AEPD (Spain) - PS/00368/2021: Difference between revisions

Revision as of 00:25, 19 February 2022

AEPD (Spain) - PS/00368/2021

Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 13 GDPR Article 13(3) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	16/02/2022
Fine:	200000 EUR
Parties:	REAL FEDERACIÓN ESPAÑOLA DE FÚTBOL (RFEF) ASOCIACIÓN DE FUTBOLISTAS ESPAÑOLES (AFE) LIGA NACIONAL DE FÚTBOL PROFESIONAL (LNFP)
National Case Number/Name:	PS/00368/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Carmen Villarroel
The Spanish DPA fined the Spanish Football Federation €200,000 for sharing the recording of a meeting between representatives of different bodies without their knowledge and consent and for not properly informing the participants of the processing of their personal data as required by Article 13 GDPR.
English Summary

Facts

Representatives of the Spanish Football Federation (RFEF), the Association of Spanish Footballers (AFE), and the Professional Football League (LNFP) held a meeting via Zoom on April 2020 to follow-up of the COVID-19 pandemic situation and its impact on the national football landscape.
According to the Association of Spanish Footballers and the Professional Football League, the Spanish Football Federation shared the recording of such meeting with two radio broadcasters (Cadena Ser, COPE) without the knowledge and consent of the participants, who discovered it when the recordings were broadcasted a few days later.
Therefore, both the AFE and the LNFP filed several complaints with the Spanish DPA (AEPD). According to the claimants, the participants were not informed about the fact that the meeting was being recorded, and did not receive the mandatory information from Article 13 GDPR.
The RFEF (the controller) alleged that during the first meeting they held (Zoom meeting at issue was the second one - the first one was on-site) all the participants had agreed to record the meetings, and that during the Zoom meeting there was a red round sign that indicated the participants that the meeting was also being recorded, and that therefore all the participants were informed about this facts. The controller also alleged that the they had shared the recording of the meeting to refute a false statement made by the AFE.
According to the controller, the meeting was recorded in order to obtain a literal record of the meeting (the minutes), and so a press release could be published due to transparency requirements. The controller also provided a document (drafted after the second meeting) that had shared when setting the meeting that contained a data protection clause that stated that the participants consented to the recording and that the controller had a public interest to record the meetings.
Holding

With regard to the information obligation from Article 13 GDPR, the AEPD considered different issues. First, that the controller could not prove that the participants had been informed that the meeting was being recorded. It was only at the beginning of the first meeting where the representative of the controller warned the participants that the meeting was being recorded, in order to document everything that was said in the meeting. Yet, no more information was given, and the fact that future meetings would also be recorded was not mentioned. Additionally, there were participants in the second meeting that had not attended the first meeting; and during the second meeting participants were not informed about the recording.
Therefore, the controller did not and could not prove that the participants in the meeting had been informed about the processing of personal data as required by Article 13 GDPR. And, as highlighted by the DPA, the controller did not provide either the information required by Article 13(3) GDPR about further processing of the data (in this case, sharing the recording with two radio broadcasters). Therefore, the AEPD concluded that the controller had breached Article 13 GDPR.
On the other hand, the AEPD concluded that the controller had a valid legal basis for the processing of personal data in the first place, since Article 18 of the Spanish Act for the Regulation of the Public Sector (LRJSP) allows public bodies to record their meetings and to store them in order to keep a literal record of the minutes.
However, having a valid legal basis does not prevent the controller from properly informing the data subjects about all the mandatory points included in Article 13 GDPR. According to the AEPD, saying 'we are recording the meeting so we can keep record of everything that will be said' at the beginning of the meeting does not amount to providing the mandatory information, and it cannot be considered to be providing basic information about the legal basis and the purposes of the processing.
Regarding the transparency obligations of public bodies with respect to the minutes of their meetings, the AEPD noted that the obligation to disclose the minutes does not include the recording itself but a written record of certain aspects. Therefore, while this allows to record the meeting and to provide access to the written minutes, it does not allow to share the actual recording of it.
With regard to the second and subsequent processing of data, in which the recording was shared with the radio broadcasters, the AEPD highlighted Recital 50 GDPR, that states that "the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected". For this subsequent processing, the controller relied on the right to freedom of information and freedom of expression, since the controller considered that it had the legitimacy to refute the allegedly false press released by the AFE and to substantiate such refutation by providing a literal record and the recording of what was exactly said during the meeting. However, the authority reasoned that such right could have been vindicated just by sharing the written record of the meeting, and not the actual recording. In this regard, the AEPD remarked that the recording of the meeting also contained comments of a personal and private nature. Therefore, if needed, they should have shared the minimum data necessary to achieve that purpose, according to the minimization principle. Therefore, by sharing the recording of the meeting, the AEPD considered that the controller breached Article 6(1) GDPR, for processing personal data without a valid legal basis.
For the violation of Article 13 GDPR, the AEPD fined the controller €100,000. For the violation of Article 6(1) GDPR, the AEPD fined the controller another €100,000.
Comment

Share your comments here!
Further Resources

Share blogs or news articles here!
English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
                                                                                 1/74








     Procedure PS/00368/2021

                - RESOLUTION OF PUNISHMENT PROCEDURE


Through an Agreement dated 07/30/21, the sanctioning procedure was initiated,
PS/0368/2021, instructed by the Spanish Data Protection Agency to the REAL
SPANISH FOOTBALL FEDERATION, (RFEF) with CIF.: Q2878017I, (hereinafter,
"the claimed party"), by virtue of the claims presented by the ASSOCIATION
OF SPANISH FOOTBALL PLAYERS (AFE) and by the NATIONAL FOOTBALL LEAGUE

PROFESSIONAL (LNFP), (hereinafter, "the complaining parties"), for alleged
infringement of Regulation (EU) 2016/679, of the European Parliament and of the Council, of
04/27/16, regarding the Protection of Natural Persons with regard to the
Treatment of Personal Data and the Free Circulation of these Data (RGPD) and of
Organic Law 3/2018, of December 5, on the Protection of Personal Data and

guarantee of digital rights, (LOPDGDD), and based on:

                                       FACTS

FIRST: On 04/16/20, three writs of
claim, from the ASSOCIATION OF SPANISH FOOTBALL PLAYERS

(AFE), THE NATIONAL PROFESSIONAL FOOTBALL LEAGUE, and its Deputy Director to
the Presidency, indicating, among others, the following:

    - The ROYAL SPANISH FOOTBALL FEDERATION (RFEF) recorded, without
       consent of the participants, including the legal representative of the

       AFE, as well as the Deputy Director of the LNFP, a meeting held on 7
       of April 2020 with other sports entities, entitled "Commission of
       Monitoring COVID 19" and held to address the issue of the impact of this
       health emergency in the world of football.


    - They indicate that, subsequently, the Federation disseminated extracts from the files of
       audio between any of the communication media (firstly, to Cadena
       SER, and, subsequently, to COPE) without the knowledge or consent of
       its participants, who discovered it when said files were issued
       on air, for the first time on April 8.


    - The aforementioned meeting took place electronically on 04/07/20 through
       of the Zoom platform, and it was the second meeting held on the issue
       of COVID 19. The first, which took place on 03/12/20, was in person.

    - According to the complainants, many of the participants were not part of the

       of the body that called the meetings, the RFEF, nor were they subject to its
       internal rules. Nor are they aware of any rule that would regulate the
       operation and organization of the meetings of the COVID 19 Commission.

    - The complainants denounce that, at no time were the

       participants to the meeting on 04/07/20 that was going to be recorded, nor were they
       informed at no time, of the aspects of the treatment of the data
       personal, contemplated in art. 13 GDPR.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 2/74









In the documentation provided together with the claim documents, you will find the
following documents:


The response made by the RFEF on 04/10/20 addressed to the AFE, where it is stated, among
another, the following:

“[…] That, at the beginning of the first meeting, held on March 12, it was agreed,
without opposition from any of the participants, record the conversations of the

commission for the record. In any case, when the commission
has met telematically, on the screens of each of the participants
A red light appears at all times to inform you that the
recording of the entire meeting. […] That this union, after the meeting held on 7
April, released a press release to the media in which

it contained a version of what happened contrary to what had actually happened. That,
in order to preserve the right to receive truthful information provided for in the
CE, the RFEF sent a press release to the media correcting the
divergences and inaccuracies with the reality of what had happened in the meeting,
accompanying, to the first medium that asked us, the recordings that so
accredited […]” .


Copy of email sent from the address ***EMAIL.1 on 04/11/20 to
“A.A.A.” which, among others, includes the following:

“[…] You know perfectly well that the operating rules of any organ or

working group are fixed in the first session and, as long as they are not modified, they continue
in effect for subsequent meetings. You have expressed it to us in many ways.
occasions in the meetings of the organs of the LNFP. And consequently also
you knew perfectly well that all the meetings of the Monitoring Committee of the
COVID-19 were being recorded. […]”


Copy of response sent by the RFEF on 05/04/20, and addressed to the Deputy Director at
the LNFP Presidency where it is stated:

“In this sense, I inform you that the purpose of processing your personal data is
make the minutes, as well as have reliable evidence of the development of the topics and the

content discussed at the meeting. [...] In the case at hand, these categories are
identification data: the institution to which each one belongs, the image and the
voice. […] The personal data that concerns you referred to in your request, I
report that they were also communicated to Cadena Ser, the only means of
communication that requested it. However, as it is information of interest

public and with social significance, it may be provided to as many media as possible
request. […] The retention period may be indefinite, unless it must be addressed
the exercise of the rights of deletion, opposition or rectification by the parties
interested. […] In the case at hand, your request is based on letter b) of the
paragraph 1 of article 18 of the RGPD. In other words, he considers that the treatment of his

data carried out by the RFEF is "illicit" and therefore requests the limitation of its
treatment. However, it does not justify in any way the alleged illegality of the
treatment nor is there any decision or resolution of the AEPD or the Courts that
so set it. Regardless of this, the RFEF is ratified in the treatments

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 3/74








carried out which are perfectly adjusted to right. In
Consequently, there are no circumstances to uphold your request for limitation of the
treatment".


SECOND: On 06/10/20, this Agency wrote to the RFEF
requesting information regarding the claims filed,
in accordance with the provisions of article 65.4 of the LOPDGDD Law.

THIRD: On 07/08/20, the RFEF sends to this Agency, among others, the

following information, regarding the request received:

"one. That on 03/12/20 a meeting of the Commission took place at the RFEF headquarters
Monitoring COVID-19 which was recorded, an end that was communicated by the
President of the RFEF and on which none of the attendees showed objection

some.

2. That on 04/07/20 a second session took place through the Zoom platform.
meeting of the COVID-19 Monitoring Commission which was recorded as well as the
first meeting, although with the particularity that, as it was held through the
Zoom platform, all attendees could verify that it was being

recorded since at all times there was a red pilot located in the part
top left of the screen next to an indication that reported "recording",
aspect on which no attendee showed disagreement.

3. Regarding the transfers of data, the RFEF provided the audio files of said

meeting to the media that so requested, taking into account the interest
audience and social significance of the issues discussed at the meeting on April 7”.

FOURTH: On 08/27/20, the Director of the Spanish Agency for the Protection of
Data dictates agreement of admission of processing of the presented claims, of

in accordance with article 65 of the LPDGDD Law, when assessing possible indications
reasons of a violation of the rules in the field of competence of the
Spanish Data Protection Agency.

FIFTH: On 05/31/21, this Agency sent a request
information to the party complained against, under the investigative powers granted

to the control authorities in article 57.1 of the RGPD.

SIXTH: On 06/12/21, this Agency received a letter from the RFEF,
answering the request made, in which, among others, it indicates:


1. That due to the COVID-19 health crisis it was essential to reorganize
all the activity of the RFEF in order to carry it out telematically.

