AEPD (Spain) - PS/00276/2021

AEPD (Spain) - PS/00276/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(b) GDPR Article 22(2) LSSI
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	16.11.2021
Fine:	None
Parties:	WW E-SERVICES IBERIA, S.L.U. ("WESTWING")
National Case Number/Name:	PS/00276/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Genoveva Gil

The Spanish DPA (AEPD) closed a procedure against a website after verifying that it only automatically installed necessary cookies without users’ consent.

English Summary

Facts

The data subject filed a complaint with the Spanish DPA (AEPD) because the company’s website required user’s email address to access the website (WESTWING.ES). According to them, it was not possible to freely access the site. Moreover, the complainant indicated that analytic cookies were installed regardless of the user’s cookies’ preferences.

The company answered that WESTWING.ES is a private shopping club that only registered members can access to. Therefore, the legal basis for the processing of personal data was the necessity for the performance of a contract (Article 6(1)(b) GDPR).

The AEPD confirmed that the website was not public and that only registered members can access to it. It concluded that data subjects were duly informed about this in the website’s Privacy Policy. However, the AEPD found that the website automatically installed 11 non-identified cookies when accessing it for the first time. These cookies were not identified in the Cookies Policy, so it was not possible to classify them as necessary or not. Therefore, Spanish DPA requested the company to inform users about all cookies used on the website and to ask for consent before automatically installing any non-necessary cookie.

The company admitted that those 11 cookies were not adequately identified in their Cookies Policy. They clarified that those cookies were necessary ones, and that law did not required consent in those cases. However, for transparency reasons, they updated their cookie banner with information on the use of necessary cookies.

Holding

The AEPD considered that the company did not infringe Article 22(2) of the Spanish Law regulating cookies and unsolicited communications (LSSI). This law permits companies to install necessary or technical cookies without users’ consent. The website only automatically installed necessary or technical cookies without users’ consent. Non-necessary cookies asked for users’ consent. Moreover, after the AEPD request, the cookie banner informed users about the use of necessary cookies. Therefore, the AEPD closed the procedure.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/13








     Procedure PS / 00276/2021

                RESOLUTION OF SANCTIONING PROCEDURE


By means of an Agreement dated 07/07/21, the sanctioning procedure was initiated, PS /
0276/2021, instructed by the Spanish Agency for Data Protection to the entity,
WW E-SERVICES IBERIA, S.L.U. ("WESTWING"), with CIF .: B65732984, holder of the
website, www.westwing.es, (hereinafter, "the claimed party"), by virtue of the
Claim presented by D.A.A.A., for alleged infringement of Law 34/2002, of 11

July, Services of the Information Society and Electronic Commerce (LSSI),
and based on the following:

                                   BACKGROUND


FIRST: On 01/15/21, a letter from
claim of the complaining party, which, among others, indicated:

"When accessing the website www.westwing.es for the first time, after accepting the
cookies (which, some of them with an analytical profile, are installed regardless of what
that is requested in the selector) the screen is blocked with a pop-up that asks you to include

your email to access the website. That email was
use to register as a user. There is no possibility of rejection of this so the
Acceptance is not free but necessary to access the web.

In addition, a box for receiving advertising (newsletter) is activated, it must be yes or yes

selected to be able to access, so acceptance is not free or at reception.
tion of advertising or in the registry. Once inside the web it is not allowed to delete the
bill. Although the request to receive newsletters is deactivated, they continue to send
do e-mails, somewhat more spaced out in time, with promotions and advertising ”.


SECOND: On 03/08/21, this Agency sent a request
informative to the claimed party, in accordance with the provisions of article 65.4
of Organic Law 3/2018, of December 5, on the protection of personal and legal data
rantía of digital rights, ("LOPDGDD").

THIRD: On 04/08/21, this Agency received a written reply to the

Request made to the claimed party, in which, among others, it is reported:

"In this case we have no evidence that the interested party has presented directly
The claim referred to in your correspondence to the Company. By
Therefore, since said claim was not received, the Company has not been able to attend to it, nor facilitate

the interested party any information or clarification regarding what is the object of their request-
ha, not knowing even if the claimant is a registered member of our Sho-
pping Club and if, therefore, you have provided any personal data to the Company. For that
reason, we ignore the causes that have motivated the claim made, beyond
that the reason that appears in the correspondence of the AEPD.


