AEPD (Spain) - PS/00493/2020

AEPD (Spain) - PS/00493/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	28.12.2021
Fine:	6000 EUR
Parties:	Real Club Naútico de Ribadeo
National Case Number/Name:	PS/00493/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	FA

The Spanish DPA fined a boating club €6000 for publishing a copy of a judgment containing the personal data of an individual without a valid legal basis under Article 6(1) GDPR.

English Summary

Facts

In September 2019, an individual filed a complaint with the Spanish DPA (AEPD) against a boating club regarding the publication of a non-redacted judgment containing their personal data by the club on its website and Facebook page.

In January 2020, after receiving a notice informing it of the investigation, the boating club responded that it removed the link to the judgment from the relevant pages, but argued that it nonetheless considered the publication to have been lawful due to the legitimate interest (per Article 6(1)(f) GDPR) it pursued.

However, in June 2020 the claimant provided evidence to the AEPD that the judgment was still available on the website if one entered its name into Google search.

Holding

In light of the above, the Spanish DPA held that the boating club unlawfully published the copy of the judgment containing the personal data of the individual, as it could not base such processing on a valid legal basis under Article 6(1) GDPR. It rejected the argument of the boating club that the publication was lawful under Article 6(1)(f) GDPR, citing the judgment in C-13/16 (‘Rīgas satiksme') as the appropriate test to be followed to determine whether processing can be based on legitimate interest:

"first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence.

After a balancing of the public's right to information against the complainant's fundamental right to the protection of their data, the AEPD held that the public benefit in publishing the judgment was insufficient to base the publication on legitimate interest per Article 6(1)(f) GDPR.

As such, the AEPD imposed a fine of €6000 on the boating club for its infringement of Article 6(1) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                               1/16










 File No.: PS/00493/2020


                  RESOLUTION OF PUNISHMENT PROCEDURE

From the procedure instructed by the Spanish Agency for Data Protection and based on the
following


                                     BACKGROUND

FIRST: A.A.A. (hereinafter, the claimant) filed a claim on 09/24/2019
before the Spanish Agency for Data Protection. The claim is directed against REAL
RIBADEO NAUTICAL CLUB with NIF G27122514 (hereinafter, the claimed). The

The reasons on which the claim is based are the publication on the website and on Facebook of the
claimed, of the judgment XXX/2019 of the (...) of *** DATE.1 that contains your data
personal and those of other people, without anonymizing, even having been appealed (...) by
he. The sentence against that of the ***COURT.1 of ***DATE.2, fully upheld the claim
action filed by the claimant against the respondent, declaring that the fundamental right
fundamental association of the actor and the nullity of the resolution issued by the defendant. Re-

the one of the Hearing, appellant the claimed, the sanction of suspension of the ***CONDI-
TION.1 with accessory (...), having been the claimant in period XXXX/YYYY,
***POST.1 of the claimed Club. The ruling classifies some actions of the
claimant as “(…)” and (…). It also refers to data from other people, such as the previous one
*** POSITION 2 of the Club to which another disciplinary was also instructed, or the holder of a

vessel that was in (...) and data of persons identifiable as "The (...)". The
Judgment partially upholds the claims of the defendant.

Provides a copy of the impression of the website and Facebook page of the respondent, in which
3/05 the sentence is mentioned with a link to access it, with reference to

sheet printing date of 12/08.


SECOND: In accordance with the mechanism prior to the admission for processing of the
claims made before the AEPD, provided for in article 65.4 of the Organic Law
3/2018, of 5/12, on the Protection of Personal Data and guarantee of digital rights (in

hereinafter, LOPDGDD), which consists of transferring them to the Delegates of
Protection of Data designated by those responsible or in charge of the treatment, or to
these when they have not appointed them, and with the purpose indicated in the aforementioned article,
the ***DATE.3 of your claim E/9792/2019 was transferred to the respondent so that
proceed to its analysis and respond within a month. The respondent did not agree to

the telematic notification, being the automatic rejection date 8/11/2019. turned to
send by postal notification on 8/11/2019.

On 01/14/2020, the respondent responded to this request, stating:


1) As a precaution they have canceled the links that allowed access to the full text of the
judgment of the Club's website as well as FACEBOOK. It accompanies documents 1 and
2. In the copy of 1, it contains the page on which the owner still leaves to prove the withdrawal
informative in which it appears "the (...) sentence that the Real Club náutico de Ribadeo fulfilled

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/16








with all the legal precepts for the (...) of Mr. A.A.A., ratifies the disciplinary file
nario initiated at (...), so you will not be able to (...)”. “It is magnificent news that will be given
own account in detail at our next assembly in August”, while

after in "here you can see the sentence" nothing appears, declaring the defendant who has
the link has been disabled. In 2, that mention is also appreciated.