2. That it also forced all of football to make decisions of enormous relevance that
required urgent agreements adopted by all the sectors involved (clubs,

athletes, referees, coaches, …). That is why the Commission of
Monitoring of COVID19. That is why the meeting was called for April 7. That
at this meeting issues of enormous importance for football were to be discussed
professional and it was necessary to have a record of the topics discussed and

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 4/74








the debates generated, also taking into account that the Minutes resulting from the
The meeting should be published on the Federation's website for reasons of transparency.


3. That prior to said meeting, the basis of legitimacy that could
be used, ruling out consent due to the fact that those attending the
meeting are representatives of legal persons without acting in a private capacity and
In addition, the lack of consent could prevent the fulfillment of the legitimate
purpose of the treatment, which is to have a literal record of the interventions and the
preparation of the record. That the analysis therefore focused on sections e) and f) of art.

6.1.

4. That it was not possible to determine precisely whether the public interest should be invoked or
legitimate interest.


5. That when using the Zoom platform, it allows viewing an indicator that the session
is being recorded. That attendees at any time can deactivate the
camera so only the voice would be recorded.

6. That therefore there is no proof of consent.


7. That when dealing with those attending the meeting as representatives of legal entities
perhaps the information might not be necessary. That it is not possible to prove the
information on data protection provided to attendees.

8. That, subsequently, for other online meetings a clause was drawn up

informative.

In response to the request, the RFEF provides the following
documentation:


    - Copy of document with title "INFORMATIVE PROTECTION CLAUSE
        OF DATA FOR VIRTUAL MEETINGS” where it is stated that “The database
        legal treatment of your data is your consent. The tratment of
        your data is also legitimized for reasons of public interest.”

    - Copy of email sent by "RFEF Secretariat" on 12/04/20

        sent to the "RFEF Secretariat" in relation to the call for a meeting to
        through Zoom and where there is an attached document with a name
        “Informative Clause Data Protection.pdf”.

    - Copy of the transcript of the meeting held on 04/07/20 through

        videoconference.

SEVENTH: On 07/30/21, by the Board of Directors of the Spanish Agency for
Data Protection, a sanctioning procedure is initiated against the RFEF, upon appreciating
reasonable indications of violation of the RGPD, for the alleged infractions:


    - For the alleged infringement of article 13 of the RGPD, by not informing
        conveniently to those attending the meetings of the aspects indicated


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 5/74








        in said article, in relation to the personal data obtained in the
        recordings with an initial fine of 100,000 euros (one hundred thousand euros).


    - For the alleged infringement of article 6.1 of the RGPD, when carrying out a treatment
        of the personal data of those attending the meetings of the Commission
        of the Monitoring of COVID-19, when they were transferred to the media
        communication without the consent of those involved, with an initial sanction
        of 100,000 euros (one hundred thousand euros).


EIGHTH: Notification of the start agreement to the RFEF, the latter by means of a document dated
09/23/21 made, in summary, the following allegations:

“The Initiation Agreement clearly states that the agreement derives from the proceedings
practiced before the RFEF “by virtue of a complaint filed by the AFE and by the LNFP,

who are “the complaining party”. However, in determining the facts based on the
that such actions have been carried out takes into account a claim
coming from the AFE and the LNFP, but also from its Deputy Director to the
Presidency, that there is no evidence that he is a complainant in these proceedings. Is
Furthermore, a large part of the facts that are included in the Agreement of that AEPD (pages 2 to
4 of the Agreement) and that are essential for the adoption of this, come from the exercise

of the right of access presented by the Deputy Director to the Presidency of the LNFP,
that he is not a complainant in these proceedings and that therefore they should not be held
into account by the AEPD.

We therefore disagree with the facts on which the AEPD is based. not only for the reason

that has just been pointed out, but because in any case the facts invoked are not
know if by the reporting entities or by a non-reporting third party, they do not adjust
to reality. On the contrary, the facts that must be taken into account are:

1.- Declaration of the state of alarm and suspension of sports activities

football related.

By Royal Decree 463/2020, of March 14, the state of alarm was declared
for the management of the health crisis situation caused by COVID-19. The
Article 10.3 of said Royal Decree established that "opening to the public is suspended
of museums, archives, libraries, monuments, as well as the premises and

establishments where public shows are held, activities
sports and leisure activities indicated in the annex to this royal decree”.

Said Annex included the "List of facilities and activities whose opening to the
is suspended in accordance with the provisions of article 10” and between them

It included the “Soccer, rugby, baseball and similar fields”. That is, on the 14th itself
March, Saturday, (date on which the Royal Decree was published in the BOE) all
sports activities related to soccer (in what interests us now) were
suspended, since the third final provision of the repeated Royal Decree provided
that the same “will enter into force at the time of its publication in the BOE.


Such suspension of the activities of the sport of soccer produced a stir that is not
I now need to describe. The social, economic, media and all kinds of impact that
occurred required an immediate reaction from the entities most involved

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 6/74








in the world of football, and in particular of the Royal Spanish Football Federation, the
National Professional Soccer League or the Spanish Soccer Players Association. For other
On the other hand, it was impossible to hold face-to-face meetings between the entities that
They have just pointed out that the reiterated Royal Decree 463/2020 had restricted,
As is well known, the freedom of movement of people, as

established in its article 7, producing a situation of confinement that prevented
holding face-to-face meetings. Consequently, it was necessary to adopt
urgent measures to deal with a situation of extraordinary gravity.

2.- Constitution of the COVID-19 Monitoring Commission and holding of the
meetings of March 12 and April 7, 2020.


In order to deal with the situation just described and which is well
known, the “COVID-19 Follow-up Commission” was constituted, made up of the
following entities: Royal Spanish Football Federation, National Football League
Professional, Spanish Soccer Players Association, Soccer Players Associations

futsal, and commissions of women's soccer and futsal clubs. These entities
They participate, obviously, through their respective representatives. even before
of the declaration of the state of alarm and when there was already widespread awareness and
knowledge that the confinement was going to be agreed, the President of the RFEF
convened a meeting of said Commission on March 12, 2020. As recorded in the
Minutes of said meeting, which is attached as DOCUMENT No. 1 to this document and

which in any case can be consulted on the RFEF transparency portal:
(https://www.rfef.es/sites/default/files/pdf/acta_comision_seguimiento_12-3-20.pdf),

The object of the meeting and the attendees were the following: In Las Rozas de Madrid,
at the headquarters of the Royal Spanish Football Federation, at 12:00 p.m.
On March 12, 2020, the first meeting of the Commission of

Monitoring of COVID-19, created to address the situation caused by the
coronavirus pandemic, made up of representatives from different areas of the Royal
Spanish Football Federation, of the National Professional Football League, of the
Association of Spanish Soccer Players, of the Associations of male and female players
futsal, women's soccer clubs and futsal. Agenda 1.- Evaluation
of the state of the situation. 2.- Possible prevention measures to adopt. Assistants

On behalf of the RFEF and on its behalf: (...), 11 people attended, of which
that only two represented the LNFP and two the AFE.

At the beginning of the meeting -the first of the COVID-19 Monitoring Commission-
It was reported that it was going to be recorded, without any of the attendees, including
those who were the representatives of the denouncing entities, opposed it.


After the declaration of the state of alarm, the second meeting of the aforementioned
Monitoring Commission, which took place on April 7, 2020. As recorded in the
Minutes of said meeting, which was attached as Document No. 3 to the brief of
response to the request for information presented by this RFEF to that EAPD,

ref E/0791/2020, which is recorded in this proceeding:
(https://www.rfef.es/sites/default/files/pdf/acta_comision_seguimiento_7-4-20.pdf),

The purpose of the meeting and the attendees were as follows: At 12:30 p.m.
on 04/07/20, a meeting of the Commission of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 7/74








Monitoring of COVID-19, made up of representatives from different areas of the Royal
Spanish Football Federation, of the National Professional Football League, of the
Association of Spanish Soccer Players, of the Associations of futsal players,

and women's soccer and futsal clubs. Agenda Analysis of the state of
situation in relation to competitions and COVID. Assistants on behalf of the
RFEF and on behalf of it (...). This meeting was therefore attended by 26
people, of which only two were representing the LNFP and three in
representation of the AFE.


The two meetings were held in order to deal with the very serious impact on the
football of the health crisis as a result of Covid-19 and the declaration of the state
of alarm (as the claimants acknowledge in their writings claiming
04/16/20: in particular, the meeting on April 7 was held “to deal with the issue of the
impact of this health emergency in the world of sport”). meeting I had

a capital transcendence for the sport of soccer and that aroused an enormous
expectation in the media due to the importance of the topics covered and
by the special circumstances surrounding the tense relations between the
entities participating in the meeting, in particular between the RFEF, the LNFP and the AFE.

3.- Information on the recording of the meetings of the Commission.


The first of the meetings of the Commission took place, as has already been pointed out,
on March 12, 2020. In it, which took place in person at the headquarters of the
RFEF, the president of the RFEF, prior to its beginning, informed the
participants therein that the meeting was going to be recorded.


The President of the RFEF, and president of the meeting, expressly informed the
beginning of this (in order that "everything is on record"), as it is
proven by the recording and transcript of the meeting. None of the
attendees opposed it. Before, on the contrary, all of them, including the representatives

of the entities that have filed the complaint, before intervening they had to press,
completely voluntarily, the button that allowed the recording. What they say
reporting entities (which were not informed that the meeting was going to be recorded) is not
according to the reality of the facts and demonstrates, that is, with all due respect, the spirit
spurious of the denouncing entities, which seek to falsify facts that are not
consistent with reality and instrumentalize the AEPD itself.


The proof that the recording was reported is found in the recording itself.
the meeting (which from this moment is made available to that AEPD) and the
transcript of said recording, which is published on the Transparency portal of
the RFEF (https://www.rfef.es/sites/default/files/pdf/acta_comision_seguimiento_12-3-

20.pdf) and, as indicated above, is attached as Document No. 1. It contains
read the following: Federation LR1:

Thanks for coming. Say hello. And… it looks like it's going to be shorter than
we had thought, because it has already been leaked to the media, on the part of the League it seems

that there is a willingness to suspend, which, since it generates for all of us a lower
uncertainty, right? In other words… now 1 the President of the RFEF. we will summon
then a Commission, as stated in the Coordination Agreement, to leave
Any issue settled, if that's okay with you, right? we'll do it, as there are two

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 8/74








representatives of the League, there is the Director of Competitions and also CC, in this
aspect I imagine that you will come with full powers to write now in a
record when finished, right? There is not much to tell you, because it was the reason for the

debate. The rest of the people who are here, from futsal, you already know that everything is
suspended… and I think that from now on what we are going to have to do is work on
coordination for recovery of calendars, for, in case you cannot
finish some competition, see how, how they are produced
promotions, descents, classifications… and that is a bit of the reason for this meeting.
We have had a lot of problems. There is some team that has already communicated that its

basketball section, two teams, one the basketball section, but the others
they are in quarantine and others… We are talking about it with UEFA. The
next week we will meet by videoconference. We also have a
tremendous risk with the referees in the VOR, because in the end they are in a room without
ventilation, all together and so on. So, we have no choice.

Catalonia has also closed schools, etc., and it seems that a
domino effect, which advises that those of us who are here, as in the rest of the
collective or work, then let's take the measures of teleworking, of doing things
with the greatest responsibility. And in that aspect, well no, there is not much more than
debate, because it seems that there is not going to be a debate regarding the suspension. No
C, is that so? I remind you, when you go to intervene click here.


We're recording the meeting to record everything, okay? And nothing,
Well, you have the floor, C. (02:25) C2 from the League: Thank you very much L. Good morning to
everybody. The truth is that I got into the car with an idea and I got here
with another, huh. Well, I think that, depending on the seriousness of this matter,

furthermore, if we realize that events are not developing day by day
day, but practically every ten minutes.

In other words, not only did the President of the RFEF inform that the meeting was
recording, but the interveners (among which are those who used

speaking on behalf of the LNFP and the AFE) had to voluntarily press
a button to proceed with the recording. It can hardly be said, therefore, that
reported the recording and that the recording was carried out without the knowledge of the
denouncing entities, when in reality they had to press a button to
proceed to the recording, as they did.


