AN - 2967/2021: Difference between revisions
(Created page with "{{COURTdecisionBOX |Jurisdiction=Spain |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=AN |Court_With_Country=AN (Spain) |Case_Number_Name=2967/2021 |ECLI=EC...") |
(→Facts) |
||
| Line 55: | Line 55: | ||
=== Facts === | === Facts === | ||
In its decision AEPD - PS/00451/2019, the Spanish DPA (AEPD) fined Equifax, a credit agency, €75,000 for unlawful processing of data. | In its decision [[AEPD - PS/00451/2019]], the Spanish DPA (AEPD) fined Equifax, a credit agency, €75,000 for unlawful processing of data. | ||
Equifax appealed this decision with the Spanish National High Court (Audiencia Nacional, "AN"). | Equifax appealed this decision with the Spanish National High Court (Audiencia Nacional, "AN"). | ||
=== Holding === | === Holding === | ||
The court declared that the decision issued by the AEPD, since the DPA had carried out a correct interpretation of the GDPR and the | The court declared that the decision issued by the AEPD, since the DPA had carried out a correct interpretation of the GDPR and the [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Spanish Data Protection Act]. | ||
Since the controller had failed to block the data included in the credit file for 30 days, as the Data Protection Act requires, the controller was processing the data unlawfully, and could therefore not rely on any legal basis. | Since the controller had failed to block the data included in the credit file for 30 days, as the Data Protection Act requires, the controller was processing the data unlawfully, and could therefore not rely on any legal basis. | ||
Revision as of 11:44, 26 July 2021
| AN - 2967/2021 | |
|---|---|
 | |
| Court: | AN (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1)(f) GDPR Article 83(5) GDPR |
| Decided: | 02.07.2021 |
| Published: | 22.07.2021 |
| Parties: | EQUIFAX IBERICA S.L. |
| National Case Number/Name: | 2967/2021 |
| European Case Law Identifier: | ECLI:ES:AN:2021:2967 |
| Appeal from: | AEPD PS/00451/2019 |
| Appeal to: | |
| Original Language(s): | Spanish |
| Original Source: | CENDOJ (in Spanish) |
| Initial Contributor: | n/a |
The Spanish National High Court declared that the Spanish DPA had carried out a correct interpretation of the GDPR and the national law regarding a case of unlawful processing of data, and had imposed a proportionate and justified fine.
English Summary
Facts
In its decision AEPD - PS/00451/2019, the Spanish DPA (AEPD) fined Equifax, a credit agency, €75,000 for unlawful processing of data.
Equifax appealed this decision with the Spanish National High Court (Audiencia Nacional, "AN").
Holding
The court declared that the decision issued by the AEPD, since the DPA had carried out a correct interpretation of the GDPR and the Spanish Data Protection Act.
Since the controller had failed to block the data included in the credit file for 30 days, as the Data Protection Act requires, the controller was processing the data unlawfully, and could therefore not rely on any legal basis.
Additionally, the court noted that the controller had alleged that, since the Data Protection Act had entered recently into force, they had not been able to implement a proper blocking system, and they did not have the means at the time to block the data; so the controller had acknowledged that they had not carried out the blockage.
The court also remarked that the fine was proportional, since the DPA had taken into account the circumstances of the case and had imposed a proportionate and justified fine, in accordance with Article 83(5) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
It seems you don't have the plugin configured to view the embedded pdf ... you can download the resolution here.
