement in this regard to it. Remember that at
       having knowledge of the complaint, the denounced entity, proceeded by
       own initiative to go to Google to remove the URL where

       reproduced the Magazine and the article, to ask their collaborators to
       remove any names from their articles or any other information
       likely to appear personal data and that they review the appointments in the private area
       of the web to delete any other sensitive data, and, finally, to review the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/60








       configuration of the accesses so that the search engines did not have access to the
       Journals.


       Consequently, if the AEPD considered that the corrective measures had already been
       pertinent in the case, how it happened, as expressed in the resolution
       appealed, the appropriate administrative action in law was the file of
       the proceedings, without making any warning or request to the
       denounced entity, as this is deduced from the correct interpretation of the
       Article 45.6 of the LOPD, taking into account its systematic and teleological interpretation."


       Judgment no. 447/2016 of 23
       September and no. 363/2016 of July 8, issued by the National Court
       (Contentious-Administrative Chamber, Section 1)-RJCA 2016\1072 and JUR
       2016\166417- "Consequently, when, as occurs in the case that we

       occupies, given the circumstances of the case and, in particular, the nature of
       the facts and the significant concurrence of the criteria established in the
       fifth paragraph of article 45 of the LOPD, it is estimated that the subject
       responsible for the infringement is not deserving of the sanction provided for the
       itself, and that in its place the obligation to carry out
       certain corrective measures, proceeding therefore the application of the

       article 45.6 of the LOPD, there is no room for the imposition of any "warning"
       as a sanctioning measure. On the contrary, what proceeds in
       such a case is to "warn" or require the responsible subject in order to comply in the
       term indicated with such obligation, as is clear from the
       interpretation of the legal precept examined>> . In the same sense, it

       Pronounce S October 17, 2014 (JUR 2014, 267483) -appeal No.
       150/2013 -, May 8, 15 (JUR 2015, 154993) -appeal No. 122/2014 -, and July 8
       of 2016 (JUR 2016, 166417) -appeal No. 242/2014 -

       Therefore, based on the foregoing, it is not applicable, as claimed by the

       plaintiff, the warning, instead of the financial sanction imposed, since
       As has been reflected, the warning included in the LOPD does not have
       punitive nature”.

FOURTH: On 07/27/22, this Agency accessed the document
"Collective Complaints and Claims Sheet": https://coagranada.es/wp-content/

uploads/2021/02/Hoja_queja_reclamaciones_colegiados_V02.pdf , where you can
read, at the bottom of it, below the form, the following legend:

       “Official College of Architects of Granada. Plaza de San Agustin Nº3, 18001
       Grenade. General Secretary . Area of Attention to the Collegiate and to the User.


       The data collected will form part of the COAGRANADA File, being the
       Responsible for *** POSITION 1 of the same, to whom it will have to be addressed in writing
       in the case of exercising the rights of access, opposition, rectification and
       cancellation, in accordance with the L.O.P.D.”


FIFTH: On 07/27/22, this Agency accessed the website
https://www.coagranada.es/ verifying in it, the following characteristics


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/60








regarding the processing of personal data, about its "Privacy Policy" and about
its “Cookie Policy”:


       a).- Regarding the obtaining of the personal data of the users of the page
       Web:

1º.- Through the link <<contact>>, located at the top of the page
main page, the web displays a form where you can enter personal data
of users such as name, email and subject.


In order to send the form, the user must necessarily click on the option:

       _ I have read and accept the <<Privacy Policy>> <<send>>


       b).- About the "Privacy Policy" on the website

If you wish to access the "Privacy Policy" through the existing link in the
contact form or through the existing link at the bottom of the page
main, the web redirects the user to a new page https://coagranada.es/politica-
de-privacidad-y-tratamiento-de-datos/, where information is provided, regarding

the protection of personal data of: the identity of the owner of the website and the Delegate
Data Protection; the purpose of the personal data obtained from the
collegiate; training/events; web users; citizen services; Within
conservation of personal data obtained; the legitimacy of the treatment of
personal information; the recipients; on the rights that assist users and

where and how to request them, as well as the possibility of filing a claim with the
competent authority.

       c).- About the Cookies Policy on the web:


The inspection is carried out with the developer tools that
provided by the Mozilla Firefox browser, in which the
cache and cookies have been removed. The tool has also been used
EDPS (Web Evidence Collector) for analysis

Observing the cookie installation panel, it can be verified that a

session cookie PHPSESSID and another from Google, _GRECAPTCHA.

According to Opinion 4/2012 of WP 194 on the exemption of the requirement of
cookie consent, the exemption applied to authentication cookies could
apply to others introduced specifically to strengthen the security of the service

requested, for example, those cookies whose purpose is to detect attempts
erroneous and repeated connection to a website or for protection of the information system
connection against abuses such as _GRECAPTCHA.

However, after browsing the website, it is observed that cookies are installed

from third parties of a non-excepted nature, which are not reported in the policies, to
despite not having given consent through the banner. the circumstance is given
that these analytical cookies are installed through the insertion of a map


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/60








interactive program of the Institute for Geoenvironmental Health of the Vivo Sano Foundation in the
page: https://coagranada.es/mapa-zonas-radon-en-elnuevo-cte-db-hs6/ .

2.- There is an information banner about cookies on the main page with the
following message:


    “We use our own and third-party cookies for analytical, functional,
 performance to offer services appropriate to your profile, as well as own advertising
  and from third parties. The basis of treatment is consent, except in the case of
 Essential cookies for the proper functioning of the website. can accept
all cookies by clicking the <<ACCEPT>> button or configuring them or rejecting their use

  pressing the <<CONFIGURE>> button. You can get more information in our
                               <<Cookie Policy>>,

               <<Accept>> <<Reject>> <<Settings>>


If you wish to reject all cookies that are not technical or necessary, clicking
in the <<reject>> option, it is checked how the web continues to use the same
third-party cookies (from Google) indicated above.

3.- If the cookies control panel is accessed through the link <<Configure>>, the
web displays a page or control panel verifying that the groups of cookies

They are pre-marked in the “deactivated” option:

    - Strictly Necessary Cookies: Off  On.
    - Analytical and Advertising Cookies: Off  On.
    - Functional Cookies: Off  On.
    - Analytical Cookies: Off  On.


                  <<Save Changes>> <<Activate All>>

If you choose "Save changes" without having accepted any group of cookies, you will
Check how the web continues to use the same cookies indicated above.


4.- If you want to access the "Cookies Policy" through the existing link in the
information banner of the first layer, through the existing link in the panel
control or through the existing link at the bottom of the main page, the web
redirects the user to a new page https://coagranada.es/politica-sobre-recogida-y-
treatment-of-cookies/ where information is provided on: what are cookies, definition and
generic function of cookies; types of cookies; what type of cookies are used in the

web and what is its purpose; how to disable cookies; cookies identify
used and information is provided on how to accept, deny, revoke the
consent or eliminate cookies, through the tools installed in the
web or through browsers installed on the terminal equipment.


SIXTH: On 09/06/22, the Director of the Spanish Agency for the Protection of
Datos agreed to initiate disciplinary proceedings against the claimed party, in accordance with the
provided in articles 63 and 64 of the LPACAP, when appreciating reasonable indications of
violation of the provisions of the articles:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/60








    - Article 38.6 of the GDPR, due to the conflict of interest detected in the
       appointment of *** POSITION 1 of the Association as Delegate of Protection of
       data, with an initial sanction of 5,000 euros (five thousand euros). Also, it

       warned that the alleged offence, if confirmed, may lead to the
       imposition of measures, according to article 58.2 d) of the GDPR. Along with it and
       In accordance with article 58.2 of the GDPR, it was also indicated that the measure
       corrective action that could be imposed would be to order him to name a
       Data Protection Officer in which he was not involved in a conflict
       of interest, as stipulated in article 38 of the GDPR.


    - Article 13 of the GDPR, due to the lack of information provided in the data sheets
       claims, about the processing of personal data obtained, with
       an initial penalty of 8,000 euros (eight thousand euros). Along with it and
       In accordance with article 58.2 of the GDPR, it was indicated that the measure

       corrective action that could be imposed would be to order him to include, in the
       forms used in the School, where personal data is obtained, all
       the information referred to in article 13 of the GDPR, referring to the treatment of
       Personal information.


    - Article 22.2 of the LSSI, regarding the use of third-party cookies from
       non-excepted character, without the consent of the user, with a penalty
       initial amount of 1,000 euros (one thousand euros).

SEVENTH: On 09/29/22, the claimant entity submits a written statement of allegations to

the initiation of the file in which the procedure is requested to be archived based on
the following considerations:

1.- Regarding the conflict of interest regarding the data protection officer of
This College.-


It points out that such a “conflict of interest” cannot be presumed, as has been said, taking
only as a basis the Statutes of COAGranada, in relation to the composition
and functions of the Governing Board, of the Permanent Commission and of the functions
of ***POINT.1 of COAGranada, since, of the statutory precepts that are
invoked by that AEPD (14.1, 13.2, 15 and 17) no existence of any

“conflict of interest” on the part of ***POINT.1 of COAGranada regarding the
protection of the interests of the Collegiate and third parties, in terms of protection of
data.

Regarding the violation of art. 38.6 of the GDPR, referring to the eventual "conflict of

interests”, the enumeration of functions of the Board is inappropriate and insufficient
of Government, as well as of the Permanent Commission and of ***PUESTO.1, all of them
established in the Particular Statutes of the Official College of Architects of
Grenada, to reach the conclusion that "the existence of a conflict is evident
of interest by ***POSITION.1 of the Official College of Architects of Granada

to act as DPD of said Body.

The COAGranada proceeded to appoint the DPD in the figure of his *** POSITION.1
thus guaranteeing the participation of the Data Protection Officer in all


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/60








issues relating to the protection of personal data and, for your support and
advice provided him with the competition and assistance of the external Legal Department.


Reference is also made to the fact that COAGranada designated its
*** POSITION 1 as Data Protection Officer was the subject of a complaint before
this Agency dated July 8, 2021 by the same claimant and who was
archived by Resolution of this AEPD on 11/11/21, therefore, there are two
Contrary resolutions, so that, in the first, infringing conduct is not imputed
any regarding the appointment of the Data Protection Officer in the figure

*** POSITION 1 of the College and, however, in the second, with said appointment
COAGranada is accused of a violation of art. 38.6 of the GDPR.

Finally, it states that the Official College of Architects of Granada adopted the
decision to appoint a new Data Protection Officer on April 26

2022, anticipating the proposed corrective action and request that it be taken into account
account this decision under art. 83.2.c) of the GDPR.


2.- about the lack of information in the forms on "complaints and claims".


Regarding the sanction referred to for the violation of art. 13 GDPR, state that they
has incorporated all the information referred to in art. 13 of the GDPR to the forms to
disposition of both Collegiate and the general public, for which they request
that this measure be taken into account under art. 83.2.c) of the GDPR.


3.- about the cookie policy

It states that the breach is due to the use of a third-party cookie for the use
of an interactive map and request that for the establishment of the amount of the
sanction is taken into account the absolute absence of guilt or illegality

of the fact as a consequence of the significant concurrence of several of the criteria
set out in article 40, based on the following criteria:

-Intentionality: COAGranada made the map available to its Members
interactive to facilitate compliance with the provisions contained in the Royal
Decree 732/2019, of December 20, by which the Technical Code of the

Building approved by RD 314/2006, of March 17, providing information
on the basic concepts related to the regulatory modification, without
to collect any information.

- Period of time during which the eventual infringement was committed. The map has already

been removed from the web and was available to the public during the period
established between February 10, 2022 and September 20, 2022, the day on which it was
retired.

-Recidivism due to the commission of offenses of the same nature: This College does not

has previously been convicted of any similar offence.

4.- Regarding improper or erroneous interpretation of article 77.2 of the LOPDGDD


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/60








At this point, the application of article 77.2 of the LOPDGDD is reiterated in the same
terms that they already stated in their letter dated 04/1/22.


Regarding the aforementioned article 77 of the LOPDGDD, they allege that the AEPD distinguishes the
public and "private" functions exercised or held by the Professional Associations but
state that these associations of professionals are Corporations of
Public Law and it is considered that it is not appropriate to impute only as "functions
private" those that are the object of the presumed infringing conducts that are imputed and
"disconnect" them without any reason or justification from public functions, in which

they can also be completely incardinated.

The following is a reproduction of the statutory precepts invoked that imply the
exercise of public functions, which are perfectly extensible to behaviors
accused; and these can perfectly overlap with such pubic functions

such as article 13. 2. It will correspond to the Governing Board, specifically;
article 15. The Permanent Commission and article 17. The *** POSITION.1. "It corresponds to
***POINT.1:

It is also stated that the Spanish Data Protection Agency, in its
Resolutions of May 24, 2021, Procedure No.: PS/00416/2020 and of May 11

2021, Procedure No.: PS/00347/2020, has adopted a different criterion from that followed in
this Sanctioning File before Public Law Corporations.

EIGHTH: On 04/10/23, this Agency once again accessed the
web page https://www.coagranada.es/ being aware of the following

Characteristics regarding its "Cookies Policy":

When entering the web for the first time, once the terminal equipment has been cleaned of the history of
navigation and cookies, without accepting new cookies or taking any action on
the web page, it has been verified that a single cookie "_GRECAPTCHA" is used,

whose purpose is to provide your risk analysis, such as detecting
erroneous and repeated connection attempts.

NINTH: On 04/10/23, this Agency accessed the data sheet
complaints and claims of the College of Architects of Granada, accessible through
of the link https://coagranada.es/quejas-y-reclamaciones/ verifying that in the

You can read the following message:

       Official College of Architects of Granada. Plaza de San Agustin Nº3, 18001
       Grenade. General Secretary. Area of Attention to the Collegiate and the User.


       In compliance with the provisions of EU Regulation 2016/679, of 27
       April 2016, hereinafter GDPR, the Official College of Architects of Granada
       with address at PLAZA DE SAN AGUSTÍN 3, 18001 GRANADA and NIF nº
       Q1875003D informs you that the collection and processing of your data through the
       The purpose of this form is the administrative, fiscal and

       accounting provided for in the legislation of professional associations and our
       statutes. Your data may be communicated to the General Council of Colleges
       Officials of Architects, related organizations and the Public Administration without
       prejudice to other assignments provided by law. Your data will be kept

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/60








       during the time necessary to comply with legal obligations. In
       You can consult additional information on this treatment at any time.
       or exercise the rights of access, rectification, deletion and opposition,
       portability and limitation of treatment by directing your request to the address above
       indicated or by email to protecciondedatos@coagranada.org. Also, in case

       If you consider your right to the protection of personal data violated, you may
       file a claim with the Spanish Data Protection Agency
       (www.agpd.es).

TENTH: On 04/10/23, a resolution proposal was formulated in the sense that
the party claimed for the infringement of article 38.6 of the GDPR is sanctioned, for the

conflict of interest detected in the appointment of *** POSITION 1 of the College
as Data Protection Delegate, with a penalty of 5,000 euros (five thousand
euro); for the infringement of article 13 of the GDPR, for the lack of information
provided in the claims forms, on the treatment of the data
personal data obtained, with a penalty of 8,000 euros (eight thousand euros) and for the

violation of article 22.2 of the LSSI, regarding the use of third-party cookies
of a non-excepted nature, without the consent of the user, with a sanction of
1,000 euros (one thousand euros).

Likewise, it was proposed that the claimed party be required so that, within the term
determined, adopt the necessary measures to adapt its performance to the

personal data protection regulations.

ELEVENTH: On 04/28/23, this Agency received a written
allegations to the proposed resolution, in which the claimed party reiterates and
confirms its previous allegations and once again requests the file of the
procedure. In this letter, the defendant states the following:


       FIRST.- REGARDING THE "CONFLICT OF INTERESTS" OF THE
       *** POSITION 1 OF THIS SCHOOL AS DELEGATE OF PROTECTION OF
       DATA, THE PROPOSED RESOLUTION IS INCONSISTENT AND
       CONTINUES IF DISTORTING THE PRINCIPLES OF CLASSIFICATION AND LEGALITY,
       PERSONAL TO THE SANCTION PROCEDURE, WHICH OPERATE IN

       FAVOR OF COAGRANADA AND AGAINST THAT AGENCY.-

       The Draft Resolution does not actually refute the allegations made
       by this College, especially regarding the violation of the principles
       of typicality and legality. Moreover, without addressing and dealing with these principles
       invoked in our pleadings brief, considers, without foundation or

       some piece of evidence- Cfr. Last paragraph of FD II a) that "it is evident the
       existence of a conflict of interest on the part of ***POSITION.1 of the College
       Official of Architects of Granada to act as DPD of said body”.