The Deputy Director to the Presidency of the LNFP filed a claim with the
AEPD denouncing that the recording of the meeting was not reported. something left
belied by the fact that he was the first to speak at the meeting,
immediately after the President's warning that the meeting was going to
record and taking into account that before speaking he had to press voluntarily on

the record button.

The first speaker, immediately after the President of the RFEF, is the
representative of the LNFP, an entity that is now the complainant, who falsely affirms that
it was reported that the meeting was being recorded. Not only was it reported

we have just demonstrated, but it was done just before the intervention of the LNFP,
without his representative objecting to it: he began his exhibition with all normality.
What's more, he had to press the button on his microphone to record, as it happened,


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 9/74








so that he himself allowed or voluntarily consented to the recording of his
intervention.


In any case, this RFEF has already had the opportunity to remember that the session was recorded and
that the Deputy Director to the Presidency of the LNFP was informed of this in the
reply sent to you on April 10, 2020 in relation to the exercise of
data protection rights filed with this RFEF, as stated in the
proceedings.


It is obvious that, as indicated in the aforementioned answer, the information provided in the
first meeting is applicable to the successive ones, also taking into account that between the
The first and second meetings of the Commission did not last even a month. To prove
that those attending the meetings of the COVID-19 Monitoring Commission were
aware that the meetings were recorded and that the information provided

in the first of the meetings it also applied to the rest of the meetings and in
particular for the meeting on April 7, testimonial evidence will be proposed in order to
prove that in fact the President of the RFEF reported such extreme. We reiterate
which is not exact, therefore, that at no time were the participants informed
that the meeting was going to be recorded. But it is also that when the Commission has
met electronically, on the screens of each of the participants appears

a red light that informs that the recording of the entire meeting is taking place.

Indeed, when the meeting is held through the Zoom platform, all the
attendees could verify that it was being recorded since in all
moment there was a red pilot located in the upper left part of the screen

next to an indication that informed: "recording", an aspect on which no one
assistant showed disagreement. And in any case, as is well known, the
attendees can disable their camera in order to avoid being seen by the rest of the
participants in the meeting and avoid recording your image.


In no case was it indicated that the cameras of the attendees were not deactivated.
This extreme, moreover, has not been denied by the claimants. I know
attached as DOCUMENT No. 2 internet screenshot in which you can see how
the red indicator light operates, indicating that the meeting is being recorded. For other
party, must also be taken into account as a relevant fact in these
actions that, after the meeting of April 4, 2020, and for other

online meetings of the collegiate bodies of the RFEF, a clause was drawn up
information that is attached as DOCUMENT No. 3 in which all the
extremes required by article 13 of the RGPD and article 11 of the Organic Law
3/2018.


This clause has been incorporated for some time in the calls for meetings
on-line. To this end and as evidence of this, a copy of DOCUMENT No. 4 is attached.
of an e-mail convening an on-line meeting in which the
document “Virtual meetings. Informative Clause data protection.pdf”.


The AEPD is aware of such extremes as they have already been revealed in
the written response to the request for information presented by this RFEF to
that EAPD, ref. E/0791/2020. The above measures are clear proof of the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 10/74








RFEF's commitment to data protection and the application of the principle of
proactive responsibility established by article 24 of the RGPD.


In conclusion, the facts to be taken into consideration in relation to the
information provided to the representatives of the entities summoned to the
meetings of March 12 and April 7, 2021 are: a) The President of the RFEF
expressly informed in advance that the meetings of the Commission of
Covid-19 follow-up were going to be recorded in order to record
of everything dealt with in them; b) At the face-to-face meeting on March 12, the

interveners voluntarily pressed a button so that their intervention was recorded;
c) In the virtual meeting of April 7, 2021, in addition, it appeared at all times in
the screens of the attendees a red light that informed that it was taking place
the recording of the meeting; d) Virtual meeting attendees can
disable your cameras at any time; e) The RFEF has approved a clause

informative detailing all the extremes required by article 13 of the RGPD and
article 11 of LO 3/2018. Said clause is incorporated into the calls for
online meetings.

4.- Publication by various communication media of information referring to
the meetings of the Covid-19 Monitoring Commission.


Given the social and media impact caused by the suspension of the activities of
football as a result of the declaration of the state of alarm, various media outlets
communication echoed the meetings held by the Committee on
Covid-19 follow-up, in particular that of April 7, 2020. In part due to the

information provided by the reporting entities. In particular, the
ASSOCIATION OF SPANISH FOOTBALL PLAYERS (AFE), one of the entities now
complainant, immediately made public, on the same day 7, a press release with the
title Communiqué from AFE to analyze the current situation of our football, in which
echoes her perception of the meeting, totally misrepresenting what in her

treaty, sending an incorrect message to society and the media
and thus confusing the soccer players who participated in the official competitions
organized by the RFEF. Such Communiqué, which can be consulted at:

https://www.afe-futbol.com/afe/comunicado-situacion-actual-futbol/ and attached
as DOCUMENT No. 5, attributes to the RFEF (which expresses its will and position to

through its President, as is obvious) positions that were not in line with reality
and that they falsified what was discussed at the meeting.

This situation of confusion generated by at least one of the reporting entities
further increased the uncertainty among the media, so the

Cadena SER, in order to offer its listeners proven information on
agreement 9 to article 20 of the Spanish Constitution, asked the RFEF to provide
part of the recordings of the meeting. Let's keep in mind that it was trying,
nothing more and nothing less than the effects on football (one of the most
media that exist and with an economic and social impact that no one can put

in doubt) of the declaration of the state of alarm, which implied the suspension of the
celebration of all professional football matches. Given the responsibility of
RFEF in the organization of football in accordance with Law 10/1990, on Sports, and the
public functions of an administrative nature that correspond to it, as well as the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 11/74








need to clarify the truth in a contrasted way in relation to the issues
analyzed at the meeting of April 7, 2020, the RFEF, also taking into account
the right to freedom of information and expression that recognizes, as has been

mentioned, article 20 of the Constitution, issued a press release correcting the
inaccuracies and discrepancies with the reality of what had happened at the meeting
(which can be consulted at https://rfef.es/noticias/comunicado-oficial-7 (DOCUMENT
No. 6).

In addition, a means of communication, in order to be able to contrast the reality of what

happened, he asked for the recordings that proved that the RFEF was the one that adjusted to
the truth (in relation to an issue, we insist, of great public importance and with a
undoubted social and economic impact). Faced with such a situation, the RFEF considered that the
transfer of the data requested by Cadena SER was protected
in the public interest in accordance with article 6.1.e) of Regulation (EU) 2016/679

(RGPD) and the prevalence in this case of the fundamental right to freedom of
expression and information on the right to data protection.

It was also taken into account that the data that was going to be transferred was data from
representatives of legal entities, in their professional relationships and in no
private case, and that at least one of the complainant entities, the National League of

Professional Soccer, is an entity strongly regulated by Law 10/1990, of 15
October, of Sport (art. 41). The transfer of data as a result of the request made by the
Cadena SER has not been hidden by the RFEF.

As stated in the Facts of the Agreement to Start the sanctioning procedure,

the Deputy Director to the Presidency of the LNFP exercised his right of access and the
RFEF replied, among other things, that the recordings of the meeting had been
forwarded to the first outlet that requested it (Cadena SER) “because it is information
of public interest and with social significance”.


Once the facts that must be taken into account in these
actions, we proceed to formulate allegations in relation to the two alleged
infractions that are imputed to the RFEF by the AEPD. Before, however, it is necessary
make two preliminary allegations: on the one hand, in relation to the lack of legitimacy of
the denouncing entities and on the other in relation to the nature of the data that
would have been subject to treatment by the RFEF.


5.-About the lack of legitimacy of the reporting entities.

It should be noted in advance that the complaint filed by the Association of
Spanish Soccer Players (AFE) and the National Professional Soccer League (LNFP) should

having been inadmissible by the AEPD. This is because, as established in article
77 of the RGPD, who have the right to file a claim with an authority
of control are "the interested parties", and these, in accordance with what is established in article
4.1 of the aforementioned RGPD, they must in any case have the status of a natural person
identified or identifiable, never legal entity.


Article 64.2 of Organic Law 3/2018 provides that when the procedure has
purpose of determining the possible existence of a violation of the provisions
in the RGPD and in the Organic Law itself, it will be initiated by means of an initial agreement

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 12/74








adopted on its own initiative or as a result of a claim, and must
understand that this claim is the one that is included in the reiterated article 77 of the
Regulation.


Only interested parties, that is, identified or identifiable natural persons, can
file a claim, which should have led to the inadmissibility, and only for
this reason, of the complaint filed by AFE and by the LNFP, both persons
legal.


This interpretation is the only possible one, given the legal nature of the GDPR, which, in
As a Regulation of the European Union, it has a "general scope" and is "mandatory
in all its elements and directly applicable in each Member State” (art. 288
of the Treaty on the Functioning of the European Union).


A proof of what is pointed out can be found in the legislation of the rest of the
Member States of the European Union. Thus, for example, the current article 141 of the
in force Italian Personal Data Protection Code provides that it is
the interested party, and only he, who can file a claim under the terms of article
77 of the GDPR.


Therefore, proceed without further ado to archive the procedure. However, and for
the hypothetical case that the AEPD considers that it is appropriate to continue the procedure,
The following allegations are made.

6.- On the nature of the data subject to treatment.


As stated in the Agreement to Start the Procedure, they are two entities
who have filed the complaint: the Association of Spanish Soccer Players and the League
National Professional Football. There is no evidence that the Deputy Director to the Presidency of
the National Professional Soccer League has filed a complaint (it did file a

claim on April 16, 2020, which is not the subject of these proceedings).

In its Resolution R/00497/2005, of July 15, 2005, issued in the procedure
sanctioning PS/00049/2005, the AEPD clearly states: (...) of articles 1 and 2.1
of the LOPD it is clearly deduced that the subjective scope of application of the LOPD
does not cover legal persons and that is only applicable to the treatment of

personal data related to natural persons.

The basis for the delimitation of this scope of application lies in the fact that, if the
protection of personal data refers to personal and family privacy, not
It can be understood that companies enjoy the aforementioned privacy and, therefore, do not

may be applicable to these, even when the activity of the company in traffic
legal must necessarily be done through a power of attorney in favor of a
Physical person.

In this way, the data that is collected will be excluded from the guarantees of the LOPD.

refer to legal persons, in all cases, as well as to professionals (in
those cases in which they organize their activity in the form of a company,
holding, consequently, the status of merchant referred to in the
first and following articles of the Commercial Code) and entrepreneurs

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 13/74








individuals provided that their commercial or professional activity can be differentiated in
each case, in a clear and decisive way, of its own privacy environment as
Physical person.


Both legal persons, in any case, as well as professionals and merchants
individuals, when they perform an activity that can be clearly distinguished from their
private activity, will be outside the scope of subjective application of the LOPD.

These last two only in the strict terms indicated above, that is,

when your data has been processed only in your consideration of businessmen or
individual professionals. On the contrary, both professionals and
Individual merchants will fall under the scope of application of the LOPD and, therefore,
therefore, protected by it, when the former did not have their activity organized
professional under the form of a company, not holding, consequently, the condition

merchant (this is the case of liberal professionals), and the latter when they do not
it was possible to differentiate in each case, clearly and conclusively, their commercial activity
of the own environment of your privacy as a natural person.

In these two cases, the recognized guarantees and principles must always be applied.
in the LOPD given the fundamental nature of the right to protect. This will require

analyze each case individually, to determine if the action that is
treat affects the fundamental right to data protection of the interested parties
natural persons, or, on the contrary, affects only the sphere of activity
business or professional.