In relation to the fact that is indicated as the reason for the claim, respectfully-
Mind you, we must state that it is not true that the consent of the users of
our Shopping Club is not loaned freely. In that sense, so that we can

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/13








correctly assess our registration system, it is necessary to bear in mind the nature of
leza of the services we offer in our Shopping Club. As noted
you on our website before customers proceed to register (for which

they only need to provide an email address and password),

"We are a shopping club that offers new sales every day selected by ex-
Pertos with great brands, a limited duration and discounts of up to 70% ".

In fact, as explained on our website, we are a true "shopping magazine

selected "(" curated shoppable magazine "), constantly providing our
users inspiration, decorating tips, house stories and information.
information on carefully selected products from famous brands or designers.
emerging senators. For this, WESTWING is committed to providing each
day to the members of your Shopping Club exclusive offers, for a very short time,

in campaigns of very short duration and with a limited number of products. How is it
Obviously, so that WESTWING can fulfill the services offered and contracted
by its users, it is necessary to promptly inform the members of the Shopping
Club of the flash campaigns it launches, which it carries out by sending via
newsletters via email. Therefore, given the nature of the service offered, in
its general conditions WESTWING undertakes to provide its customers

information related to different products, whether owned or from collaborated third parties-
res, and facilitate access to them by acquiring them under the conditions
offered on the WEB, through the established contracting procedure (all
this jointly referred to as the "SERVICES") ".


For this purpose, it is only possible to access the private shopping club "after acquiring
sition of membership "and" The offers of WESTWING.ES are not free
access, but are reserved solely and exclusively for its members "." In these
conditions, WESTWING provides information about various products, pro-
pios or third parties, offering its members the possibility of acquiring through

WESTWING.ES under the conditions specified here.

As you can see, so that WESTWING can fulfill these commitments and
provide their services correctly, it is necessary to send these newsletters
you, being protected the treatment of the personal data of the users for
this purpose give art. 6.1.b) of the RG PD, as it is the "treatment necessary for the

execution of a contract in which the interested party is a party or for the application upon request
of this pre-contractual measures. "Otherwise, WESTWING could not
provide users with the services they request from their Shopping Club, including
thus pleading its own general contracting conditions.


Guided by a criterion of maximum prudence and respect for the will of the users,
at the time of requesting registration in the Shopping Club, users are asked
that give their consent to periodically receive information by mail
related to the Shopping Club, letting them know with the maximum trans-
It seems that, however, they can revoke their consent at any time

(even simultaneously with the registration in the Shopping Club), easily and immediately
diata, either by email or through the user profile on the website, in a visible place
sible and accessible from the first moment of access ("My account").


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/13








Thus, even when the sending of these informative bulletins is protected on the basis of
treatment provided for in art. 6.1.b) of the RGPD, as it is the way in which WES-
TWING provides the services it offers in accordance with its general conditions, by

The purpose of the user himself being the one who can modulate the scope of the services
you want to receive from the Shopping Club, you are provided with a direct, immediate and
to be able to indicate that you want to limit the services established in the conditions
general hiring purposes, indicating that you do not want to receive any type of newsletter
informative of the Shopping Club, or reducing the frequency with which you want to receive it,
thus exempting WESTWING from its commitment to provide you with information about

the offers of your Shopping Club, reducing them to the establishment and use of a store
online, accessible when the user wishes. This allows the member who
want to minimize your contact or interaction with the Shopping Club so you can establish it
cer, so that the user in question is the one who delimits the scope of the services
provided by WESTWING and, consequently, the processing of your personal data-

them. In this way, we provide greater information and security to the client, guaranteeing
thus giving the users absolute freedom and the maximum attention to their interests.

Shortly after the entry into force of the RGPD, on 05/25/2018), in January
2019 Westwing received a request for information from the supervisory authority
competent German (Bayerisches Landesamtfúr Datenschutzaufsicht— BayLDA -),

in which you were asked to inform about the registration process in your Shopping
Club. This request was met by the company's legal advisers, ex-
asking the supervisory authority that the basis of treatment in question was art.
6.1.b) of the GDPR, given that, among other things, "Westwing's obligation goes beyond
of the mere making available of the closed area for members.