       At this point it is necessary to remember that this Agency continues to be based on some

       “Guidelines” or “best practices of the Working Group on
       Data Protection". It is clear that any administrative offense
       must take as an inexcusable foundation a normative element (legal, or
       regulation) which, in the present case, does not exist, since it results in all
       inappropriate point to take as a title of imputation some guidelines or

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/60








       recommendations, given that this implies a violation of the principles of
       typicity and legality. Even in article 29 of the “Guidelines on the
       data protection delegates (DPD)" of said Working Group, it will be

       to set an "example" (that "a DPO be asked to represent the person responsible or
       to the data processor before the courts in cases related to the
       Data Protection").

       The mere fact of mentioning an example in a sanctioning procedure already
       implies per se, dispensing with the essential factual element that must distort

       the principle of presumption of innocence and, likewise, even applying as
       implausible example, there are no similar circumstances in the present
       Sanctioning procedure. On the other hand, the considerations of the aforementioned
       "Working Group" regarding the "conflict of interest of the DPD are
       extremely generic and, in no way, can they serve as a basis

       to enervate the aforementioned presumption of innocence.

       Moreover, even applying such "Criteria" -which is not rejected either
       would result in the existence of a “conflict of interest” to appoint the
       *** POSITION 1 of the College, with the assistance and support of the Legal Department of the
       COAGranada, as DPD. The “Criteria” themselves establish that the

       determination or consideration of the existence of a "conflict of interest" in
       the figure of the DPD must be "considered on a case-by-case basis", which has not been done
       for that AEPD.

       In this sense, it is worth mentioning the Judgment of the Court of Justice of the Union

       Commission (Sixth Chamber) of February 9, 2023, Case C-453/21: “Fourth
       question referred for a preliminary ruling 43 Third, as regards the context in which
       that article 38, section 6, of the GDPR is registered, it should be noted that,
       according to article 39, paragraph 1, letter b) of the GDPR, the protection officer
       of data has the function, in particular, of supervising compliance with the

       provided in the GDPR, other data protection provisions of the
       Union or of the Member States and of the policies of the person in charge or of the
       person in charge of the treatment regarding the protection of personal data,
       including assignment of responsibilities, awareness raising and training of
       staff involved in processing operations, and audits
       corresponding.


       From this it can be deduced that they cannot be entrusted to a protection delegate
       of data, its functions or tasks that lead it to determine the purposes and
       means of processing personal data of the controller or
       from his manager. Indeed, in accordance with Union Law or the Law of

       Member States in the field of data protection, the control of these
       purposes and means must be carried out independently by said
       delegate.

       The determination of the existence of a conflict of interest, in the sense of the

       art 38 paragraph 6 of the GDPR, must be carried out on a case-by-case basis, on the basis of
       an assessment of all the relevant circumstances, in particular, of
       the organizational structure of the controller or his manager and in the light of all
       applicable regulations, including any policies of the latter.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/60









       In view of all the above considerations, it is appropriate to reply to the
       fourth question referred that Article 38(6) of the GDPR must

       interpreted as meaning that there may be a "conflict of interest", in
       the meaning of this provision, when entrusted to a delegate of
       data protection other functions or tasks that would lead it to
       determine the purposes and means of processing personal data in the
       within the person responsible for the treatment or his manager, which is the responsibility of
       determine in each case the national judge on the basis of all the

       relevant circumstances, in particular the organizational structure of the
       responsible for the treatment or its manager and in light of all the regulations
       applicable, including any policies of the latter.

       By virtue of all of the above, the TJ (Sixth Chamber) declares: (...) 2) Article 38,

       Paragraph 6 of Regulation 2016/679 must be interpreted in the sense that
       there may be a "conflict of interest" within the meaning of this provision,
       when other functions are entrusted to a data protection officer
       or tasks that would lead him to determine the ends and means of the
       processing of personal data within the controller or
       of his person in charge, which is the responsibility of the national judge to determine in each case

       on the basis of all the relevant circumstances, in particular the
       organizational structure of the data controller or its manager and
       light of all applicable regulations, including any policies of these
       last.


       On this point, that Agency confuses the very concept of "conflict of
       interests” when he seems to equate the position of ***POSITION.1 of the College to
       "management positions", given that, as a result of the application of article 17
       of the Particular Statutes of COAGranada, it is evident that the
       ***POSITION.1 does not in any way hold such senior management functions,

       This concept is also applicable to other types of entities, not to COAGranada.
       To these considerations, as it cannot be otherwise, it is not offered by
       that AEPD response or factual or legal foundation that distorts it.

       And this is especially relevant, given that the expression "conflict of
       interests” implies the application of an indeterminate legal concept that, in

       a disciplinary procedure, while restrictive of rights, must
       be applied with extreme caution and with a strong factual heritage, probative
       and legal-regulatory that supports it, all of which has not happened in the
       present case.


       And it is that "the conflict of interest" has to be proven by that Agency and not
       be presumed, which is what has happened in this Procedure
       Sanctioner. It is not possible to presume, as has been said, such a "conflict of interest"
       taking as a basis only the Statutes of COAGranada, regarding
       to the composition and functions of the Governing Board, the Commission

       Permanent and of the functions of ***POSITION.1 of COAGranada, position
       that, of the statutory precepts that are invoked by that AEPD (14.1, 13.2,
       15 and 17) does not infer any existence of "conflict of interest" on the part of the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/60








       *** POSITION 1 of COAGranada regarding the protection of the interests of the
       Collegiate and third parties in terms of data protection.


       That is to say, of the statutory precepts that regulate the functions of the Board of
       Government (Art. 13.2), its composition (Article 14.1), the Permanent Commission
       of the Governing Board (article 15) and, especially, the powers of the
       *** POSITION.1 (article 17) in no way can the performance of
       functions that imply a "conflict of interest" with the figure of the DPD.


       The COAGranada proceeded to appoint the DPD in the figure of his
       ***POINT.1 thus guaranteeing the participation of the DPD in all
       issues relating to the protection of personal data and, for your support and
       advice endowed him with the help and assistance of the Legal Department of the
       COAGranada.


       2.- As has been said, the sanctioning power of the Public Administration
       is directly linked to the principles that inspire criminal law, given that
       Both powers are an expression of the Legal System of the State, as
       as expressed in the Constitutional Text itself (art. 25) and recognizes the
       jurisprudence of the Constitutional Court from the STC 18/1 981, of June 8 and

       a very reiterated jurisprudential doctrine of the TS (STS September 29, 1980
       and STS November 4, 1980 and STS November 10, 1980, among others).

       The sanctioning power of the Administration is based
       constitutional in article 25 of the CE. It is reiterated doctrine of the Court

       Constitutional (STC 77/83, of October 3, STS 42/87, of April 7; STC
       29/1989, of February 6) that the administrative sanctioning order
       includes a double guarantee: the first, of a material nature, supposes the
       need for normative predetermination of illegal conduct and sanctions
       corresponding, through legal precepts that allow predicting, with

       sufficient degree of certainty, the conducts that constitute an infraction and the
       applicable penalties or sanctions.

       It appears derived from the binding mandate or "lex certa" and is specified in
       the requirement of normative predetermination of the illegal conducts and of the
       corresponding sanctions, which places on the legislator the duty of

       configure them in the penalizing laws with the greatest possible precision
       (principle of typicality) so that citizens can know in advance
       the scope of what is proscribed and thus foresee the consequences of their actions.
       (STC 242/2005, of October 10 and STC 162/2008, of December 15). The
       second, of a formal nature, refers to the range of norms

       typifying the infractions and regulating the sanctions, insofar as they
       the term "current legislation" contained in art. 25.1 CE is expressive of
       a reserve of law.

       Therefore, the formal guarantee implies that the law must contain the determination

       of the essentials. Well then, the material guarantee comes to constitute
       the aforementioned principle of typicality, which "supposes the imperative
       need for normative predetermination of the infringing conducts and the
       corresponding sanctions, that is, the existence of legal precepts (lex

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/60








       previous) that allow predicting with a sufficient degree of certainty (lex certa)
       those behaviors and know what to expect in terms of responsibility and
       to eventual sanction" (Cf. STC 61/1990, of March 29 and STC 24/1996 of
       February 13; STS April 20, 2006; STS November 18, 2000; STS December 20
       1999; SAN of December 2, 2011; STS No. 74/2017, Litigation Chamber

       Administrative, of January 23). For its part, article 27 of Law 40/2015
       of October 1, of LRJSP-, includes the so-called principle of typicality, according to the
       which only constitute administrative infractions the violations of the
       legal system foreseen as such infractions by a Law.

       The principle of classification, related to that of legality, requires that the fact

       that allegedly has an illegal character is expressly found
       foreseen as an infraction in some precept of the legal system
       administrative. For a conduct to be classified as typical, and for
       Therefore, unlawful and punishable, it is necessary that there is a coincidence between the action
       carried out by the actor and the conduct exposed in the applicable legal precept.

       Through the application of the principle of typicality, it is intended to verify if a
       event that occurred in reality meets all the characteristics described in the
       law as presuppositions of the infringement of a rule of a punitive nature.

       For this, it is necessary that the action be subsumed in a sanctioning precept,
       understanding as such that part of the offense that describes all the elements

       subjective and objective that, as a whole, give rise to the infringement of the
       rule. According to Judgment no. 4672/2022 of December 23, of the Court
       Superior Court of Justice of Catalonia, (Contentious-Administrative Chamber,
       Section 4)-JUR 2023\48531-: "Requirements of the principle of classification in matters
       administrative penalty that, as is well known, despite the notable
       conciseness and taking into account the implicit content of the aforementioned article 25 of the

       Constitution (judgment of the Constitutional Court 34/1996, of March 11
       (RTC 1996, 34) ), has been highlighted since ancient times by jurisprudence
       constitutional in relation to what has been called the guarantee
       material of the principle of legality (among many others, from the judgment of the
       Constitutional Court 42/1987, of April 7 (RTC 1987, 42), for the
       judgments of the Constitutional Court 3, 11, 12, 100 and 101/1988, of June 8

       (RTC 1988, 101), 161, 200 and 219/1989, of December 21 (RTC 1989, 219),
       61/1990, of March 29 (RTC 1990, 61), 207/1990, of December 17 (RTC
       1990, 207), 120 and 212/1996, 133/1999, of July 14, 142/1999, of July 22
       (RTC 1999, 142), and 60 and 276/2000, of November 16 (RTC 2000, 276) ),
       that comes to be identified with the traditional principle of typicity of faults and
       administrative sanctions (sentences of the Supreme Court, Third Chamber, of

       dates January 16 and June 8, 1992, February 5 and October 2, 2002)
       and that always requires the necessary certain normative predetermination of the
       specific conducts that by action or omission are deemed to constitute a
       illegal administrative, with prohibition of possible analogical interpretations
       to the effect or extensive in malam partem (ruling of the Constitutional Court

       125/2001, of June 4 (RTC 2001, 125), citing their previous judgments
       81/1995, of June 5 (RTC 1995, 81), 34/1996, of March 11, (RTC 1996,
       34) 64/2001, of March 17 (RTC 2001, 64), and order of the Court
       Constitutional 3/1993, of January 14, and 72/1993, of March 1; as well as
       Judgment of the Supreme Court, Third Chamber, of May 30, 1981, of 4

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/60








       of June 1983, of December 29, 1987, of October 20, 1998, of
       February 22, 2000 and March 3, 2003). Or put it in words
       of the Constitutional Court itself, among many other previous and subsequent
       in its judgment 113/2002, of May 9 (RTC 2002, 113), in the following
       terms: "(...) Specifically, in relation to the material guarantee referred to

       is subject to the sanctioning power of the Administration, we have
       specified that normative predetermination supposes the existence of
       legal precepts (lex prior) that allow predicting with a sufficient degree of accuracy
       certainty (lex certa) the infringing behaviors and knowing in advance to which
       abide in terms of the attached responsibility and the eventual sanction that
       the offender can deserve (STC 219/1989, of December 21, FJ

       4; 61/1990, of March 29, FJ 7; and 133/1999, of July 15, FJ 2) ".

       Also being well-consolidated jurisprudential doctrine that teaches
       that in the exercise of its sanctioning administrative power the
       acting sanctioning administration does not properly respond to the exercise

       of an administrative power of essence or discretionary tendency but rather
       predominantly regulated for the application to each specific case of the framework
       normative pre-established sanctions with a general nature in the legal system
       applicable sanctioning law, which entails, from the outset, the requirement of
       the necessary adequacy and rigor in the classification of the imputed facts and in
       its punctual incardination and adequate subsumption in the legally infringing type

       defined for its correction, in such a way that the contrary, certainly,
       would be determinative of violation of the subjective fundamental right since
       targeted and all recognized by the current constitutional text ex article
       25.1 of the Constitution (sentences of the Constitutional Court 77/1983, of 3
       of October (RTC 1983, 77) ,199 7 and 3/1988, of January 21 (RTC 1988, 3) ),
       which, because it is subject to constitutional protection, would incur an eventual

       sanctioning administrative action infringing the same in the vice of
       full nullity today provided for in article 47.1. a) of Law 39/2015
       ".

       3.- Finally, in relation to the non-compliance related to the appointment
       of the DPD, it must be recorded that, prior to the receipt of

       Resolution PS/00345/2022, as known and known to that Agency, the
       COAGranada adopted the decision to appoint a new Delegate of
       Data Protection on April 26, 2022, with electronic receipt no.
       REGAGE22e00014921519, meeting the requirements of art. 38 of the GDPR.

       This College has anticipated the proposed corrective measure and we request

       that this decision be taken into account under art. 83.2.c) of the GDPR, which
       establishes the following: “[…] When deciding to impose an administrative fine
       and its amount in each individual case shall be duly taken into account: c)
       any measure taken by the controller or processor to
       alleviate the damages and losses suffered by the interested parties.” In this point

       We also invoke the proportionality application of art 29.3 LRJSP.

       SECOND.- ON THE LACK OF INFORMATION IN THE FORMS
       ABOUT "COMPLAINTS AND CLAIMS".


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/60








       Regarding the sanction referred to for the violation of art. 13 GDPR, it is reiterated
       what is stated in the First Allegation, in the sense that no response is given and
       what is alleged by COAGranada in its pleadings is addressed. So and

       as stated in this, was applied as soon as this fact became known, the
       proposed corrective action having incorporated all the information
       referred to in article 13 of the GDPR to the forms available to both
       Collegiate as well as the general public, for which we request that
       Take this measure into account under art. 83.2.c) of the GDPR.


       On this point, related to what is stated in the First Allegation, the lack of
       concurrence of an essential element implies that the active subject has not
       committed the conduct described in the type allegedly violated by its
       action, therefore, it is perfectly lawful. That is, the atypicality
       determines the absence of responsibility for the subject responsible and, therefore,

       hence, the impossibility of displaying the effects of the ius puniendi on the subject.

       Furthermore, for the action to be considered typical, and therefore,
       display legal effects, it is necessary that together with the objective elements of
       typicality the so-called subjective elements of typicality concur. based on
       principle of subjective typicity requires that, in order to proceed to impute and

       sanction for an action, the voluntary nature of the active subject is confirmed.

       In this sense, jurisprudence has repeatedly required the
       existence of guilt to be able to impose an administrative sanction,
       to the point that today it is configured as one of the pillars on the

       that the sanctioning administrative law is established, discarding all
       sanction outside of negligent or negligent conduct and, therefore,
       discarding what has traditionally been called responsibility
       objective.


       Specifically, regarding guilt, the Constitutional Court has declared that, in
       Indeed, the Spanish Constitution undoubtedly enshrines the principle of guilt
       as a basic structural principle of Criminal Law and has added that, without
       However, the constitutional consecration of this principle does not imply in any way
       that the Constitution has made a certain mode of
       understand it (Cf. STC 150/1991).