This party is aware, as stated above, that both the GDPR
such as the LOPDGDD also apply to the data of natural persons despite being
referring to their relationship with legal persons, but it is no less true that in relation to
With this issue, the following considerations should be made:


The LOPDGDD itself presumes, in its article 19, that the treatment of the so-called
contact data is enabled by the legitimate interest of those responsible. The
LOPDGDD starts from the basis that it is necessary to bear in mind the true damage
that occurs to the owners of the data when considering whether it has occurred or
not punishable conduct. And in this sense it is evident that the treatment of
data that the RFEF has carried out has not affected the private or

complainants, but only to their merely professional field, in
how many representatives of the entities summoned to the meeting (the entities, and not
natural persons, were the ones summoned, as recognized by the
plaintiffs. And the entities were the ones that expressed their will or opinion in the
meetings, albeit through those acting on their behalf).


It should be noted that the complainants are the AFE and the LNFP. if they pretend
denounce the treatment of data referring to them as entities, you must
be inadmissible If it refers to the use of personal data of its representatives, they lack
of legitimacy because they are not interested as we have shown.


7.- Regarding the alleged lack of information offered to the people who attended the
meetings of the COVID-19 Monitoring Committee.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 14/74








As has been proven, the President of the RFEF informed those attending the
meetings of the COVID-19 Monitoring Committee that the sessions were going to be
recorded. Consequently, the duty of information required by articles 13 of the

RGPD and 11 of the LOPDGDD was complied with by the RFEF.

The information referred to in the aforementioned art. 11 was facilitated, because by pointing out that the
meetings of the Commission were going to be recorded, the person in charge was being informed
of the treatment (the RFEF was going to proceed with the recording) and the purpose (to record
of the content of the meetings). In addition, and in any case, the RFEF counts from the

application of the RGPD and the entry into force of the LOPDGDD with a policy of
privacy adapted to the new regulations. This can be seen in the URL
https://www.rfef.es/proteccion-datos (DOCUMENT No. 7).

In any case, the AEPD itself has already had the opportunity to confirm the policy of

data protection of the RFEF, and in particular its compliance with the duty to
information, as expressly stated in its File Resolution of
Actions issued in File No.: E/02043/2019: It is also relevant that
by Diligence of the Data Inspection of the AEPD dated 02/14/2019
left a record in the administrative file, through various captures of
screen obtained from the RFEF website, that this entity has several

personal data collection forms and that its website offers a
information on data protection that is adapted to the requirements of the
article 13 of the RGPD.

It was recorded that in the privacy policy of the RFEF website,

identifies the data controller and provides their 13 contact details; I know
specifies what type of data will be processed and the purpose of the treatment
that is held; Regarding international data transfers, it is indicated
that will only take place when required by the purpose pursued by the treatment and
the legal basis of the processing of personal data that it carries out is detailed.


The right to withdraw consent to treatment at any time is also informed.
moment; that the RFEF will not communicate data to third parties unless it is
essential for the purpose of the treatment or prior judicial request or
Administrative; of the term of conservation of the data and the rights of access,
rectification, deletion, opposition and conditions for its exercise and the right to

submit claims to the AEPD.

Therefore, the AEPD continues: After analyzing the reasons given by the defendant and
made the relevant checks on the adequacy of the policy of
privacy of the website of the one claimed to the RGPD and, in particular, to article 13

of the RGPD, there are no reasonable indications of an alleged infringement of the
personal data protection regulations in the facts that are submitted
for the consideration of this Agency. Therefore, it should not be understood that there has been no
informed to the interested parties (all of them representatives of legal entities).


It was expressly done at the first meeting, held on March 12, 2020, with
general scope for the rest of the meetings of the COVID-19 Monitoring Commission.
19, and in particular for the one held on April 7. Meeting attendees
they were aware of this and at the second meeting they already had the information they

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 15/74








had been provided at the first of the Commission's meetings, so that in
In any case, the provisions of article 13.4 of the RGPD would apply.


As was advanced when exposing the facts that must be taken into account in the
present procedure, witness evidence is proposed in order to take a statement from
attendees who will be indicated at the time so that they declare that in effect
conveniently informed that the meetings of the Commission would be recorded with
the purpose of recording what was discussed in them and that this rule was applicable
to all the meetings held by the Commission.


8.- On the alleged illicit treatment of the personal data of those attending the
meetings. Data protection and freedom of information and expression.

As has been pointed out in the facts that are exposed later in this writing

of allegations, the transfer of the recording of part of the meeting of April 7, 2020
to Cadena SER was produced in order to guarantee the right to freedom of
information and to receive truthful information recognized in article 20 of the
Constitution.

It was the media that, in exercise of such a fundamental right, asked the

the RFEF to facilitate this recording. What occurred on a stage of enormous
confusion generated by the suspension of all soccer activity, in which the AFE
had sent 14 a completely false message regarding the possible celebration, in
his case, from football matches, which could even affect the health of the
football players.


The media needed to clarify a serious situation that had
falsified the AFE. And not being enough with the Press Release issued by the RFEF
(Document No. 6) a means of communication, in order to clarify some facts
of extraordinary gravity, he asked the RFEF for the recording that we already know.


Therefore, what was done by the RFEF was to facilitate the correct exercise of
right to freedom of expression and information and the right to receive information
truthful. The relationship between the right to data protection and the right to freedom
of expression and information is provided for in article 85 of the RGPD. Between the
exceptions that must be implemented by the Member States are the principles

(among others, the legality of the treatment) and the rights of the interested parties (for example, to
to be informed). Well, ultimately, the right to protection of
personal data with freedom of expression and information.

In this sense, Recital 153 of the RGPD provides: The Law of the States

members must reconcile the rules governing freedom of expression and information,
including journalistic, academic, artistic or literary expression, with the right to
protection of personal data in accordance with this Regulation. The treatment
of personal data for exclusively journalistic purposes or for expression purposes
academic, artistic or literary should be subject to exceptions or exemptions from

certain provisions of this Regulation if required to reconcile
the right to the protection of personal data with the right to freedom of
expression and information enshrined in article 11 of the Charter.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 16/74








This should apply in particular to the processing of personal data in the field 15
audiovisual and in news archives and newspaper archives. Therefore, the states
Members must adopt legislative measures that establish the exemptions and

necessary exceptions to balance these fundamental rights.

Member States must adopt such exemptions and exceptions in relation to
the general principles, the rights of the interested party, the person in charge and the person in charge
of the treatment, the transfer of personal data to third countries or
international organisations, independent control authorities, the

cooperation and consistency, and specific data processing situations.

If these exemptions or exceptions differ from one Member State to another, the
the law of the Member State that is applicable to the controller. finally
to bear in mind the importance of the right to freedom of expression in all

democratic society, it is necessary that notions related to said freedom, such as the
journalism, be interpreted broadly. The relationship between both rights has already
analyzed by the AEPD itself and by the Courts.

Just as an example we can point out the following. In the Guide on the use of
video cameras for security and other purposes of the AEPD it is said (pp. 48-49):

6.2 Treatment of images by the media. The publication of
images in the media supposes an exercise of the right to freedom
of expression and information conferred by article 20 of the Spanish Constitution.

In the event that any individual considers his rights injured by the

publication of images, would have to go to court under the provisions
in the Organic Law 1/1982, of May 5. In any case, the RGPD contains a mandate to
Member States to reconcile by law the right to data protection
of the European standard with the right to freedom of expression and information,
including treatment for journalistic purposes and academic expression purposes,

artistic or literary.

It is clear that the conclusion reached by the Agency (the publication of images on
the media is an exercise of the right to freedom of expression
and information that must be covered by the Organic Law 1/1982) is
perfectly applicable to the case referred to in this proceeding.


Therefore, it is appropriate to consider that it is not possible to consider punishable as an infringement
of the right to data protection the transfer to a communication medium of the
recording referred to in this procedure.


The AEPD in its Report 624/09 estimates that "despite the lack of regulation
specific in Spain with regard to the processing of personal data for
exclusively journalistic or artistic or literary expression, as provided by the
Article 9 of the Directive, the best doctrine understands that given the content of art. 6.1
of the LORTAD (LOPD), according to which "the processing of personal data

will require the unequivocal consent of the affected party, unless the law provides otherwise.
thing"; the expression "unless the law provides otherwise", allows us to understand that it is not
The consent of the affected party is necessary when art. 20 of the CE allows the
treatment.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 17/74









What will require a consideration of the specific case, and from the principles of
adequacy, relevance and consistency collected in art. 4 of the LORTAD (LOPD)

(...)». For its part, the AN has already had the opportunity to rule on alleged
specific, the judgment of 06/09/09 being especially relevant. In this
judgment, the National High Court, following the criteria established by the Court
Constitutional, conditioned the prevalence of the fundamental right to freedom of
information on the right to data protection or other rights
fundamental, that it refers to facts with public relevance, in the sense of

newsworthy, and that said information is truthful.

Especially relevant is also the Judgment of the National High Court of 11
April 2012, resource 410/2010, in which the following is stated: "...it will be necessary
proceed to a weighting between the rights and purposes that protect the owner of these

rights and the right to data protection of those affected. To perform this
weighting, it is necessary to take into account the specific circumstances of each
case, taking into account the right that is exercised, the type of information that is provided and its
relevance, the purpose pursued, the means used, the number of recipients
possible and the existence of general interests in obtaining this type of
information. It should not be forgotten, at the time of making this weighting, that both the

freedom of expression, as also occurs with that of information, acquire special
relevance when "they are exercised in connection with matters that are of general interest,
by the matters to which they refer and by the people who intervene in them and
contribute, consequently, to the formation of public opinion, reaching
then its maximum level of justifying efficacy against the right to honor, which

weakens, proportionally, as the external limit of the freedoms of expression and
information, as long as its holders are public persons, they exercise public functions
or are involved in matters of public relevance, thus forced to bear
a certain risk that their subjective personality rights will be affected
for opinions or information of general interest, as this is required by pluralism

politics, tolerance and the spirit of openness, without which there is no society
democratic" (STC 107/1988, of June 8, FJ 2). …..

It should be remembered, in this sense, that the Constitution recognizes the right to express and
freely spread thoughts, ideas and opinions by word, writing
"or any other means of reproduction" and the right to communicate or receive

truthful information freely "by any means of dissemination". All this, without prejudice
that the protection afforded by these rights in their confrontation with other
should be understood reinforced when its exercise is produced by the professionals of the
information or by the conventional means of communication, but without forgetting that the
communication, today, is not limited to the media

traditional but to other very diverse means, propitiated by the current technology,
in which the internet occupies a very important role in obtaining and disseminating information
truthful and to freely express their own opinions and ideas.

For this reason, the special position held by the rights to freedom of expression and

information is preached not only to protect an individual interest, but, at the same
time, allow the creation of a free public opinion in a plural society and
democratic...


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 18/74








The information provided was truthful (or at least it could not be considered gratuitous or
notoriously unfounded), was documented and had general interest and relevance
public, affecting people who, in their capacity as public officials and with

important positions in the University has a clear public projection attending to the
position they held and the service they provided.

The exercise of freedom of expression and information that protected the appellant
implies the treatment of the personal data of the subjects object of the criticism and the
information, since the use of your personal data, proportionally and

justified by the end pursued and the freedom exercised, a
essential instrument without which criticism or information would be meaningless and
would be emptied of content. On the other hand, both their names, positions and images were
of public knowledge..., so it cannot be argued that the data
provided were out of public reach revealing personal data

that unrelated to the information were not previously known.

That is why the use of the data of the complainants was protected
for the appellant's exercise of freedom of expression and information and the lack of
consent of those affected is justified in accordance with the provisions of the
article 6.2 of the LOPD, without it being understood that their conduct constitutes

any administrative infraction in terms of data protection.

The Supreme Court, in its Judgment of September 27, 2010, rec. 6511/2008, has
made it clear that "although the notoriety of a person does not authorize to invade his life
private, the public interest that it covers strengthens the demands of freedom of

information about it to the same extent that that interest is affected, with the
consequence of the fact that their privacy will have to yield in the aspects related to said
interest". And the Report of the AEPD itself N/REF is also especially important:
012007/2019 (https://www.aepd.es/es/documento/2019-0044.pdf) which refers to the
balance between data protection and freedom of expression and information.