2) Add that the publication is made based on article 6.1 f) of the RGPD. The treatment
of data is necessary, since public communication is essential for achieving
of the legitimate interest pursued. Has a legitimate interest in publicly denouncing

some serious acts committed by (...) of the Club, which damaged the image of the entity
and its assets, the content of the ruling being convincing in recognizing not only
irregularities but even actions that could entail a criminal offence.

Regarding the weighting of the rights and interests in conflict, they will be taken into account:

ta:

The information is true as long as it appears incorporated in a non-revoked judicial resolution.
given to the date of the date, the sentence does not contain any sensitive data, to the content of the sen-
possession had public access, not through the publications made by the defendant
but from social media.


3) Attach a copy of information disclosed by means of social communication as do-
Documents 3,4,5 and 6 (digital newspapers (...), “***DIARIO.1”, “***DIARIO.2” and “***DIARIO.3” indi-
stating that all of them are prior to the publication made "by this entity on the day ***FE-
CHA.4”. Thus appears one of ***DATE.5 of the “***DIARIO.2” with the name of the claimant and the

headline (…). The news commented on various aspects of the judicial resolution connected with the
Club management.

It indicates that the dissemination on its FACEBOOK page only reached 444 people. document
7, and that the news posted on the Club's website reached 138 people, documents

ment 8.


THIRD: On 03/13/2020, after analyzing the documentation that was in the
file, resolution E/09792/2019 was issued by the Director of the AEPD, agreeing on the
claim file. The resolution was notified to the claimant and claimed, to the first

on 06/15/2020, considering the suspension of deadlines due to the state of alarm, and
according to receipt notice that appears in the file.


FOURTH: On 07/08/2020, RR 302/2020 was filed with the AEPD.

of the claimant against the file resolution, in which he shows his disagreement with the
contested resolution, arguing -among other arguments- that the judgment
continues to be published on the website of the respondent as of 06/29/2020 through the following
link:
***URL.1, the result of entering the words “judgment

***SENTENCIA.1”, (page 194/220) being the website found for the defendant. Accompany the
search result with screen print and access to a 21-page pdf
with the sentence as document 1 and 2, with the date printed on the left side
of the sheet.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/16









The appeal is signed on 12/17/2020, estimating and agreeing the admission for processing of the

claim.


FIFTH: On 03/24/2021, the director of the AEPD agreed:


       “INITIATE PUNISHMENT PROCEDURE against REAL CLUB NÁÚTICO DE
RIBADEO, with NIF G27122514, for the alleged infringement of article 6.1 of the RGPD of
in accordance with article 83.5.a) of the RGPD.

"For the purposes specified in the art. 64.2 b) of Law 39/2015, of October 1, of the

Common Administrative Procedure of the Public Administrations, the sanction that
could correspond would be a fine of 6,000 euros (six thousand euros) without prejudice to what
result of the instruction.

Regarding the notification of the start agreement, the certificate of the

provider of the notification service and authorized electronic address, of the Factory
National Currency and Stamp of 04/05/2021, of which the notification is sent to the claimed
with availability 03/25/2021 and automatic rejection date 04/05/2021 that is
produced after 10 calendar days have elapsed since it was made available for
access according to paragraph two article 43 of law 39/2015 of 1/10.



No claims are received.

SIXTH: On 11/10/2021, a resolution proposal is formulated with the literal:


“That the Director of the Spanish Agency for Data Protection sanction REAL
CLUB NAUTICO DE RIBADEO, with NIF G27122514, for an infringement of article 6.1 of the
RGPD, typified in article 83.5 of the RGPD, and for prescription purposes in article
72.1.b) of the LOPDGDD with a fine of 6,000 euros.”


In it, it was stated:

“This proposal is sent by postal mail with the extraordinary purpose that
know the notification, although Law 39/2015, of 1/10, of Administrative Procedure

Common of the Public Administrations, (LPCAP) establishes the obligation for the
legal entities, including associations, to be related
electronically with the Public Administrations. At the same time, in order to
effective compliance with the measures that may be recorded in the
resolution, if the infraction is confirmed, so that the infraction is not repeated or stops

occur, since in accordance with article 58.2 d) of the RGPD, each control authority
may “order the person responsible or in charge of the treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate, in accordance with
a certain way and within a specified period…”.


You are also informed that the resolution will be notified electronically.”



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/16









SEVENTH: On 12/2/2021, allegations are received stating:



1) The situation that gave rise to the complaint originates from an existing conflict between the
(...) of which the claimant was part and the one that preceded him (claimant during the period
X-XX-XX to X-XX-XX and B.B.B. during the period X-XX-XX to XX-XX-XX). This new (...),
from his inauguration, until the arrival of the motion for a resolution, it was only
aware that, at the end of her predecessor's mandate, the AEPD had initiated a

file at the request of the claimant, "and that it had been archived after completing the Club
the indications of the Agency.

