AEPD (Spain) - EXP202303754

AEPD - EXP202303754
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(a) GDPR Article 6(1)(b) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	25.06.2024
Fine:	180,000 EUR
Parties:	Mapre Inversión Socidedad de Valores, S.A.
National Case Number/Name:	EXP202303754
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	lm

The AEPD fined an investment company €180,000 because it lacked a legal basis when it transferred a data subject's funds without prior authorisation, as required by the contract, or another form of valid consent. The controller was ultimately fined of €180,000.

English Summary

Facts

A data subject and his spouse were clients of Mapre Inversión Socidedad de Valores, S.A. (the controller), an investment securities company. The data subject entered into an asset management contract with the controller which authorised it do manage his funds and carry out investment operations on his behalf. The contract required express authorisation by both parties prior to all investment operations. Since contracting with the controller, the data subject always opted for an electronic channel authorising transactions with his passwords and electronic signatures.

However, on 2 June 2021, the controller executed various transfer orders of the data subject’s funds, initiating six investment operations, without the data subject’s prior authorisation or consent. The data subject contacted the controller concerning the transfers, which acknowledged the irregularity and stated that there had been malpractice on the part of an agent. The controller offered to compensate economic damage and return the data subject’s account to its prior status. The controller did not respond to the data subject’s questions concerning how the issue occurred (such as whether his signatures were forged).

The data subject subsequently filed a complaint with the Spanish DPA (AEPD). In response to the complaint, the controller stated that it received several orders for investment operations on 2 June 2021 from the data subject. The controller claimed instead of using the electronic channel, the data subject had requested a paper signature system, so an agent used their own employee PIN authorisation system via the controller’s application to record the data subject’s request on paper. The controller argued that in this case, the representative was entitled to electronically order the transfer of funds with their own passwords and electronic signature and subsequently obtain the ratification of the data subject. However, the data subject did not ratify the request. Due to this absence of ratification, the controller sent the data subject a communication offering the possibility of revoking the transactions and being compensated. The data subject did not respond to this communication. The controller did not provide evidence that the data subject had initiated the transactions. In order to mitigate discrepancies that could occur in written signatures, the controller stated that it adopted corrective measures as recommended by its DPO.

On 31 May 2023, the AEPD resolved to archive the claim because it lacked sufficient evidence to find an infringement of the GDPR. The data subject appealed the resolution and clarified that the June investment orders were not authorised by the data subject’s PIN or signature, but rather by the agent’s own account and PIN. The AEPD reopened the investigation pursuant to the appeal.

Holding

The AEPD found that the controller lacked a legal basis and imposed a fine of of €180,000 on the controller.

Despite the contractual relationship between the parties, the AEPD found that Article 6(1)(b) GDPR did not provide a legal basis for the processing because it was not necessary for the execution of the contract. According to the contract, fund transfer operations require prior consent, not subsequent ratification. The AEPD rejected the controller’s argument that the agent was entitled to electronically order the transfer of funds and obtain subsequent ratification from the data subject. Given the agent’s failure to obtain the data subject’s consent prior to the transaction in accordance with the contract, the controller lacked a legal basis for the processing pursuant to Article 6(1)(b) GDPR. In addition, since there was no evidence that consent was obtained from the data subject in any case, Article 6(1)(a) GDPR also did not provide a legal basis.

The AEPD recommended a sanction of €300,000. Pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €180,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/23








     File No.: EXP202303754



       RESOLUTION OF TERMINATION OF THE PAYMENT PROCEDURE
                                   VOLUNTEER

From the procedure instructed by the Spanish Data Protection Agency and based
to the following



                                 BACKGROUND

FIRST: On May 31, 2024, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning proceedings against MAPFRE

INVERSIÓN SOCIEDAD DE VALORES, S.A (hereinafter, the claimed party),
through the Agreement transcribed:

<<


File No.: EXP202303754
Sanctioning Procedure No.: PS/00236/2024

           AGREEMENT TO START SANCTIONING PROCEDURE


Of the actions carried out by the Spanish Data Protection Agency and in
based on the following

                                     FACTS

FIRST: A.A.A. (hereinafter, the claiming party) dated July 4, 2023

filed a claim with the Spanish Data Protection Agency. The
claim is directed against MAPFRE INVERSIÓN SOCIEDAD DE VALORES, S.A
with NIF A79227021 (hereinafter, the claimed party/MAPRE INVERSIONES). The
The reasons on which the claim is based are the following:


- That he is a client, together with his wife (B.B.B.), of the MAPFRE entity
    INVERSIONES, with which a wealth management contract was signed that
    enabled the claimed entity to manage the funds that had been
    deposited, and carry out investment operations with them, always prior to
    express authorization of both, by handwritten or electronic signature.

- States that, however, on June 2, 2021, the claimed party
    executed several orders to transfer the deposited capital, acquiring six funds
    investment, without their authorization, not knowing the method that was used to
    impersonate your signature and consent.
- That it was the claimant who became aware of the 6 investment operations at
    casually consult the MAPFRE INVERSIONES APP that is used to

    the contracted investment management.
- In view of what happened, the claimant contacted the claimed party and stated
    that it recognized its irregular actions, sending the complaining party
    receipts of the controversial transfers, and stating in an email

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/23








    email of 11-26-21 that there had been "malpractice on the part of the
    representative of the claimed party”, offering to "remake the original situation
    before executing the controversial operations, compensating for possible damage
    economic valuation".
- That the claim remains unanswered regarding the questions raised by the

    claimant regarding the means according to which those
    instructions, not knowing if their signatures were supplanted, or if there was a use
    fraudulent Logalty certificate (mechanism used for electronic signature
    of said operations), since up to now it has not provided the
    signature and consent documents for said operations.


Along with the claim, provide:

- Document 1. Screenshots of 12 transfer orders among which
    find the 6 controversial investment orders.
- Document 2. The receipts of said transfers provided by the defendant.

- Document 3. List of movements in the account portfolio obtained to date
    from 15-6-21.
- Document 4. Tax information corresponding to the 2021 financial year of the portfolio that
    work in the MAPFRE APP.
- Document 5. Copy of the email messages exchanged between the
    complaining and claimed party, in which the former requests explanations and is

    responds that they have forwarded the matter to the corresponding department and that
    is pending resolution. Specifically, emails from 17 of
    June, June 18, June 23, June 25, September 3, and September 6
    2021, exchanged between the claimant and the director of Mapfre Gestión
    Patrimonial.
- Document 6. Writing presented by the claimant's lawyer before MAPFRE on the 15th

    November 2021.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party, to
to proceed with its analysis and inform this Agency within a period of one month, of the

actions carried out to adapt to the requirements provided for in the regulations of
Data Protection.