       This principle of culpability governs in matters of administrative infractions,
       because to the extent that the sanction of said infraction is one of the
       manifestations of the ius puniendi of the State is inadmissible in our
       system a regime of strict liability or without fault (Cf. STC

       76/1990). This same sentence requires guilt in the case of infractions
       administrative acts committed by legal entities, affirming that "...Even
       this TC has described the principle of personal responsibility as "correct"
       by own facts principle of the personality of the penalty or sanction (STC
       219/1988).


       All this, however, does not prevent our Administrative Law from admitting
       direct liability of legal persons, recognizing them, therefore,
       infringing capacity. This does not mean, at all, that in the case of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/60








       administrative offenses committed by legal entities
       suppressed the subjective element of guilt.


       Law 40/2015 itself, on the Legal Regime of the Public Sector, provides in its
       Article 28 that "they may only be penalized for acts constituting
       administrative infraction natural and legal persons, as well as, when a
       Law recognizes the capacity to act, the affected groups, the unions and
       entities without legal personality and independent estates or
       self-employed, who are responsible for them by way of fraud or negligence".

       The majority jurisprudence of our Supreme Court (from its
       judgments of January 24 and 25 and May 9, 1983) and the doctrine of the Tribunal
       Constitutional (after its STC 76/1990) emphasize that the principle of
       Guilt, even without explicit recognition in the Constitution, is inferred from
       the principles of legality and prohibition of excess (art. 25.1 CE), or of the

       requirements inherent to a rule of law, and require the existence of
       fraud or fault

       The requirement of guilt in the penalizing administrative law has
       impregnated the jurisprudence of the Supreme Court in the different areas
       materials in which he has had the opportunity to speak, discarded by

       legal and constitutional requirement, strict liability, that is, regardless of
       from any wrongdoing. In this way, the principle of guilt
       constitutes an essential element of the administrative offense.

       THIRD.- ABOUT THE COOKIES POLICY


       In relation to the sanction proposal "About the Cookies Policy", as
       as the Resolution Proposal itself acknowledges, when entering the web by
       first time, without accepting cookies or performing any action on the page,
       You can check that non-technical cookies are not used or

       necessary.

       The breach detected is due to the use of a third-party cookie by the
       use of an interactive map. Based on art. 39 bis a) of Law 34/2002, of 11
       July, Information Society Services and Electronic Commerce,
       We request that the establishment of for the establishment of the amount of

       the sanction takes into account the absolute absence of guilt of the
       defendant or the illegality of the act as a consequence of the
       significant concurrence of several of the criteria set forth in article 40,
       based on the following criteria: -Intentionality: The COAGranada
       made the interactive map available to its members to facilitate the

       compliance with the provisions contained in Royal Decree 732/2019, of
       December 20, by which the Technical Building Code was modified
       approved by Royal Decree 314/2006, of March 17, providing
       information on the basics related to the modification
       regulations, without the intention of collecting any information.


       Period of time during which the eventual infringement was committed. The map
       has already been removed from the web and was available to the public during the
       period established between February 10, 2022 and withdrew on February 20, 2022.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/60








       September 2022. -The recidivism by commission of infractions of the same
       Nature: This College has not been previously condemned by any
       similar offence. At this point it is invoked, as in the Allegation
       above, the principle of guilt and, in addition, that of proportionality.


       FOURTH.- WE UNDERSTAND THAT THE PROPOSED RESOLUTION
       REITERATES THE IMPROPER OR WRONG INTERPRETATION OF THE ARTICLE
       77.2 OF THE ORGANIC LAW 3/2018 OF DECEMBER 5, OF PROTECTION
       OF PERSONAL DATA AND GUARANTEE OF RIGHTS
       DIGITALESLOPDGDD-.


       We invoke the application of article 77.2 of the LOPDGDD in the same terms
       that we already exposed in our letter dated April 1, 2022. And it is that,
       here it is also necessary to remember that we are in the heart of a
       disciplinary procedure, in which they are applied, as inspiring principles
       of the criminal order, that of presumption of innocence and that of in dubio pro reo.


       Regarding the aforementioned article 77 of the LOPDGDD, that Agency distinguishes the
       public and "private" functions exercised or held by the Colleges
       Professionals. But it is that, in addition to being associative entities of
       professional, privately-based, the fundamental thing for the purposes that we here
       occupy, is that they are Public Law Corporations. And, at this point,

       We consider that it is not appropriate to impute only as "private functions"
       those who are the object of the presumed infringing conducts that are imputed and
       “disconnect” them without any reason or justification from public functions, in
       which can also be totally incardinated.

       What is inappropriate at all points is to try to justify spuriously

       the exercise of "private functions" overlapping it with a norm that is not
       in application mode, such as Law 7/2006, of May 31, on the exercise of
       titled professions and professional associations of the Community
       Autonomous of Catalonia.

       Said Law is not applicable neither by reason of the matter, nor of the territory and,

       even less within a disciplinary procedure, which leads us
       again to the violation of the principles of classification and legality, without
       can be "presumed", without any evidence or factual foundation
       and legal, the exercise of private functions erring in the normative framework of
       application and assuming that the alleged infringements have been in the
       exercise of such functions.


       If we take into account the statutory precepts that the AEPD invokes
       regarding the alleged “conflict of interest” of ***POINT.1 of the
       COAGranada, the statutory precepts invoked by that AEPD
       involve the exercise of public functions, which are perfectly extensible

       to the imputed conducts; and these can be perfectly imbricated as
       pubic functions

       -Article 13. 2. It will correspond to the Governing Board, specifically: "a)
       Prepare draft standards of a general nature and the promotion of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/60








       procedure of approval and reform of the statutes. b) Propose to the
       General Assembly the matters that concern it, provide advice and
       technical support and arbitrate the means leading to the exact compliance of the
       agreed by it. c) Resolve the applications for the incorporation of new
       collegiate, of collegiate withdrawals and on the suspension of collegiate services and

       of college status. d) Authorize the registration of Companies
       Professionals in the corresponding Association Registry, upon request, who
       may be processed electronically through the single window established in
       this School e) Collect, distribute and manage the funds of the School,
       in accordance with the provisions of the Title on the Economic and Patrimonial Regime of
       the present Particular Statutes. h) Promote actions of all kinds through

       favor of the profession. i) Know the actions carried out due to
       urgency by the Dean or by the Permanent Commission, assuming them or
       censoring them when they were not within their own competence. j)
       Resolve as many proposals as the Permanent Commission may put forward k)
       Exercise the disciplinary function and adopt precautionary measures, initiating, of

       ex officio or by virtue of denunciation, the disciplinary files, in which it will dictate
       the corresponding Resolution. The exercise of such functions may be delegated
       in the Dean, in a group of members of the Governing Board or in a
       Commission. l) Send to the Investigating Commission the Files initiated in
       disciplinary matter, for the purposes of its processing and formulation of the
       corresponding proposed resolution. m) Initially approve the

       Regulations for the operation of attendance and telematic voting in the
       General Assembly, in order to be definitively approved by the General Assembly
       General of the Collegiates.”

       -Article 15. The Permanent Commission. The Governing Board will be constituted in
       Permanent Commission, made up of the Dean, the ***POSITION.1 and the Treasurer

       as ex officio members, for the fulfillment of the functions assigned to them
       in these Statutes. Corresponds to the Permanent Commission of the Board of
       Governance of the School: 1. Put into practice the guidelines issued by the
       Governing Board. 2. Propose to the Governing Board as many acts as are
       consequence of the powers that it has assumed. 3. The adoption of
       the necessary measures to comply with the agreements of the Board of

       Government. 5. Adopt decisions on matters of an urgent nature
       that, being the competence of the Governing Board, cannot suffer
       postponement until the meeting of the latter, having to account for these acts,
       for its ratification, in the first session held by the Governing Board. 6.
       Those functions expressly delegated by the Governing Board.


       -Article 17. The *** POSITION.1. “Corresponds to *** POSITION.1: 1. Organize, with
       the approval of the Dean and according to the criteria of the Governing Board,
       The school secretary. 2. Provisionally resolve on admission
       of the new members in accordance with the provisions of these Statutes
       individuals. 3. Receive and process all requests and communications that are

       directed to the College and its different Bodies, reporting them to whoever
       corresponds. 4. Issue the certifications that are requested and must be
       issued and keep the registration book of collegiate. 6. Make notifications
       college ups and downs. 7. Keep the minute books of the meetings of the
       General Assembly of members, Governing Board and the Commission

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 23/60








       Permanent and transfer the agreements, monitoring compliance
       thereof.". 10. Direct the services of the College offices.”.

       And, as a complement to the previous statutory precepts in article 6
       the functions of COAGranada are listed, fully governed by Public Law -

       Article 6. Functions. "Without prejudice to those reserved to the Superior Council of
       the Colleges of Architects of Spain and the Andalusian Council of Colleges
       Official Architects, are functions of the Official College of Architects of
       Granada, in its territorial scope, those expressly determined, for the
       achievement of its purposes, in the legislation on Professional Associations and,
       specifically, the following: 1. Registration: e) Facilitate the bodies

       courts and Public Administrations, in accordance with the laws, the
       List of members who may be required to intervene as
       experts or designate them directly, as appropriate. f) Equip yourself with the systems
       appropriate electronic communications and computer programs that
       allow citizens, Collegiates and other practicing Architects

       in its territory, to the Public Administrations and to the organizations declared
       authorities, resolve their administrative relations with them in
       single window system, without prejudice to the fact that it can also be done by other
       ways. g) Establish and maintain a telematic and in-person customer service
       to consumers and users and to Collegiates and other architects with the functions
       that the Law establishes and those that regulate the Superior Council of Schools of

       Architects, the Andalusian Council of Official Colleges of Architects and this
       School, according to the Law

       2. Representation and relations with Public Administrations: a)
       Represent the profession, in the territorial area that corresponds to it, before the
       public powers of the Andalusian Autonomous Community and others

       Public Administrations, defending the general interests of the
       profession, lending their collaboration in the matters of their competence, to
       which may enter into agreements to carry out activities of interest
       common, as well as for the promotion of actions aimed at defending the
       public interest and, especially, of the users of the professional services of
       the collegiate, with the different Public Administrations and with organizations

       public or private. When the representation must take place before bodies
       with jurisdiction outside the scope of the College and refers to matters that
       beyond its territorial scope, the actions will be carried out with the
       prior knowledge or through mediation of the Superior Council or Andalusian Council,
       as appropriate. b) Prior agreement of the Governing Council of the Junta de
       Andalusia, which must be published in the Official Gazette of the Junta de

       Andalusia, exercise administrative functions related to the profession,
       all this prior to the report of the Andalusian Council of Official Colleges of
       Architects and the express acceptance of the College. c) Act before the Judges and
       Courts, inside and outside their territorial scope, both in their own name and in
       defense of the goals and interests of the profession and professionals

       members of the Association or practitioners in its territorial scope, as in name,
       on their behalf and in their procedural substitution, in the defense that they themselves
       voluntarily entrust him. d) Report in legal proceedings or
       administrative proceedings in which fees or other professional issues are discussed,
       when required to do so. e) Inform, in accordance with the Laws, the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 24/60








       draft provisions at the local level that regulate or directly affect
       to the professional attributions or the conditions of activity of the
       Architects as well as those of regional scope when it does not correspond to the
       Andalusian Council. f) Cooperate in the improvement of teaching and research
       of architecture, urbanism and the environment. g) Participate and

       represent the profession in congresses, juries and advisory bodies to
       request of the Administration or individuals. i) Exercise the right of petition
       in accordance with the Law. j) Attend, in its capacity as competent body, the
       requests for information that are requested, in accordance with the provisions
       in Spanish or European Union legislation, both by individuals
       as by the Collegiate and other practicing architects or by the organisms

       national or international authorized by law.

       3. Ordination: a) Ensure the ethics and dignity of the profession, both in the
       reciprocal relations of the Architects as in those of these with their clients
       or with the organizations in which they carry out their professional work. b) Watch

       by the optional independence of the Architect in any of the
       modalities of professional practice. c) Avoid and prosecute before the Courts
       professional intrusion. d) Establish, within the scope of its competence,
       criteria on the minimum required levels of professional diligence, in
       particular, regarding the presentation of works and the quality control and
       monitoring of the works. e) Visa in accordance with what is established in the

       regulatory or legal application standards the professional works of the
       Architects. The visa will in no case include the fees, nor the
       Other contractual conditions for the provision of professional services
       agreed by the Architects with their clients. f) Prevent competition
       unfair between the Architects in the terms established in the legislation
       in force on unfair competition. g) Exercise disciplinary power over the

       Architects and Professional Societies that fail to comply with their collegiate duties
       or professionals, both legal and deontological, approving for this purpose a
       Code of Ethics, in accordance with the provisions of the Law and by the Council
       Superior of the Colleges of Architects of Spain and the Andalusian Council of
       Official Colleges of Architects. Said Code will be accessible to
       Collegiate and other practicing architects and consumers and users of

       their professional services. i) Advise members and others
       practicing architects as well as consumers and users of their
       professional services on the contracting conditions of the services
       professionals of the Architects, seeking the best definition and guarantee of
       the respective obligations and rights. j) Establish, within the scope of its
       competence, regulations on professional activity in the exercise of these

       management functions, subject to the Statutes and other
       general provisions of application.

       4. Service: e) Resolve by award, in accordance with the legislation on arbitration
       and to the collegiate Rules of Procedure itself, conflicts between

       Collegiate and citizens, or raised by the latter, that are
       submitted in matters related to the professional competence of the
       Architects. f) Establish fee scales merely for
       indicative for the sole purpose of cost appraisals in conflicts or
       jurisdictional proceedings. i) Provide the collaboration that is required in

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 25/60








       the organization and dissemination of competitions that affect Architects and
       ensure the adequacy of their calls to the regulatory standards of the
       professional exercise. m) Exercise as many administrative powers as may be

       legally attributed, collaborate with the Administration by carrying out
       of studies or issuance of reports and exercise the powers that are
       attributed by other norms of legal or regulatory rank, or are
       delegated by the Public Administrations or derived from agreements of
       collaboration. n) Prepare the letter of services to the citizen, offer
       information on the content of the profession and the members registered in the

       College, respecting the provisions of the regulations on data protection
       of a personal nature. o) Guarantee collaboration with the Administration of the
       Junta de Andalucía and its dependent bodies, as well as with the other
       Public Administrations and public entities in the control of situations of
       members who, due to their status as public employees at their service,

       could be affected due to incompatibility for the exercise of
       professional activities. p) Exercise arbitration and mediation functions in the
       Conflicts that, for professional reasons, arise between the Collegiate,
       between members and citizens, and between them when they decide
       freely, all in accordance with the applicable legislation on
       arbitration and mediation.


       5. Organization: a) Approve the Particular Statutes and their modifications
       prior report from the Higher Council of Colleges about its compatibility
       with the General Statutes of the Colleges of Architects and their Council
       Superior, submitting them to a report from the Andalusian Council of Official Colleges

       of Architects for its subsequent qualification of legality and registration in the
       Registration of Professional Associations of Andalusia by the Ministry
       competent. b) Prepare and approve the annual income budgets and
       expenses, as well as their accounts and settlements. d) Issue regulations of
       organization and internal functioning for the development and of those present

       Statutes.".

       And the Spanish Data Protection Agency itself, in its Resolutions of
       May 24, 2021, Procedure No.: PS/00416/2020 and May 11, 2021,
       Procedure No.: PS/00347/2020 has adopted a different criterion from that followed in
       this Sanctioning File before Public Law Corporations.

       Thus, the first of the aforementioned Resolutions establishes the following:

       "The denounced facts are specified that through the web page
       http//www.albuixech.es/wp-content/uploads/ ownership of the claimed could be
       access personal data of neighbors such as ID, telephone, disability,

       economic situation and that despite the fact that he had stated that he had solved the
       incidence, the corresponding measures had not been taken since
       he could still access the data of the neighbors.