For this, it endorses the doctrine of the sentence of the National High Court of 22
January 2019, “whose fourth legal basis summarizes the constitutional doctrine
regarding the weighting between the right to data protection and the rights to
freedom of information and expression recognized by article 20 of the Constitution,
highlighting the existing differences in the case of people who

perform public functions”. And in particular it points out (the underlining is from the AEPD itself)
in its Report): “Therefore, the protection of these other rights is weakened
constitutional rights recognized by article 20.4 CE against the freedoms of expression
e 18 information, when they are exercised in connection with matters that are of interest
general, by the matters to which they refer and by the people who intervene in them

and contribute, consequently, to the formation of public opinion, as occurs
when they affect public persons, who exercise public functions or are
involved in matters of public relevance, thus forced to bear a certain
risk that their subjective rights of personality will be affected by
opinions or information of general interest (SSTC 107/1988, of June 8, 20/2002,

of January 28, 160/2003, of September 15, 151/2004, of September 20, and
9/2007, of January 15).



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 19/74








And in the case of people who exercise public functions, as recalled in the judgment
of the Supreme Court of January 11, 2019, “the public relevance of the
information- according to the criteria of the Constitutional Court is determined both by the

matter or object of this, as by reason of the public or private condition of the
person concerned. As we have said repeatedly, the authorities and
public officials, as well as public figures or those engaged in activities that
carry public notoriety «voluntarily accept the risk that their rights
subjective personality traits are affected by criticism, opinion or revelation
adverse and, therefore, the right to information reaches, in relation to them, its

maximum level of legitimating efficacy, insofar as their life and moral conduct
participate in the general interest with a greater intensity than that of those people
private that, without a vocation for public projection, are circumstantially seen
involved in matters of public importance, to which it is necessary, for
consequently, recognize a higher level of privacy, which prevents granting

general importance to facts or behaviors that would have it if they were referred to
public figures” (for all, STC 172/1990, of November 12, FJ 2)”.

Likewise, the criterion related to the participation that the interested party has in the
as a limit to their right to personal data protection has been
frequently used by the Court of Justice of the European Union, being able to

citing for these purposes the judgment of May 13, 2014 regarding the so-called
"right to be forgotten" that in the interpretation of Directive 95/46 and the European Charter of
Fundamental Rights indicates that "since the interested party may, taking into account
your rights under Articles 7 and 8 of the Charter, request that the information
in question is no longer made available to the general public through its

inclusion in such a list of results, it is necessary to consider, as follows, in
particular, of section 81 of this judgment, that these rights prevail,
in principle, not only on the economic interest of the operator of the search engine,
but also on the interest of said public in finding the aforementioned information
in a search to be seen on that person's name.


However, this would not be the case if it turned out, for specific reasons, as the role
carried out by the aforementioned interested party in public life, that the interference in
their fundamental rights is justified by the preponderant interest of said
public to have, as a result of this inclusion, access to the information in question”.


Another criterion to consider is that relating to the professional activity carried out by the
affected, since as indicated in the Judgment of the National High Court of June 6,
2017 “in the case at hand, entering into the weighting of the rights and interests
at stake, it must be taken into account in the first place, that it refers to professional life and
not personal life, since this is very relevant to modulate the intensity that must be

deserve the protection of the right regulated in article 18.4 of the Constitution,
As this Chamber and Section have pointed out in the judgment of May 11, 2017 (Rec.
30/2016).

In this regard, reference should be made to the guidelines of the Working Group of the

29 on the right to be forgotten (Guidelines on the implementation of the Court of
Justice of the European Union Judgment on “Google Spain and inc v, AEPD and
Mario Costeja C-131/12), according to which: "There is a basic difference between life
person's private life and their public or professional life. The availability of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 20/74








information in search results becomes more acceptable the less
information reveals about a person's private life (...) it is more likely that the
information is relevant if it is related to the professional life of the interested party,

but it will depend on the nature of the work of the interested party and the legitimate interest of the
public to have access to that information through a search by name”.

In the present case it is evident that each and every one of the
the requirements required by the National High Court, the Constitutional Court, the
Court of Justice of the European Union and the AEPD itself to understand that it must

prevail the right to freedom of information over the right to protection of
data.

Indeed: - We are dealing with events of public relevance, in the sense of being newsworthy,
and the information requested by the media and made public is truthful. -

The people involved are, without a doubt, characters with public relevance
(well-known directors of the LNFP and the AFE). - The information made public is
refers exclusively to the professional or public activity of such persons, not to their
private activity. In conclusion, applying the criteria of the highest Courts
that have just been pointed out and of the AEPD itself, it is evident that in our case we do not
it is only possible to file the actions and not continue with the procedure to be

refer to these allegations, initiated on the basis of the complaint filed by the
LNFP and the AFE, which also lack the legal standing to present
any complaint in relation to alleged and non-existent violations of the right to
Data Protection.


Rather it seems that such entities seek to instrumentalize the AEPD and something as
serious as the right to the protection of personal data (the High Court
National on more than one occasion, as is known, has closed the door to the defense
of the right to honor and privacy through the instrumentalization of the Law of
Data Protection and has spoken in favor of freedom of information in

cases in which people of public relevance were involved, as is the case
referred to in this proceeding).

9.- Application of aggravating criteria by the AEPD.

If, despite the above allegations, the AEPD considers that it is appropriate to continue the

processing of the procedure, we must make the following allegations in
relationship with which we consider incorrect application of the aggravating criteria that
in the Agreement to Start the Sanctioning Procedure are collected.

The AEPD provides in said Agreement that it is considered appropriate to graduate the

sanctions to be imposed (both for the alleged violation of art. 13 of the RGPD and of the
alleged violation of art. 6.1) according to the following aggravating criteria that
Article 83.2 of the RGPD establishes: - The scope or purpose of the operations of
data processing, as well as the number of interested parties affected and the level of
damages they have suffered (section a). - The intentionality in the infraction,

by the entity (section b). - The way in which the supervisory authority had
knowledge of the infringement, since the AEPD was aware of the infringement
through the claim of the interested parties (section h).


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 21/74








Likewise, it adds that, for its part, article 76.2 of the LOPDGDD establishes that,
In accordance with the provisions of article 83.2.k) of the RGPD, it will be taken into account, as
aggravating factors of the sanction, the following: - The link of the activity of the

offender with the processing of personal data, (section b). Well
Well, this RFEF considers that none of the above criteria is applicable. Plus
quite the opposite, since they should act as mitigating factors.

Let's see. Scope or purpose of the data processing operations, as well as the
number of affected parties and the level of damages they have suffered

(section a). Scope or purpose of the treatment operations: such criterion does not
should apply to the alleged lack of information (the lack of information is not a
treatment operation and therefore such a criterion cannot be applied) and in terms of its
application to the alleged illicit transfer of the recordings to a media outlet,
the truth is that said assignment moves in the field of the exercise of a right

fundamental, the right to freedom of expression and information, which must be put into
relation to the right to data protection, a right that in numerous
Sometimes it has been pointed out that he must yield to the first.

More in the case object of the present procedure, referring to the treatment of data of
representatives of legal persons. On the other hand, this RFEF cannot admit under

no concept the judgment made by the AEPD in the sense of considering that "it is
escuda” in the seriousness of the situation to illegally transfer personal data. Should
It should be taken into account that, among other matters, the meeting on the 7th was being discussed
April the very serious issue of the health of soccer players. No illicit purpose in the
treatment, therefore. Rather the complete opposite. Without forgetting, moreover, that perhaps

that does hide the complaint from the LNFP and the AFE is an attempt to hide the
true scope of the situation and instrumentalize data protection, as well
as to crookedly use the AEPD to divert attention from what was the
real problem that was raised then: adopt measures against COVID-19
that they take into account, as the RFEF intended, the health of the footballers, and not only

Economic interests.

Minimum number of affected: the representatives of the reporting entities are
only two by the LNFP and three by AFE. That is, only five
persons. Without prejudice to the lack of legitimacy of the reporting entities and
that there is no evidence to this party that they declare to act in the name and on behalf of

none, one or more possible affected, the truth is that in any case it cannot
under no circumstances consider that the rest of those attending the meetings can
considered affected, since the lack of denunciation on their part (logical otherwise
given the correct performance of the RFEF) should be understood in the sense that
They consider that they were correctly informed of the processing of their data and

who consider that communication to a media outlet is protected by
data protection legislation and by article 20 of the Constitution.

To understand it in another way would go against the presumption of innocence that the
Constitution establishes and would suppose to consider a conduct as infringing without

evidence, which is typical of an inquisitorial regime and not contradictory.

The intentionality in the infraction, by the entity (section b). The application
of this aggravating criterion lacks any motivation in the initial agreement. It's more,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 22/74








the truth is that in no case has there been any intention on the part of the RFEF to infringe the
personal data protection legislation. It has already been revealed
in this brief of allegations that, on the one hand, the RFEF informed the

attendees at the meeting that it was going to be recorded and that, in any case, it was already
more effective measures were launched by the RFEF to enhance the
information duty. And on the other hand, regarding the transfer of the recordings to a
means of communication it has already been revealed that before the Press Release of
the AFE containing a clearly false interpretation of the result of the meeting of
April 7, 2020, the RFEF first published a press release to establish the truth of

the facts and only later handed over part of the recording when a media outlet
communication requested his delivery, to guarantee the right to freedom of
information and to receive truthful information. Consequently, it cannot be seen
intent in the infringement by the RFEF and therefore cannot be estimated
that meets such aggravating criterion.


The way in which the supervisory authority became aware of the infringement, since the
AEPD became aware of the infringement through the claim of the interested parties
(section h). In this pleadings brief, it has already been shown that
the AEPD has not been aware of the alleged infractions through the
claim of the interested parties, since they have not been natural persons, but have been

the LNFP and AFE entities that have filed the complaint. Given its status as
legal persons it is not possible to appreciate in them the condition of interested parties and therefore
it is not possible to appreciate the aggravating criterion put forward by the AEPD.

Linking the activity of the offender with the performance of data processing

personal, (section b). Finally, this aggravating criterion should not be applied either.
Indeed, the activity carried out by the RFEF involves the processing of personal data,
but its activity is not linked to carrying out treatments. The activity that
is imputed to the RFEF (not informing the interested parties and giving some recordings to
media) do not imply that they are activities related to the

carrying out treatments, such as those carried out by companies of the
marketing sector, or the provision of cloud services, or social networks.

If the criterion to which we refer were interpreted from another, the same would be applied to all
those responsible for treatment and would make such a criterion an application criterion
universal, making it an aggravating factor of general application to any activity

treatment, which is not what the data protection legislator wants.

In conclusion, it is not possible to assess any of the aggravating criteria invoked by the
AEPD. On the contrary, the very small number of
affected, the lack of intentionality of the RFEF, the fact that the AEPD has not

had knowledge of the facts by complaint of the interested parties and the non-involvement
of the activity of the RFEF with the performance of data processing.

10.- Test Proposal.


In accordance with what is stated in the Agreement to Start the Sanctioning Procedure to the
which these allegations are made and what is established in article 77 of the Law
39/2015, of October 1, regulating the Common Administrative Procedure,
They propose the following means of evidence: - Documentary. Consisting of: o The

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 23/74








documents that were attached by this party in its answer brief to the
request for information in the matter of Reference E/0791/2020, which is already
held by that AEPD. o The documents that are provided together with this

pleadings brief. - Witness. Consisting of taking statements from the
representatives (which will be specified at the appropriate time) of the entities
summoned to the meetings of the Covid-19 Monitoring Commission held on
March 12 and April 7, 2020 in order for them to testify in relation to the
following questions: o About whether the President of the RFEF informed the
attendees at the meetings of March 12 and April 7, 2020 that the meetings

they were going to be recorded. o About whether they considered that the rules regarding the
recording of the meetings of the Covid-19 Monitoring Commission were applicable to
all meetings held by it.