The transfer, which was carried out in accordance with the rules established in Law 39/2015, of
October 1, of the Common Administrative Procedure of Administrations
Public (hereinafter, LPACAP), was collected on April 4, 2023, as

It appears in the acknowledgment of receipt that is in the file.

FOURTH: On May 4, 2023, this Agency received a letter from
response from the respondent indicating that:


- The defendant signed with the claimant and Mrs. B.B.B. a framework contract
    financial products and services dated January 28, 2018.

- On 2-6-21 the agent who acted as representative of MAPFRE INVERSIONES
    (C.C.C., hereinafter, the representative of Mapfre) received several orders of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/23








    investment operations formulated by the claimant, and “following the
    order execution procedure that was implemented as of 2-6-21
    in the entity, the representative of MAPFRE INVERSIÓN chose to use the

    paper signature system. In this context, the representative introduced in the
    Mapfre Inversión application your professional mobile phone on which you received the
    PIN code, which allowed him to sign the orders given by D through LOGALTY.
    A.A.A., so that they could be ratified by the client through their handwritten signature
    on paper".



- The claimant states that, for unknown reasons, despite having
    ordered such operations, the claimant later refused to ratify the
    operations that he had ordered by means of his handwritten signature.



- After several attempts at a solution, the defendant sent a communication to the
    claimant on 11-26-21 in which he was offered the possibility of revoking the orders
    and compensate him for the damages, without the claimant answering in this regard.


- That he has learned that the claimant has proceeded to reimburse

    the funds acquired between June 11 and 15, 2021, “so that the
    result of the operations was assumed by the claimant, depriving Mapfre of
    the possibility of acting in any sense with respect to them.”


- In order to mitigate discrepancies that arise in signing procedures

    on paper, the defendant has adopted the corrective measures that have been
    recommended by your Personal Data Protection Officer, dated
    July 15, 2021.



- That the controversy concerns the existing discrepancies regarding the form and
    compliance with the framework contract signed with the appellants, for the resolution of which
    There are other ways, and there is no non-compliance in the treatment of the
    protection of personal data of the appellants that is the responsibility of this
    Agency.


The following documentation is attached:

- Document 1. Framework contract for financial products and services signed between the
    claimant and the claimed entity and acceptance document and signatures of 28
    January 2018.

- Document 2. Email sent by the defendant to the claimant on December 26
    November 2021, where it refers to the “malpractice” of the representative
    that executed the 6 investment orders.
- Document 3. Report corrective measures implemented by the defendant.


THIRD: On May 31, 2023, after analyzing the documentation that
appeared in the file, a resolution was issued by the Director of the Spanish Agency
of Data Protection, agreeing to file the claim for not attending the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/23








said moment sufficient probative elements of the occurrence of an infraction
that could undermine the principle of presumption of innocence. The resolution was
notified to the appellant, on June 9, 2023, as proven

on the record.

FIFTH: On July 4, 2023, the claimant and the joint owner of the aforementioned
contract of which the relationship between the defendant and the claimant arises, they file a
optional appeal for replacement through the Electronic Registry of the AEPD, against
the resolution fell in file EXP202303754, in which it shows its

disagreement with the contested resolution and requests that the processing of the
initial claim filed.

On February 16, 2024, the appeal filed was sent to the claimed party.
within the framework of the provisions of article 118.1 of Law 39/2015, of October 1,

of the Common Administrative Procedure of Public Administrations (in
hereinafter, LPACAP) for the purposes of formulating the allegations and presenting the
documents and supporting documents that it deems appropriate.

After the request and granting of an extension of the deadline to make allegations against the
appeal filed, the defendant presented a response document dated March 1

from 2024, in which:

- Considers reproduced the allegations contained in his previous writing, insisting
    in which the controversy raised must be resolved by other instances or means,
    because it is not the material responsibility of this Agency.

- Clarifies that the keys were not used in any case to organize the investments
    and Pin of the appellants nor the signature that appears for them on the Logalty certificate, but
    that the agent who carried them out used his own account and user passwords.
- Adds that a meeting was held with the appellant on 6/21/21 in which he
    refused to sign the ratification or revocation of the investment orders, even though

    was offered this alternative, so there is no documentation of
    ratification of signature of these operations by the appellants.
- The representation contract signed by Mapfre Inversiones with the
    agent who was in charge of executing these investment operations as
    Document 1.


In view of the allegations and documentation provided by the appellant and
appealed, on May 10, 2024, a Resolution is issued by the
Director of the Spanish Data Protection Agency, in which the
appeal and the admission of the claim for processing is agreed, since by not
the ratification of the investment operations by the appellants has been proven,

There are indications of a possible lack of legitimacy of the entity claimed to
process the personal data of the claimants when carrying out the 6 operations of
controversial investment.

FOURTH: According to the report collected from the AXESOR tool, the entity

MAPFRE INVERSIÓN SOCIEDAD DE VALORES, S.A of May 27, 2024, is a
large company established in 1989, and with a turnover of
€52,959,024 in 2022.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/23








                           FOUNDATIONS OF LAW

                                           Yo

                             Competence and procedure

In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on Protection of Personal Data and

guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures

processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."

                                           II

                                  Previous issues

The name, surname, NIF and account numbers of the claimant and his wife, who
appear in the 6 capital transfer orders and acquisition of investment funds
which were carried out by the defendant charged to the account contracted by both,

are considered personal data, the processing of which is subject to the regime provided for in the
RGPD, as well as its development provisions, in accordance with the provisions of the
article 4.1, and 4.2 of the GDPR, which provides the following:

    “Article 4 Definitions


    For the purposes of this Regulation it will be understood as:


    1) "personal data": any information about an identified natural person or

    identifiable ("the interested party"); Any identifiable natural person will be considered
    person whose identity can be determined, directly or indirectly, in
    particular by means of an identifier, such as a name, a telephone number,

    identification, location data, an online identifier or one or more
    elements of physical, physiological, genetic, psychological identity,
    economic, cultural or social of said person;



    2) "treatment": any operation or set of operations performed on
    personal data or sets of personal data, whether by procedures

    automated or not, such as the collection, registration, organization, structuring,
    conservation, adaptation or modification, extraction, consultation, use,
    communication by transmission, broadcast or any other form of enabling

    access, collation or interconnection, limitation, deletion or destruction;(…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/23








In the present case, in accordance with the provisions of article 4.1 of the RGPD, there is
that the claimed entity has processed personal data when executing
on behalf of the claimant and his wife 6 fund transfer operations for

capital acquisition obtained from the “LOW DURAT EURO COVER” investment fund
BC AC EUR” (hereinafter, investment funds) dated June 2, 2021, with
charge to the cash account that they contracted with MAPFRE INVERSIONES in the
year 2018.