It is therefore now, when this (...) is aware of the reopening of the file already
that she was not informed of this by the claimant nor did she receive any notification from the AEPD. No

no electronic notification has been received, or at least there is no record of it, regarding
this particular, as things are, it should be noted that an email has been activated to interact
with the Tax Agency, from 12/27/2019, being the replacement appeal dated
07-1-20 and the admission for processing of the claim on 12-17-20. Provide a "certificate
maintenance telephone data and electronic address to receive notices from the AEAT ", in
that they provide an email address and a mobile phone for sending

informative notices, and paths crosses in the HIGH section.


2) Prescription of the infraction. Complaint of 09/24/2019, which gave rise to the resolution
notified to the claimant on 06/15/2020, E/9792/2019, which appeals for reconsideration,

resolving on 12/17/2020 the admission to processing of the claim. Dated 03/24/2021
it was agreed “to restart the procedure that has not been effectively notified to this party
until 11/18/2021, that is, two years and two months after the initial complaint, one year and
five months from the reversal appeal.”


“There being no term for the “a quo day”, it is necessary to resort to the applicable supplementary rule,
Article 30, section 2, of Law 40/2015, of 1/10, indicates that "the limitation period for
infractions will begin to be counted from the day on which the infraction was committed.
task. In the case of continuous or permanent infractions, the term will begin to
run since the offending conduct ended.


“The limitation period for fines of less than 40,000 euros is one year according to Regulation
(EU) 2016/679 and article 78 Organic Law 3/2018, of December 5. According to Article 75.
Interruption of the prescription of the infraction:

“The prescription shall be interrupted by the initiation, with the knowledge of the interested party, of the

sanctioning procedure, restarting the prescription period if the file
sanctioning party is paralyzed for more than six months for reasons not attributable to the
alleged offender."



3) “Public nature of the ***POSITION.1 of the entity”, the ***POSITION.1 “(…) of the entity and
to whom he entrusts his statute (literally) (...). Mentions article XX of the
statutes that correlates the representation of the *** POSITION.1 of the Club before people
physical or legal, (...). Provide a copy of the Statutes.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/16









4) The claimant (...) as ***POSITION.1 of the Club and as (...) years before the
described circumstances. You can make a quick query through the internet browser,

so that the person has (...). Accompanies four news urls from several years before
of the publication of the judgment on its website.

The facts related in the sentence created a situation of enormous conflict and
had within the Club, and therefore "in the town of Ribadeo and region" a large
public transcendence, both due to the relevance of the characters and the

institution. The conflict was widely followed in the media.
publishing all the parties the vicissitudes of each and every one of the details of the
conflict. The facts related to the imputation caused a relevant consternation
in the area and especially among members. There are multiple news links that
They follow the procedure from the beginning.


5) The judicial procedure was not only directed against him but also because he had
expelled (...) that were processed in different procedures with different results.

 Although the (...) in the judgment of first instance declared the nullity of the (...), the (...)
revoked the sentence, which has been confirmed (…). However, it should be noted that the

resolutions contained inculpatory and exculpatory elements and it was considered that their
publication turned out to offer the most objective information, without any personal data
different from those who were already in the media transcended, since the
The only personal information was the name of the (...).


There are many links that collect the evolution of the procedure in which the
interested party, despite not holding the position, makes public statements about it, without
object to being mentioned by name, including including a photograph in the
news, for example in the news of 20XX on the first judicial resolution of the Court,
there is the news that a judge annuls the sanction against the (...) of the Ribadeo Nautical Club and

of the news echoes the “(…)”, when “(…)” Provides a copy of the link in the ***DIARIO.2.

The resolution was also reported in the local and provincial media.
of the Hearing (...) that give it a certain complexity because it corrects, the previous one and declares
proceeding (...), and also includes exculpatory elements. Provide a link to the newspaper ***DIA-
RIO.2 in which it indicates the news that is transposed:

(...).
(...).

Also the sentence (...) in the news that appears includes the full name of (...). Contribute
the link see the news of ***DIARIO.3 on this resolution (...).



6) There is a legitimate interest of the person claimed in the treatment covered by article 6.1. F)
of the RGPD, alluding to the fact that it was a controversial situation between the previous two (...) that
resulted in the annulment of the sanctions to ***POST.2 and ***POST.3 but that
they kept the (...) of the ***POST.1.