The offer on www.westwína.de is a shopping club or a ”shopping magazine”
for registered members. Therefore, our client's service also consists of
to offer members all the benefits of a shopping club and provide them with
Valuable information in the form of curated emails. [...] The fact that the

art. 6 (1) phrase 1 lit. b of! GDPR can be used as an authorization element also
It is also 'endorsed by the Data Protection Conference [...] ". After facilitating
the German supervisory authority said information, the BayLDA resolved not to open any
disciplinary proceedings or direct any other action regarding WESTWING, with
which we understand validated our interpretation of the GDPR, applicable throughout the
UE, and the registration system of our Shopping Club. Therefore, not showing the self-

control no non-conformity with our registration system or with the transaction
data collection of users, we have legitimately trusted that
we comply with all the requirements and demands in the RGPD and other regulations
of application.


For the appropriate illustrative purposes of the AEPD, a document is provided as Document No. 1.
copy of the information that was provided at the time to the German control authority
na (state of Bavaria), after which the supervisory authority decided not to carry out any
guna performance against WESTWING. We trust that the above is sufficient
so that the inadmissibility for processing of the received claim is agreed. Nevertheless,

If this is not enough, we remain at the disposal of the AEPD to facilitate the information
additional information that may be specified for this purpose. Likewise, in line with the will
of cooperation with the AEPD already stated, we would like to point out that, in case of
that the criterion or interpretation of the AEPD regarding this matter is different from the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/13








of the German supervisory authority and consider that it is necessary on the part of WES-
TWING adopt some measure so that, in its opinion, compliance with the
RGPD or, also, with the LOPDGDD, WESTWING will carry out all the actions

regulations that are required in Law to adjust their activity to the criteria and guidelines
of the AEPD ”.

FOURTH: On 06/04/20, this Agency carried out the following
Checks on the website www.westwing.es:


    a) About the processing of personal data:

The website in question is not a public website, in the sense of allowing access to its
content to any internet user, since it only allows access to users
registered in advance. The home screen is locked with a pop-up wall (pop-
up), which requests the email and password of the registered user in order to

access web content. This emerging wall also allows the option of giving
Register as a registered user on the web.

If you want to register, through the option << register for free >>, the web redirects to
a form where you must enter the email address and a password

sign.

In said registration form, there is a link to the << Privacy Policy >>, where
informs the future user of everything related to the processing of their personal data
endings. The user must accept the sending of advertising emails related to

two with web activity. However, it makes it possible to revoke this consent in
any time, via the link, <<revoke>>:

        “_ I would like to receive periodically, by email, promotions from
        sales, reminders, discount coupons and product appraisal surveys
        pipeline by Westwing. This consent can be <<revoiced>> in

        any moment". << Privacy Policy >> - << Terms of use >>

    b) About the Privacy Policy:

If you choose to access the "Privacy Policy", through the link in the

registration form, or through the link in the initial banner that appears on the
bre cookies or through the link at the bottom of the home page, the
web redirects to a new page, https://www.westwing.es/privacy-policy/, where
provides information about who is responsible for data processing
personal; the type of personal data that they process; the purposes of the treatment; the
term of conservation of the same and the elimination of the data; the communication of

data to third parties; the processing of data for the processing of orders; the base le-
gal for the treatment of the data and informs about the rights that assist the
users in terms of data protection, how and where to exercise them.

    c) About the Cookies Policy:


1. When entering the web for the first time, without accepting cookies or taking any action
on the page, it has been detected that up to 11 unidentified cookies are used in the
"Cookies Policy" of the web. The other cookies used before carrying out any
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/13








An action on the page is not identified in the Cookies Policy of
the web, so it is not possible to classify it as necessary or not. The cookies
that are used when entering the web page and without having taken any action on the
They are and without being identified in the cookie policy are:


 Cookie Domain

 ww_jid westwing.es
 OptanonConsent westwing.es

 PHPSESSID westwing.es
 ww_ft_newsmartbanner westwing.es
 ww_ft_cdppdp westwing.es
 ww_ft_MyAccountApp westwing.es
 ww_ft_gdpr westwing.es

 ww_ft_header2 westwing.es
 deviceName_2019_09 westwing.es
 abtest_variant… westwing.es
 OptanonConsent_bkp westwing.es


2. The banner about cookies that appears on the main page of the web, has the
following message:

       “We use cookies to provide you with the best possible experience on our
       Web. Some cookies are necessary for the use of our website, while

       that others help improve your shopping experience in the future or
       determine the effectiveness of our advertising efforts. Clicking
       "Accept cookies", you accept the use of all cookies. In "Settings
       cookies "you can decide which cookies you want to allow. You can change these
       settings at any time.