       Article 83.5 a) of the GDPR (LCEur 2016, 605), considers that the infringement of

       "the basic principles for the treatment, including the conditions for the
       consent under articles 5, 6, 7 and 9" is punishable, according to
       with section 5 of the aforementioned article 83 of the aforementioned GDPR, "with fines
       administrative costs of €20,000,000 maximum or, in the case of a company,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 26/60








       of an amount equivalent to a maximum of 4% of the total turnover
       global annual report of the previous financial year, opting for the one with the highest
       amount". On the other hand, the LOPDGDD (RCL 2018, 1629), for the purposes of
       prescription, in its article 72 indicates: "Infringements considered very serious:
       1. Based on what is established in article 83.5 of the Regulation (EU)

       2016/679 are considered very serious and will prescribe after three years the
       offenses involving a substantial violation of the articles
       mentioned therein and, in particular, the following: a) The treatment of
       personal data violating the principles and guarantees established in the
       Article 5 of Regulation (EU) 2016/679. (...)" V The violation of article 32
       of the GDPR (LCEur 2016, 605) is typified in article 83.4.a) of the

       cited GDPR in the following terms:

       4. Violations of the following provisions will be penalized, according to
       with paragraph 2, with administrative fines of EUR 10,000,000 as
       maximum or, in the case of a company, an amount equivalent to 2%

       maximum of the overall annual total turnover of the financial year
       above, opting for the one with the highest amount: a) the obligations of the
       responsible and of the manager in accordance with articles 8, 11, 25 to 39, 42 and 43.
       (...)" For its part, the LOPDGDD (RCL 2018, 1629) in its article 71,
       Violations, states that: "Infractions are the acts and conducts to the
       referred to in paragraphs 4, 5 and 6 of article 83 of Regulation (EU)

       2016/679, as well as those that are contrary to this organic law". And
       in its article 73, for prescription purposes, it qualifies as "Offences
       considered serious": "Based on what is established in article 83.4 of the
       Regulation (EU) 2016/679 are considered serious and will prescribe after two years
       the infractions that suppose a substantial infringement of the articles
       mentioned therein and, in particular, the following: (...) g) The

       breach, as a consequence of the lack of due diligence, of the
       technical and organizational measures that have been implemented in accordance with the
       required by article 32.1 of Regulation (EU) 2016/679". (...)"

       VI The proven facts show access through the website
       http//www.albuixech.es/wp-content/uploads owned by the defendant to the

       personal data of residents of the town (ID, telephone,
       disability, economic situation, etc.), despite having stated to
       this AEPD that had provided a solution to the incident, breaking and
       violating technical and organizational measures and the duty to
       data confidentiality. As stated in the background and accredited
       based on the proven facts of the procedure, it has been proven that the

       file resolution of the initial claim, the claimant filed an appeal
       optional replacement against the relapsed resolution showing its
       disagreement and stating that the defendant had not taken the measures
       adequate since, despite what was alleged, the data continued to be accessed
       of the municipal website, contributing together with the new appeal document

       relevant documentation.

       After the analysis and checks carried out, it was found that there
       published documents containing information with character data


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 27/60








       personnel who had not been eliminated or anonymized, estimating the
       appeal and agreeing to the admission of the claim presented.


       Therefore, the entity's actions constitute a violation of the principles of
       confidentiality and data security, regulated in articles 5.1.f) and
       32.1 of the GDPR (LCEur 2016, 605), and typified in articles 83.5.a) and
       83.4.a) of the GDPR. However, in order to clarify the terms of the
       incident produced and that led to the opening of this proceeding
       sanctioning party, the defendant by letter of 02/18/2021 indicated that if

       Well at first I installed a WP Content Copy Protection Pro plugin for
       block access to existing documents on the website of the
       City Council and carry out the elimination of the files that contained
       personal data published on the aforementioned page, after receiving the
       agreement to open the procedure the computer service treated in a

       first moment of solving the incident, reaching the conclusion that the
       measure adopted (install a plugin to block access to the web),
       seemed insufficient since although it prevented access to the contents
       it was still possible to access them if the URL address was known
       of the published files.


       Therefore, the migration of the entity's website to another server was carried out
       which determined that the content that could have been accessed with
       Prior to the aforementioned date, it was deleted, and it was not possible to access the
       same from the moment the migration was performed. For the purpose of
       avoid incidents such as the one that occurred, the new website adopted a

       series of technical measures: remove access to the wp-content folder and its
       content through. htaccess ; check before serving WP permissions
       using the is-luger-logged-in function, to retrieve a file for a
       wp-content subfolder etc. In addition, the defendant has indicated that he assumes
       its responsibility as a consequence of the infractions committed, although

       considers that the efforts made to improve
       security measures in order to ensure the safety and security of
       confidentiality of personal data for which it is responsible
       and that the violation is not due to inaction or lack of proactivity in the
       compliance with data protection regulations.


       On the other hand, it should be noted that the defendant provides a screen print
       of the web page where the content of the character data should be
       staff that caused the claim and who are currently
       deleted, not being possible to access them VII The LOPDGDD
       (RCL 2018, 1629) in its article 77, Regime applicable to certain

       categories of controllers or processors, establishes what
       following: In the case at hand, in accordance with the evidence of
       those that are available and without prejudice to what results from the instruction, said
       conduct could constitute, on the part of the defendant, a possible violation of the
       provided in article 5.1.f) and 32.1 of the GDPR (LCEur 2016, 605).


       It should be noted that the GDPR, without prejudice to the provisions of its article 83,
       contemplates in its article 77 the possibility of resorting to the sanction of
       warning to correct the processing of personal data that is not

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 28/60








       conform to their forecasts, when those responsible or in charge
       listed in section 1 committed any of the offenses to which
       refer to articles 72 to 74 of this organic law. Also, it is contemplated
       that the resolution issued will establish the measures to be adopted
       so that the conduct ceases, the effects of the infraction are corrected

       committed and its adequacy to the requirements contemplated in the
       Articles 5.1.f) and 32.1 of the GDPR, as well as the contribution of means
       certifying compliance.

       However, it is considered that the response formulated by the defendant in
       letter dated 02/18/2021 has been reasonable, correcting the incident

       produced, not proceeding to urge the adoption of additional measures to those already
       taken by the defendant, which is one of the main purposes of the
       procedures with respect to those entities listed in article 77
       LOPDGDD, having been accredited the suspension of the website of the
       entity where the information contained the character data

       neighbors staff having migrated it to another server and adopting
       measures to prevent the occurrence of events such as those that gave rise to the
       claim.

       Therefore, in accordance with the applicable legislation and assessed the criteria of
       graduation of sanctions whose existence has been accredited, The

       Director of the Spanish Data Protection Agency RESOLVES:
       FIRST IMPOSE ALBUIXECH CITY COUNCIL, with NIF
       P4601400G, for a violation of article 5.1.f) of the GDPR (LCEur 2016, 605)
       , typified in article 83.5.a) of the GDPR, a penalty of warning, of
       in accordance with article 77 of the LOPDGDD (RCL 2018, 1629). SECOND
       TO IMPOSE the CITY COUNCIL OF ALBUIXECH, with NIF P4601400G, for

       an infringement of article 32.1 of the GDPR (LCEur 2016, 605), typified in the
       Article 83.4.a) of the GDPR, a warning sanction, in accordance with
       article 77 of the LOPDGDD (RCL 2018, 1629)”. About these resolutions
       dictated by the AEPD itself, the Resolution Proposal is not pronounced.

       FIFTH.- ABSENCE OF DETERMINATION OF THE CORRESPONDING TYPE

       TO THE PROPOSED SANCTIONS AND LACK OF REASONS FOR THE
       DETERMINATION OF THE AMOUNT THEREOF. ALTERNATIVE AND
       SUBSIDIARILY, INVOCATION OF THE PRINCIPLE OF
       PROPORTIONALITY.

       The Resolution Proposal does not establish which are the specific types

       of the sanctions that are proposed and the determination and graduation of the
       quantum of the same, which entails an absence of contrary motivation
       to article 35.1 a) of Law 39/2015 of October 1, on Procedure
       Common Administrative of Public Administrations. The type is not specified
       of infraction committed (we understand that, slight) nor is it motivated why they are imposed

       the respective sanctions of 5,000, 8,000 and 1,000 euros. With this you can
       consider that it has generated defenselessness for COAGranada.

       Alternatively and subsidiarily, in the event that it is estimated that
       one or more of the infractions contained in the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 29/60








       Resolution Proposal, we request the application of the principle of
       proportionality established in the aforementioned article 29.3 of the LRJSP as well as
       also invoked article 83.2.c) of the GDPR.

       The principle of proportionality in its application aspect, has served in the

       jurisprudence as an important mechanism of jurisdictional control of the
       exercise of the sanctioning power of the Administration when the norm
       establishes for an infraction several possible sanctions or indicates a margin
       quantitative for the fixing of the pecuniary sanction; and, thus, it has been insisting
       in which the aforementioned principle of proportionality or the individualization of
       the sanction to adapt it to the seriousness of the fact, make the determination

       of the sanction a regulated activity and, of course, it is possible in the
       jurisdiction not only the confirmation or elimination of the sanction imposed but also
       its modification or reduction (Cf. Judgment of the National Court of December 11,
       March 2008, Rec. 501/2006). In this sense, it is worth mentioning the Judgment of the
       Supreme Court of September 25, 2003 (Rec. 527/1998): "The power

       disciplinary measure is not discretionary and this implies that, when for
       a certain infraction has legally provided for a list of sanctions,
       the imposition of a more serious or higher than that established with the character of
       minimum must be clearly motivated by consigning the
       specific reasons and circumstances on which the superior malice or
       negligence that are taken into account to choose that greater punishment. This is how the

       interdiction of arbitrariness of article 9.3 of the Constitution and also the
       principle of proportionality included in the guarantees of article 25 of the
       same constitutional text.

       Therefore, the principle of proportionality implies that, since the activity is
       sanctioning of the Administration an activity typically of application of

       the rules, the factors that have to preside over its application are based on
       what is available in each sector of the Legal System and, especially,
       in the concurrent circumstances. As established in the Judgment of the
       Superior Court of Justice of Castilla y León de Burgos, nº 3/2017 of 13
       January (Rec. 80/2016): "It is precisely in this area that a
       extraordinarily clarifying role the motivation of the concrete act

       administrative sanction and to the extent that it will define not
       only the circumstances modifying the responsibility appreciated and
       proven but, in addition, the specific reason that the Administration understands that
       concurs to, within the margins granted by law, impose a specific
       sanction".


       It is for this reason that, by virtue of what is stated in these Claims,
       in the event that it is deemed that there are infringing conducts and consequent
       sanctions to be applied, be it by reducing as much as possible their
       economic amount, since given the concurrent circumstances, the
       total amount of 14,000 euros seems disproportionate and excessive (said

       be with due respect and in strict terms of defense. I ASK THE
       SPANISH DATA PROTECTION AGENCY: That, having
       presented this brief, please admit it and consider the allegations
       which are formulated therein. Granada for Madrid, on the date of signing
       electronics.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 30/60









                               PROVEN FACTS:

Of the actions carried out in this procedure and of the information and
documentation presented by the parties, the following have been accredited

facts:

First: To the claim document presented in this Agency on 12/21/21,
attached the following documentation relevant to this proceeding:

    - Copy of the document that A.A.A., collegiate ***COLEGIADO.1, sends to the

       claimant, on 08/30/21, where, among others, you can read:

           or "(...) The Governing Board of the College in its session held on
              April 2019 adopted, among others, the following agreement: "(AIG)
              04.11.19/08.- DESIGNATE THE *** POSITION. 1 OF THE OFFICIAL ASSOCIATION

              OF ARCHITECTS AS DELEGATE OF PROTECTION OF
              DATA FOR THE SCHOOL OF ARCHITECTS.” therefore i can
              inform you that, currently, the Data Protection Officer of the
              Official College of Architects of Granada is his *** POSITION. 1 D.
              B.B.B. (…)”.


    - Copy of the "Complaint Sheet" of the Official College of Architects of
       Granada where you can read, among others, the following information with
       Regarding the data protection policy:

           o Official College of Architects of Granada. Plaza de San Agustin No. 3,

              18001 Grenada. General Secretary . Area of Attention to the Collegiate and
              to user. The data collected will form part of the File of the
              COAGRANADA, being Responsible for ***POINT.1 of the same, to
              who will have to address in writing in the case of exercising the rights
              of access, opposition, rectification and cancellation, in accordance with the
              L.O.P.D.


    - Copy of the "Visa Application" addressed to the Dean of the Official College of
       Architects of Granada, where you can read, among others, the following
       Information regarding the data protection policy:

           o In accordance with the provisions of LO 15/1999 on Data Protection of

              Personal character, the existence of a file is reported
              automated whose purpose is the provision of the requested service. The
              Applicants expressly consent to the
              treatment and transfer of existing data in the automated file
              to the various Spanish Official Colleges of Architects and to other

              administrative bodies, for the purposes related to the function of
              visa. Signatories may exercise the right of access,
              rectification, opposition and cancellation in writing before the C.O.A. of
              Granada, with address at Plaza de San Agustín Nº 3, 18001 Granada,
              email coagranada@coagranada.org


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 31/60








Second: On 07/27/22, this Agency verified that in the
document "Member Complaints and Claims Sheet", accessible on the page
Web,


https://coagranada.es/wp-content/uploads/2021/02/
Sheet_complaint_reclamations_collegiate_V02.pdf,

that there was only the following legend referring to the data protection of
personal character:


       “Official College of Architects of Granada. Plaza de San Agustin No. 3, 18001
       Grenade. General Secretary. Area of Attention to the Collegiate and the User.

       The data collected will form part of the COAGRANADA File, being the

       Responsible for *** POSITION 1 of the same, to whom it will have to be addressed in writing
       in the case of exercising the rights of access, opposition, rectification and
       cancellation, in accordance with the L.O.P.D.”

It was also found that in the document "Complaints and Claims Sheet of
Consumers and Users”, accessible on the website,


https://coagranada.es/wp-content/uploads/2021/02/
Sheet_complaint_claims_consumers_V02.pdf

that only the following information related to data protection existed

of a personal nature:

       “Official College of Architects of Granada. Plaza de San Agustin No. 3, 18001
       Grenade. General Secretary. Area of Attention to the Collegiate and the User.


       The data collected will form part of the COAGRANADA File, being the
       Responsible for *** POSITION 1 of the same, to whom it will have to be addressed in writing
       in the case of exercising the rights of access, opposition, rectification and
       cancellation, in accordance with the L.O.P.D.”

On 04/10/23, this Agency accessed the complaint form and

complaints from the College of Architects of Granada, accessible through the link
https://coagranada.es/quejas-y-reclamaciones/ verifying that it
you can read the following message:

       Official College of Architects of Granada. Plaza de San Agustin Nº3, 18001

       Grenade. General Secretary. Area of Attention to the Collegiate and the User.

       In compliance with the provisions of EU Regulation 2016/679, of 27
       April 2016, hereinafter GDPR, the Official College of Architects of Granada
       with address at PLAZA DE SAN AGUSTÍN 3, 18001 GRANADA and NIF nº

       Q1875003D informs you that the collection and processing of your data through the
       The purpose of this form is the administrative, fiscal and
       accounting provided for in the legislation of professional associations and our
       statutes. Your data may be communicated to the General Council of Colleges

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 32/60








       Officials of Architects, related organizations and the Public Administration without
       prejudice to other assignments provided by law. Your data will be kept
       during the time necessary to comply with legal obligations. In

       You can consult additional information on this treatment at any time.
       or exercise the rights of access, rectification, deletion and opposition,
       portability and limitation of treatment by directing your request to the address above
       indicated or by email to protecciondedatos@coagranada.org. Also, in case
       If you consider your right to the protection of personal data violated, you may
       file a claim with the Spanish Data Protection Agency

       (www.agpd.es).

Third: About the "Cookies Policy" of the website https://www.coagranada.es/
It was initially found that a third-party cookie of an unauthorized nature was used.
excepted, without the prior consent of the web user. the circumstance is given

that this analytical cookie was installed through the insertion of a map
interactive of the Institute for Geoenvironmental Health of the "Vivo Sano" Foundation in the
page: https://coagranada.es/mapa-zonas-radon-en-elnuevo-cte-db-hs6/ .

On 04/10/23, this Agency accessed the website again
https://www.coagranada.es/ having knowledge of the following characteristics

regarding its “Cookies Policy”:

When entering the web for the first time, once the terminal equipment has been cleaned of the history of
navigation and cookies, without accepting new cookies or taking any action on
the web page, it has been verified that a single cookie "_GRECAPTCHA" is used,

whose purpose is to provide your risk analysis, such as detecting
erroneous and repeated connection attempts.