There was an obvious legitimate interest in safeguarding the prestige of the entity that obviously
includes his public image being the (...) a public figure, reiterating his relevance
public that derives from the Statutes.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/16









It was considered by the then ***PUESTO.1, appropriate to transfer the full text of the
statement on the Club's website for more information on its members, since

that this whole thing was causing a huge stir in the entity and is a means
provided, considering that it does not contain "any personal information that affects
to the private life of the (...) expelled, public figure”, echoing the media
communication from the first resolution that was favorable. A partial translation of the
information could have been interpreted as a bias in favor of the performance of the, in
new at that time (...), since "not all the irregularities

detected”. The publication in its entirety of content in the computer media
intended the truthful information about what happened, action proportionate to the end pursued,
of special relevance for the 900 members, more than half reside outside Ribadeo, and
interested in the activities of the Club, who, being largely vacationers who only
they resided for a time, they did not have an easy reach of being known when they were published in the media

local and regional.

7) “In the resolution that is transferred to us, there is not a single personal data that affects the
complainant's private life. There is no home address, email or
number of personal identification. “The information contained in the sentence is referred to
in the regional press in great detail”



8) “This (...) contacts the technician who maintains the page and asks him to check the
facts and eliminate any access that could have been hidden to the sentence”,
“find the statement file in the media library so the document

although it was no longer accessible from the web, it was still available through links
indexed in search engines, deleting the file from the folder.” “It is no longer accessible from
the seekers”. He considers that at the time they canceled the website he did not have
adequate knowledge because he was unaware of the existence of the media library, and
Although they acted in good faith, I was not aware of that aspect, considering that there was no intent.

A call to the Club could have led to the definitive deletion of the file. "The
reopening of the file is produced by the survival of an indirect channel -Google- by the
that the sentence was still being accessed, due to a technical error, not to bad will, and
The Club received no notification of the problem.

9) The entity is a non-profit sports association.


It also provides:

- The news that result from the indicated links.


-Copy of "actions on the website of the claimed" in which it is stated that an order was given
delete the document, which checks the web and that “it had been deleted from the web, the entry in the
that said document appeared and had even deleted from the ticket bin. But,
surely due to ignorance on the matter, he had not eliminated the document from the
media page. So the document, although not from the web, was still

available from links indexed in search engines” “We proceeded to eliminate
of said document from the media area, being totally inaccessible”.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/16








                                    PROVEN FACTS

1) On 09/24/2019, the claimant claims against the respondent for being exposed in

open in pdf format, on its website and on its Facebook, on 05/03/2019, a sentence of
the (...) of ***DATE.1 that contains your personal data, also stating that you had
been appealed (...). The sentence resolves at the request of the defendant the appeal on the
sanction of suspension of the ***CONDITION.1 of three years with (...) who had been
imposed by the claimant. The claimant was in the period ***PERIODO.1, ***POSITION.1
of the claimed Club, and the sanction originates because the new (...) arising from the elections of

November XXXX detects a series of irregularities that end in the sanction imposed on the
reclaimed. The sentence reviews the actions of the claimant in different matters
related to the management of the Club (...), its repercussion with (...) the Club, and if it appears
justified sanction.


In the sentence, the then *** position 2 of the Club is made identifiable, also informing
disciplinary file was followed.

2) Although after the transfer of the claim to the respondent made by the AEPD, the
claimed on 01/14/2020 that it had canceled the access links to the full text of
both links, the claimant proves, by entering 06/29/2020 in the search engine

GOOGLE the words “sentencia ***SENTENCIA.1” the return of the url
***URL.1, which is a 21-page pdf with the judgment object of the claim.

3) The digital media (...) exposed the news of the sentence as
example, on ***DATE.5 with the name of the claimant and the headline “(…)” and that the claimant

he states that he will appeal it (...). The news commented on various aspects of the judicial resolution
connected with the management of the Club.

4) After the proposal, the respondent states that she removed the document that enabled the
access in the browser.


                               FOUNDATIONS OF LAW

                                                I

By virtue of the powers that article 58.2 of Regulation (EU) 2016/679 of the Parliament

European and Council of 04/27/2016 regarding the protection of natural persons in the
regarding the processing of personal data and the free circulation of these data (as far
hereafter, GDPR); recognizes each control authority, and according to what is established in the articles
Articles 47 and 48 of Organic Law 3/2018, of 5/12, on the Protection of Personal Data and ga-
guarantee of digital rights (hereinafter LOPDGDD), the Director of the Agencia Es-

Spanish Data Protection Authority is competent to initiate and resolve this procedure.
unto