Fund transfer orders that have been provided as Document 2 of the

claim, and that have been made by the agent/representative (C.C.C.) of the
claimed entity.

The claimed party provides two contracts:


- Framework Contract for financial services and products dated January 28, 2018
    signed between MAPFRE INVERSIONE (the entity) and the claimant and his wife
    (CLIENTS), which was provided as Document 1 of the response letter to the
    transfer (hereinafter, Framework Contract).

- Representation Contract signed between MAPFRE INVERSIONES and the

    representative C.C.C. (referred to as Agent, or C.C.C.) dated June 28,
    2019 (hereinafter, Representation Contract).

In view of the documentation provided by both parties, there is no doubt that
that the aforementioned transfer or investment orders made by the agent of the

claimed were personal data processing operations, in the sense
provided for in article 4.2 of the RGPD, since they involved access to the accounts
of the claimant and his wife and the use of the personal data that they
they contained.


Thus, as the claiming party proves when providing the transfer receipts
of funds made by the agent of the defendant to acquire these 6 investments,
It can be seen that they appear: two account numbers that are
ownership of the claimant and his wife, who appear with their name, surname and NIF.

The claim is raised in the documents presented dated May 4, 2023 and

March 1, 2024 the existence of a possible lack of material competence of this
Agency to hear the facts prosecuted, which, according to the claimant, relate
on the discrepancies between the parties regarding the execution of the contract
signed that corresponds to resolving other instances or bodies, and not on the
breach of personal data protection regulations.


However, it is worth clarifying that the aforementioned transfer/investment orders - whose
validity and legal effects corresponds to determining other bodies or instances, such as
points out the claimed - necessarily entailed for its realization the execution of
personal data processing operations to which reference has been made, which

are subject to certain requirements provided for in the regulations for the protection of
data by the person responsible for the treatment, the failure of which could lead to
an administrative offense typified therein, whose sanctioning power is
competence of this Agency.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/23









In this sense, the doctrine established by the Court of Appeals is applicable to this case.
Contentious-Administrative of the National Court, is reflected, among others, in the SAN

of October 17, 2007, or in the SAN of July 3, 2007 (rec.232/2005), whose
Second Law Foundation says:

    “The appellant begins the defense of his claim alleging incompetence
    of the Data Protection Agency since the controversy concerns the
    existence or not of a certain contract and this question is of a nature

    essentially civil and, consequently, removed from its jurisdiction, according to
    art. 37 of the LOPD. Actually the Director of the Protection Agency
    of Data has not resolved on the origin or inadmissibility of the debt, but rather
    that its resolution focuses on considering certain precepts of
    the LOPD, binding as a consequence to said infractions the imposition of

    a sanction. It is enough to read the operative part of the contested resolution to
    confirm what has just been stated. And without a doubt he is fully competent to
    dictate this resolution. Another thing is that to exercise its competence it must
    carry out factual or legal assessments whose nature we could classify as
    preliminary ruling, and on which it could not adopt a final decision with effective
    against third parties. If the principle of quality of the data collected in the LOPD requires

    that the data processed by a third party referring to a person are accurate and
    truthful, the Administration specifically in charge of enforcing this
    regulations, for the sole purpose of considering this principle fulfilled or violated
    can make an assessment of the accuracy and veracity of a certain piece of information, in
    this case of the certainty of a debt, without this meaning a departure from

    their rules of competence. This ground of challenge must be rejected.”

The claimed entity is responsible for the processing of personal data
carried out in the present case, in accordance with the provisions of article 4.7 of the
GDPR, which provides the following:


    7) "responsible for the treatment" or "responsible": the natural or legal person,
    public authority, service or other body that, alone or together with others, determines
    the purposes and means of the processing; whether the law of the Union or of the States

    members determines the purposes and means of the processing, the person responsible for the
    treatment or the specific criteria for its appointment may be established by
    the law of the Union or of the Member States (…)”


In the present case, the defendant states that she hired a representative or
agent who was in charge of carrying out the aforementioned operations on his behalf. Of the
content of the Representation Contract signed with the claimant is deduced without

There is no doubt that the person responsible for the processing of the personal data managed
its agent is MAPFRE INVERSIONES.

Thus, from the “Annex for processing personal data” attached to the
Representation Contract, it follows that it is the entity (MAPFRE INVERSIONES)
It establishes the means and purposes of the processing of personal data managed by the

agent. And in Clause 10.5 thereof, it is indicated that the entity will be responsible for
the actions of the representative without prejudice to his right to initiate actions against
this in case of deviating from what was agreed.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/23









Consequently, if it is confirmed during the investigation that a
improper processing (unlawful in accordance with the provisions of article 6.1 of the GDPR) of

the personal data contained in the account contracted by the claimant and its
wife, MAPFRE INVERSIONES will be the presumed responsible person who will be required to
administrative responsibility for the alleged non-compliance committed,
in accordance with the provisions of article 70. 1 a) of Organic Law 3/2018, of 5
December, protection of personal data and guarantee of digital rights (in
forward, LOPPDD):


    “Article 70. Responsible subjects.

    1. They are subject to the sanctioning regime established in the Regulation (EU)
        2016/679 and in this organic law: a) Those responsible for the

        treatments. b) Those in charge of the treatments. c) The representatives of
        those responsible or in charge of the treatments not established in the
        territory of the European Union. d) Certification entities. e) The
        accredited entities overseeing codes of conduct. (…)”.

                                          III.

              Offending conduct: lack of basis for legality of the treatment.