       << Privacy Policy >> << More information >> << Configuration of
       Cookies >> << Accept cookies >>

If you choose to go to the cookie control panel, << Cookie settings >>, you will
displays a control panel where you can manage cookies in ways
granular:


Required (off)  (ON) - always active.
Performance (OFF)  (on) - pre-marked in the “OFF” option.
Functional (OFF)  (on) - pre-marked in the “OFF” option.
Marketing (OFF)  (on) - pre-marked in the “OFF” option.


<< Save selection >> << Accept all cookies >>

If the option << Save selection >> is selected, without having made any
movement of the cursors from the “off” position to the “on” position, considering with
This means that all non-necessary cookies (required or technical) are rejected,

note that no new cookies are used, except those indicated above.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/13








3.- If the "Cookies Policy" is accessed, through the link in the banner
initial on cookies, << Privacy Policy >>, the web redirects to a new page,
https://www.westwing.es/privacy-policy, where, in its tenth section, it reports on,

what are cookies, what types of cookies exist and identifies the cookies used by the
web, (its purpose and duration), with the exception of the cookies indicated in the table above-
rior as "unidentified".

FIFTH: On 07/07/21, by the Director of the Spanish Protection Agency
of Data, a sanctioning procedure is initiated against the claimed party, for infringement of the

article 22.2) of the LSSI, punishable in accordance with the provisions of art. 39) and 40) of
the aforementioned Law, regarding the "Cookies Policy" of the website of its ownership,
directing her a "warning" and ordering her to take the necessary measures
on the website of its ownership to adapt it to current regulations on the matter
of Cookies Policy, including in the second layer (Cookies Policy), the information

necessary information on all cookies used on the web and that, if not
be necessary or technical, were identified and included a mechanism that would prevent
lite its use before the user provides their consent.

SIXTH: The initiation agreement has been notified to the claimed party, the latter by means of a written
On 07/30/21, he made, in summary, the following allegations:


After notifying us of the initiation agreement issued by the Director of the AEPD, the
subscribing commissioned the technical manager of the company to check whether, such and
As indicated in said resolution, there were a series of cookies that were not
correctly identified in our Cookies Policy and that, in addition, is installed-

ban automatically when visiting our website, without obtaining the consent of the
Username.

In this regard, we must inform the AEPD that, indeed, after conducting an exhaustive
tive technical analysis of our website, we have verified that cookies at

referred to in the agreement to initiate the sanctioning procedure is not
have been identified in our Cookies Policy. Even though, for the reasons I know
They will say, we understand that it is not necessary in this case to provide any specific information
individualized specific information regarding each of these cookies, as all of them are
technical cookies, the generic information of the cookie banner being sufficient
that “We use cookies to provide you with the best possible experience on our

Web.

Some cookies are necessary for the use of our website, while others help
give to improve your shopping experience in the future or to determine the effectiveness of
our advertising efforts. By clicking "Accept cookies", you agree to the use of

all cookies. In "Cookie settings" you can decide which cookies you want
let. You can change these settings at any time ”.

This is because, regarding this type of cookies, in its Guide on the use of cookies,
after indicating that “it can be understood that these cookies are excluded from the scope of

application of article 22.2 of the LSSI, and, therefore, it would not be necessary to inform or
obtain consent on its use ”, the AEPD recommends“ for reasons of trans-
parencia [..] inform, at least in a generic nature, of those cookies excluded
of the scope of application of article 22.2 of the LSSI, either in the cookie policy or

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/13








in the privacy policy itself (example: “This website uses cookies that allow
have the operation and the provision of the services offered therein ")".


Therefore, we consider that our website complies with the recommendations es-
established by the AEPD in this regard. Of course, as the agreement itself warns
of initiation, as information about these cookies was not offered on our website, no
It was possible for the AEPD to verify that they were necessary cookies. Thus,
We must clarify that all those cookies (the 11 identified) are technical cookies or
necessary for the proper functioning of the web, among other things so that the page

can not record the consents given by users on the use of
cookies.

Thus, in accordance with the provisions of art. 22.2 LSSI, it is not necessary to collect
the prior consent of the user for its use. Specifically, cookies in

question are listed below

ww_jid This cookie is used for troubleshooting and error identification
res on the website. www.westwing. is required Cookie.