                                               II


On the fact that the initiation agreement was not notified, there is a certificate from the Fa-
National Currency and Stamp Factory that verifies its availability, with respect to a
entity obliged to communicate with these means. It is also credited that on other occasions
telematic shipments have been produced to the claimed, and he did not access them either.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/16








mos. The method of sending the proposal was made in order to facilitate the knowledge and defense
sa of your rights to avoid non-collection of the shipment again. The initiation agreement notifies
and the passage of time without accessing it produces the effects of having been notified

fallen.
Regarding the prescription of the infraction, it is taken as the end date of the same, and as

more favorable to the claimant, since it does not provide the date of completion of the data deletion, the
of the notified proposal, which serves for the cessation of the infraction: 11/18/2021, and this
Infraction carries a three-year statute of limitations, according to the article of the LO-
PDGDD. Counting from any date, filing of the claim: 09/24/2019, fe-
the date in which he responded to the transfer, or that of 01/14/2020 in which he stated that they had been eliminated

data, or from the date of agreement to start the sanctioning procedure,
03/24/2021, the infraction would not be prescribed, as article 72.1.b) of
the LOPDGDD.









                                                III


The RGPD defines in its article 4:


1) "personal data": any information about an identified or identifiable natural person
("the interested"); An identifiable natural person shall be deemed to be any person whose identity

can be determined, directly or indirectly, in particular by means of an identifier, such as
for example a name, an identification number, location data, an identifier
online or one or more elements of the physical, physiological, genetic,
psychic, economic, cultural or social of said person;”


  2) “processing”: any operation or set of operations performed on data
personal data or sets of personal data, whether by automated procedures or not,
such as the collection, registration, organization, structuring, conservation, adaptation or
modification, extraction, consultation, use, communication by transmission, diffusion or
any other form of authorization of access, collation or interconnection, limitation, suppression or
destruction;


  7) “controller” or “controller”: the natural or legal person, authority
public, service or other body that, alone or jointly with others, determines the ends and means
of the treatment; if the law of the Union or of the Member States determines the purposes and
means of treatment, the person responsible for treatment or the specific criteria for its

appointment may be established by the Law of the Union or of the Member States;

The defendant exposes a complete sentence with the data of a person, member of the Club to the
that (...), and (...) of the Club that appeared in two spaces, the website and FACEBOOK of the claimed party, if
well as of 06/29/2020, it only refers to the website of the claimed party when a
search in the GOOGLE search engine with the terms “sentencia ***SENTENCIA.1”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/16








The defendant had stated in the previous transfer that she had removed the links
precautionary to the sentence.

These facts suppose the commission of the defendant of an infraction of article 6.1 of the

RGPD that indicate the legitimate bases for the treatment:
"one. The treatment will only be lawful if at least one of the following conditions is met:


a) the interested party gave his consent for the processing of his personal data for one
or several specific purposes;

b) the treatment is necessary for the execution of a contract in which the interested party is
part or for the application at the request of the latter of pre-contractual measures;


c) the treatment is necessary for the fulfillment of a legal obligation applicable to the
data controller;

d) the treatment is necessary to protect the vital interests of the interested party or another
Physical person;


e) the treatment is necessary for the fulfillment of a mission carried out in the interest
public or in the exercise of public powers vested in the data controller;

f) the treatment is necessary for the satisfaction of legitimate interests pursued by the

responsible for the treatment or by a third party, provided that said interests are not
prevail the interests or the fundamental rights and freedoms of the interested party that
require the protection of personal data, in particular when the interested party is a child.”

The defendant, a party to the civil judicial proceeding, establishes the technical and
organizational and decides as responsible to enable access to the judgment in full with
all personal data when adding it to your website and on FACEBOOK. Probably
was not properly deindexed and is accessible through search engines,

throwing the same literal as when the links existed. The sentence treats the data of the
claimant in relation to the challenge of the disciplinary sanction imposed by the
claimed, sports association. The (...) of the Club that succeeded that of the claimant, detected
a series of irregularities and initiated the aforementioned disciplinary file. The judgment reviews
the actions of the imputed claimant reproaching him for his conduct in the management of the

Club affairs. It refers to the right of association and the private disciplinary sphere and the
application and statutory legitimacy of the Club.

The defendant is the one who exposed it in the open, not only for the partners, the sentence.

 He argues in the transfer of the claim that there was in his day, as a legitimizing basis, the

article 6.1.f) of the RGPD considering that your right to information and
has a legitimate interest in communicating the facts to the general public, (...), adding that
days before several written media outlets had echoed the news
identifying the claimant with the facts.

To be legitimate data processing based on legitimate interest, three must be fulfilled:
cumulative requirements, namely, first, that the data controller or third party
zero or third parties to whom the data is communicated pursue a legitimate interest; second
Firstly, the need to process personal data to satisfy the legitimate interest

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/16








persecuted, and, thirdly, the requirement that rights and freedoms do not prevail.
fundamental rights of the interested party (judgment of May 4, 2017, Rīgas satiksme, C-
13/16, EU:C:2017:336, paragraph 28).