Consideration of the complainant entities from the point of view of the legislation

of administrative procedure As has been shown, they are not the
natural persons allegedly affected who have filed the complaint, but the
LNFP and the AFE. Therefore, they do not have the status of interested parties in the procedure.

It is REQUESTED: 1.- Take for granted in a timely manner ALLEGATIONS against the
Agreement to Start Sanctioning Procedure against the Royal Spanish Federation

of Soccer in Procedure No.: PS/00368/2021. 2.- Issue resolution by which
agree on the file of the proceedings. 3.- In any case, consider presented
the documentary evidence that accompanies this document and by proposed evidence
testimonial, in the terms established in this document, and agrees to the practice of
said testimonial evidence. 4.- Do not consider anyone interested in the procedure.

effect, to the LNFP and the AFE.”

NINTH: On 11/08/21, the test practice period began,
remembering in the same: a).- to consider reproduced for evidentiary purposes the complaint
filed by the complainant and her documentation, the documents obtained and

generated that are part of file E/03735/2020 and b).- consider reproduced
evidentiary effects, the allegations to the initiation agreement of PS/00368/2021,
presented.

TENTH: On 11/29/21, the RFEF is notified of the proposed resolution,
in which, it is proposed that, by the Director of the Spanish Agency for

Data Protection was sanctioned for the following infractions:

    - For the infringement of article 13 of the RGPD, by not properly informing
        those attending the meetings of the precepts established in said article,
        with a fine of 100,000 euros (one hundred thousand euros).


    - For the infringement of article 6.1 of the RGPD, when carrying out an illegal treatment of
        the personal data of the people attending the meetings of the
        Commission for the Monitoring of COVID-19, when they were transferred to the media
        communication without the express consent of those involved, with a sanction

        of 100,000 euros (one hundred thousand euros).

ELEVEN: Once the proposed resolution has been notified to the party complained against, the latter, with
dated 12/13/21, submits a brief of allegations, indicating, among others, the following:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 24/74









       "FIRST. Reiteration of the arguments presented at the opening brief
       process.


The allegations that were made at the time are reiterated and reproduced.
submitted to the brief to initiate the sanctioning procedure, without prejudice to reiterating
through this document and develop, where appropriate, additional allegations or that
complete the above. Likewise, it insists on the proposal and practice, for this
Essential RFEF, of the testimonial evidence then proposed. Your non-admission

produces a clear defenselessness for this RFEF.

       SECOND. On the facts declared proven.

Regarding the Proven Facts (pages 25 et seq. of the Proposal), the

narration of these that we already did in our brief of allegations to the agreement of
beginning. In addition, we must show the following:

2 - The defenselessness that the inadmissibility of the evidence has produced for this party is reiterated
proposed testimony. With all due respect, it should be noted that the facts remain
misrepresented by being based only on "the joint assessment of the documentary evidence

operating in the procedure” (p. 27 of the Resolution Proposal). - The AEPD to the
that we address, in the proposed resolution of the Instructor of the Procedure (p.
25), considers that it should be taken into account that at the first meeting (March 12
2020) was attended by 11 people and that the second (April 7, 2020) was attended by
26, 15 people more than in the first. This circumstance is considered relevant

the Instructor for the purposes, it seems, of communicating to the attendees that the session
was being recorded. We reiterate that all those attending the second meeting
they were aware that, like the first, the session was being recorded,
as would have been unquestionably demonstrated had he admitted the
proposed witness evidence.


In this sense, it should also be noted that of the 15 more people who attended
at the second meeting, 13 belong to the RFEF and therefore were aware
perfectly of the rules by which the meetings are governed (as it would have been put
manifest in the testimonial evidence proposed by this RFEF).


On the part of the LNFP, the same people attended both meetings and therefore the
information provided in the first was already known to them. And by the AFE
The same people also attended both meetings, although the second
A person from Legal Services also attended, who is not affected by the
present procedure (which, according to the complaint of the complainant entities,

reaches the legal representation of the AFE and the Deputy Director of the LNFP, as
exposes in the first of the Acts that is collected on p. 1 of the P. of
Resolution.

In the Resolution Proposal (p. 26) it indicates, erroneously, that this RFEF

“Implicitly assumes that the above allegations to try to justify the
GDPR compliance, with regard to article 13 is not supported (sic)
conveniently and that, after the second meeting, they have proceeded to adjust their
protocol to what is mandated in the RGPD and in the LOPDGDD”. Respectfully

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 25/74








we consider that an error must have occurred in the way in which the Instructor has
interpreted the performance of this RFEF. In no event do we assume, either implied or
explicitly, that those attending the meetings were not informed. what is

RFEF pointed out in its allegations to the initial agreement that what it did was
precisely apply the principle of proactive responsibility established in article
24 of the RGPD and that the LOPDGDD rightly considers the most important change that
brings with it the Regulations.

This has also been made clear, repeatedly, by the AEPD itself, by

example in its Report 0089/2020, stating that "This Legal Cabinet comes
repeatedly emphasizing, in the different consultations submitted to his report, the
paradigm shift brought about by the full application of the Regulation (EU)
2016/679 of the European Parliament and the Council, of April 27, 2016, regarding the
protection of natural persons with regard to the processing of their data

personal information and the free circulation of these data, as based on the principle of
“accountability” or proactive responsibility, as stated in the Statement of
Reasons for Organic Law 3/2018, of December 5, on Data Protection
Personal and guarantee of digital rights: “the biggest novelty presented by the
Regulation (EU) 2016/679 is the evolution of a model based, fundamentally, on
in the control of compliance to another that rests on the principle of responsibility

active, which requires a prior assessment by the person in charge or by the person in charge of the
treatment of the risk that could be generated by the treatment of personal data
personnel to, based on said assessment, adopt the appropriate measures”.

Well, this RFEF, not because the duty to inform of

in accordance with article 13 of the RGPD but as proof of the intention of constant
improvement in terms of data protection with which the RFEF is committed,
elaborated a specific informative clause for online meetings (something that, as
doubtless the AEPD knows, it is not usual) and therefore, as we say, what
really demonstrates is the RFEF's commitment to good practices (commitment

which was already verified by the AEPD itself in its resolution to file actions
issued in File No.: E/02043/2019, in which it was recorded that the
RFEF perfectly complied with the information obligations required by the
art. 13 GDPR).

The RFEF received from Cadena SER the request that part of the

recording of the meeting on April 7, 2020 given the enormous confusion generated by
the declaration of confinement produced by the pandemic and the suspension of
soccer activities. And it is reiterated that what was at stake was full respect for the
fundamental right to freedom of expression and information. In relation to a
a situation that has never occurred in history. In the proven facts,

In addition, the AEPD must indicate that the data that saw the light in no case
referred to private activities but to professional activities of representatives of
legal persons. It is a proven fact that the claimants themselves
recognize, by pointing out in their complaints that the data referred to "the representation
of the AFE, as well as the Deputy Director of the LNFP”. Such a circumstance must

be included in the list of proven facts that have been accredited, since
This is something of enormous relevance when it comes to determining the legitimacy of the
treatment from the point of view of data protection legislation.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 26/74








In addition, it should be noted that the full text of the session of the
meeting, but only part of the recording. On page 41 of the motion for a resolution
it is expressly stated that they disseminated “excerpts from the audio files”.


       THIRD. About the recording of the meetings of the Commission of
       Monitoring of COVID19.

What has already been stated in our allegations to the initial agreement is reiterated. What's more,
we must point out that in our opinion the Instructor carries out an interpretation

erroneous article 18 of Law 40/2015 (LRJSP). The motion for a resolution errs
point out (p. 28) that according to said article 18 “they will only have access to the
recording [of the minutes] the members of the collegiate body…. At no time, the
norm allows access to the recording of people outside (sic) the collegiate body”.
And this is not so because, for example and without going any further, Law 19/2013, of

transparency and good governance allows and even requires the publication of the minutes, for
Much that they are regulated by article 18 of the LRJSP. In this sense, for
For example, the Resolution of the 4th Transparency and Good Governance Council R/0482/2018
of 11/12/18, which was issued in the following case (we transcribe the summary that the
Advice does on your website:
   https://www.consejodetransparencia.es/ct_Home/Actividad/recursos_jurisprudencia/

Resources_AGE/2019/119_CRTVE_16.html

A journalist submitted a request for access to information addressed to the Corporation
of RTVE to see the announcements, minutes and agendas of the meetings of its
Board of Directors, since 2014. The RTVE Corporation denied the

information to understand that what is requested affects the confidentiality and secrecy in
decision-making and that it is auxiliary or support information.

Once a claim was presented, the Council for Transparency and Good Governance considered it,
consider that the arguments of the RTVE Corporation were not applied, since

It is not auxiliary information due to the very essence of its contents, since it is
make important decisions in that Body and because it cannot harm the
confidentiality of meetings and discussions that have already taken place and whose
public knowledge serves to respond to the public, as established by law.
It should be noted that the aforementioned Resolution was confirmed in its essentials by Judgment
of the Central Contentious-Administrative Court No. 4, of 07/22/19 (sent. No.

81/2019, issued in ordinary procedure No. 4/2019). It was confirmed in
essential because it partially upheld the appeal filed by RTVE and ruled that it should
“exclude from the right of access to the minutes, interventions in a private capacity”.

In other words, any intervention that was not carried out on a private basis had to be provided to the

journalist who requested the minutes (all the minutes since 2014, remember, not one or
two minutes). Therefore, it is not accurate to say that no one outside the collegiate body can
have access to the recording of the minutes.

On the other hand, the motion for a resolution insists that at the second meeting

15 people who did not attend the first participated, which he interprets in the sense
that they might not be aware that, like the first meeting, also the
second was to be recorded. We have already pointed out that 13 of them are part of the
RFEF itself and they knew perfectly well that the session was going to be recorded, as well as the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 27/74








purpose of the recording and that another person was a person of the Services
Legal of the AFE. Therefore, we must reject the conclusion that there were 15
people who were unaware that the meeting was going to be recorded and the purpose of the

recording. Also, we cannot agree with the following statement
of the Instructor (p. 31): “as the ambiguity of the information provided by the
representative of the RFEF on the purposes for which the personal data was going to be used
obtained from the recordings is so evident, it forces us to raise the possibility that the
The purpose for which the recordings were going to be used was something other than the legally established one.


In this case, it would have been necessary to collect from each and every one of the attendees
consent to the meetings, since it would have no place (sic) in any other type of
legitimacy, except "consent". And this because the instructor, in our
opinion, part of a mere hypothesis, of a "possibility", as in the proposal
points out; and part of the fact that only the consent would be an enabling title for the

communication of the recording of the meeting to a prestigious media outlet.
When in reality both the fundamental right to freedom of information and
expression and the existence of an evident public interest legitimize such communication.

       QUARTER. About the publication by various media of
       information regarding the meetings of the COVID-19 Monitoring Commission


First of all, we reiterate that in our opinion it is not accurate to state, as the
proposed resolution (p. 31), which legally only with the prior authorization of
those involved with their express consent, the recording of
a meeting of a collegiate body for something other than to support the

authenticity of the minutes of the session. We have already seen that Law 19/2013 allows and still
obliges the minutes of collegiate bodies to be made public, particularly when “the
make important decisions in that body and because you cannot harm the
confidentiality of meetings and discussions that have already taken place and whose
public knowledge serves to answer to the citizenry”.


That is exactly what has happened in the case at hand. and his own
Recital 50 of the RGPD mentioned in the resolution proposal refers to the
existence of lawful compatible uses, which must also be related to the
recital 153 and article 85, both of the RGPD.


In any case, and with all due respect, it should be considered when
least inappropriate to consider that article 20 of the Constitution is an article
“helped”, as stated on p. 33 of the motion for a resolution. said article
is one of the foundations of our constitutional model and this RFEF considers
that in all its scope and importance is fully applicable to the case that is now

analyze. And it was analyzed in detail, and not in a way assisted by this RFEF at the time
to consider the weighting between the fundamental right to data protection and
the fundamental right to freedom of information and expression. There's no need
recall now the normative nature of the Constitution and therefore the possibility of
that article 20 legitimizes by itself, without the need for a subsequent or intermediate rule,

the processing of personal data in exercise of the right “to communicate or receive
freely truthful information by any means of dissemination”.

