AEPD (Spain) - PS/00172/2020

AEPD - PS/00172/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 7 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	23.03.2021
Fine:	None
Parties:	POSADA LAS ANIMAS VIGO SPAIN, S.L.
National Case Number/Name:	PS/00172/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	CSO

The Spanish DPA (AEPD) issued a warning to a pub for recording and disseminating the image of its customers on their social networks without a legal basis.

English Summary

Facts

The complainant turned to the AEPD to claim that the entity had recorded him, along with other people, during a public event without his permission. Subsequently, the respondent had disseminated the images on their social networks.

The complainant alleged that the dissemination of the images caused him serious harm, since he could be seen kissing a person who was not his couple.

The respondent alleged that they had placed at the entrance of the place a large informative sign specifying that the event was going to be recorded and uploaded to their social networks.

Dispute

Did the respondent process the claimant's personal data with sufficient legal basis? Is the sign posted at the entrance of the event an adequate measure to ensure fair data processing?

Holding

The AEPD concluded that the respondent needed the complainant's consent to capture his image and subsequently disseminate it on their social networks. For such consent to be valid, it had to be informed, unequivocal, specific and free. The fact that the respondent had provided an explanatory poster does not guarantee that the consent was unequivocal, since the data controller could not prove that each and every one of the attendees to the event had read the poster and agreed with its content.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                1/13








     Procedure No.: PS / 00172/2020

                RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following

                                  BACKGROUND


FIRST: A.A.A. (hereinafter, the claimant) dated October 28, 2019
filed a claim with the Spanish Data Protection Agency. The
The claim is directed against POSADA LAS ANIMAS VIGO SPAIN, S.L. with NIF
B27793926 (hereinafter, the defendant) for some facts that could be violating
the legislation on protection of personal data. The main reasons in which

based on the claim are as follows:

“On 09/21/2019, they have released a video of me where it is displayed
perfectly my face and that of other people in the premises of the ALLEGED
RECLAIMED. This video is recorded inside the premises and published on the social network

INSTAGRAM in the official profile of the establishment: "la_posada_vigo". I dispose of
screenshots and witnesses that can corroborate this publication.

In addition, the video has been edited with graphic elements according to the situation that
it is being recorded, which is my person kissing another person. In the video, which

It lasts approximately 20 seconds, you can see my face and the
act.

When they give me a transfer of this publication, which I did not know at the time
It was recorded, because they had recognized me from the Internet, I try to get in touch
with the ALLEGED COMPLAINT at the contact telephone number that appears in your profile of

INSTAGRAM, indicating that it will immediately withdraw those contents, to which
He replied "whoever enters his premises is exposed to being recorded".

This telephone conversation has not been recorded.


Consequently, I have suffered significant non-pecuniary damage, since the person with whom I
kissing me was not my partner at that time.

I request that the corresponding sanction provided for by law be applied, before an act of
disclosure of sensitive personal images, without my consent, even if it is taken into account

the editing of the contents counts as a tax on the diffused image […] »

Along with the claim, it provides several frames of the supposed video recorded.

SECOND: Prior to the admission for processing of this claim, a
transferred the defendant, in accordance with the provisions of article 65.4 of the Law

Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter, LOPDGDD).



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/13








On 12/03/2019, a written reply from LA was entered in this Agency.
POSADA DE LAS ÁNIMAS VIGO SPAIN S.L, in which it states the following:


"one. In the access to the hospitality establishment there is an express communication from the
fact that the premises take pictures and videos of the environment, made not from
automated way but by a photographer.


2. It is also indicated that if you have any questions, contact the management.

3. As the complainant himself indicates, the removal of the video was not requested in a
written, but by phone and without success.


4. That there are ways of communication by email or writing available
in the premises, open from Monday to Friday from 20:30.

In any case, the photographs and images of the environment are deleted and replaced by
others on a weekly basis, with any client having the right to be informed in advance

access to address the address. In the event that the photograph or video were
made without being aware of it, there are mechanisms to request the withdrawal
immediate of it. "

Attach image of the poster that appears at the entrance of the establishment.


THIRD: The claim was admitted for processing by resolution of June 2
2020.