The processing of personal data of natural persons by those responsible
must be governed by the principles related to article 5 of the RGPD, among which
which is the Principle of legality and transparency provided for in the first section

of the same, which has:

   "1. The personal data will be:
   a) treated in a lawful, fair and transparent manner in relation to the interested party
   ("legality, loyalty and transparency"); […]”


Furthermore, article 5.2 of the GDPR indicates that: “The data controller will be
responsible for compliance with the provisions of section 1 and capable of
prove it.”

In development of this principle, article 6 of the RGPD related to the “Legitimacy of the

treatment” determines in section 1 the cases in which the regulations allow
carry out the processing of personal data of a third party, which is called
“legal basis”. If any of these assumptions or conditions do not occur, the
processing will not be legitimate, or considered lawful by the RGPD:


    "1. The treatment will only be legal if it meets at least one of the following
    conditions:

    a) the interested party gave his consent for the processing of his personal data
    for one or more specific purposes;

    b) the processing is necessary for the performance of a contract in which the
    interested party is part or for the application at his request of measures
    pre-contractual;


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/23








    c) the processing is necessary for compliance with a legal obligation
    applicable to the data controller;
    d) the processing is necessary to protect vital interests of the interested party or of
    another natural person.
    e) the processing is necessary for the fulfillment of a mission carried out in

    public interest or in the exercise of public powers conferred on the person responsible for the
    treatment;
    f) the processing is necessary for the satisfaction of legitimate interests
    pursued by the person responsible for the treatment or by a third party, provided that
    The interests or rights and freedoms do not prevail over said interests.
    fundamentals of the interested party that require the protection of personal data, in

    particularly when the interested party is a child.
    The provisions of letter f) of the first paragraph will not apply to the treatment
    carried out by public authorities in the exercise of their functions.”

This means that it is a mandatory requirement in terms of data protection that the

claimed entity has one of these bases of legality to be able to carry out the
personal data processing operations that derive from the 6
fund transfer and investment operations referred to in this
proceedings.

In principle, given the existence of a contractual relationship between the claimant and

claimed through the subscription of the Framework Contract to which reference has been made
In the previous legal basis, it is worth analyzing whether such operations of
processing of personal data could have its legal basis in the intended cause
in article 6.1.b) of the RGPD: “b) the processing is necessary for the execution of a
contract to which the interested party is a party or for the application at his request of
pre-contractual measures”.


Regarding whether the treatment in question was necessary for the execution of the Contract
Framework signed by the defendant and claimant, the claimant maintains, in
synthesis, that:

- In accordance with the contract, fund transfer operations (operations

    investment) require your prior consent (and not subsequent ratification)
    expressed through an electronic or handwritten signature, and that since
    contracted in 2018 with the claimed party has always signed electronically
    all transfer orders for investment through its APP,
    using your passwords and electronic signature.
- That upon consulting the aforementioned APP, he realized that the agent of the defendant had

    executed the 6 transfer orders without previously obtaining their signature.
- Denies that, as the entity says, the claimant or his wife requested execution
    of these investments prior to the execution of the transfer orders.
- That the defendant proposed to ratify said orders, which he refused.
- That in an email dated November 26, 2021, the defendant

    recognized that there had been malpractice on the part of the agent, and offered to ratify the
    transfer orders or revoke them at his option, but did not indicate how it was possible
    that he had accessed his account without having his passwords, username and
    password. Email that has been provided to this procedure.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/23








For its part, the defendant points out, in essence, the following relevant arguments
To determine whether there was a legal basis in the present case:

- Regarding the process of executing the orders: “On 2-6-21 the agent who
    acting as a representative of MAPFRE INVERSIONES (C.C.C.) received several

    investment operation orders formulated by the claimant”, and “following
    the procedure for executing orders that as of 2-6-21 was
    implemented in the entity, the representative of MAPFRE INVERSIÓN opted to
    use the paper signature system. In this context, the representative introduced
    in the Mapfre Inversión application your professional mobile phone on which you received
    the PIN code, which allowed him to sign through LOGALTY the orders given by

    D. A.A.A., to be ratified by the client through his handwritten signature
    on paper."

- That the procedure carried out within the framework of the contractual relationship does not
    fully compromised and guaranteed their rights and will, by requiring that the

    appellant party will ratify or revoke, by signing, the orders that in his
    name and under his instructions would have been executed by the agent.

- To avoid any damage in the event that said operations do not
    responded satisfactorily to your instructions or investment strategy
    agreed, is allowed, and was thus offered on several occasions, not only its revocation

    but also be restored to the balance sheet and products situation previously
    constituted. Both in a meeting held on 6-21-21, and in the email
    aforementioned email of 11-26-21 was offered such a solution without the
    claimant has expressed himself.

- Points out that the agent did not deviate from the procedure for issuing and signing

    operations implemented at that time in the entity, and that the system has been
    modified later, precisely to avoid this type of situation
    controversial.

- Following the events in dispute, on July 15, 2021,
    implemented modifications in the procedure for signing orders of

    paper operations, such as: establishing the minimum age of the
    client so that they can sign on paper instead of via LOGALTY, limit
    users who can authorize paper printing, establish a process for
    authorization prior to the management of the signature on paper, and limit it to a maximum of 24
    hours the possibility of printing once authorized.


Consequently, from the arguments presented it follows that it is not a question
controversial, because it has been recognized by both parties, the one referring to the fact that the
representative hired by MAPFRE INVERSIONES executed on June 2, 2021
a total of 6 fund transfer operations charged to the investment portfolio and
associated account of the claimant and his wife. Nor is it controversial the fact that

that the representative of the claimed entity did not obtain its prior authorization or
communicated this fact to the account holders, and that the defendant offered the
claimant subsequently ratify or revoke these transfer orders, without the
claimant expressly accepts neither of these two options, filing
complaint and asking for explanations about the custody of the personal data that the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/23








claimed was carrying out, by having allowed his representative to order said
operations without having your electronic or handwritten signature.


The main controversial issue of the present procedure focuses on determining
If in accordance with the signed contract, it was necessary to obtain prior authorization from
the account holders to be able to execute the transfer/investment orders that
gave rise to the processing of personal data contained in your account, about which
covers this procedure. Or if, as the claimant states, the agent was
authorized to electronically order the transfer of funds with its own

keys and electronic signature, and subsequently obtain ratification of the signature
handwritten by the account holders, on paper.