                           FUNDAMENTALS OF LAW


                                           YO.-
                                     Competence:

    - Regarding the processing of personal data and the "Privacy Policy":

The Director of the Spanish Agency is competent to resolve this procedure

of Data Protection, by virtue of the powers that article 58.2 of the GDPR recognizes
each Control Authority and, as established in arts. 47, 64.2 and 68.1 of the Law
LOPDGDD.

    - About the "Cookies Policy":


The Director of the Spanish Agency is competent to resolve this procedure
Data Protection, in accordance with the provisions of art. 43.1, paragraph
second, that of the LSSI Law.




                                           II
       Reply to the allegations presented to the resolution proposal

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 33/60









a).- Regarding the alleged conflicts of interest of the Data Protection Officer
(DPD) in the person of ***POSITION.1 of the Official College of Architects of Granada.


There is evidence that, in the session held by the Governing Board of the College of
Architects of Granada, on 04/11/19 the agreement was adopted to designate ***POSITION.1
of said Association as Delegate of Data Protection (PDP) and thus specified
expressly in the meeting minutes: "(...) Therefore, I can inform you that,
currently the Data Protection Delegate of the Official College of Architects of

Granada is his ***POST.1 D. B.B.B. (…)”.

According to the claimed party, the decision was made to appoint a new
Data Protection Delegate dated 04/26/22, and that was notified to the
Agency in response to the requirements of art. 38 of the GDPR.


In the allegations presented by the defendant entity, both in the initiation of the
file as in the motion for a resolution essentially defends that
There has never been any conflict of interest for the appointment of ***POSITION.1
as Delegate of Data Protection (DPD), in the College of Architects of
Grenade.


Well then, we must begin this section by indicating that, as indicated in
repeatedly this Agency, the greatest novelty presented by the GDPR is the
evolution of a model based, fundamentally, on the control of compliance with
current legislation to another that rests on the principle of active responsibility, which

that requires a prior assessment by the person in charge or by the person in charge of the treatment
of the risk that the processing of personal data could generate in order to
Based on said assessment, adopt the appropriate measures.

A fundamental role within the new model of active responsibility is

will perform the DPD. Also following on this point the Statement of Reasons for the
LPDGDD, "the figure of the DPD acquires outstanding importance in the GDPR and so
includes the Organic Law, which starts from the principle that it can have a
obligatory or voluntary, being or not integrated in the organization of the person in charge or
manager and be both a natural person and a legal person.


Section 4 of CHAPTER IV, of the GDPR -articles 37 to 39-, regulates
detailed figure of the DPD. In connection with the interpretation and application of these
precepts can refer to the guidelines contained in the document of the Group of the
Article 29 "Guidelines on Data Protection Delegates" -WP243-,
last revised and adopted on April 5, 2017.


This regulation is complemented by the provisions of CHAPTER III of the
TITLE V of the LOPDGDD-, whose articles 34 to 37 contain some
specialties directly applicable to our domestic law. Specifically, the
The appointment of the data protection officer is included in article 37 of the

GDPR, expanding in article 34 of the LOPDGDD the spectrum of subjects
bound to their appointment.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 34/60








From the foregoing it can be deduced that the requirement for the appointment of a DPD should not
interpreted, without further ado, as a mere formality, having to comply with the
requirements established in the applicable legal regulations. Consequently, it turns out

necessary to carry out a brief analysis of the functions and resources of which
dispose of the DPD. Thus, it must be based on the important functions that article 39.1 of the
GDPR assigns:

       "1. The data protection officer will have at least the following
       Functions: a) inform and advise the person in charge or the person in charge of the treatment

       and to the employees who deal with the treatment of the obligations that
       are incumbent under this Regulation and other provisions of
       data protection of the Union or of the Member States; b) supervise the
       compliance with the provisions of this Regulation, of other
       data protection provisions of the Union or of the Member States and

       of the policies of the person in charge or of the person in charge of the treatment regarding
       protection of personal data, including the assignment of responsibilities, the
       awareness and training of personnel involved in security operations
       treatment, and the corresponding audits; c) offer advice that
       asked about the impact assessment relating to the protection of
       data and supervise its application in accordance with article 35; d) cooperate

       with the control authority; e) act as a point of contact for the authority
       control for issues relating to treatment, including consultation prior to
       referred to in article 36, and consult, where appropriate, on any
       another matter." It is, therefore, functions of advice and
       supervision aimed at guaranteeing adequate compliance with regulations

       on protection of personal data, pointing out article 39.2 that "The
       data protection officer will carry out his functions providing the
       due attention to the risks associated with processing operations,
       taking into account the nature, scope, context and purposes of the
       treatment".


Likewise, article 38.1 clearly establishes that: "The person in charge and the person in charge of
of the treatment will guarantee that the data protection officer participates in an
adequately and in a timely manner in all matters relating to the protection of
personal information".


In addition to the important advisory functions assigned to the DPD,
including the cases in which it is necessary to carry out an impact assessment
because they are high-risk treatments, and specifying the functions of supervision,
Article 36 of the LOPDGDD provides that: "The delegate may inspect the
procedures related to the purpose of this organic law and issue

recommendations within the scope of its powers", that "In the exercise of its
functions the data protection officer will have access to personal data and
treatment processes, not being able to oppose to this access the person in charge or the
person in charge of the treatment the existence of any duty of confidentiality or
secrecy, including that provided for in article 5 of this organic law", and that, "When the

data protection delegate appreciates the existence of a relevant violation in
data protection matter will document it and notify it immediately to the
administrative and management bodies of the person in charge or the person in charge of the treatment”.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 35/60








On the other hand, article 39.1.e) of the GDPR also establishes as functions of the DPO
“Act as the contact point of the control authority for questions related to the
treatment, including the prior consultation referred to in article 36, and carry out

consultations, where appropriate, on any other matter.

For the proper fulfillment of these tasks, the GDPR requires certain requirements
of training of the DPD, and that it is endowed with the necessary resources. To the
training requirements, refers to article 37.5 GDPR, providing that "The
data protection officer will be appointed based on their qualities

professionals and, in particular, their specialized knowledge of Law and
data protection practice and its ability to perform the
functions indicated in article 39”. For its part, article 35 of the LOPDGDD
adds that "Fulfillment of the requirements established in article 37.5 of the
Regulation (EU) 2016/679 for the appointment of the data protection officer,

whether a natural or legal person, may be demonstrated, among other means, through
voluntary certification mechanisms that will take particular account of the
Obtaining a university degree certifying specialized knowledge in
data protection law and practice.

In order to the best interpretation and application of these precepts, you can go to

the guidelines contained in the document of the Group of Article 29 “Guidelines on the
Data Protection Delegates" -WP243-, last revised and adopted on
April 5, 2017, that, in relation to the knowledge and skills of the DPD,
note the following points:


    - Level of knowledge: The level of knowledge required is not defined
       strictly, but must be commensurate with the sensitivity, complexity, and quantity
       of the data that an organization processes. For example, when the activity of
       data processing is especially complex or when it involves a large
       amount of sensitive data, the DPO may need a higher level of

       knowledge and support. There is also a difference depending on whether the
       organization systematically transfers personal data outside the Union
       Union or if said 9 Legal Cabinet transfers are occasional.

       Thus, the DPO must be chosen carefully, taking due account of
       issues relating to data protection that arise in the organization.


    - Professional qualities: Indicate that, although article 37, section 5, does not
       specifies the professional qualities that must be taken into account when
       appointment of the DPO, an important factor is that he has knowledge
       on national and European protection legislation and practices

       of data and a deep understanding of the GDPR.

    - Ability to perform their duties: The DPO's ability to
       perform their functions must be interpreted both in reference to their
       personal qualities and knowledge as to his position within the

       organization.




C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 36/60








       Personal qualities should include, for example, integrity and a level
       high professional ethics; the primary concern of the DPD should be
       enable compliance with the GDPR.


       The DPD plays a key role in promoting a culture of
       data protection within the organization and contributes to the application of
       essential elements of the GDPR, such as the principles related to the treatment of
       data, the rights of the interested parties, the protection of the data from the
       design and by default, recording of processing activities, security

       of the treatment and the notification and communication of the violations of the
       data security.

       On the other hand, the need to provide the DPO with the necessary resources for the
       performance of their duties is included as an obligation of the person in charge

       in article 38.2 of the RGPD: "The person in charge and the person in charge of the treatment
       will support the data protection officer in the performance of the
       functions mentioned in article 39, providing the necessary resources
       for the performance of said functions and access to personal data and
       processing operations, and for the maintenance of their knowledge
       specialized”.


       In particular, the following aspects should be taken into account: · Active support
       to the work of the DPD by senior management (at the level of the board of
       administration). Sufficient time for the DPO to comply with its
       functions, which is particularly important when appointing a DPO

       internal part-time or when the external DPO carries out the protection of
       data in a complementary way to other obligations.

       Otherwise, conflicting priorities could lead to neglect of the
       DPO obligations. It is essential to have enough time to

       dedicate it to DPD tasks. It is good practice to establish a
       percentage of time for the DPD's own work when it is not carried out
       full time. It is also good practice to determine the time
       necessary to perform the work, the appropriate level of priority for the
       functions of the DPO and for the DPO (or organization) to write a plan of
       job. Adequate support in terms of financial resources, infrastructure

       (premises, facilities, equipment) and personnel, as required. ·

Therefore, what is essential is that DPDs meet the training and
independence that allow them to adequately develop the functions that the
GDPR assigns them, as Recital 97 of the GDPR recalls, "The level of

necessary specialized knowledge must be determined, in particular, according to
of the data processing operations carried out and the protection
required for personal data processed by the person in charge or in charge”.

In this way, and provided that its independence is adequately guaranteed, it

relevant is that the functions assigned to the DPD can be carried out effectively,
taking into account, equally, the criterion of availability, fundamental
to ensure that data subjects can easily contact the DPO (according to
to article 38.4 of the GDPR, "interested parties may contact the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 37/60








data protection officer for all matters relating to the
processing of your personal data and the exercise of your rights under the
this Regulation").


In conclusion, these functions can be carried out effectively if the following are met:
training requirements when proceeding with the appointment of the DPO and is endowed with the
necessary resources, including, as noted by the Article 29 Group, a DPO team
(a DPD and his staff), a team that must be proportional to the size and structure of the
organization, as well as the sensitivity, complexity and amount of data that

an organization deals with, and the availability of the DPO must be guaranteed so that
interested parties can contact him, as well as communicate with the authorities of
Data Protection.

Focusing now on the questions related to independence and the possible

conflicts of interest of the delegate, must comply with the legal norms that the
regulates the position of the delegate in his relations with the person in charge and/or with the
treatment manager. Thus, article 36 of the LOPDDD provides the following:

       "Position of the data protection officer" 1. The data protection officer
       data will act as interlocutor of the person in charge or in charge of the treatment

       before the Spanish Data Protection Agency and the authorities
       data protection regulations. The delegate may inspect the
       procedures related to the purpose of this organic law and issue
       recommendations within the scope of their competences. 2. When it comes to
       a natural person integrated into the organization of the person in charge or in charge

       of the treatment, the data protection officer may not be removed or
       sanctioned by the person in charge or in charge for carrying out their duties
       unless he incurred in willful intent or gross negligence in his exercise.

The independence of the data protection officer will be guaranteed within the

organization, avoiding any conflict of interest.” For his part, he
Article 38.3 of the GDPR, when regulating the position of the Data Protection delegate,
underlines their independence by pointing out that the person in charge and the person in charge of the
treatment will guarantee that the data protection officer does not receive any
instruction regarding the performance of said functions, and cannot be
dismissed or sanctioned by the person in charge or in charge of carrying out their

functions, and reporting directly to the highest hierarchical level of the
responsible or in charge.

In addition, according to the Article 29 Group document “Guidelines on the
Data Protection Delegates”, last revised and adopted on April 5

of 2017 -WP243-, their appointment must take into account the element
regarding the independence of the DPO. Thus, article 38.3 of the GDPR establishes some
basic guarantees for delegates to act independently within the
organization in which they provide their services, including that "they do not receive any
instruction relative to the exercise of their tasks”.


It is important to note that those bound to comply with the GDPR are responsible
or the person in charge of the treatment, so that, if they adopt decisions contrary to the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 38/60








rule and advice provided by the delegate, he must be given the possibility
to clearly express their dissatisfied opinion regarding said decisions.


The aforementioned article 38.3 also refers to the fact that the delegates of
data protection "should not be dismissed or penalized by the person in charge or the
entrusted with carrying out its functions", which supposes a reinforcement of its
autonomy and independence. Yes, you could be fired or sanctioned accordingly
with the applicable contractual, labor or criminal legislation of each country, for reasons
other than the performance of their duties.


In relation to the possible conflict of interest of the delegate, the guidelines on the
data protection delegates adopted by the Protection Working Group
Data of Article 29, -WP243-, state the following: “3.5. Conflict of interest The
Article 38(6) allows DPOs to “perform other functions and duties”.

However, it requires the organization to ensure that "such functions and
tasks do not give rise to a conflict of interest.

The absence of conflict of interest is closely linked to the requirement to act
independently. This assumes, in particular, that the DPO cannot occupy a
position in the organization that leads him to determine the purposes and means of the treatment of

personal information. On the other hand, although DPOs may have other functions,
They can only be entrusted with other tasks and tasks if these do not give rise to
conflicts of interest. Due to the specific organizational structure of each
organization, this should be considered on a case-by-case basis.


As a general rule, conflicting positions within an organization can
include senior management positions (such as CEO, Director of
operations, financial director, medical director, head of the department of
marketing, head of human resources or director of the IT department) but
also other lower positions in the organizational structure if such positions or positions

lead to the determination of the purposes and means of processing.

In addition, a conflict of interest may also arise, for example, if a
DPO representing the controller or processor in court
in cases related to data protection.


From the foregoing it can be deduced that, regardless of the formula adopted for their appointment,
the appointment of the data protection officer must meet the requirements
derived from the principle of independence in the development of its activity, and must
ensure that the performance of their functions and duties do not give rise to conflict
of interests. The provision of a data protection officer in organizations

public or private requires that the selection conform to the legal requirements
established and, in particular, that specialized knowledge in
law and practice of data protection indicated by the GDPR.

For the rest, the formula adopted for the appointment of DPD will depend on the

decision adopted by the entity in which he performs his duties, such as
consequence of its organizational autonomy. However, questions regarding the
autonomy of the organizations in which the delegates belong, clearly
derived from the regulations analyzed in this report, cannot be an obstacle to the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 39/60








necessary guarantee of the independence of the data protection officer - ex
article 38 GDPR- within the framework of internal and external legal relations that
maintain in the development of its functions.


Thus, in any case, it will be enforceable, as provided for in article 36 of the LOPDGDD,
that (i) in the case of a natural person integrated into the organization of the
responsible or in charge of the treatment, the data protection officer does not
may be removed or penalized by the person in charge or in charge of carrying out
their functions unless they were guilty of intent or gross negligence in their exercise, that (ii)

the independence of the data protection officer is guaranteed within the
organization, avoiding any conflict of interest, and that (iii) when the
data protection delegate appreciates the existence of a relevant violation in
data protection matters, document it and immediately notify the
administrative and management bodies of the person in charge or in charge of the treatment.


In short, although Section 4 of CHAPTER IV of the GDPR -articles 37 to 39-,
contemplates for DPOs wide possibilities regarding their appointment and
frame in the organization of the entities to which its designation refers, not
it is less true that said autonomy must be reconciled with the demands derived
of the principle of independence of the delegate, and it must be guaranteed that the exercise of

their duties do not give rise to situations of incompatibility or conflict of interest.

In the legal norms that regulate the figure of the data protection delegate, it is
configure the requirement of their independence as inherent to the performance of their
functions.


In the case at hand, the Governing Board of the College of Architects of
Grenada, in a session held on 04/11/19, adopted the agreement to designate the
*** POSITION 1 of said College as Data Protection Delegate (DPD), and thus
it is certified in the letter sent by the Association to the claimant on 08/30/21: "(...) Therefore,

Therefore, I can inform you that, currently, the Data Protection Delegate of the
Official College of Architects of Granada is his *** POSITION. 1 D. B.B.B. (…)”.