FOURTH: On July 17, 2020, the Director of the Spanish Agency for

Data Protection agreed to initiate a sanctioning procedure to the claimed, by the
alleged infringements of article 6.1 and 7 of Regulation (EU) 2016/679 (Regulation
General Data Protection, hereinafter RGPD) typified in article 83.5 of
the aforementioned rule, granting a period of ten days to present allegations.


FIFTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written
allegations in which it stated that:

“[…] The fact that environmental photographs and videos are those that are
carried out as specified by the poster that occupies 25% of the upper frame of the

only access door to the premises.

It is therefore unfailingly necessary that every client who has access to the
local have the poster in your field of vision












C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/13








1. In the access to the hospitality establishment there is an express communication from the
fact that the premises take pictures and videos of the environment, made not from
automated way but by a photographer.


Apart from this fact, as also indicated in the answer, the photographs and
small clips (videos) are made manually by a photographer. Being possible
at any time, as it is a digital camera, request its removal or
even asking that his image not be captured.


According to article 4 of the RGPD, it must be a "manifestation of will
free, specific, informed and unequivocal by which the interested party accepts, either
by means of a declaration, or a clear affirmative action, the treatment of the data
people who concern you »


The fact that the informational poster occupies a prominent place in the only route of
access, along with the fact that the person who captures the images is accessible in all
moment in the opinion of the mercantile "La posada de las animas" respond to the
need for a clear affirmative action, through access to the establishment and the
not communicate any impediment to the person taking the photographs.


Regarding the responsibility to remove the image, it is clear that
corresponds to the interested party, disproportionately, in what corresponds
this qualification is considered from the mercantile that does not correspond to reality,
since not only could he have told the photographer to delete the video clip,
but as soon as he wanted, he could contact the establishment by phone,

It could also have been done by email, in any case the
Images and video clips are deleted by default on a weekly basis.

That is why it is requested that this writing be considered presented and proceed to
close the file opened against POSADA LAS ANIMAS VIGO SPAIN SL. "


SIXTH: On September 3, 2020, the instructor of the procedure agreed to the
opening of a period of practice of tests, being considered reproduced, for the purpose of
evidence the claim filed by the claimant and its documentation, the
documents obtained and generated by the General Sub-Directorate of Inspection of
Data and allegations presented by the claimed.


SEVENTH: On October 13, 2020, a resolution proposal was formulated,
proposing that a penalty of warning be imposed on the defendant, for
respective infractions of articles 6.1 and 7 of the RGPD, typified in article 83.5 of
the same rule. In this proposal, a period of 10 days was established for the

claimed could allege whatever he considered in his defense as well as present the
documents and information deemed pertinent, in accordance with article
89.2 of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP).


On October 30, the defendant submitted a brief of allegations in which
stated the following:

"[...]

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/13








 1- The proposed resolution is based on “The fact that the mere existence of a
informational poster does not guarantee that all customers who access the premises are
aware of the possible capture of their physical image ”this as indicated to them

prevents compliance with the provisions of article 7.1 of the RGPD "When the treatment is
Based on the consent of the interested party, the person in charge must be able to
demonstrate that he consented to the processing of his personal data "

2- There is no specific regulation on signaling regarding
data protection should extrapolate this regulation from the only two regulations

existing in the matter and from which the entire legal basis of other types of
signals not included in them. the Royal Legislative Decree 339/1990 of 2
March by which the articulated text of the law on traffic, circulation of
Motor vehicles and road signs and the other RD 485 on road signs.
security and health.


In both cases, a signaling system is established by means of warning panels.
different nature (Prohibition, warning obligation, etc.) where

All users of the roads that are the object of this Law are obliged to obey the
traffic signs that establish an obligation or a prohibition and adapt

their behavior to the message of the rest of the regulatory signals that are
found on the roads on which they circulate (art 53.1 of the Regulations)

This paragraph together with the extensive and abundant jurisprudence is what leads to the fact that
that if an informative sign from a panel in a private company (RD485 / 97) or on a

public (RD 339/1990) indicates that the maximum speed is 20 KM and I access the road
I am accepting that said maximum speed is 20 km per hour. Having no effect
liberating the fact that the signal was seen or not (as long as it exists).

This principle extrapolated to all types of signage is that it creates signals so

shoot like

Some wear the blue color of obligation, others the red emergency, however
None is standardized since it is not to regulate road traffic or traffic
conditions of access and safety at work.