Well, from the analysis of the documentation on hand, several pieces of evidence emerge.
that lead to positioning themselves in favor of the version offered by the claimant. The

The most significant evidence is the following:

- Firstly, the defendant does not expressly deny that it is necessary to obtain the
    consent of the clients, and despite stating that the agent followed the
    procedure established at that time (which allowed the agent to sign the
    operations electronically with their own passwords and signature, and, after having

    executed the same, obtain the handwritten signature of the clients on paper), incurs
    in various contradictions that lead to the opposite conclusion.

    Thus, according to their own statements and antecedents
    documented in the procedure, it is clear that the defendant apologized to the

    complainant for the “malpractice” of the agent in the email sent to the
    claimant on November 26, 2021, and maintained various contacts and even
    a meeting with the same on June 21, 2021 with the claimant for the purpose of
    offer you the option to ratify or revoke such operations. And on the other hand, he points out
    which has adopted new measures to rectify the aforementioned procedure of

    subsequent ratification on paper, implying an implicit recognition that
    This was generating irregularities.

- The Framework Contract establishes the obligation to obtain consent or signature
    prior authorization from the client to authorize payment operations or carry out any type of
    financial operation charged to them:


    Thus, according to the Tenth Stipulation of the GENERAL STIPULATIONS
    of the Framework Contract, referring to “10.1.- AUTHORIZATION OF OPERATIONS OF
    PAGO states that: “Payment operations will be considered
    authorized when the CUSTOMER has given his consent to them,

    in accordance with the provisions of these General Stipulations, as well as
    as in the respective Particular Stipulations, for each of the
    payment operations that the CLIENT and the ENTITY have agreed upon.”

    And on the other hand, in the Seventh Stipulation of the STIPULATIONS
    PARTICULARS ON CUSTODY AND ADMINISTRATION OF THE CURRENCY PORTFOLIO

    INVESTMENT, it was also specified: “So that the ENTITY can use
    own account or on behalf of another client the financial instruments that have been
    entrusted by the CLIENT or establish agreements for financing operations of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/23








    securities on said instruments, the client must give his express authorization, for
    written and formalized by means of your signature or equivalent mechanism, by which
    authorizes the ENTITY to use its financial instruments in custody with the

    intended purpose and expressly accepted in the particular conditions that are
    establish, which will include: obligations and responsibility of the ENTITY
    (including the remuneration in favor of the CLIENT for lending his securities), the
    conditions of restitution and the inherent risks. The use of these instruments
    “It will be restricted to the conditions previously accepted by the CLIENT.”


- The defendant indicates that it was the claimant who initiated the service, formulating the
    investment orders that were executed by the agent, which negates the
    claimant, who claims to have been aware of them when they were already
    executed, by viewing them in the “MAPFRE Financial Portal” APP.


    Regarding this controversial issue, it should be noted that the defendant has not
    provided documentation proving that the investment order came from the
    claimant, activating the so-called “service of reception, transmission and
    execution of investment orders” which is provided for in the framework contract. Without
    This prior request is reflected in the receipts for the transfer of funds, captures
    screen of the investment orders placed, and/or lists of movements that

    were provided by the claimant.

- The procedure followed by the agent to order the transfer was not chosen by
    the client, as indicated in the Framework Contract:


    In accordance with the Seventh Stipulation of the General Stipulations of the
    Framework Contract, the provision of consent or prior authorization of the client
    It could be obtained through two possible channels, which will always be your choice.
    from the client: face-to-face channel (handwritten signature in the office), or through the internet
    (with passwords, username and electronic signature in the APP “Mapfre financial portal”):


“(…) The CUSTOMER registration process in the ENTITY and the signing of this
FRAMEWORK CONTRACT will necessarily be carried out through the in-person channel,
that is, at the MAPFRE office of your representative. This FRAMEWORK CONTRACT
It cannot be signed until the CLIENT has not presented all the documentation
required by the ENTITY.


Notwithstanding the above, once the FRAMEWORK CONTRACT is signed, the subsequent management
of any operation related to the contracted products and/or services, as well as the
contracting of new financial products or services may be carried out, at the discretion
from the CUSTOMER, either through the in-person channel (MAPFRE Office of the representative)
or, through the INTERNET, in accordance with the provisions of the following

“Stipulation regarding access and use of remote channels”

    Access and use of remote channels could be done only by
    the client, through their own password, username and electronic signature, which were
    personal to each user and non-transferable. This aspect is noted in the

    Eighth Stipulation of the General Stipulations of the Framework Contract, which
    regulates the “8. ACCESS AND USE OF REMOTE CHANNELS”, pointing out
    that:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/23








        “Likewise, the ENTITY will initially automatically assign to each
       CLIENT a Password and an Electronic Signature, which must be
       modified by the CLIENT immediately after the first access,

       adhering to the alphanumeric criteria defined by the ENTITY in each
       moment. Notwithstanding the foregoing, the ENTITY reserves the right to
       whether or not to accept an interested party as a USER. (…) This elements
       (User Identifier, Password and Electronic Signature), hereinafter the
       “keys” will be personal to each USER and non-transferable, allowing
       access to operations in all those products and services in which

       said USER appears as Owner (sole or jointly owned with third parties)
       persons) or as Authorized on behalf of the Holders. (…) From this one
       moment, and once the keys have been validated by the ENTITY's systems,
       will understand that the orders transmitted to the ENTITY are instructions in
       firm, with the express consent of the CUSTOMER and, therefore, with full

       legal effectiveness. The Parties grant to orders transmitted via
       telematics, through the use of keys, identical value to consent
       rendered in writing with a handwritten signature.

   In conclusion, it follows from these clauses that the choice between both
   channels to order investments was up to the client, and not to the agent, who

   opted for the in-person procedure, ordering with his passwords and signing the
   investments, without it having been proven that it was the client (claimant and his
   wife) who had requested that the investment be made in this way. In
   In this case, in addition, the claimant states that since 2018 he had chosen
   always through the electronic channel, and authorized with your passwords and electronic signature

   each investment operation. So in this case, with more reason, the
   agent consult the customer and obtain his prior consent to switch to the channel
   in person.

   This, together with the fact that the entity also had the obligation to require their consent

   prior to being able to order a payment referred to in general stipulation 10.1,
   implies without a doubt that the agent omitted the requirement to consult and obtain the
   prior consent of the client, both to opt for the face-to-face channel, as well as
   to order payment and investment operations.