In the Order of February 20, 2018, which approves the modification of the
Statutes of the Official College of Architects of Granada establishes, in its article 13
and 14, the functions and composition of its Governing Board; in its article 15, the

functions of the Permanent Commission and in its article 17, the functions of the
*** POSITION 1 of the College.

As we have previously indicated, Section 4 of CHAPTER IV, of the GDPR -
articles 37 to 39-, regulates in detail the figure of the DPD and in relation to the

interpretation and application of these precepts, you can refer to the guidelines contained
in the document of the Group of Article 29 “Guidelines on the Delegates of
Data Protection" -WP243-, last revised and adopted on April 5,
2017: (https://ec.europa.eu/newsroom/article29/itemdetail.cfm?item_id=612048).


This regulation is complemented by the provisions of CHAPTER III of the
TITLE V of the LOPDGDD-, whose articles 34 to 37 contain some
specialties directly applicable to our domestic law. Thus, article 36


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 40/60








LOPDGDD guarantees the independence of the DPO within the organization, having to
avoid any conflict of interest.


For its part, article 38.3 of the GDPR, when regulating the position of the DPD, underlines its
independence by stating that the person in charge and the person in charge of the treatment
will ensure that the data protection officer does not receive any instructions in
regarding the performance of said functions, and cannot be dismissed or
sanctioned by the person in charge or the person in charge for carrying out their functions, and
reporting directly to the highest hierarchical level of the person in charge or

in charge.

In the specific case that he does not occupy, the functions as *** POSITION 1 of the College of
Architects of Granada that incur in a conflict of interest, are all those in
the one that carries out activities or advises as ***POSITION.1 on issues that may

be affected by the data protection of the members, personnel at the service of the
School or users of the same and also have to develop the functions of
a DPD.

If we look at the functions of *** POSITION 1 of the Official College of
Architects (article 17) that can be influenced by data protection, we

we find that it has powers to: 2. Provisionally resolve on the
admission of new members in accordance with the provisions of these
Particular Statutes. 3. Receive and process all requests and communications that
addressed to the College and its different Bodies, reporting them to whoever
corresponds. 4. Issue the certifications that are requested and must be issued and

keep the registration book of collegiate. 5. Annually formulate the lists of collegiate
in its different versions. These lists must be arranged annually in the
deadlines provided in these Particular Statutes for the purposes of elections. 6.
Make notifications of high and low college. 7. Keep the minute books of the
meetings of the General Assembly of collegiate, Governing Board and the Commission

Permanent and transfer the agreements, monitoring compliance with the
themselves.

Likewise, ***POSITION.1 is an ex officio member of the Governing Board, whose
functions (article 13.2), which may be affected by data protection, the
following: c) Resolve the applications for the incorporation of new members, of dismissals

collegiate and on the suspension of collegiate services and collegiate status.
e) Collect, distribute and manage the School's funds, in accordance with the provisions of
the Title on Economic and Patrimonial Regime of the present Statutes
individuals. k) Exercise the disciplinary function and adopt precautionary measures, initiating,
ex officio or by virtue of a complaint, the disciplinary proceedings, in which the

corresponding Resolution.

Also, as a member of the Permanent Commission of the Official College (article 15),
that it has as functions, which may be affected by data protection, the
following: 1. Put into practice the guidelines issued by the Governing Board. 2.

Propose to the Governing Board as many acts as a consequence of the
competences that it has assumed. 3. The adoption of the necessary measures
for the fulfillment of the agreements of the Governing Board. 4. Organize the
College office services.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 41/60









In greater abundance, it means that *** POSITION 1 of this official school forms
part of these two collegiate management and administration bodies, which determine

purposes and means of treatment, with voice and vote, in such a way that, in addition to their
advice, their will conforms to that of the collegiate body.

Therefore, taking into account the functions that, according to the GDPR, correspond to the DPD and the
functions that, according to the Order of February 20, 2018, which approves the
Modification of the Statutes of the Official College of Architects of Granada,

correspond to the Governing Board and the Permanent Commission of the Official College
of Architects of Granada, in addition to those of the position of ***POSITION.1, it is
the existence of a conflict of interest on the part of ***POSITION.1 of the
Official College of Architects of Granada to act as DPO of said Organism,
since it was appointed as DPD on 04/11/19 until 04/26/22 when it was adopted

the decision to replace him.

b).- Regarding the alleged lack of information in the forms on “complaints and
claims”, referring to the treatment of personal data obtained in the
themselves.


As could be verified by this Agency, on 07/27/22, when accessing the document
Refer to the "Member Complaints and Claims Sheet" through the link:

https://coagranada.es/wp-content/uploads/2021/02/Hoja_queja_reclamaciones_cole-
giados_V02.pdf


You can read, in the lower part of it, below the form, the following le-
yenda:

       “Official College of Architects of Granada. Plaza de San Agustin No. 3, 18001

       Grenade. General Secretary. Area of Attention to the Collegiate and the User.

       The data collected will form part of the COAGRANADA File, being the
       Responsible for *** POSITION 1 of the same, to whom it will have to be addressed in writing
       in the case of exercising the rights of access, opposition, rectification and cancellation
       celación, in accordance with the L.O.P.D.”


It was also possible to verify that same day, 07/27/22, that in the document "Hoja de
Complaints and Claims from Consumers and Users" accessible at the link:

https://coagranada.es/wp-content/uploads/2021/02/Hoja_queja_reclamaciones_consu-

midores_V02.pdf

there was the following legend:

       “Official College of Architects of Granada. Plaza de San Agustin No. 3, 18001

       Grenade. General Secretary. Area of Attention to the Collegiate and the User.

       The data collected will form part of the COAGRANADA File, being the
       Responsible for *** POSITION 1 of the same, to whom it will have to be addressed in writing

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 42/60








       in the case of exercising the rights of access, opposition, rectification and cancellation
       celación, in accordance with the L.O.P.D.”


In the brief of allegations to the initiation of the file, presented by the entity
claimed before this Agency on 09/29/22, it was indicated, among others, that: "(...) Regarding
to the sanction referred to for the violation of art. 13 GDPR, we must record
of the application of the proposed corrective measure and that all the information has been incorporated.
information referred to in art. 13 of the GDPR to the forms available to both
Collegiate as well as the general public, for which we request that you take into

account this measure under art. 83.2.c) of the GDPR (…)”.

In the verification carried out by this Agency after writing allegations of
the sheets of complaints and claims of the College of Architects of Granada, accessed
via the link https://coagranada.es/quejas-y-reclamaciones/, it was requested to read

The next message:

       Official College of Architects of Granada. Plaza de San Agustin Nº3, 18001
       Grenade. General Secretary. Area of Attention to the Collegiate and the User.

       In compliance with the provisions of EU Regulation 2016/679, of 27

       April 2016, hereinafter GDPR, the Official College of Architects of Granada
       with address at PLAZA DE SAN AGUSTÍN 3, 18001 GRANADA and NIF nº
       Q1875003D informs you that the collection and processing of your data through the
       The purpose of this form is the administrative, fiscal and con-
       table provided for in the legislation of professional associations and our statutes.

       Your data may be communicated to the General Council of Official Colleges
       of Architects, related organizations and the Public Administration without prejudice to
       other assignments provided by law. Your data will be kept during the
       time necessary to comply with legal obligations. At any mo-
       moment you can consult the additional information of this treatment or exercise

       the rights of access, rectification, deletion and opposition, portability and limitation
       treatment by directing your request to the address indicated above or by
       email to protecciondedatos@coagranada.org. Also, if you consider
       violated your right to the protection of personal data, you may file
       a claim before the Spanish Data Protection Agency (www.a-
       gpd.es).


Well, article 12.1 of the GDPR establishes, regarding the requirements that must be met
the information that the data controller must make available to the interested parties
resados, the following:


       "1. The person in charge of the treatment will take the appropriate measures to facilitate
       to the interested party all the information indicated in articles 13 and 14, as well as any
       any communication pursuant to articles 15 to 22 and 34 relating to the treatment
       information, in a concise, transparent, intelligible and easily accessible form, with a slow
       clear and simple language, in particular any information directed specifically-

       mind a child The information will be provided in writing or by other means,
       including, if applicable, by electronic means. When requested by the interested party,
       The information may be provided orally provided that identity is proven.
       of the interested party by other means (…)”.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 43/60









And for its part, article 13 of the GDPR, details the information that must be provided to the
interested when the data is collected directly from him, establishing the following:

next:

        "1. When personal data relating to him or her is obtained from an interested party, the
        responsible for the treatment, at the time they are obtained, will provide you with
        tare:


        a) the identity and contact details of the person in charge and, where appropriate, their re-
        presenter; b) the contact details of the data protection officer, in
        Their case; c) the purposes of the processing for which the personal data is intended and the
        legal basis of the treatment; d) when the treatment is based on article 6,
        paragraph 1, letter f), the legitimate interests of the controller or a third party; and)

        recipients or categories of recipients of personal data, in
        Their case; f) where appropriate, the intention of the person responsible for transferring personal data
        to a third country or international organization and the existence or absence of
        an adequacy decision by the Commission, or, in the case of transfers
        indicated in articles 46 or 47 or article 49, paragraph 1, second paragraph,
        reference to the adequate or appropriate guarantees and to the means to obtain

        a copy of these or the fact that they have been provided.

        2. In addition to the information mentioned in section 1, the person responsible for the
        treatment will provide the interested party, at the time the data is obtained,
        personal data, the following information necessary to guarantee treatment

        fair and transparent data management: a) the period during which the data will be kept;
        personal data or, when this is not possible, the criteria used to determine
        nar this term; b) the existence of the right to request the data controller
        access to personal data relating to the interested party, and its rectification
        tion or deletion, or the limitation of its treatment, or to oppose the treatment,

        as well as the right to data portability; c) when the treatment is-
        tea based on Article 6(1)(a) or Article 9(2)(2)
        a), the existence of the right to withdraw consent at any time,
        without this affecting the legality of the processing based on prior consent.
        he saw his withdrawal; d) the right to lodge a complaint with an authority
        of control; e) if the communication of personal data is a legal requirement or

        contractual, or a necessary requirement to sign a contract, and if the interested party
        is obliged to provide personal data and is informed of the possi-
        possible consequences of not providing such data; f) the existence of decisions
        automated, including profiling, referred to in article 22,
        paragraphs 1 and 4, and, at least in such cases, significant information about the

        applied logic, as well as the significance and intended consequences of that
        treatment for the interested party.

Therefore, it is evident that, at least since the claimant submits the brief
claim on 12/21/21 to 09/29/22, date on which the claimed party filed

the allegations to the initiation indicating having solved the observed deficiencies
given by this Agency, there is a violation of the provisions of the GDPR res-
regarding the information that must be provided to users when obtaining
of them your personal data, such as the identity and contact details of the person responsible.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 44/60








ble, the purposes of the processing for which the personal data is intended and the legal basis
of the treatment; the possible recipients or categories of recipients of the data
personal cough, if applicable; the period during which the personal data will be kept

or, when this is not possible, the criteria used to determine this term or the
right to file a claim with a control authority, for which
comply with the provisions of current regulations on data protection.

c).- About the Cookies Policy of the website https://www.coagranada.es/.


On 07/27/22, it was found that when entering the website of the College
Oficial de Arquitectos de Granada https://www.coagranada.es/ two were used
cookies "PHPSESSID" and another from Google, "_GRECAPTCHA".

According to Opinion 4/2012 of WP 194 on the exemption of the requirement of

cookie consent, the exemption applied to authentication cookies could
apply to others introduced specifically to strengthen the security of the service
requested, for example, those cookies whose purpose is to detect attempts
erroneous and repeated connection to a website or for protection of the information system
connection against abuses as in the case of “_GRECAPTCHA”.


However, after browsing the website, it was observed that cookies were installed
from third parties of a non-excepted nature, which were not reported in the policies. HE
It so happens that these analytical cookies are installed through the insertion
of an interactive map of the Institute for Geoenvironmental Health of the Vivo Foundation
Healthy on the page: https://coagranada.es/mapa-zonas-radon-en-elnuevo-cte-db-hs6/

.

In the subsequent checks carried out by this Agency, regarding the
"Cookies Policy" of the website https://www.coagranada.es/, on 04/10/23 the
last one on 05/03/23, it is observed that the web only uses the cookie

“_GRECAPTCHA”, established in order to provide its risk analysis against
the erroneous and repeated attempts to connect to the web.

In this sense, the GT29, in its Opinion 4/2012, interpreted that among the cookies
excepted would be the user input Cookies" (those used to
fill in forms, or as management of a shopping cart); cookies from

authentication or user identification (session); user security cookies
(those used to detect erroneous and repeated attempts to connect to a site
Web); media player session cookies; session cookies to balance
load; user interface customization cookies and some of
complement (plug-in) to exchange social content.


These cookies would be excluded from the scope of application of article 22.2 of the
LSSI, and, therefore, it would not be necessary to inform or obtain consent about your
use. On the contrary, it will be necessary to inform and obtain the prior consent of the
user before the use of any other type of cookies, both first and second

third party, session or persistent.

Therefore, the use of third-party cookies of a non-excepted nature,
during the time they were active, at least since 07/27/22, date of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 45/60








detection by this Agency of said cookies until 04/10/23, suppose for
part of the defendant, the commission of the infringement of article 22.2 of the LSSI.


Regarding the application of the principle of proportionality alleged by the entity
claimed, it must be indicated that it is not applicable because in the present case, the file
penalized for infraction of article 22.2 of the LSSI, it was only considered as
aggravating, the existence of intentionality, an expression interpreted as equivalent to
degree of guilt in accordance with the Judgment of the National Court of
11/12/07 relapse in Appeal no. 351/2006.


d).- On the possible application of article 77.2 of the LOPDGDD in the present case.

The art. 83.7 of the GDPR establishes that: "Without prejudice to the corrective powers of the
control authorities (…) each Member State may establish rules on whether

can, and to what extent, impose administrative fines on authorities and bodies
public establishments established in that Member State".

In application of the aforementioned article, article 77 LOPDGDD, on the regime applicable to
certain categories of controllers or processors, establishes,
on the regime applicable to the Entities that make up the Public Administration, which

following:

       "1. The regime established in this article will be applied to the treatments
       of those who are responsible or in charge: (...)


       g) Public law corporations when the purposes of the treatment
       related to the exercise of public law powers.

Before entering into its analysis, previously, it must be taken into account that the
Professional Associations, are corporations of Public Law, protected by the Law

and recognized by the State, with its own legal personality and full capacity to
the fulfillment of its purposes.

Despite qualifying as a Public Law corporation, it is necessary to have
present that it can also exercise functions of a legal-private nature,
depending on whether the College is acting in the exercise of public functions or, for the

contrary, in the exercise of private functions.

Before continuing, clarify the error by referring to Law 7/2006, of May 31,
when it should actually have been referred to as the head of the applicable regulations
to professional associations, to Law 2/1974, of February 13, on Associations

Professionals, although this Law was already referenced and included in the tag "(...) or
other regulations”.

Well, even though the Professional Associations are legal corporations
Public, protected by law and recognized by the State, with legal personality

own and full capacity for the fulfillment of its purposes (art. 1.1 Law 2/1974, of 13
February, of Professional Associations) have a mixed nature that implies that,
Indeed, the Colleges carry out public functions, but they also carry out
activities and provide services to their members under private law.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 46/60










It is true that the legal regime of these organizations is necessarily complex.

since it lacks uniformity and has to adapt to nature (public or
private) of the activity carried out by the College at all times. The functions
practices to be exercised by the Professional Associations are, essentially, the management of the
professional practice, which includes the exercise of sanctioning power and control
compliance with ethical standards. In the absence of such functions
public, it is not possible to speak properly of Colleges but of private associations

dedicated to the achievement of goals oriented to the exclusive benefit of their
members.