Neither the warning sign of the mercantile, the posada de las animas Vigo Spain
It is, however it makes clear the warning “Environmental photographs are taken that
they get on social networks ”.

This signage, being placed on the only access door, complies with

perfectly meet the requirements of a warning sign. Being able the person
that you do not want to consent not to access.

The fact that the reading of the warning sign cannot be guaranteed does not
invalid nor the fulfillment of the requirements that extrapolating from the abundant

jurisprudence in panel signs could only be for one of these reasons.

- That the sign is not covered or hidden in such a way as to prevent its visualization.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/13








- Make it legible
- That precedes the obligation, danger zone, etc.


- That in concurrence with other signals is contradictory.

None of these reasons is given and therefore the claimant accesses the interior of the premises
may or may not be informed, but at no time has he been denied the right to
the information and therefore your consent when expressly accessing the
establishment is free and conscious.


Imposing a warning for this issue removes the validity of warning signs.
information panel in any field since in all it is based on the same
reference rules.


Regarding the ease (Symmetry) art 7.3, to oppose being recorded or
photographed I return to art 7.1 already commented on the express consent shown to
access the premises, being able to be duly informed and as which accepting of
expressly and voluntarily the possibility of being recorded or photographed. "



In view of all the actions, by the Spanish Agency for Data Protection
In the present proceeding, the following are considered proven facts,


                                       FACTS


FIRST: The claimant submitted a brief on October 28, 2019 to the
Data Protection Agency that the one that shows that on the 21st of
September 2019 the establishment POSADA DE LAS ÁNIMAS VIGO published in the
social network Instagram a video of him while he was inside
said establishment, video that would have been recorded without their consent (and

allegedly edited). Provide screenshots in this regard.

SECOND: The hotel establishment takes photographs and videos of the environment of
some of your clients. These photos and videos are taken by a photographer and
published in the profile of the establishment in a social network during a period
temporary one week.


THIRD: The defendant has placed a sign at the entrance of the establishment in
the one that warns that inside photographs and videos of the environment are taken to
its publication on the official website and that upon entering the establishment it is presumed
the consent of the client.



                           FOUNDATIONS OF LAW

                                            I


By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/13








The Spanish Data Protection Agency is competent to resolve this
process.
                                             II


The defendant is charged with committing an offense for violation of article 6.1
of the GDPR, which states that:

"one. The treatment will only be lawful if it complies with at least one of the following
terms:


a) the interested party gave their consent for the processing of their personal data
for one or more specific purposes;

b) the treatment is necessary for the execution of a contract in which the interested party
is part of or for the application at his request of pre-contractual measures;


c) the treatment is necessary for the fulfillment of a legal obligation applicable to the
responsible for the treatment;

d) the treatment is necessary to protect vital interests of the interested party or another
Physical person.


e) the treatment is necessary for the fulfillment of a mission carried out in the interest
public or in the exercise of public powers conferred on the data controller;

f) the treatment is necessary for the satisfaction of legitimate interests pursued

by the person responsible for the treatment or by a third party, provided that on said
interests do not override the interests or fundamental rights and freedoms of the
interested party who require the protection of personal data, in particular when the
interested is a child.


The provisions of letter f) of the first paragraph will not apply to the treatment
carried out by public authorities in the exercise of their functions. "

Likewise, an infringement of article 7 of the same legal text, which provides
that:


"one. When the treatment is based on the consent of the interested party, the person in charge
must be able to demonstrate that he consented to the processing of his data
personal.

2. If the consent of the interested party is given in the context of a written statement

that also refers to other matters, the request for consent will be submitted
in such a way that it is clearly distinguished from other matters, in an intelligible and
easily accessible and using clear and simple language. It will not be binding any
part of the declaration that constitutes an infringement of this Regulation.