In this case, the concurrence of two fundamental rights recognized in the
Constitution: the fundamental right to the protection of personal data of the
people whose data appear collected in the judicial resolutions, mainly the

claimant and the fundamental right to freedom of information of the association, the Club
that publishes collide and the defendant considers that he has the right to the aforementioned
exposition. However, the relevance of the position and responsibility of the claimant is not
public character, it is an association, in fact the news is offered in local newspapers,
It is not a criminal matter either, but a civil matter that concerns the members of the Club, and it must be
question whether said purpose of informing can be feasible without exposing personal data

contained in a sentence in which one has been a claimed party and at the same time
disciplinary instructor, and if this is in accordance with the principle of proportionality and
adequacy in the use of the data.

On the other hand, this prevalence among rights must be based on exceptions to the
application of data protection regulations “only to the extent that they result

necessary to reconcile the right to privacy with the rules governing the freedom of
expression and information. In this sense, and expressing ourselves in the terminology
established in the LOPDGDD, the exceptions to the application of said rule must
be understood as manifestations of the principle of proportionality, enshrined in the
Article 5.1 c) of the Organic Law, according to which "Personal data will only be
may collect for treatment, as well as submit them to such treatment, when they are

adequate, relevant and not excessive in relation to the scope and purposes
determined, explicit and legitimate for which they have been obtained”. Does this mean that
The disclosure of information containing personal data should be considered lawful.
in the cases and areas in which said disclosure is adequate, pertinent and
not excessive in relation to the free exercise of freedom of information. In this way, the
information to be disclosed should be that which is necessary so that information

are relevant to the interests of the association can be known by their
members, understanding public relevance as that which serves the general interest in the
information and does so by referring to a public matter such as facts or events that
affect all citizens.

However, this is not about expressing information or communicating facts that are not

discussed are real, but a document, the sentence integrates in open, with all the
details, not aspects or comments of it, which are exposed outside the circle of
Club members, to whom the Statutes are applicable, and in pdf format which means more
versatility in sending, downloading and forwarding. The information of the management of the association,
the loss of their property or assets affects the 900 associated with said entity, by
circle to which the management of those interests reaches and they could have been informed of the

sense of it. The respondent indicates that since many of the partners do not reside in the
municipality, and that the integrated publication contributes to the objectivity of the information, being
reasons for exposure. It is not disputed that it may be important and that they are the
partners who must be informed and could have had knowledge, although it could be
and the scope of exposure, knowledge, should have been limited only to associates, not
There is a need for universal dissemination of the same, in the aforementioned format. With the

exposure of discloses the data of the claimant in the exercise of their functions
of the association and the information of its management that concerns the associates in a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/16








civil matter. Proportionality is not fulfilled in the treatment for the purpose of
inform the partners and the affected rights of the claimant are not considered, so
the prevalence of the legitimate interest in the open exhibition of the

civil sentence integrates and its possible consultation in the search engine.

On the other hand, the fact that the judicial proceedings are public does not justify that these data
were revealed in an area other than the judicial process, and that they are exposed in addition to
a complete form outside the scope in which it is properly affected and concerned by
the performances of the (...).

It has been the defendant who has decided to include a copy of the effective judgment on his website.
performing a technical operation in which it has made it possible for anyone to have
Knowledge of the sentence integrates with the data of the claimant. For this, the claimed
associated the sentence to its website, considering that the automated treatment by which

offers on its website and through the search engine, obtaining the sentence is a treatment of
data.

In the present case, moreover, the judgment was not final, his appeal was pending.
The respondent treats the claimant's data exposing the entirety of the sentence in its
open web, not restricted to its partners. In this case, the information exercise of the
claimed is only related to the faculties it represents, its associates and the

management related to them. The prevalence of the right to freedom of information
on the right to data protection must be interpreted consistently with what is
provided in the data protection regulations, considering this exception to the
application of data protection regulations only to the extent that they result
necessary to reconcile the right to privacy with the rules governing the freedom of
expression and information. In this sense, to inform, in this case the sentence

integrates, completely dealing with everything related to the matter in an irrelevant way
and excessive by an entity that represents the interests of a group, individuals, a
association not of a public nature, and treating the data for all people by having
universal access on its website, not being a criminal matter but an internal disciplinary one,
considering that the treatment that takes place through the incorporation and

automation of the consultation on its website, does not respond to the scheme of article 6.1.f) of the
RGPD, since the right to know the full sentence does not prevail by any person,
on the affected party's right to privacy, given the broad terms in which it is
produces, not necessary in its universal dissemination when it affected the interests and efforts
of the associates. The ***POSITION.1 represents the institution, both in public spheres

as private, against individuals or legal entities, private or public, which does not mean
that is or holds in itself a public representation as claimed by the defendant. The right
of the claimant, so that their data is not used either in a surprising way, or in
social networks, or web associated with an integral sentence with access for third parties must
then prevail over the general exposure obtained from the search.