As we have already indicated in section a).- “Regarding the alleged conflicts of

interests of the Data Protection Officer (DPO) in the person of ***POSITION.1
of the Official College of Architects of Granada”, the functions of the *** POSITION.1
of the Official College of Architects (article 17) that can be affected by the
data protection, we find that it has powers to: 2. Resolve
provisionally about the admission of new members in accordance with
the provisions of these Particular Statutes. 3. Receive and process all requests and

communications addressed to the College and its different Bodies, giving an account of
them to whom it may concern. 4. Issue the certifications that are requested and must be
issued and keep the registration book of collegiate. 5. Formulate annually the lists of
collegiate in its different versions. These lists must be annually
arranged within the terms set forth in these Particular Statutes for the purposes of

elections. 6. Make notifications of college registrations and withdrawals. 7. Carry the books
of minutes of the meetings of the General Assembly of collegiate, Governing Board and
of the Permanent Commission and transfer the agreements, keeping track of the
compliance thereof.


Likewise, ***POSITION.1 is an ex officio member of the Governing Board, whose
functions (article 13.2), which may be affected by data protection, the
following: c) Resolve the applications for the incorporation of new members, of dismissals
collegiate and on the suspension of collegiate services and collegiate status.
e) Collect, distribute and manage the School's funds, in accordance with the provisions of
the Title on Economic and Patrimonial Regime of the present Statutes

individuals. k) Exercise the disciplinary function and adopt precautionary measures, initiating,
ex officio or by virtue of a complaint, the disciplinary proceedings, in which the
corresponding Resolution.

In greater abundance, it means that, in this specific case, the claim is

constrains "the privacy of the data of the members and therefore their rights", for
which goes beyond public functions.

Therefore, in the present case, the conflict of interest detected in the appointment
*** POSITION 1 of the College as Data Protection Delegate as we have already

set forth in section a).- “Regarding the alleged conflicts of interest of the Delegate
of Data Protection (DPD) in the person of *** POSITION 1 of the Official College of
Arquitectos de Granada", and the lack of information provided in the sheets of
claims of the College, on the treatment of personal data of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 47/60








private users, have no place in any of the public functions that
attributed by the regulations, so it would not be possible to apply in this case what is established in the
Article 77 of the LOPDGDD and on the "Cookies Policy", indicate that they are governed by the

LSSI, therefore art. 77 of the LOPDGDD.

e).- On the allegations presented regarding the Resolutions of this Agency
of May 24, 2021, Procedure No.: PS/00416/2020 and of May 11, 2021,
Procedure No.: PS/00347/2020


In the resolution of PS/00416/2020, the following can be read verbatim:

       "(...) It should be noted that the GDPR, without prejudice to what is established in its
       article 83, contemplates in its article 77 the possibility of resorting to the sanction of
       warning to correct the processing of personal data that is not

       conform to their forecasts, when those responsible or in charge
       listed in section 1 committed any of the offenses to which
       Articles 72 to 74 of this organic law refer (...).

However, as we have previously indicated, the conflict of interest detected
in the appointment of ***POSITION.1 of the Association as Delegate of Protection of

data, and the lack of information provided in the claims forms of the
Colegio, on the treatment of personal data of private users, not
have no place in any of the public functions attributed to them by the regulations, so
that it would not be possible to apply either, in this case what is established in article 77 of the
LOPDGDD.


d).- On the absence of determination of the type corresponding to the sanctions
proposals and lack of motivation to determine their amount,
alternatively and secondarily, invocation of the principle of proportionality.


Violations in the field of data protection are typified in the sections
4, 5 and 6 of article 83 of the GDPR. It is a classification by referral, admitted
fully by our Constitutional Court. In this sense, also article 71
of the LOPDGDD makes a reference to them by stating that "They constitute
offenses the acts and behaviors referred to in sections 4, 5 and 6 of the
Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to the

present organic law”.

In this sense, the Opinion of the Council of State of October 26, 2017 regarding
to the Draft Organic Law on Protection of Personal Data
provides that "The European Regulation does typify, even though it does so in a sense

generic, conduct constituting an infringement: in effect, sections 4, 5 and 6 of
its article 83 contains a catalog of infractions for violation of the precepts
of the European standard indicated in such sections.

The offenses established in articles 72, 73 and 74 of the LOPDGDD are only for

effects of the prescription, as stated in the beginning of each and every one of these
precepts. This need arose in our State since it does not exist in the GDPR
any reference to the statute of limitations relating to offences, given that this institute
legal is not specific to all EU Member States.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 48/60









We must start from the fact that the GDPR is a directly applicable legal norm, which has
been developed by the LOPDGDD, only in what the first allows. So

is clear and as regards the prescription in the explanatory statement of the
LOPDGDD when it states that "The categorization of offenses is introduced to
the sole purpose of determining the prescription periods, having the description of
the typical behaviors as the only object the enumeration of exemplary way of
some of the punishable acts that should be understood as included within the types
general established in the European standard. The organic law regulates the assumptions of

interruption of the prescription based on the constitutional requirement of the
knowledge of the facts that are imputed to the person”.
It results from the application and interpretation of the RGPD, and not from the LOPDGDD, which
determines the seriousness of an infringement based on a series of conditions
provided therein.


As we can see, the RGPD does not present a typification in
very serious, serious or minor infractions typical of the Spanish legal system, nor
neither can it be deduced from his diction that the violation of the precepts of the
article 83.4 of the GDPR correspond to minor infractions and the precepts of article
83.5 or article 83.6 of the GDPR correspond to serious infringements.


Thus, recital 148 speaks of serious infringements as opposed to minor ones
when it determines that, “In case of minor infraction, or if the fine that is likely to
were imposed would constitute a disproportionate burden on a natural person, in
place of sanction by means of a fine, a warning may be imposed. must not

However, special attention should be paid to the nature, severity and duration of the
infraction, to its intentional nature, to the measures taken to alleviate the damages and
damages suffered, the degree of responsibility or any previous infringement
pertinent, to the way in which the supervisory authority has learned of the
infringement, compliance with measures ordered against the person responsible or in charge,

adherence to codes of conduct and any other aggravating or
extenuating.".

For all these reasons, the seriousness of an infringement is determined for the purposes of the GDPR and
with the elements endowed by it.


Once again, we bring up the aforementioned Opinion of the Council of State, which
explains in great profusion: "On the other hand, the European Regulation does not distinguish,
when setting the amount of the sanctions, between very serious, serious and minor infractions,
as stated in the preamble to the Draft. Actually, the European standard
is limited to distinguishing, depending on the maximum quantitative limit of the fine to be imposed,

among some infractions that can be sanctioned "with administrative fines of 10
EUR 000 000 maximum or, in the case of a company, an amount
equivalent to a maximum of 2% of the total annual global business volume of the financial year
previous financial" (section 4 of article 83), and other infractions that can be
sanctioned "with administrative fines of a maximum of 20,000,000 EUR or,

in the case of a company, an amount equivalent to a maximum of 2% of the
overall annual total turnover of the previous financial year" (paragraphs 5 and 6
of article 83). From this distinction it can be deduced that, for the Law of the European Union,
the offenses typified in sections 5 and 6 of article 83 can reach

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 49/60








have the same and greater seriousness than those contemplated in section 4 of the
same article 83 of the European Regulation. The European standard is thus limited to
establish two categories of offenses based on their seriousness.


The limitation periods for infringements are not provided for in the
European Regulation and, therefore, there is a tacit but peaceful understanding that
Member States have the power to establish such terms. The
determination of such deadlines must be based, as is well known, on the
severity of the offence.


Well, the offenses provided for in section 4 of article 83, on the one hand, and in the
paragraphs 5 and 6 of article 83 of the European Regulation, on the other, have a different
maximum limit -10,00,000 euros or 2% of the business volume in the first case,
20,000,000 euros or 4% of the business volume in the second- but the same limit

minimum, which in both cases is 1 euro. The existence of such wide margins
quantitative indicates that the violations of article 83, whether those of section 4 are
those of sections 5 and 6, can be of very different entity and that, for this reason, do not
may have the same limitation period those offenses that, due to their
severity, are close to the upper quantitative limit than those other
that, due to their lightness, are closer to the lower quantitative limit.


In such circumstances, the setting of the limitation periods would not be resolved.
satisfactorily, applying to the infractions of the precepts mentioned in
sections 5 and 6 of article 83 a term longer than the infringements of the
precepts mentioned in section 4 of article 83, given that infringements

contemplated both precepts, in case of being light, they would require a period of
lower prescription.

From this point of view and with the sole purpose of establishing its limitation period,
A distinction has been made between "merely formal infringements" and "violations

substantial" of such precepts, considering the former as "violations
minor" with a limitation period of one year and the latter as "violations
serious" and "very serious" with prescription periods of two and three years
respectively. In the opinion of the Council of State, this classification of offences,
to the extent that it is carried out for the sole purpose of determining certain terms of
statute of limitations for offenses not provided for in the European Regulation, cannot

be understood contrary to the provisions of the European standard.

This classification is not, however, important in terms of the amount of the
fines. The determination of the amount of the fines to be imposed for the violation of
the precepts mentioned in sections 4, 5 and 6 of article 83 of the Regulation

In accordance with the European standard, it is the responsibility of the control authorities, of
according to the graduation criteria established in section 2 of this same
provision, among which is the "nature" or "seriousness" of the offence".

Within the quantitative limits established by the European Regulation, the

control authorities, according to the greater or less seriousness of the infringement,
They must fix the amount of the fines. Certainly, the margins available to the
control authorities are very large - from 1 euro to 10,000,000 euros per violation of
the precepts mentioned in section 4 of article 83 and from 1 euro to 20,000,000

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 50/60








euros for violation of the precepts mentioned in sections 5 and 6-, which
confers on such authorities a high degree of discretion, far superior to those
which is usual in countries of our legal tradition.


It is, in any case, the model desired by the European Regulation, hence the
distinction between minor, serious and very serious infractions contemplated in the
Draft may not have a consequence in determining the maximum amount
of minor infractions, and in any case the determination of their
amount made by the control authorities, according to the circumstances of the case

concretely, within the limits established in that regulation”.

Thus, the classification of offenses for the purposes of the prescription of
LOPDGDD does not have virtuality in terms of determining the severity of the
infringement for the purposes of the GDPR or with respect to the imposition of fines

corresponding”.

Well then, in the proposed resolution of this file, notified to the
concerned on 04/10/23, the facts that are considered
proven and their exact legal classification in the section "PROVEN FACTS" and in
the FD II in response to the allegations indicated the following:


In point a).- On the alleged conflicts of interest of the Delegate of
Data Protection (DPD) in the person of *** POSITION 1 of the Official College of
Architects from Granada.


The offense was determined:

       Therefore, taking into account the functions that, according to the GDPR, correspond to the
       DPD and the functions that, according to the Order of February 20, 2018, by which
       the modification of the Statutes of the Official College of Architects is approved

       of Granada, correspond to the Governing Board and the Permanent Commission
       of the Official College of Architects of Granada, in addition to those of the position
       of ***POINT.1, it is evident the existence of a conflict of interest for
       part of *** POSITION 1 of the Official College of Architects of Granada for
       act as DPO of said Organism, finding ourselves before the violation of the
       article 38.6) of the GDPR.


The person responsible and the proposed sanction were identified:

       “FIRST: That by the Director of the Spanish Agency for the Protection of
       Data is sanctioned to the OFFICIAL COLLEGE OF ARCHITECTS OF GRANADA,

       owner of the website, https://www.coagranada.es/, by:

       Violation of article 38.6 of the GDPR, due to the conflict of interest detected in
       the appointment of *** POSITION 1 of the College as Protection Delegate
       of data, with a penalty of 5,000 euros (five thousand euros) (...)


In accordance with the provisions of the GDPR, the amount of the fine was valued at 5,000 euros,
that is in the lower section of the possible sanctions, thus giving
compliance with the provisions of article 83.1 of the GDPR: "Each control authority

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 51/60








ensure that the imposition of administrative fines under this
article for the infringements of this Regulation indicated in sections 4, 5 and
6 are in each individual case, effective, proportionate and dissuasive.”


On the other hand, article 83.2 of the GDPR states that "administrative fines shall be
will impose, depending on the circumstances of each individual case, additionally
or substitute for the measures referred to in article 58, paragraph 2, letters a) to h) and
j). When deciding the imposition of an administrative fine and its amount in each case
will be duly taken into account:” (emphasis added).


That is, it provides for the assessment of the penalty as a whole, taking into account each and every
one of the concurrent circumstances in the specific case and that are
provided for in the aforementioned precept.


The jurisprudence pronounces itself along the same lines when it refers to the principle of
proportionality, "fundamental principle that beats and presides over the graduation process
of sanctions and implies, in legal terms, "its adequacy to the seriousness of the
fact constituting the infringement" as provided in article 29.3 of Law 40/2015,
of the Legal Regime of the Public Sector, given that any sanction must be determined in
consistency with the entity of the offense committed and according to a criterion of

proportionality in relation to the circumstances of the fact.” (Sentences of the
Supreme Court of December 3, 2008 (rec. 6602/2004) and April 12, 2012
(rec. 5149/2009) and Judgment of the National Court of May 5, 2021 (rec.
1437/2020), among others).


Thus, the Judgment of the Third Chamber of the Supreme Court, dated May 27,
2003 (rec. 3725/1999), indicates that "Proportionality, pertaining specifically to
to the scope of the sanction, constitutes one of the principles that govern the Law
Sanctioning administrative, and represents an instrument of control of the exercise of the
disciplinary power by the Administration within, even, the margins that, in

principle, indicates the applicable rule for such exercise. It is certainly a concept
difficult to determine a priori, but which tends to adjust the sanction, by establishing
its specific graduation within the indicated possible margins, to the severity of the
fact constituting the infringement, both in its aspect of unlawfulness and of
guilt, weighing as a whole the objective and subjective circumstances
that make up the budget of punishable fact (...)"


We can also cite for this purpose the Supreme Court Judgment 713/2019, of 29
of May (rec. 1857/2018): "We will begin by pointing out that the proportionality of the
sanctions implies that they come tempered to the particular gravity
of the fact in conjunction with the circumstances of a subjective nature (which refer to the

offender) and objective (which refer to the typical fact) being that in the field of law
administrative sanction in general and in the field of the stock market in
In particular, there are no dosimetry criteria similar to those included in the article
66 of the CP and that the modifying circumstances differ from those of the scope
penal. Let us remember that there is no room for automatic application, without any qualification of the

guiding principles of criminal law to the sanctioning administrative procedure
(S.TS 6-10-2003 Rec.772/1998).”



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 52/60








For this reason, Directives 04/2022 of the European Committee for Data Protection on the
calculation of administrative fines in accordance with the RGPD, in its version of 12
May 2022, submitted to public consultation, indicate that "As regards the

evaluation of these elements, increases or decreases in a fine do not
They can be previously determined through tables or percentages. It is reiterated that the
The actual quantification of the fine will depend on all the elements collected during the
research and other considerations also related to the experiences
of the supervisory authority regarding fines.”


In point b).- Regarding the alleged lack of information in the forms on “complaints
and claims”, referring to the treatment of personal data obtained in the
themselves.

The offense was determined:


       “From what is evident that the forms lacked the necessary information
       ria established in article 13 GDPR, such as, for example, the identity and
       contact details of the person in charge, the purposes of the treatment for which they are intended
       the personal data and the legal basis of the treatment; the possible recipients
       names or categories of recipients of personal data, if applicable; he

       period during which the personal data will be kept or, when it is not
       possible, the criteria used to determine this term or the right to pre-
       file a claim with a control authority, for which they failed to comply with the
       stipulated in the current regulations on data protection


The person responsible and the proposed sanction were identified:

       “FIRST: That by the Director of the Spanish Agency for the Protection of
       Data is sanctioned to the OFFICIAL COLLEGE OF ARCHITECTS OF GRANADA,
       owner of the website, https://www.coagranada.es/, by:


       (...) Violation of article 13 of the GDPR, due to the lack of information
       provided in the claims forms, on the treatment of the data
       obtained, (with a penalty of 8,000 euros) (...)

In accordance with the provisions of the GDPR, the amount of the fine was valued at 5,000 euros,

that is in the lower section of the possible sanctions, thus giving
compliance with the provisions of article 83.1 of the GDPR: "Each control authority
ensure that the imposition of administrative fines under this
article for the infringements of this Regulation indicated in sections 4, 5 and
6 are in each individual case, effective, proportionate and dissuasive.”


We reiterate the considerations set forth in the previous section in relation to
with the determination of the amount of the fine.