3. The interested party will have the right to withdraw their consent at any time. The
Withdrawal of consent will not affect the legality of the treatment based on the
consent prior to its withdrawal. Before giving consent, the interested party
you will be informed of it. It will be as easy to withdraw consent as it is to give it.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/13









4. When evaluating whether consent has been freely given, it will be taken into account in the
as much as possible the fact whether, among other things, the performance of a contract,

including the provision of a service, is subject to data consent
personnel that are not necessary for the execution of said contract. "

Violations are classified in article 83.5 of the RGPD:

"Violations of the following provisions will be sanctioned, in accordance with the

paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:


a) the basic principles for the treatment, including the conditions for the treatment
consent in accordance with articles 5, 6, 7 and 9; […] "

For the purposes of the statute of limitations for infractions, those indicated in paragraph
above are considered very serious and prescribe after three years, in accordance with article
72.1 of the LOPDGDD, which establishes that:


"Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
following:


[…] B) The processing of personal data without any of the conditions concurring
of legality of the treatment established in article 6 of Regulation (EU) 2016/679.

c) Failure to comply with the requirements of article 7 of Regulation (EU)

2016/679 for the validity of the consent […] "

                                            III


This procedure has its origin in the consideration as an infringer of the
current policy of recording images and videos of clients of the establishment of
hospitality and leisure POSADA LAS ÁNIMAS VIGO for further dissemination in networks
social or website. The defendant bases the legitimate basis of the treatment in the
consent of the interested parties.


The RGPD regulates the different legitimate bases for the processing of personal data in
its article 6.1, and on this question of the legality of the treatment, also affects the
Recital 40 of the aforementioned RGPD, when it states that “For the
treatment is lawful, personal data must be processed with consent
of the interested party or on any other legitimate basis established in accordance with Law, and

either in this Regulation or by virtue of other Union law or of the
Member States covered by this Regulation, including the need to
comply with the legal obligation applicable to the person responsible for the treatment or the need to
execute a contract with which the interested party is a party or in order to take measures
at the request of the interested party prior to the conclusion of a contract. "

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/13









According to what was stated by the complainant, he has based the treatment of
data object of the procedure in the consent of the interested parties and to this

In this regard, it is necessary that it be linked to the specific purposes of the
treatment of your data. In relation to the definition of consent, article
4.11 of the RGPD represents a paradigm shift with respect to the current scheme with
prior to the aforementioned rule, inasmuch as it makes the legal reality disappear
called “presumed consent”. Thus, this definition indicates that it is considered
consent of the interested party that “manifestation of free will, specific,

informed and unequivocal by which the interested party accepts, either through a
declaration, or a clear affirmative action, the treatment of the personal data that
concern ».

Regarding the form of consent, according to Recital 32 «The consent

must be given by means of a clear affirmative act that reflects a manifestation of
free, specific, informed and unequivocal will of the interested party to accept the
processing of personal data that you agree, such as a statement by
written, including by electronic means, or an oral statement. This could include
check a box on a website on the internet, choose technical parameters for the
use of information society services, or any other statement or

conduct that clearly indicates in this context that the interested party accepts the
Proposal for the processing of your personal data. Therefore, the silence, the boxes already
marked or inaction should not constitute consent. Consent must
be given for all treatment activities carried out with the same or the same
purposes. When the treatment has several purposes, consent must be given to

all of them. If the consent of the interested party has to be given as a result of a request for
electronic means, the request must be clear, concise and not disturb
unnecessarily the use of the service for which it is provided. "

 And abounding in this need for a clear and unequivocal statement, Recital

42 establishes that: “When the treatment is carried out with the consent of the
interested party, the data controller must be able to demonstrate that he has
given your consent to the processing operation. In particular in the context of
a written statement made on another matter, there must be assurances that
the interested party is aware of the fact that he gives his consent and of the extent to which
that makes. In accordance with Council Directive 93/13 / EEC [of April 5,

1993, on abusive clauses in contracts concluded with consumers],
an elaborate model declaration of consent must be provided
previously by the person responsible for the treatment with an intelligible formulation and
easy access that uses clear and simple language, and does not contain clauses
abusive. For the consent to be informed, the interested party must know

at least the identity of the person responsible for the treatment and the purposes of the treatment
which are intended for personal data. Consent must not
be considered freely provided when the interested party does not enjoy true or free
choice or cannot deny or withdraw their consent without suffering any harm ”.


Likewise, article 7 of the RGPD lists the conditions that must be met for
the granting of consent and in our ordinance, the LOPDGDD indicates
in its article 6, which has as a rubric “Treatment based on the consent of the
affected ”the following:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/13









"one. In accordance with the provisions of article 4.11 of Regulation (EU) 2016/679,
The consent of the affected party is understood to be any manifestation of free will,

specific, informed and unequivocal by which it accepts, and cleans through a
declaration or a clear affirmative action, the processing of personal data that
concern.