Therefore, the allegation of the defendant of legitimacy of data processing is not upheld.
of the publication of the full judgment of the claimant as optional based on his interest
alleged legitimate


                                               IV


Article 83.5 a) of the RGPD, considers that the infringement of “the basic principles for the

treatment, including the conditions for consent under articles 5, 6, 7 and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/16








9” is punishable, in accordance with section 5 of the aforementioned article 83 of the aforementioned Regulation.
regulation, with administrative fines of a maximum of €20,000,000 or, in the case of a
company, of an amount equivalent to a maximum of 4% of the total turnover

annual global of the previous financial year, opting for the highest amount.
Article 58.2 of the RGPD provides: "Each control authority will have all the

following corrective powers indicated below:

        d) order the person in charge or in charge of the treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate, in accordance with
a certain way and within a specified period;


        i) impose an administrative fine under article 83, in addition to or instead of
the measures mentioned in this section, according to the circumstances of each case
particular;

        The infraction is typified in article 72 of the LOPDGDD, which indicates:


"one. Based on the provisions of article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that suppose a
substantial violation of the articles mentioned therein and, in particular, the following:


b) The processing of personal data without the concurrence of any of the conditions of legality
of the treatment established in article 6 of Regulation (EU) 2016/679.”


                                                v


The determination of the sanctions that should be imposed in this case requires observing
the provisions of articles 83.1 and 2 of the RGPD, precepts that, respectively, have
ne the following:

    "one. Each control authority will guarantee that the imposition of administrative fines
in accordance with this article for the infringements of this Regulation indicated in
sections 4, 9 and 6 are in each individual case effective, proportionate and dissuasive.”

    "two. Administrative fines will be imposed, depending on the circumstances of each

individual case, in addition to or as a substitute for the measures referred to in article 58,
section 2, letters a) to h) and j). When deciding to impose an administrative fine and its amount
aunt in each individual case will be duly taken into account:


a) the nature, seriousness and duration of the offence, taking into account the nature,
scope or purpose of the treatment operation in question, as well as the number of
affected parties and the level of damages they have suffered;

b) intentionality or negligence in the infringement;


c) any measure taken by the controller or processor to alleviate
the damages suffered by the interested parties;

d) the degree of responsibility of the person in charge or of the person in charge of the treatment,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/16








account of the technical or organizational measures they have applied under articles
25 and 32;

e) any previous infringement committed by the person in charge or the person in charge of the treatment;


f) the degree of cooperation with the supervisory authority in order to remedy the
infringement and mitigate the possible adverse effects of the infringement;

g) the categories of personal data affected by the infringement;


h) the way in which the supervisory authority became aware of the infringement, in particular
lar if the person in charge or the person in charge notified the infringement and, if so, to what extent;

i) when the measures indicated in article 58, section 2, have been ordered
previously against the person in charge or the person in charge in question in relation to the same
matter, compliance with said measures;


j) adherence to codes of conduct under Article 40 or to certification mechanisms
fication approved in accordance with article 42, and

k) any other aggravating or mitigating factor applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or indirectly,

through the infringement.”

 Within this section, the LOPDGDD contemplates in its article 76, entitled "Sanctions and
corrective measures":

  "one. The sanctions provided for in sections 4, 5 and 6 of article 83 of the Regulation (EU)

2016/679 will be applied taking into account the graduation criteria established in the
section 2 of the aforementioned article.

  2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679, also
may be taken into account:


  a) The continuing nature of the offence.

  b) The link between the activity of the offender and the performance of data processing
personal.

  c) The profits obtained as a result of committing the offence.


  d) The possibility that the conduct of the affected party could have led to the commission of
the infringement.

  e) The existence of a merger by absorption process subsequent to the commission of the
infringement, which cannot be attributed to the absorbing entity.


  f) Affectation of the rights of minors.

  g) Have, when not mandatory, a data protection officer.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/16








  h) Submission by the person in charge or person in charge, on a voluntary basis, to
alternative conflict resolution mechanisms, in those cases in which
there are disputes between them and any interested party.


  3. It will be possible, complementary or alternatively, the adoption, when appropriate, of the
remaining corrective measures referred to in article 83.2 of the Regulation (EU)
2016/679.”