OptanonConsent This cookie is set by the cookie compliance solution of

OneTrust. Stores information about the categories of cookies used by the site and
whether visitors have given or withdrawn their consent to the use of each category.
This allows site owners to prevent cookies of each type from being set.
theory in the user's browser, when consent is not given. The cookie has-
It has a normal lifespan of one year, so returning visitors to the site remember

they will give their preferences. It does not contain information that can identify the visitor of the
site. www.westwing. is Required Cookie 1 To reduce the size of the box, it is not
has included the information regarding the activity or duration of the cookies that, notwithstanding
Therefore, it can be found in the complete table in the Cookies Policy of the page.
gina web and is also indicated in the web cookie control panel.


PHPSESSID This cookie is necessary to maintain a login status
for a customer when visiting the website. www.westwing. is required Cookie.

ww_ft_newsmartba nner This is a cookie that enables or disables certain functions
tions. The cookie does not contain any personal data and is necessary to optimize the

best customer experience on our website. www.westwing. is Cookie required
gives.

ww_ft_cdppdp It is a cookie that enables or disables certain features, not with
has no personal information and is necessary to optimize the best experience

of the customer on our website. www.westwing. is Cookie required

ww_ft_MyAccountA pp It is a cookie that enables or disables certain features,
does not contain any personal information and is necessary to optimize the best experience.
customer experience on our website. www.westwing. is required Cookie.


ww_ft_gdpr This is a cookie that enables or disables certain functions. The
cookie does not contain any personal data and is necessary to optimize the best experience
customer experience on our website. www.westwing. is required Cookie.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/13









ww_ft_header2 This is a cookie that enables or disables certain functions. The
cookie does not contain any personal data and is necessary to optimize the best experience

customer experience on our website. www.westwing. is required Cookie.

deviceName_2019_09 The user's device type persists (host computer)
desktop, tablet or phone) to optimize the user experience on our site

Web. www.westwing. is required Cookie.


abtest_variant_ * Cookie to perform ab-tests of internal behavior.

www.westwing. is Cookie required


OptanonConsent_bk p This cookie is set by the compliance solution for
OneTrust cookies. Stores information about the categories of cookies used by
za the site and whether visitors have given or withdrawn their consent to the use of each
category. This www.westwing. en Required cookie allows site owners
prevent cookies of each category from being set in the user's browser,
when your consent is not given. The cookie has a normal shelf life of one year,

so returning visitors will remember your preferences. It does not have
information that can identify the site visitor.

All that information is accessible on the web in various ways. From the outset, access
giving the cookie configuration panel from the initial information banner,

that appears when you visit the website, and that leads to a program to manage
granular cookies, in which you can find detailed information about
each of the cookies that operate on the website, under the button "Information about
cookies ”: In said panel, within the“ Required Cookies ”section, you can access
refer to the information related to each of the cookies detected by the AEPD in

the tab "Cookie information", which in the image has been marked in red:
access, a menu appears in which you can access the information related to
each of the necessary cookies used by the web.

For example, in relation to the cookies that are the subject of the agreement to initiate the
sanctioning procedure, the following two examples serve: 1. OptanonConsent.

PHPSESSID. Likewise, it seems appropriate to indicate that said management panel of
Cookies is also accessible from the Cookies Policy of our website
(https://www.westwing.es/privacy-policy/), which also includes a table with in-
training on all cookies used by the website ”.


SEVENTH: On 08/07/21, by this Agency, the website is consulted
denounced, www.westwing.es verifying in the same, the following characteristics
tics about the cookie policy:

1. When entering the web for the first time, without accepting cookies or taking any action

on the page, it has been detected that cookies declared by the entity are used
as technical or necessary.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/13








2. The banner about cookies that appears on the main page of the web, has the
following message:

       “We use cookies to provide you with the best possible experience on our
       Web. Some cookies are necessary for the use of our website, while

       that others help improve your shopping experience in the future or
       determine the effectiveness of our advertising efforts. Clicking
       "Accept cookies", you accept the use of all cookies. In "Settings
       cookies "you can decide which cookies you want to allow. You can change these
       settings at any time. << Privacy Policy >> << More
       information >> << Cookie settings >> << Accept cookies >>


If you choose to go to the cookie control panel, << Cookie settings >>, you will
displays a new page where cookies can be managed in ways
granular:


Required (off)  (ON) - always active.
Performance (OFF)  (on) - pre-marked in the “OFF” option.
Functional (OFF)  (on) - pre-marked in the “OFF” option.
Marketing (OFF)  (on) - pre-marked in the “OFF” option.