       FIFTH. On the lack of legitimacy of the reporting entities.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 28/74









We reiterate here again what we already pointed out in our pleadings to the agreement
of initiation of sanctioning procedure, which we take for reproduced. Nevertheless,

we must add or remember the following. On the one hand, the motion for a resolution does not mention
not at all the article that is key here: article 77 of the RGPD, whose text is the
following: 1. Without prejudice to any other administrative recourse or judicial action,
Every interested party shall have the right to present a claim before an authority of 6
control, in particular in the Member State in which he has his habitual residence,
place of work or place of the alleged infringement, if you consider that the treatment of

personal data concerning you violates this Regulation. 2. The authority
of control before which the claim has been filed will inform the claimant
about the course and outcome of the claim, including the possibility of
access judicial protection under article 78. This article makes the Law
39/2015 is not fully applicable to the procedures processed by the AEPD with

occasion of an infringement of the right to data protection.

From the outset, it is no longer possible to initiate a procedure at the request of the
interested party, but only ex officio, and must be made prior claim by the interested party,
as stated in art. 77 of the GDPR. Therefore, only those interested can urge,
by means of a claim, the beginning of a sanctioning procedure. So set it

clearly the art. 64 of the LOPDGDD, which, in particular, in paragraph 2 provides
When the purpose of the procedure is to determine the possible existence of
an infringement of the provisions of Regulation (EU) 2016/679 and this law
organic, will be initiated by means of a start-up agreement adopted on its own initiative or as
consequence of claim.


The complaint of an uninterested third party has no place today in the procedure
sanctioning in terms of data protection, despite the fact that it is foreseen, for other
cases, in article 58 of the LPACAP. For this reason, and rightly so, article 3.3 of the Royal
Decree 389/2021, of June 1, approving the Statute of the Agency

Spanish Data Protection, has 3. The procedures processed by the
Spanish Agency for Data Protection will be governed by the provisions of the
Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27,
2016, Organic Law 3/2018, of December 5, on the Protection of Personal Data
and guarantee of digital rights, by the regulatory provisions issued in
their development and, as long as they do not contradict them, on a subsidiary basis, by the rules

general information on administrative procedures

We cannot agree with the statement made by the motion for a resolution
saying (p. 35) that "there is no regulatory body regarding the protection
of personal data” the differentiation between the treatment of personal data

personal data of natural persons that affect their private life than the data that
affect your professional life. It is enough to quote -as we have already done in our
allegations to the agreement to initiate the sanctioning procedure- article 19 of the
LOPDGDD that clearly differentiates the processing of data for private purposes that
for professional purposes.


       SIXTH. On the nature of the data subject to treatment.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 29/74








This RFEF fully reiterates what it already maintained in the allegations it presented to the
agreement to start sanctioning procedure. In particular, the fact that
who were summoned to the meetings, and therefore who participated in

them, were the entities LNFP and AFE, which evidently had to express their
respective positions through their representatives. The data that was transferred
were those of such entities through their representatives. must be kept in
account that there are personal data that affect private life and data that are of
professional nature. In fact, the motion for a resolution recognizes this
expressly, by indicating (p. 37) that "in the recorded interventions there is data

or exclusively personal opinions”.

If that is so, it is necessary to conclude that there are also data or opinions not
exclusively personal. Although, the proposal does not indicate to what data
exclusively personal concerns. In the transcript of the meetings, which has been

attached by this RFEF and which has been admitted as documentary evidence, does not appear
no exclusively personal opinion of the representatives of the LNFP and the
AFE, but professional opinions expressed in their capacity as representatives of such
entities.

       SEVENTH. Regarding the alleged lack of information offered to people who

       attended the meetings of the COVID-19 Monitoring Committee.

We also reiterate here what was already pointed out in our allegations to the opening brief
sanctioning procedure, in the sense that those attending the meetings were informed
meetings. The AEPD Instructor now points out that the extremes were not reported

that collects article 13 of the RGPD and that the privacy policy of the Web of the
RFEF was not available to the participants in the meetings. Likewise, it
points out that the RFEF implicitly acknowledges that it did not report since later
elaborated an informative clause that is incorporated into the calls for the
meetings.


In relation to such issues, we must make the following allegations: - In
Regarding the first, it must be taken into account that not only art. 13 of the
GDPR, but also art. 11 of the LOPDGDD, which allows basic information
less extensive than the one that the motion for a resolution includes on p. 38. Also,
according to article 13.4 of the RGPD, its sections 1 to 3 do not apply to the extent

that the interested parties already have the information.

This information is already available to those interested on the website of the
RFEF, as the resolution proposal itself points out, with the exception, perhaps, of the
purpose of the treatment. But this information was already expressly provided by the

President of the RFEF when pointing out that the purpose of the recording was to leave
record of what was discussed in the meetings.

Therefore, the duty to inform was fulfilled. - Indicates the proposed resolution
that “meeting attendees were not connected at any time to the

website of the Federation, it is not even clear that they had informative equipment
(sic) that they could connect to the internet to access the Federation page”.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 30/74








In relation to the first statement, it is not supported by any evidence, so
it is a mere appreciation of the Instructor that cannot be demonstrated in any case. Y
in relation to the second, we want to understand that it is an error of the

Motion for a resolution, since it is clear that when it comes to holding
online meetings via Zoom (unquestioned and proven fact) each and every one of the
attendees had to be connected to the internet and use computer equipment that
allowed to attend them. Taking into account that, as is known, the
telematic attendance by internet to a meeting via Zoom allows you to open other pages
Web. Regarding the third, we refer to what we have already pointed out in the

second allegation in this writing.

       EIGHTH. On the alleged illicit treatment of the personal data of the
       meeting attendees. Data protection and freedom of information and
       expression.


At this time we must reiterate everything that we have already pointed out in our
allegations to the agreement to start the sanctioning procedure. Given the significance
of the relationship between two fundamental rights we believe opportune to transcribe great
part of what we alleged at the time, completing it in view of the proposal for
resolution. The transfer of the recording of a part of the meeting of April 7, 2020

to Cadena SER was produced in order to guarantee the right to freedom of
information and to receive truthful information recognized in article 20 of the
Constitution.

We must now insist that the recording of the entire meeting was not made available, but only

on the one hand, precisely what was considered essential to be able to
guarantee the right to receive truthful information. The proposal itself
The resolution acknowledges that only “excerpts from the audio files” were released (p.
41). Such transfer occurred in a scenario of enormous confusion generated by the
suspension of all soccer activity, in which the AFE had sent a message

totally false regarding the possible holding, if any, of football matches,
which could even affect the health of the soccer players.

The media needed to clarify a serious situation that had
falsified the AFE. And not being enough with the Press Release issued by the RFEF a
means of communication, we repeat that, in order to clarify some facts of

extraordinary seriousness, asked the RFEF for the recording that we already know. Therefore, it
made by the RFEF was to facilitate the correct exercise of the right to
freedom of expression and information and the right to receive truthful information. No
we can share the statement made in the motion for a resolution (p. 39)
that the issuance of a press release already constitutes by itself the exercise of

right to freedom of information and to communicate truthful information and that
providing the recording to a prestigious communication medium “is no longer an exercise
of a fundamental right since the exercise of the right is already carried out with
in advance when sending a press release to the media”.


Nor can we accept that the fundamental right has been exercised with the shipment
of the press release and that the sending of the partial recording of the meeting “exceeds
by far” the limits of the RGPD. On the contrary, it is clear that sending the
content of the meeting was necessary to fully exercise that right, since

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 31/74








we can forget that the AFE had already issued a false message and that the
The media wanted to know the truth of what was discussed at the meeting: in
definitively, they wanted to receive truthful information and the RFEF had the right to issue that

information.

Nor, with all due respect, can we admit that, as the
proposed resolution, the RFEF provided "without any objection" (p. 39
of the proposal) the recording of part of the meeting. This value judgment implies
that the RFEF acted premeditated, which is not at all true. What he did

It was exercising a fundamental right. Nor can we share the opinion that
includes the motion for a resolution (p. 40) in the sense that the call for
a press conference would suffice to exercise the right to freedom of information. Y
nor can we share the idea that freedom of information can only
be exercised through the processing of data that have been obtained for

exclusively journalistic, as the proposal intends (p. 40).

What recital 153 and article 85 of the RGPD observe is the treatment of
data for journalistic purposes, but without requiring that the treatment of these be in all
case for journalistic purposes. Otherwise it would not be possible, for example, to deal with
journalistic purposes data of a conduct of a person of public relevance or the

data derived from a sentence, which obviously are not initially treated "with
exclusively journalistic purposes. That said, and despite the fact that we already exposed it in
our allegations to the initial agreement, we must now reiterate what we said.

The relationship between the right to data protection and the right to freedom of expression

expression and information is provided for in article 85 of the RGPD, whose text, as it is
known, provides: Article 85 Treatment and freedom of expression and information 1.
Member States shall reconcile by law the right to data protection
under this Regulation with the right to freedom of
expression and information, including treatment for journalistic purposes and purposes of

academic, artistic or literary expression. 2. For processing carried out for purposes
journalistic or for purposes of academic, artistic or literary expression, the States
Members shall establish exemptions or exceptions to the provisions of chapters II
(principles), III (rights of the interested party), IV (responsible and in charge of the
treatment), V (transfer of personal data to third countries or organizations
international), VI (independent control authorities), VII (cooperation and

coherence) and IX (provisions related to specific situations of treatment of
data), if they are necessary to reconcile the right to data protection
with freedom of expression and information. 3. Each Member State
shall notify the Commission of the legislative provisions it adopts in accordance with
paragraph 2 and, without delay, any subsequent modification, legislative or otherwise, of the

themselves. Among the exceptions that must be implemented by the Member States are
are the principles (among others the legality of the treatment) and the rights of the
stakeholders (for example, to be informed). Well, ultimately, you must reconcile the
right to the protection of personal data with freedom of expression and
information.


In this sense, Recital 153 of the RGPD provides (the underlines are
ours): The law of the Member States must reconcile the rules governing the
freedom of expression and information, including journalistic, academic,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 32/74








artistic or literary, with the right to the protection of personal data in accordance with
to this Regulation. The processing of personal data for purposes exclusively
journalistic or for purposes of academic, artistic or literary expression must be subject
to exceptions or exemptions from certain provisions of this Regulation
if so required to reconcile the right to protection of personal data with

the right to freedom of expression and information enshrined in article 11 of
the letter.

This should apply in particular to the processing of personal data in the field
audiovisual and in news archives and newspaper archives. Therefore, the states
Members must adopt legislative measures that establish the exemptions and

necessary exceptions to balance these fundamental rights. The states
members must adopt such exemptions and exceptions in relation to the principles
general, the rights of the interested party, the person in charge and the person in charge of the treatment,
the transfer of personal data to third countries or organizations
international authorities, independent control authorities, cooperation and

coherence, and the specific situations of data processing. If said
exemptions or exceptions differ from one Member State to another the law must apply
of the Member State that is applicable to the data controller.

In order to bear in mind the importance of the right to freedom of expression in all
democratic society, it is necessary that notions related to said freedom, such as the

journalism, be interpreted broadly. The relationship between both rights has already
analyzed by the AEPD itself and by the Courts. Just as an example
we can note the following. In the Guide to Using Camcorders for
security and other purposes of the AEPD (https://www.aepd.es/sites/default/files/2019-
12/guide-video surveillance.pdf) it is expressly stated (pp. 48-49): 6.2 Treatment of
media images.


The publication of images in the media is an exercise in
right to freedom of expression and information conferred by article 20 of the
Spanish constitution.

In the event that any individual considers his rights injured by the

publication of images, would have to go to court under the provisions
in the Organic Law 1/1982, of May 5. In any case, the RGPD contains a mandate to
Member States to reconcile by law the right to data protection
of the European standard with the right to freedom of expression and information,
including treatment for journalistic purposes and academic expression purposes,
artistic or literary.