   Practice that, in addition to involving illicit processing of the personal data of the

   claimant and his wife, would violate the provisions of the “Annex on limitation of
   activity and representation services” of the Representation Contract, which indicates
   expressly that the representative: “Will not assume in any case any faculty or power
   of any management on the financial instruments owned by the client,
   limiting its activity to the reception and transmission of orders on behalf of

   clients in relation to one or more financial instruments of the Mapfre group or of
   third parties".

In conclusion, from the above it can be deduced that according to the contract signed by the parties
it was necessary for the claimant and his wife to previously authorize the use of the

face-to-face or electronic channel, and fund transfer operations to acquire
investments that were made by the agent of the claimed entity. And it appears in the
file that the agent acted in accordance with “malpractice”, ordering 6
payment and investment operations without previously obtaining authorizations

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/23








necessary, which involved the use of the personal data of the owners of the
account for which he lacked legitimacy.


Therefore, it is understood the personal data processing operations carried out
by the agent of the transfer claim lacked a basis for the legality of the article
6.1.b) of the RGPD, as the processing is not necessary for the execution of the contract
frame.

The same arguments used would serve to rule out the concurrence of a

basis of legality of article 6.1.a) of the RGPD, given the lack of consent of the
claimant, and his wife, recognized by both parties. And there is no evidence that the claimed
has proven the concurrence of any other basis of legality of those provided for in the
mentioned article 6.1 of the RGPD.


Consequently, if the evidence provided by the parties to this case is confirmed
procedure during the investigation phase, this would imply that the claimed entity
processed the personal data contained in the claimant's account
and his wife when ordering the transfers of funds referred to herein
procedure, without being protected by any legal basis that would justify the legality
of the processing, which could entail a violation of article 6.1. of the GDPR.


                      IV. Classification and classification of the infraction.

The conduct of the defendant could constitute a violation of article 6.1
of the GDPR. Infraction typified in article 83.5. of the GDPR which establishes:


    "5. Violations of the following provisions will be sanctioned, according to
    with section 2, with administrative fines of a maximum of 20,000,000 Eur or,
    In the case of a company, an amount equivalent to a maximum of 4% of the
    global annual total business volume of the previous financial year, opting

    for the largest amount:
    a) The basic principles for treatment, including the conditions for treatment
    consent in accordance with articles 5,6,7 and 9.”

For the purposes of determining the statute of limitations for the violation, the LOPDGDD qualifies
in its article 72 this violation of the RGPD is a very serious infringement. The precept

has:

   "1. Based on what is established in article 83.5 of Regulation (EU) 2016/679
   are considered very serious and the infractions that occur will expire after three years.
   involve a substantial violation of the articles mentioned therein and, in

   in particular, the following:
   [...]
   b) The processing of personal data without any of the conditions concurring
   of legality of the treatment established in article 6 of the Regulation (EU)
   2016/679.”


                                            V
                              Sanction: Administrative fine


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/23








Article 58.2 of the RGPD relates the corrective powers attributed to the AEPD as
supervisory authority, including the power to impose a fine
administrative (section i).


Without prejudice to what results from the instruction of the procedure, in this phase
initiation agreement, the imposition on the claimed party of a
sanction of administrative fine for the alleged violation of article 6.1 of the RGPD
whose responsibility is attributed to him.


Article 83 of the GDPR, “General conditions for the imposition of fines
"administrative measures", says in section 1 that the control authority will guarantee that the
imposition of fines for violations of this Regulation indicated in the
sections 4,5 and 6, comply in each individual case with the principles of effectiveness,
proportionality and dissuasive nature.


The principle of proportionality implies a correlation or adequacy between the
infraction committed and the sanction imposed, with prohibition of unnecessary or
excessive, so that the sanction is suitable to achieve the purposes that justify it.

Article 83.2. of the RGPD, through a list of criteria or factors for its

graduation, establishes the technique to achieve adequacy between the infraction and the
sanction. The precept provides:

   “Administrative fines will be imposed, depending on the circumstances of each
   individual case, as an additional or substitute for the measures contemplated in the

   Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine
   administrative and its amount in each individual case will be duly taken into account.
   account:

   a) the nature, severity and duration of the infringement, taking into account the

   nature, scope or purpose of the processing operation in question, as well as
   such as the number of interested parties affected and the level of damages that
   have suffered;
   b) intentionality or negligence in the infringement;
   c) any measure taken by the person responsible or in charge of the treatment to
   alleviate the damages and losses suffered by the interested parties;

   d) the degree of responsibility of the person responsible or in charge of the treatment,
   taking into account the technical or organizational measures that have been applied in
   under articles 25 and 32;
   e) any previous infraction committed by the person responsible or in charge of the
   treatment;

   f) the degree of cooperation with the supervisory authority in order to remedy
   the infringement and mitigate the possible adverse effects of the infringement;
   g) the categories of personal data affected by the infringement;
   h) the way in which the supervisory authority became aware of the infringement, in
   particular whether the person responsible or the person in charge notified the infringement and, in that case, in

   what measure;
   i) when the measures indicated in Article 58(2) have been
   previously ordered against the person responsible or the person in charge in question
   related to the same matter, compliance with said measures;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/23








   j) adherence to codes of conduct under Article 40 or to mechanisms of
   certification approved in accordance with Article 42, and
   k) any other aggravating or mitigating factor applicable to the circumstances of the

   case, such as financial benefits obtained or losses avoided, direct or
   indirectly, through infringement.”

Section k) of article 83.2 of the RGPD connects with article 76 of the LOPDGDD,
“Sanctions and corrective measures”, which states:


   "2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679
   may also be taken into account:
   a) The continuous nature of the infringement.
   b) The linking of the offender's activity with the performance of medical treatment.
   personal information.

   c) The benefits obtained as a consequence of the commission of the infraction.
   d) The possibility that the conduct of the affected person could have induced the
   commission of the infraction.
   e) The existence of a merger by absorption process subsequent to the commission of the
   infringement, which cannot be attributed to the absorbing entity.
   f) The impact on the rights of minors.

   g) Have, when not mandatory, a data protection delegate.
   h) The submission by the person responsible or in charge, on a voluntary basis,
   to alternative conflict resolution mechanisms, in those cases in which
   that there are disputes between them and any interested party.”


In accordance with the transcribed precepts and the information contained in the file
administrative, are taken into consideration to set the amount of the fine with which
It would be appropriate to sanction the person complained of for the violation of article 6.1 of the RGPD, the

following factors that show greater illegality or guilt of your
conduct:

    - Article 83.2.a) of the RGPD: “the nature, severity and duration of the

        infringement".