<< Save selection >> << Accept all cookies >>


If the option << Save selection >> is selected, without having made any move-
movement of the cursors from the “off” position to the “on” position, thereby considering
that all non-necessary cookies (required or technical) are rejected, it is confirmed
that no new cookies are used, except those indicated above.


3.- If the "Cookies Policy" is accessed, through the link in the banner
initial on cookies, << Privacy Policy >>, the web redirects to a new page,
https://www.westwing.es/privacy-policy, where, in its tenth section, it reports on,
what are cookies, what types of cookies exist and identifies the cookies used by the
web, (its purpose and duration).


EIGHTH: On 08/18/21, the requested entity of the proposal is notified
resolution, in which it is proposed that, by the Director of the Agency
Spanish Data Protection is ARCHIVE of this procedure against the
entity WW E-SERVICES IBERIA, S.L.U. ("WESTWING"), with CIF .: B65732984,
owner of the website, www.westwing.es for alleged infringement of article 22.2 of
the LSSI.


NINTH: The resolution proposal has been notified, it has not had entry in this Agency
no written allegations thereto, in the time allotted for that purpose.

                                PROVEN FACTS


1º.- According to the claimant, regarding the cookie policy of the website,
www.westwing.es indicates that some of them with an analytical profile are installed independently
toothily of what is requested in the selector:


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/13








2º.- After consulting the web page, by this Agency, on 06/04/21, it was possible to
verify that:


        “(…) We must clarify that all these cookies are technical or necessary cookies.
        for the proper functioning of the web, among other things so that the page
        can not record the consents given by users on the use of
        cookies.

3º.- On the part of this Agency it was verified, on 08/07/21 that, upon entering the

initial page of the web, (first layer), cookies are used that, as identified,
both in the control panel and in the "Privacy Policy (cookies section)", are
Technical cookies necessary for the proper functioning of the web.

                            FOUNDATIONS OF LAW


                                     I.- Competition.

The Director of the Spanish Agency is competent to resolve this procedure
of Data Protection, in accordance with the provisions of art. 43.1, second paragraph
second, of the LSSI.


II.- On the alleged infringement regarding the "Cookies Policy"

This Agency has been able to verify that, when entering the initial page of the web, (first-
1st layer), when entering the initial page of the web, (first layer), cookies are used

that, as they are now identified in the control panel and in the “Privacy Policy
(cookies section) ”, are technical cookies, necessary for the correct functioning.
website.

In this sense, article 22.2 of the LSSI, which establishes the Rights of the

recipients of information society services, it is indicated that:

"2. Service providers may use storage devices and recu-
operation of data in terminal equipment of recipients, provided that the recipients
themselves have given their consent after they have been provided with information
clear and complete information on its use, in particular on the purposes of the treatment

of the data, in accordance with the provisions of Organic Law 15/1999, of December 13,
bre, protection of personal data.

When technically possible and effective, the consent of the recipient to
accept the data processing may be facilitated by using the parameters

from the browser or other applications.

The foregoing will not prevent possible storage or access of a technical nature to only
in order to carry out the transmission of a communication over a communication network
electronic devices or, insofar as is strictly necessary, for the provision of

an information society service expressly requested by the recipient.
River."



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/13








In the present case, based on the evidence available at this time,
It is considered that the "Cookies Policy" of the claimed website is not contradictory.
ce with the provisions of article 22.2 of the LSSI.


In this case, the judgment of the National Court, Sala de lo
Contentious-Administrative, First Section, resource 455/2011, of 11/29/2013, where-
The warning is analyzed as an act of a non-sanctioning nature, as
deduces from the foundation his right SIXTH: “It must be recognized that this Chamber and Section
tion has on some occasion qualified the warning imposed by the AEPD, in application

cation of the examined article, as a sanction (SAN of June 7, 2012, rec.
285/2010), and in other cases it has dismissed contentious-administrative appeals in
filed against resolutions analogous to the one appealed in this proceeding, without
stop at the non-sanctioning nature of the measure expressed (SSAN of January 20,
ro 2013, rec. 577/2011, and of March 20, 2013, rec. 421/2011).