In accordance with the precepts transcribed, in order to set the amount of the sanction of a fine
to impose in the present case for the infringement of article 83.5.a) of the RGPD, of which
holds the claimed party responsible, they are considered concurrent as aggravating
following factors that reveal greater unlawfulness and/or culpability in the conduct of the
reclaimed:


-Article 83.2.a) RGPD:  Nature, seriousness and duration of the infraction taking into account
account the nature, scope or purpose of the treatment operation in question as well
such as the number of interested parties affected and the level of damages they have suffered.
suffered.


Originally, the entire sentence, despite the possibility of being able to appeal, appeared
exposed at the same time in two links, the web and the FACEBOOK page, not implementing
ultimately an effective data removal mechanism.

-Article 83.2.b) GDPR. “Intentionality or negligence in the infringement”: Aspect that

relates the execution of the action to the subject, in the sense of not only imputability of
the infraction to its responsible, but the fact of being able to aggravate or reduce the sanction according to the
degree of guilt. Regarding the imputability to the responsible subject, the principle of
guilt, prevents the admission in the sanctioning administrative law of the
strict liability, although it is also true that the absence of intentionality
It is secondary since this type of infraction is normally committed by a

guilty or negligent action which is sufficient to integrate the subjective element of the
guilt. What is valued in this section is its analysis for the graduation of the sanction (art.
40 LRJPAC), observing the specific diligence displayed in the action by the
responsible, which excludes the imposition of a sanction, solely based on the mere
result, that is to say to the principle of strict liability. The succession in the (...)s does not exempt

of the administrative responsibility for the actions produced in the preceding ones, nor
may suppose an eventual change, a blur in the enforceability of behaviors that have been
produced and recognized. Having the claimed the possibility of having acted
differently than you did, the claim was moved and not all links were removed
to the sentence, proving lack of diligence.


-Article 83.2.c) “any measure taken by the data controller or data processor

to alleviate the damages suffered by the interested parties” Failing to eliminate
of the data, it follows that it did not have adequate and effective measures to eliminate the
data.


Considering the exposed factors, the valuation reached by the fine for the im-
putada is 6,000 euros, without prejudice to what results from the instruction of the procedure.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/16









Therefore, in accordance with the applicable legislation and having assessed the graduation criteria
of the sanctions whose existence has been proven,


the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: IMPOSE REAL CLUB NÁUTICO DE RIBADEO, with NIF G27122514, by
an infringement of article 6.1 of the RGPD, in accordance with article 83.5 a) of the
RGPD and 72.1.b) of the LOPDGDD, a fine of 6,000 euros.


SECOND: NOTIFY this resolution to the REAL CLUB NÁUTICO DE RIBADEO.


THIRD: Warn the sanctioned person that he must make the imposed sanction effective once

that this resolution is enforceable, in accordance with the provisions of art. 98.1.b)
of Law 39/2015, of October 1, of the Common Administrative Procedure of the
Public Administrations (hereinafter LPACAP), within the voluntary payment period
established in art. 68 of the General Collection Regulations, approved by Royal
Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, through its entry, indicating the NIF of the sanctioned and the number of

procedure that appears in the heading of this document, in the restricted account
nº ES00 0000 0000 0000 0000000, opened in the name of the Spanish Protection Agency
of Data in the banking entity CAIXABANK, S.A.. Otherwise, it will be processed
collection in executive period


Received the notification and once executed, if the date of execution is between the
days 1 and 15 of each month, both inclusive, the term to make the voluntary payment will be
until the 20th day of the following month or immediately after, and if it is between the days
16th and last of each month, both inclusive, the payment term will be until the 5th of the second
following or immediately following business month.


In accordance with the provisions of article 50 of the LOPDGDD, this Resolution
It will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the

Interested parties may optionally file an appeal for reconsideration before the Director of
the Spanish Agency for Data Protection within a period of one month from the day
following the notification of this resolution or directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court, with
in accordance with the provisions of article 25 and section 5 of the fourth additional provision

of Law 29/1998, of July 13, regulating the Contentious-administrative Jurisdiction,
within two months from the day following the notification of this act,
according to the provisions of article 46.1 of the aforementioned Law.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, it may be

precautionary suspension of the firm decision in administrative proceedings if the interested party expresses
its intention to file a contentious-administrative appeal. If this is the case, the
The interested party must formally communicate this fact in writing addressed to the Agency
Spanish Data Protection, presenting it through the Electronic Registry of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/16









Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the

remaining records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1.
You must also transfer to the Agency the documentation that proves the filing
effectiveness of the contentious-administrative appeal. If the Agency were not aware of the

filing of the contentious-administrative appeal within two months from the day
following the notification of this resolution, it would end the suspension
precautionary



                                                                                             938-26102021
Sea Spain Marti
Director of the Spanish Data Protection Agency




















































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es