In point c).- On the treatment of personal data and the "Policy of

Privacy” of the web: https://www.coagranada.es/ whose owner is the Official College of
Granada architects:

The lack of infringement was determined:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 53/60









       "Therefore, in the present case, according to the evidence available
       At this time, it is considered that the management of personal data that
       makes the web page, https://www.coagranada.es/ does not contradict what
       stipulated in the RGPD regarding the consent in the treatment of the

       personal data and the information that must be provided to the interested party
       when your personal data is obtained from it.

In point d).- About the Cookies Policy of the website
https://www.coagranada.es/.


The offense is determined:

       "Therefore, the use of third-party cookies of a non-existent nature
       excepted, which are not reported in the policies and despite not having
       given the consent through the banner could suppose on the part of the

       claimed, the commission of the infringement of article 22.2 of the LSSI

The person responsible and the proposed sanction were identified:

       “FIRST: That by the Director of the Spanish Agency for the Protection of
       Data is sanctioned to the OFFICIAL COLLEGE OF ARCHITECTS OF GRANADA,

       owner of the website, https://www.coagranada.es/, by:

       (...) Violation of article 22.2 of the LSSI, regarding the use of cookies
       from third parties of a non-excepted nature, without the consent of the user, with
       a penalty of 1,000 euros (one thousand euros).


The fine to be imposed has been determined in application of the provisions determined
in the LSSI.

e).- On the allegations presented as a consequence of the filing in the
exp202101340 and the change of criteria in this file.


According to the claimed party, on 07/08/21, the claimant submitted a written
before this Agency, in the same sense as the present claim, indicating, among
others, that:

       "(...) Such is the lack of knowledge regarding PD on the part of this College,
       that according to these accredited by their statements, the *** POSITION.1 holds the

       title of DPD and Responsible for the processing of personal data at the same
       time. As evidenced by the text that accompanies the sheet of
       claims of this College, (...)"

Well then, this claim was filed by Resolution of the AEPD dated

of 11/11/21 in file E/08892/2021, indicating in it that:

       "(...) Once the reasons presented by the OFFICIAL SCHOOL OF
       ARCHITECTS OF GRANADA, who work in the file, it has been verified
       the lack of rational indications of the existence of an infringement in the field

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 54/60








       competence of the Spanish Data Protection Agency, not proceeding,
       consequently, the opening of a disciplinary procedure.


On 11/23/21, the claimant filed an appeal for reversal (RR/0731/21),
against the resolution issued by the Director of the Spanish Agency for the Protection of
Data, in which, among others, it indicated that "the AEPD should clarify whether the DPD and
the ***POINT.1 of COAG can be the same person”.

On 04/04/22, this Agency issued a resolution on the appeal of

replacement RR/0731/21, indicating in it, regarding the issue expressed
by the claimant, in relation to the duplication of charges, DPD and ***POSITION 1 of the
COAG, the following:

       "Regarding the appointment as data protection delegate in the same

       person who holds the position of ***POSITION.1 general, it should be noted that the
       appellant party cannot claim that in the appeal phase the
       recounts facts that it did not state in a previous procedural phase.

       The LPACAP provides in its article 118: "They will not be taken into account in the
       resolution of the appeals, facts, documents or allegations of the appellant,

       when having been able to provide them in the claims process, they have not
       made. Nor may the practice of evidence be requested when their lack of
       realization in the procedure in which the appealed decision was issued outside
       attributable to the interested party."


       This norm contains a rule that is nothing more than the positive concretion for
       the common administrative scope of the general principle that the Law does not cover the
       abuse of the right (article 7.2 of the Civil Code), in this case, the abuse of the
       procedural law. There is no doubt that this principle is intended to prevent
       that the processing of allegations and evidence of the procedures of

       application, as it would be if the interested parties could choose, at their discretion,
       the moment in which to present evidence and allegations, since this
       it would be contrary to an elementary procedural order.

       The claimed party has informed that the person designated as delegate of
       data protection possesses the competencies and has the knowledge

       required for the performance of said position, adding that they have the
       collaboration of external professionals who are experts in the matter”.

Therefore, there has not been a change in criteria of the administration, but rather, in the
exposed cases, the reason why they were archived was because there was no proof

sufficient for the imputation of an infraction. In fact, this is how it is stated in the
resolution of inadmissibility, that the principle of presumption of innocence is applied and that,
not having sufficient evidence of non-compliance, we proceed to archive the
claim. In the same sense, the resolution of the appeal of
reinstatement, particularly in relation to that breach, what it says is that in phase

of appeal cannot be taken into account facts other than those valued throughout
of the procedure. This does not prevent a new claim from being filed.
in which aspects can be accredited by the claimant that reveal the
existence of a violation.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 55/60









f).- About the Cookies Policy of the website https://www.coagranada.es/.


On 07/27/22, it was found that when entering the website of the College
Oficial de Arquitectos de Granada https://www.coagranada.es/ a cookie was installed
session ID PHPSESSID and another from Google, _GRECAPTCHA. The first is a cookie
technique and the second is used by websites developed with WordPress as the
which is the object of analysis, to protect web forms from spam and attacks
external.


According to Opinion 4/2012 of WP 194 on the exemption of the requirement of
cookie consent, the exemption applied to authentication cookies could
apply to others introduced specifically to strengthen the security of the service
requested, for example, those cookies whose purpose is to detect attempts

erroneous and repeated connection to a website or for protection of the information system
connection against abuses such as _GRECAPTCHA.

However, after browsing the website, it is observed that cookies are installed
from third parties of a non-excepted nature, which are not reported in the policies, to
despite not having given consent through the banner. the circumstance is given

that these analytical cookies are installed through the insertion of a map
interactive program of the Institute for Geoenvironmental Health of the Vivo Sano Foundation in the
page: https://coagranada.es/mapa-zonas-radon-en-elnuevo-cte-db-hs6/

Therefore, there was a clear violation of current regulations (LSSI) by not informing

the users of the web of the installation of third-party cookies of a non-
excepted.
                                          III.-
                       Violation committed and Sanction to be imposed


   Regarding the alleged conflicts of interest of the Data Protection Officer
 (DPD) in the person of ***POSITION.1 of the Official College of Architects of Granada.

In accordance with the available evidence, set forth in section a)
of DF II, it is considered that there is a violation of article 38.6) of the GDPR.


This infraction can be sanctioned with a fine of a maximum of €10,000,000 or,
in the case of a company, an amount equivalent to a maximum of 2% of the
total annual global business volume of the previous financial year, opting for the
of greater amount, in accordance with article 83.4.a) RGPD.


For its part, article 73.w) LOPDGDD, considers serious, for the purposes of prescription:

       “Not enabling the effective participation of the data protection officer in
       all matters relating to the protection of personal data, not
       support him or interfere in the performance of his duties”.


In accordance with the precepts indicated, for the purpose of setting the amount of the sanction to
imposed in the present case, it is considered appropriate to graduate the sanction according to
with the following aggravating criteria established in article 83.2 of the GDPR:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 56/60









    - The number of interested parties affected by the processing of their personal data
        (section a), bearing in mind the relationship that the College of Architects of

        Granada has with the registered members, the contracted personnel and with the
        users in general.

It is also considered that it is appropriate to graduate the sanction to be imposed in accordance with the
following aggravating criteria, established in article 76.2 of the LOPDGDD:


    - The linking of the activity of the offender with the performance of treatment of
        personal data, (section b), considering the level of implementation of the
        College in the community, in which personal data of
        Hundreds of people who access their services.


The balance of the circumstances contemplated in article 83.2 of the GDPR and 76.2
LOPDGDD, with respect to the offense committed by violating the provisions of the
Article 38.6 GDPR, allows a final penalty of 5,000 euros (five thousand euros) to be set.

On the other hand, it is not appropriate to require a corrective measure since the DPD of the
Official College of Architects of Granada in another person that is not the *** POSITION.1

of the same.
                                           IV.-
                        Violation committed and Sanction to be imposed

       Regarding the alleged lack of information in the forms on "complaints and

   claims”, referring to the treatment of personal data obtained in the
                                        themselves.

In accordance with the available evidence, set forth in section b)
of DF II, it is considered that there is a violation of article 13) of the GDPR


This infraction can be penalized as established in article 83.5.b) of the
GDPR, where it is established that:

       Violations of the following provisions will be penalized, according to
       with paragraph 2, with administrative fines of EUR 20,000,000 as

       maximum or, in the case of a company, an amount equivalent to 4%
       maximum of the overall annual total turnover of the financial year
       above, opting for the one with the highest amount: a) the rights of the interested parties
       pursuant to articles 12 to 22”.


In this sense, article 74.a) of the LOPDGDD, considers light, for the purposes of
prescription:

       "Breach of the principle of transparency of information or the right
       of information of the affected party for not providing all the information required by the

       articles 13 and 14 of Regulation (EU) 2016/679.”




C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 57/60








In accordance with the precepts indicated, for the purpose of setting the amount of the sanction to
imposed in the present case, it is considered appropriate to graduate the sanction according to
with the following aggravating criteria established in article 83.2 of the GDPR:


    - The number of interested parties affected by the processing of their personal data
        (section a), bearing in mind the relationship that the College of Architects of
        Granada has with the registered members, the contracted personnel and with the
        users in general.


It is also considered that it is appropriate to graduate the sanction to be imposed in accordance with the
following aggravating criteria, established in article 76.2 of the LOPDGDD:

    - The linking of the activity of the offender with the performance of treatment of
        personal data, (section b), considering the level of implementation of the

        College in the community, in which personal data of
        Hundreds of people who access their services.

The balance of the circumstances contemplated in article 83.5.b) of the GDPR, with
regarding the offense committed by violating the provisions of article 13 of the GDPR,
allows a final penalty of 8,000 euros (eight thousand euros) to be set.


On the other hand, it is not appropriate to require a corrective measure as the
Substitution of the information provided in the “complaints and claims” models
adjusting to the provisions of article 13 of the GDPR.


                                           V.-
                        Violation committed and Sanction to be imposed

      About the Cookies Policy of the website https://www.coagranada.es/.


Article 22.2 of the LSSI establishes that users must be provided with information
clear and complete information on the use of storage devices and
data recovery and, in particular, on the purposes of data processing.
This information must be provided in accordance with the provisions of the GDPR.

Therefore, when the use of a cookie entails a treatment that enables the

identification of the user, those responsible for the treatment must ensure the
compliance with the requirements established by the regulations on the protection of
data.

However, it is necessary to point out that they are exempted from compliance with the

obligations established in article 22.2 of the LSSI those necessary cookies
for the intercommunication of terminals and the network and those that provide a service
expressly requested by the user.

In this sense, the GT29, in its Opinion 4/2012, interpreted that among the cookies

excepted would be the user input Cookies" (those used to
fill in forms, or as management of a shopping cart); cookies from
authentication or user identification (session); user security cookies
(those used to detect erroneous and repeated attempts to connect to a site

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 58/60








Web); media player session cookies; session cookies to balance
load; user interface customization cookies and some of
complement (plug-in) to exchange social content.


These cookies would be excluded from the scope of application of article 22.2 of the
LSSI, and, therefore, it would not be necessary to inform or obtain consent about your
use. On the contrary, it will be necessary to inform and obtain the prior consent of the
user before the use of any other type of cookies, both first and second
third party, session or persistent.


In this case, when entering the web for the first time, without accepting cookies or making
no action on the page, it has been verified that cookies are not used that
They are not technical or necessary.


However, after browsing the website, it is observed that cookies are used
third parties of a non-excepted nature, which are not reported in the policies, despite
of not having given consent through the banner. The circumstance occurs that
These analytical cookies are installed through the insertion of an interactive map of the
Institute for Geoenvironmental Health of the Vivo Sano Foundation on the page:
https://coagranada.es/mapa-zonas-radon-en-elnuevo-cte-db-hs6/


Therefore, the use of third-party cookies of a non-excepted nature,
which are not reported in the policies and despite not having given consent
through the banner could suppose on the part of the defendant, the commission of the
infringement of article 22.2 of the LSSI, since it establishes that:


       “Service providers may use storage devices and
       recovery of data in terminal equipment of recipients, provided
       that they have given their consent after they have been
       provided clear and complete information on its use, in particular on

       the purposes of data processing, in accordance with the provisions of the Law
       Organic 15/1999, of December 13, on the protection of personal data
       staff.

       When technically possible and effective, the recipient's consent
       to accept the processing of the data may be facilitated through the use of the

       appropriate parameters of the browser or other applications.

       The foregoing will not prevent the possible storage or access of a technical nature
       for the sole purpose of carrying out the transmission of a communication over a network of
       electronic communications or, to the extent strictly

       necessary, for the provision of a service of the information society
       expressly requested by the addressee.

This infraction is typified as "mild" in article 38.4 g), of the aforementioned Law, which
considered as such: "Use data storage and recovery devices

when the information has not been provided or the consent of the
recipient of the service in the terms required by article 22.2.", and may be
sanctioned with a fine of up to €30,000, in accordance with article 39 of the aforementioned
LSSI.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 59/60









In accordance with said criteria, it is deemed appropriate to impose a penalty of 1,000
euros, (thousand euros), for the violation of article 22.2 of the LSSI, for the time that
maintained the use of non-excepted cookies without the prior consent of the
user


Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been accredited, the Director of the
Spanish Data Protection Agency

                                     RESOLVES:


FIRST: IMPOSE the OFFICIAL ASSOCIATION OF ARCHITECTS OF GRANADA, with
CIF.: Q1875003D, owner of the website, https://www.coagranada.es/, the following
sanctions:


    - For violation of article 38.6 of the GDPR, due to the conflict of interest
       detected in the appointment of ***POSITION.1 of the College as Delegate
       of Data Protection a sanction of 5,000 euros (five thousand euros).

    - For the infringement of article 13 of the GDPR, due to the lack of information
       provided in the claims forms, on the treatment of the data

       obtained, a penalty of 8,000 euros (eight thousand euros).

    - For the violation of article 22.2 of the LSSI, regarding the use of
       third-party cookies of a non-excepted nature, without the consent of the
       user, a penalty of 1,000 euros (one thousand euros).



Being the total sanction of 14,000 euros (fourteen thousand euros).

SECOND: NOTIFY this resolution to the OFFICIAL ASSOCIATION OF

ARCHITECTS OF GRANADA.

THIRD: Warn the penalized party that the sanction imposed must make it effective
once this resolution is enforceable, in accordance with the provisions of Article
Article 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure

Common of Public Administrations, within the voluntary payment period indicated in the
Article 68 of the General Collection Regulations, approved by Royal Decree
939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by depositing it in the restricted account No. ES00 0000 0000 0000
0000 0000, opened in the name of the Spanish Data Protection Agency in the
Banco CAIXABANK, S.A. or otherwise, it will proceed to its collection in

executive period.

Once the notification has been received and once executed, if the execution date is
between the 1st and 15th of each month, both inclusive, the term to make the payment
voluntary will be until the 20th day of the following or immediately following business month, and if
between the 16th and the last day of each month, both inclusive, the payment term

It will be until the 5th of the second following or immediately following business month.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 60/60









In accordance with the provisions of article 50 of the LOPDGDD, this

Resolution will be made public once the interested parties have been notified.

Against this resolution, which puts an end to the administrative procedure (article 48.6 of the
LOPDGDD), and in accordance with the provisions of articles 112 and 123 of the Law
39/2015, of October 1, of the Common Administrative Procedure of the

Public Administrations, interested parties may optionally file
appeal for reversal before the Director of the Spanish Agency for Data Protection
within a month from the day following notification of this
resolution or directly contentious-administrative appeal before the Chamber of
contentious-administrative of the National Court, in accordance with the provisions of the

article 25 and in section 5 of the fourth additional provision of Law 29/1998, of
July 13, regulating the Contentious-administrative Jurisdiction, within the period of
two months from the day following the notification of this act, according to what
provided for in article 46.1 of the aforementioned legal text.


Finally, it is noted that in accordance with the provisions of art. 90.3 a) of Law 39/2015,
of October 1, of the Common Administrative Procedure of the Administrations
Public, the firm resolution may be temporarily suspended in administrative proceedings if
The interested party declares his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through

writing addressed to the Spanish Data Protection Agency, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the
aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the
documentation proving the effective filing of the contentious appeal-

administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative proceedings within a period of two months from the day following the
Notification of this resolution would terminate the precautionary suspension.

Mar Spain Marti

Director of the Spanish Data Protection Agency.





















C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es