However, the specific terms in which the controversy has arisen in the
This contentious-administrative appeal leads this Chamber to the conclusions ex-
put, thus correcting the doctrine that until now had presided over the application
of article 45.6 of the LOPD. Well, in the case at hand, the specific assumption
to, from among those expressed in the fifth section of article 45, accepted by the resolution

Administrative action appealed to justify the application of article 45.6 of the LOPD
is the first, because it appreciates "a qualified decrease in the guilt of the accused
taking into account that there is no relevant link between the activity of the
linked to the processing of personal data, its volume of
business or activity and there are no benefits obtained as a result of the

sion of the infringement ”, as expressed in its legal basis VII.

Therefore, in the circumstances that allowed the application of article 45.6
of the LOPD, proceeded to "warn" or require the accused to carry out
the corrective measures that the Spanish Data Protection Agency considers

pertinent, in substitution of the sanction that otherwise would have corresponded.

However, since it was proven that the claimed party on initiative
pia had already taken a series of corrective measures, which it communicated to the Agency
Spanish Data Protection Agency, and that it had verified that the data of the
nunciante were no longer locatable on the website of the defendant, the Spanish Agency for

Data Protection did not consider it appropriate to impose on the accused the obligation to
carry out other corrective measures, so it did not agree to any requirement in
such sense. Remember that upon having knowledge of the complaint the entity complains-
da, he proceeded on his own initiative to contact Google to have the URL removed
where the Magazine and the article were reproduced, to ask their collaborators to submit

any name of their articles or any other susceptible information
to seem personal data and that they will review the appointments in the private area of the web to
delete any other sensitive data, and, finally, to review the configuration of the accesses
These are so that search engines would not have access to the Magazines.


Consequently, if the Spanish Agency for Data Protection considered adopted
and to the pertinent corrective measures in the case, as it occurred, as expressed in the
appealed resolution, the administrative action proceeding in Law was to the file
of the actions, without practicing any warning or requirement to the entity

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/13








denounced, as it follows from the correct interpretation of article 45.6 of the
LOPD, attended to its systematic and teleological interpretation. On the contrary, the resolution
appealed administrative action proceeded to "warn", although without imposing the obligation

to adopt any corrective measure, which can only be interpreted as the im-
position of a "warning", well understood as a warning, that is, as
sanction, or as a mere requirement without purpose. In the first case we would find-
faced with the imposition of a sanction not provided for in the LOPD, with manifest infringement
tion of the principles of legality and typicity in sanctioning matters, provided for in the
Articles 127 and 129 of Law 30/1992, of November 26, on the Legal Regime of

the Public Administrations and the Common Administrative Procedure, and in the second
Second assumption before an act of impossible content, null by right, of
conformity with the provisions of article 62.1.c) of the Law. "

This sentence interprets or links a warning with the requirement of an action

to correct the infraction, and if there is no such requirement, because the
expected measures related to the infringement, in this case, the adaptation of the
cookie policy to current legislation, the procedure should be archived, such and
as can be deduced from the SIXTH foundation of the cited Judgment.

Therefore, in the present case, after the analysis carried out on the website object

of the claim, the documents provided and the concurrent circumstances, not
there is evidence of a violation of current legislation on the cookie policy of the website.
claimed web page.

In view of the above, the following is issued:


                                      RESOLVES:

ARCHIVE: the present sanctioning procedure to the entity, WW E-SERVICES
IBERIA, S.L.U. ("WESTWING"), with CIF .: B65732984, owner of the website,

www.westwing.es, for alleged infringement of article 22.2 of the LSSI.

NOTIFY: this resolution to the entity, WW E-SERVICES IBERIA, S.L.U.
("WESTWING"), and inform the claimant.

In accordance with the provisions of article 50 of the LOPDPGDD, this Re-

solution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the
LOPDPGDD, and in accordance with the provisions of article 123 of the LPACAP, the
The interested parties may file, optionally, an appeal for reconsideration before the Director

of the Spanish Agency for Data Protection within a month from
the day after notification of this resolution or directly contentious appeal
administrative before the Contentious-Administrative Chamber of the National Court,
in accordance with the provisions of article 25 and section 5 of the additional provision
Fourth nal of Law 29/1998, of July 13, regulating the Contentious Jurisdiction-

administrative, within a period of two months from the day following the notification
tion of this act, as provided in article 46.1 of the aforementioned Law.

Mar Spain Martí

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/13











Director of the Spanish Agency for Data Protection.















































































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es