      The conduct in which the nature of the infraction attributed to the
      claimed affects a basic principle in data protection, the

      legality of the treatment, punishable as stated, with a fine of up to 20
      million euros or 4% of the turnover of the claimed party.

      The seriousness of the conduct is based on the fact that the financial institution acted without

      legitimation, illicitly processing the personal data of the two owners of the
      account (name, surname, NIF and account numbers that appeared in the
      themselves).


      It is also considered that, in accordance with what is stated in the orders of
      transfer of funds provided as Document 2 of the claim, the
      claimed carried out 6 processing operations of these personal data without

      legal basis, for an amount of 4,215 euros each, so the investment

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/23








      unauthorized amounted to a total of 25,290 euros in the account corresponding to the
      investment fund from which said amounts were deducted.


      Regarding the duration of the violation for which the entity is held responsible
      claimed, it is considered that the violation was consummated on the day the
      fund transfer operations, on 2-6-21.


    - Article 83.2.b) The intentionality or negligence of the infringement:



      Although there is no apparent intention to act without legal basis on the part of the

      agent who ordered the transfers, if serious negligence is observed in the
      actions of this and the claimed entity, which claims to have been applying a
      procedure to order operations that is not provided for in the Contract

      Framework signed with the claimant, allowing its agents to execute
      orders without obtaining prior authorization from customers when choosing the
      face-to-face channel by the agent.




      Taking into consideration that in the development of its activity
      business is dedicated to investment management, which they present with relative

      frequency of these fund transfer operations, is part of the diligence
      minimum that is required from a financial entity such as MAPFRE INVERSIONES
      to ensure that the necessary technical and organizational measures are adopted

      prevent agents or employees acting on behalf of the entity
      can make these decisions without having a handwritten or electronic signature
      prior to clients.


      Regarding the degree of diligence that the person responsible for the treatment is
      obliged to deploy in compliance with the obligations imposed by the

      data protection regulations, the SAN of 10/17/2007 (Rec.
      63/2006), extrapolated to the case at hand, which indicates that: “the Court
      Supreme Court has come to understand that recklessness exists whenever it is neglected

      a legal duty of care, that is, when the offender does not behave with
      required diligence. And in assessing the degree of diligence it must be weighed
      especially the professionalism or not of the subject, and there is no doubt that, in the

      case now examined, when the appellant's activity is constant and
      abundant handling of personal data, emphasis must be placed on rigor and
      “exquisite care to comply with the legal provisions in this regard.”


      - The evident link between the business activity of the defendant and the
      processing of personal data (article 83.2.k, of the RGPD in relation to the
      article 76.2.b, of the LOPDGDD.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/23








      Given that in the business activity of the defendant it is essential
      processing of numerous personal data of its clients, therefore,

      taking into account the very important business volume of the financial institution
      claimed when the events occur the significance of the conduct
      infringing object of this claim is undeniable.


Thus, without prejudice to what results from the instruction of the procedure, it is
understands that in light of the aforementioned graduation circumstances, it is determined
initially a fine of €300,000 (THREE HUNDRED THOUSAND EUROS) for the
alleged violation of the provisions of article 6.1 of the RGPD.


                                          SAW
                          Imposition of corrective measures

If the violation is confirmed, the resolution issued may establish the measures

corrective measures that the offending entity must adopt to put an end to the non-compliance
of the personal data protection legislation, in this case article 6.1 of the
RGPD, in accordance with the provisions of the aforementioned article 58.2.d) of the RGPD, according to the

which each control authority may “order the person responsible or in charge of the
treatment that the processing operations comply with the provisions of the
this Regulation, where appropriate, in a certain manner and within a

specified period…”

The imposition of this measure is compatible with the sanction consisting of a fine
administrative, in accordance with the provisions of article 83.2 of the RGPD.


Thus, the responsible entity may be required to adapt its actions to the
personal data protection regulations, with the scope expressed in the
previous Fundamentals of Law.


This act establishes the alleged infraction committed and the facts
that could give rise to this possible violation of the regulations for the protection of
data, from which it is clearly inferred what measures to adopt, without prejudice

that the type of procedures, mechanisms or specific instruments to
implementing them corresponds to the sanctioned party, since it is responsible for the
treatment who fully knows its organization and must decide, based on the

proactive responsibility and risk approach, how to comply with the GDPR and
LOPDGDD.

However, in this case, regardless of the above, in accordance with the

evidence that there is currently an agreement to start
sanctioning procedure, the resolution that is adopted may require

MAPFRE INVERSIONES so that, within a period of 3 months, counting from the date
of enforceability of the resolution finalizing this procedure, impart
instructions to its agents to refrain from using the personal data of

their clients arranging investments that fail to comply with the authorizations agreed in the
framework contracts for financial or wealth management products and services signed
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/23








by them and establish the technical means that are appropriate to
make it impossible to formalize said investment operations by signature

electronically by a person other than the client or person authorized by the client

It is warned that failure to comply with the possible order to adopt measures imposed by
This body in the resolution of this sanctioning procedure may be

considered as an administrative offense in accordance with the provisions of the RGPD,
classified as an infraction in its articles 83.5 and 83.6, and such conduct may be motivated by
opening of a subsequent administrative sanctioning procedure.


Likewise, it is recalled that neither the recognition of the infraction committed nor, in its
case, the voluntary payment of the proposed amounts exempts from the obligation of
adopt the pertinent measures to stop the conduct or correct the effects of

the infraction committed and to prove to this AEPD compliance with that
obligation.

Therefore, in accordance with the above, by the Director of the Agency

Spanish Data Protection, IT IS AGREED:

FIRST: START SANCTIONING PROCEDURE against MAPFRE INVERSIÓN
SOCIEDAD DE VALORES, S.A, with NIF A79227021, for the alleged violation of the
article 6.1 of the RGPD, typified in article 83.5 of the same RGPD.


SECOND: APPOINT R.R.R. as instructor. and, as secretary, to S.S.S.,
indicating that they may be challenged, if applicable, in accordance with the provisions of the
articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Sector
Public (LRJSP).


THIRD: INCORPORATE into the sanctioning file, for evidentiary purposes, the
claim filed by the complaining and claimed party, together with its
documentation, as well as the documents obtained in the actions prior to the
initiation of this sanctioning procedure and during the appeal phase.