2. When it is intended to base the treatment of the data on the consent of the
affected for a plurality of purposes, it will be necessary to record in a

specific and unequivocal that said consent is granted for all of them.

3. The execution of the contract may not be subject to the consent of the affected party
processing of personal data for purposes that are not related to the
maintenance, development or control of the contractual relationship. "


In accordance, therefore, with the provisions of article 6.1 of the RGPD, in relation to
Considering paragraphs 32 and 42, when the treatment is based on the consent of the
affected, to consider such consent valid, it must be informed,
refer specifically to specific purposes, lend themselves freely and be
unequivocal. On this issue, Guidelines 5/2020, adopted by the Committee

European Data Protection, offer mechanisms to help the
interpretation of these criteria and their compliance by those responsible for the
treatments.

 In relation to the need for informed consent, it will be necessary to

Go to article 13 of the RGPD, article that determines the information that will be
be provided when the data is obtained from the interested party. To achieve this end, the article
11 of the LOPDGDD articulates the way to offer the information of article 13 of the
RGPD, establishing what basic information must be provided, at least in a
direct, and without prejudice to the due indication of the medium or place where it may be

access the complete information to be offered by virtue of the aforementioned
Article 13 of the RGPD. The elements that make up the information to be provided in
the assumption that consent is established as the legitimizing basis of the treatment
must reach: the identity of the person in charge, the purposes of the treatment or
treatments, what type of data is collected, the existence of the right to withdraw the

consent, information on whether the data will be the subject of automated decisions
and the possible risks in the event that a transfer is planned
international data in the absence of an adequacy decision and the
corresponding safeguards.


 The requirement of specificity is closely linked to the requirement of the
informed consent and refers to the fact that consent is given
only for the purpose for which it is established and in the event that they are
various purposes, consent must be differentiated for each of the
they. This consent requirement must, logically, be based on the information

specific previously provided.

 A consent freely given means that the interested party must have a
real option not to grant it. Consequently, the
consent freely when the subject cannot deny its granting without suffering

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/13








some type of negative consequence, extreme that the person responsible for the
treatment..


 Finally, with respect to non-equivocation, this requirement would be manifested in that the
interested party accepts in an undisputed way the processing of their data through a
deliberately affirmative action and prior to the start of treatment
of the data.


The RGPD does not prescribe a specific way to record the consent given and
therefore, it will be the responsibility of the person responsible to determine that, in line with the principle
of proactive responsibility established by article 4.2 of the RGPD, in such a way
that can prove that the interested party has validly provided the aforementioned
consent, that is, that it is informed, free, specific, and provided
unequivocal way.


In relation to the foregoing and in accordance with the proven facts highlighted
In this procedure, the complained party carries out data processing
consisting of taking pictures of the clients of the establishment for their
subsequent dissemination on social networks based on consent, which is not

in accordance with the data protection regulations for the following reasons.

Thus, in those cases in which the captured photographs affect people
identifiable and unaware of when these photographs are
being taken, the consent obtained cannot be considered to be valid since

that:

1. It is not possible to prove that the persons object of the images have been
duly informed. The fact, by itself, of having a poster of
adequate dimensions at the entrance of the premises (occupies more than 25% of the
entrance to the premises), even if it collects at least the basic information provided in the

Article 11 of the LOPDGDD and indicate an address where to go to know the rest
of the information that must be provided to the interested parties is not enough to
those data processing whose legitimating basis is consent since
does not allow to prove that each and every one of the people whose data is going to be
treated, have read the poster and have been informed. A different question would result, for

For example, data processing carried out for security reasons through
a video surveillance camera, data processing whose legitimating basis is the
public interest and not consent, and where the requirement of the duty of information
It is understood that the provision of a poster that meets the minimum requirements has been fulfilled.


2. It cannot be considered that people who are captured without being aware of
their recording have undoubtedly consented to the taking of a photograph or video of
their physical image because they may not even know that they are being subjected
of that treatment. As noted above, the presumed consent
has ceased to be valid within the framework of the data protection regulations that have arisen
From the approval of the RGPD, it must be express.