FOURTH: THAT for the purposes provided for in art. 64.2 b) of law 39/2015, of 1
October, of the Common Administrative Procedure of Public Administrations, the
sanction that could correspond would be €300,000 (THREE HUNDRED THOUSAND EUROS),
without prejudice to what results from the instruction.


FIFTH: NOTIFY this agreement to MAPFRE INVERSIÓN SOCIEDAD DE
VALORES, S.A, with NIF A79227021, granting a hearing period of ten days
competent to formulate the allegations and present the evidence that it considers
convenient. In your written statement of allegations you must provide your NIF and the number of
file that appears at the head of this document.


If within the stipulated period you do not make allegations to this initial agreement, the same
may be considered a proposal for a resolution, as established in the article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP).


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/23








In accordance with the provisions of article 85 of the LPACAP, you may recognize your
responsibility within the period granted for the formulation of allegations to the
present initiation agreement; which will entail a 20% reduction in the

sanction that may be imposed in this procedure. With the application of this
reduction, the penalty would be established at 240,000 euros, resolving the
procedure with the imposition of this sanction.

Likewise, you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which

will mean a 20% reduction in the amount. With the application of this reduction,
The penalty would be established at 240,000 euros and its payment will imply termination
of the procedure, without prejudice to the imposition of the corresponding measures.

The reduction for the voluntary payment of the penalty is cumulative with that corresponding

apply for recognition of responsibility, provided that this recognition
of the responsibility becomes evident within the period granted to formulate
allegations at the opening of the procedure. The voluntary payment of the referred amount
in the previous paragraph may be done at any time prior to the resolution. In
In this case, if both reductions were to be applied, the amount of the penalty would remain
established at 180,000 euros.


In any case, the effectiveness of any of the two mentioned reductions will be
conditioned upon the withdrawal or waiver of any action or appeal pending.
administrative against the sanction.


In the event that you choose to proceed with the voluntary payment of any of the amounts
indicated above (240,000 euros or 180,000 euros), you must make it effective
by depositing it into the IBAN account number: ES00-0000-0000-0000-0000-0000
(BIC/SWIFT Code: CAIXESBBXXX) opened in the name of the Spanish Agency of
Data Protection in the banking entity CAIXABANK, S.A., indicating in the

concept the reference number of the procedure appearing in the heading
of this document and the reason for the reduction of the amount to which it applies.

Likewise, you must send proof of income to the General Subdirectorate of
Inspection to continue the procedure in accordance with the quantity
entered.


In compliance with articles 14, 41 and 43 of the LPACAP, it is noted that, as far as
Subsequently, the notifications sent to you will be made exclusively
electronically, through the Unique Enabled Electronic Address (dehu.redsara.es), and
that, if you do not access them, your rejection will be recorded in the file, considering

the procedure has been carried out and the procedure is followed. You are informed that you can
identify to this Agency an email address to receive the notice
of making notifications available and that the lack of practice of this notice does not
will prevent the notification from being considered fully valid.


The procedure will have a maximum duration of twelve months from the date
of the initiation agreement or, where applicable, of the draft initiation agreement. After that
period will expire and, consequently, the proceedings will be archived; of
in accordance with the provisions of article 64 of the LOPDGDD.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/23









Finally, it is noted that in accordance with the provisions of article 112.1 of the LPACAP,

There is no administrative appeal against this act.


                                                                             935-18032024
Sea Spain Martí
Director of the Spanish Data Protection Agency

>>


SECOND: On June 20, 2024, the claimed party has proceeded to pay
the penalty in the amount of 180,000 euros making use of the two reductions
provided for in the initiation Agreement transcribed above, which implies the
recognition of responsibility.


THIRD: The payment made, within the period granted to formulate allegations to
The opening of the procedure entails the waiver of any action or appeal pending.
administrative against sanction and recognition of responsibility in relation to

the facts referred to in the Initiation Agreement.

FOURTH: In the initiation agreement transcribed previously, it was stated that,
If the infringement is confirmed, it could be agreed to impose on the person responsible the adoption of
appropriate measures to adjust its actions to the regulations mentioned in this

act, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD, according to the
which each control authority may “order the person responsible or in charge of the
treatment that the processing operations comply with the provisions of the
this Regulation, where appropriate, in a certain manner and within a
specified period…”


Having recognized the responsibility for the infraction, the imposition of
the measures included in the Initiation Agreement.



                           FOUNDATIONS OF LAW

                                           Yo
                                    Competence


In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to

initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions

in Regulation (EU) 2016/679, in this organic law, by the provisions

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/23








regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."


                                           II
                             Termination of the procedure

Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common Public Administrations (hereinafter, LPACAP), under the heading
“Termination in sanctioning procedures” provides the following:


"1. A sanctioning procedure has been initiated, if the offender recognizes his responsibility,
The procedure may be resolved with the imposition of the appropriate sanction.

2. When the sanction has only a pecuniary nature or a penalty can be imposed

pecuniary sanction and another of a non-pecuniary nature but the
inadmissibility of the second, the voluntary payment by the alleged responsible, in
Any time prior to the resolution, will imply the termination of the procedure,
except in relation to the restoration of the altered situation or the determination of the
compensation for damages caused by the commission of the infringement.


3. In both cases, when the sanction has only a pecuniary nature, the
body competent to resolve the procedure will apply reductions of, at least,
20% of the amount of the proposed penalty, these being cumulative with each other.
The aforementioned reductions must be determined in the initiation notification.
of the procedure and its effectiveness will be conditioned on the withdrawal or resignation of

any administrative action or appeal against the sanction.

The reduction percentage provided for in this section may be increased
“regularly.”


According to what was indicated,
the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: DECLARE the termination of procedure EXP202303754, of
in accordance with the provisions of article 85 of the LPACAP.


SECOND: ORDER MAPFRE INVERSIÓN SOCIEDAD DE VALORES, S.A to
that within 90 days from when this resolution becomes final and enforceable,
notify the Agency of the adoption of the measures described in the
legal foundations of the Initiation Agreement transcribed in this resolution.


THIRD: NOTIFY this resolution to MAPFRE INVERSIÓN SOCIEDAD
DE VALUES, S.A.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 23/23










administrative litigation before the Administrative Litigation Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the

Contentious-Administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.



                                                                                   1259-16012024
Sea Spain Martí
Director of the Spanish Data Protection Agency






















































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es