On the other hand, in those photographs in which the client appears looking directly and
intentionally to the camera, it would be possible to conclude, unlike the assumption
above, that the consent is unequivocal. Now, it is important to note that

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/13








In these cases, all the requirements that have been
mentioned above as necessary for the provision of consent
valid, which implies, therefore, the need for consent to also be

reported for each and every one of the purposes (in this case, the capture of the
image and its subsequent dissemination through social networks) and free, the
responsible must be in a position to prove that these points have been fulfilled in
all cases.

Taking into account the foregoing, therefore, the allegations of the

claimed since these are settled on the basis that the claimed provides
information clearly visible at the entrance of the establishment and that would fall on
the sphere of responsibility of the clients whether to read it or not; how has it
indicated, the framework that configures the RGPD for the processing of personal data
whose legitimating basis is the consent of the interested parties requires a clear

affirmative action in the provision of said consent that must comply with all and
each of the conditions referred to above, eliminating from
this form the so-called tacit or presumed consent. Therefore, to fulfill
with the data protection regulations when the legitimizing basis of the treatment is
constitutes the consent of the interested party, the sole making available to him of
information —whose reading in this case cannot even be credited— is

set up as a necessary but not sufficient budget.

On the other hand, it is indicated that, in the face of the affirmation of the absence of
signage regarding data protection, although it is true that there are no
provisions on the type of informational signs, articles 13 and 14 of the RGPD

collect the information that the controller is obliged to supply depending on whether
The data is obtained or not from the interested party and article 11 of the LOPDGDD offers a
means of fulfilling this obligation through the so-called layer system
(in which a distinction is made between basic information that must be provided
immediately and the complementary information that can be offered in a

second moment). The way to fulfill this duty of information
will depend, logically, on the type of treatment in particular, being the responsibility
responsible for the design and offering of that information.

                                           IV


Without prejudice to the provisions of article 83.5, sections a) and b), of the RGPD, its art.
58.2 b) provides the possibility of sanctioning with warning, in relation to the
indicated in Recital 148:

"In the event of a minor offense, or if the fine that is likely to be imposed

would constitute a disproportionate burden for an individual, rather than
sanction by fine may be imposed a warning. It must however
pay special attention to the nature, severity and duration of the offense, to its
intentional nature, to the measures taken to alleviate the damages suffered,
the degree of responsibility or any relevant prior infringement, the way in which

that the supervisory authority has had knowledge of the infringement, to the fulfillment
of measures ordered against the person in charge or in charge, to the adherence to codes of
conduct and any other aggravating or mitigating circumstance. "


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/13








In the present case, when deciding the sanction to impose, they have taken into account
counts the following elements:


 That it is a company whose main activity is not related to the
processing of personal data.

 That there is no recidivism or repetition, as the commission of
previous infringements regarding data protection.


Therefore, it is considered that the sanction that would correspond to impose is
warning, in accordance with the provisions of article 58.2 b) of the RGPD, in
relation to what is stated in Considering 148, cited above.


On the other hand, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD,
according to which each supervisory authority may 'order the person in charge or manager
of the treatment that the treatment operations conform to the provisions of the
this Regulation, where appropriate, in a certain way and within a
specified term […] ”, the person in charge must adopt the necessary measures to

prove that the consent given by the interested parties is informed, specific,
free and undoubted.


Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of the sanctions whose existence has been accredited, the Director of the

Spanish Agency for Data Protection RESOLVES:


FIRST: IMPOSE POSADA LAS ANIMAS VIGO SPAIN, S.L., with NIF
B27793926, for individual infractions of articles 6.1 and 7 of the RGPD, typified in

Article 83.5 of the aforementioned rule, a sanction of APPEARANCE.

SECOND: ORDER POSADA LAS ANIMAS VIGO SPAIN, S.L so that
accredits, within a maximum period of ONE MONTH from the notification of this resolution, the
adoption of the necessary measures to prove that the consent given by
the interested parties is informed, specific, free and undisputed.


THIRD: NOTIFY this resolution to POSADA LAS ANIMAS VIGO
SPAIN, S.L. and inform the claimant.



In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the

LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/13









National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the

interested party expresses his intention to file contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-

web /], or through any of the other records provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal

contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.


                                                                                     938-131120
Mar Spain Martí

Director of the Spanish Agency for Data Protection



































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es