It is clear that the conclusion reached by the Agency (the publication of images on
the media is an exercise of the right to freedom of expression
and information that must be covered by the Organic Law 1/1982) is
perfectly applicable to the case referred to in this proceeding.


Therefore, it is appropriate to consider that it is not possible to consider punishable as an infringement
of the right to data protection the transfer to a communication medium of the
recording referred to in this procedure. On the other hand, the AEPD in its
Report 624/2009 estimates that "despite the lack of specific regulation in Spain

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 33/74








regarding the processing of personal data for purposes exclusively
journalistic or artistic or literary expression, as provided in article 9 of the
Directive, the best doctrine understands that given the content of art. 6.1 of the LORTY

(LOPD), according to which "the processing of personal data will require the
unequivocal consent of the affected party, unless the law provides otherwise»; the
expression "unless the law provides otherwise", allows us to understand that it is not
The consent of the affected party is necessary when art. 20 of the CE allows the
treatment.


What will require a consideration of the specific case, and from the principles of
adequacy, relevance and consistency collected in art. 4 of the LORTAD (LOPD)
(...)». For its part, the National High Court has already had the opportunity to rule on
specific assumptions, being especially relevant the judgment of July 9,
2009. In this judgment, the National High Court, following the criteria established by the

Constitutional Court, conditioned the prevalence of the fundamental right to
freedom of information on the right to data protection or other rights
fundamental, that it refers to facts with public relevance, in the sense of
newsworthy, and that said information is truthful.

Especially relevant is also the Judgment of the National High Court of 11

April 2012, resource 410/2010, in which the following is stated: "...it will be necessary
proceed to a weighting between the rights and purposes that protect the owner of these
rights and the right to data protection of those affected. To perform this
weighting, it is necessary to take into account the specific circumstances of each
case, taking into account the right that is exercised, the type of information that is provided and its

relevance, the purpose pursued, the means used, the number of recipients
possible and the existence of general interests in obtaining this type of
information. It should not be forgotten, at the time of making this weighting, that both the
freedom of expression, as also occurs with that of information, acquire special
relevance when "they are exercised in connection with matters that are of general interest,

by the matters to which they refer and by the people who intervene in them and
contribute, consequently, to the formation of public opinion, reaching
then its maximum level of justifying efficacy against the right to honor, which
weakens, proportionally, as the external limit of the freedoms of expression and
information, as long as its holders are public persons, they exercise public functions
or are involved in matters of public relevance, thus forced to bear

a certain risk that their subjective personality rights will be affected
for opinions or information of general interest, as this is required by pluralism
politics, tolerance and the spirit of openness, without which there is no society
democratic" (STC 107/1988, of June 8, FJ 2). …..


It should be remembered, in this sense, that the Constitution recognizes the right to express and
freely spread thoughts, ideas and opinions by word, writing
"or any other means of reproduction" and the right to communicate or receive
truthful information freely "by any means of dissemination". All this, without prejudice
that the protection afforded by these rights in their confrontation with other

should be understood reinforced when its exercise is produced by the professionals of the
information or by the conventional means of communication, but without forgetting that the
communication, today, is not limited to the media
traditional but to other very diverse means, propitiated by the current technology,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 34/74








in which the internet occupies a very important role in obtaining and disseminating information
truthful and to freely express their own opinions and ideas.


For this reason, the special position held by the rights to freedom of expression and
information is preached not only to protect an individual interest, but, at the same
time, allow the creation of a free public opinion in a plural society and
democratic… The information provided was truthful (or at least could not
considered gratuitous or patently unfounded), was documented and had an interest
general and public relevance, affecting people who, in their capacity as

public officials and with important positions in the University has a clear
public projection according to the position they held and the service they provided.

The exercise of freedom of expression and information that protected the appellant
implies the treatment of the personal data of the subjects object of the criticism and the

information, since the use of your personal data, proportionally and
justified by the end pursued and the freedom exercised, a
essential instrument without which criticism or information would be meaningless and
would be emptied of content. On the other hand, both their names, positions and images were
of public knowledge ……, so it cannot be argued that the data
provided were out of public reach revealing personal data

that unrelated to the information were not previously known.

That is why the use of the data of the complainants was protected
for the appellant's exercise of freedom of expression and information and the lack of
consent of those affected is justified in accordance with the provisions of the

article 6.2 of the LOPD, without it being understood that their conduct constitutes
any administrative infraction in terms of data protection. The court
Supreme Court, in its Judgment of September 27, 2010, rec. 6511/2008, has made it clear
that “although the notoriety of a person does not authorize the invasion of his private life, the
public interest magazine strengthens the demands of freedom of information on

her to the same extent that that interest is affected, with the consequence that
their privacy will have to yield in the aspects related to said interest”. And it is also
Especially important is the Report of the AEPD itself N/REF: 012007/2019 (https://
www.aepd.es/es/documento/2019-0044.pdf) which refers to the weighting between
data protection and freedom of expression and information.


For this, it endorses the doctrine of the sentence of the National High Court of 22
January 2019, “whose fourth legal basis summarizes the constitutional doctrine
regarding the weighting between the right to data protection and the rights to
freedom of information recognized by article 20 of the CE, highlighting the
existing differences in the case of persons who exercise functions

public”.

And in particular it points out (emphasis is from the AEPD itself in its Report): "For this reason,
sees weakened the protection of these other constitutional rights recognized by the
Article 20.4 CE against the freedoms of expression and information, when they are exercised

in connection with matters that are of general interest, for the matters to which
refer and by the people who intervene in them and contribute, consequently, to
the formation of public opinion, as occurs when they affect public figures,
who exercise public functions or are involved in matters of public relevance,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 35/74








therefore obliged to bear a certain risk that their subjective rights of the
personality are affected by opinions or information of general interest
(SSTC 107/1988, of June 8, 20/2002, of January 28, 160/2003, of January 15

September, 151/2004, of September 20, and 9/2007, of January 15).

And in the case of people who exercise public functions, as recalled in the judgment
of the Supreme Court of January 11, 2019, “the public relevance of the
information- according to the criteria of the Constitutional Court is determined both by the
matter or object of this, as by reason of the public or private condition of the

person concerned. As we have said repeatedly, the authorities and
public officials, as well as public figures or those engaged in activities that
carry public notoriety «voluntarily accept the risk that their rights
subjective personality traits are affected by criticism, opinion or revelation
adverse and, therefore, the right to information reaches, in relation to them, its

maximum level of legitimating efficacy, insofar as their life and moral conduct
participate in the general interest with a greater intensity than that of those people
private that, without a vocation for public projection, are circumstantially seen
involved in matters of public importance, to which it is necessary, for
consequently, recognize a higher level of privacy, which prevents granting
general importance to facts or behaviors that would have it if they were referred to

public figures” (for all, STC 172/1990, of November 12, FJ 2)”.

Likewise, the criterion related to the participation that the interested party has in the
as a limit to their right to personal data protection has been
frequently used by the Court of Justice of the European Union, being able to

citing for these purposes the judgment of May 13, 2014 regarding the so-called
"right to be forgotten" that in the interpretation of Directive 95/46 and the European Charter of
Fundamental Rights indicates that "since the interested party may, taking into account
your rights under Articles 7 and 8 of the Charter, request that the information
in question is no longer made available to the general public through its

inclusion in such a list of results, it is necessary to consider, as follows, in
particular, of section 81 of this judgment, that these rights prevail,
in principle, not only on the economic interest of the operator of the search engine,
but also on the interest of said public in finding the aforementioned information
in a search to be seen on that person's name.


However, this would not be the case if it turned out, for specific reasons, as the role
carried out by the aforementioned interested party in public life, that the interference in
their fundamental rights is justified by the preponderant interest of said
public to have, as a result of this inclusion, access to the information in question”.


On the other hand, another criterion to consider is that related to the professional activity that
develop the affected, since as indicated in the Judgment of the National High Court of 6
of June 2017 "in the present case, already entering into the weighting of the rights
and interests at stake, it must be taken into account in the first place, that it refers to the life
professional and not personal life, since this is very relevant to modulate the

intensity that the protection of the right regulated in article 18.4 of
the Constitution, as indicated by this Chamber and Section in the judgment of May 11
of 2017 (Rec. 30/2016). In this regard, reference should be made to the guidelines
of the Working Group of 29 on the right to be forgotten (Guidelines on the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 36/74








implementation of the Court of Justice of the European Union Judgment on “Google
Spain and inc v, AEPD and Mario Costeja C-131/12), according to which: “There is a difference
between a person's private life and his or her public or professional life.


The availability of information in search results becomes more
acceptable the less information it reveals about a person's private life (...)
information is more likely to be relevant if it is related to life
professional of the interested party, but it will depend on the nature of the work of the interested party
and the legitimate interest of the public in having access to that information through a

search by name.

In the present case it is evident that each and every one of the
the requirements required by the National High Court, the Constitutional Court, the
Court of Justice of the European Union and the AEPD itself to understand that it must

prevail the right to freedom of information over the right to protection of
data. Indeed:

We are facing events with public relevance, in the sense of being newsworthy, and the
Information requested by the media and made public is truthful. - The
people involved are, without a doubt, characters with public relevance

(well-known directors of the LNFP and the AFE). - The information made public is
refers exclusively to the professional or public activity of such persons, not to their
private activity. In conclusion, applying the criteria of the highest Courts
that have just been pointed out and of the AEPD itself, it is evident that in our case we do not
it is only possible to file the actions initiated based on the complaint filed by the

LNFP and the AFE, which also lack the legal standing to present
any complaint in relation to alleged and non-existent violations of the right
essential to data protection. Rather it seems that such entities intend
instrumentalize the AEPD and something as serious as the right to data protection
of a personal nature (the National High Court on more than one occasion, as is known,

has closed the door to the defense of the right to honor and privacy through the
instrumentalization of the Data Protection Law and has spoken in favor of
freedom of information in cases involving 15 people from
public relevance, as is the case referred to in this proceeding).

We have recalled and reiterated the above considerations, moreover, because they have not

deserved any attention in the motion for a resolution and we understand that they are
essential to weigh the relationship between the right to data protection and the
right to freedom of expression and information.

       NINTH. Application of aggravating criteria.


We do not understand the Instructor's statement (which we respectfully consider
that goes against the respect that in turn should have towards people, although
are entities denounced before the AERPD) when he affirms that "it only remains
the entity claimed” in which the lack of information is not an operation of

treatment and does not consider other factors, which it is not necessary to transcribe now because
they are collected on page 41 of the proposal.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 37/74








To demonstrate that the entity claimed, the RFEF, is not "only left" in what
that the Instructor points out, we now reiterate, again, what we already pointed out in detail
in our brief of allegations to the initiation agreement, in which we carried out a

analysis, we believe detailed, of the circumstances established by the RGPD and the
LOPDGDD. We said then and we reiterate now, that in the event that the AEPD
considered that it is appropriate to continue processing the procedure, we must
make the following allegations in relation to the one we consider incorrect
application of the aggravating criteria that in the Agreement to Initiate the Procedure
they pick up


The AEPD provided in said Initial Agreement that it is considered appropriate to graduate
the sanctions to be imposed (both for the alleged violation of art. 13 of the RGPD and of
the alleged violation of art. 6.1) according to the following aggravating criteria
established in article 83.2 of the RGPD: - The scope or purpose of the operations

of data processing, as well as the number of interested parties affected and the level of
damages they have suffered (section a). - The intentionality in the infraction,
by the entity (section b). - The way in which the supervisory authority had
knowledge of the infringement, since the AEPD was aware of the infringement
through the claim of the interested parties (section h). It also adds that, due to its
part, article 76.2 of the LOPDGDD, establishes that, in accordance with the provisions of

Article 83.2.k) of the RGPD, will be taken into account, as aggravating factors of the
sanction, the following: - The link between the activity of the offender and the
of personal data processing, (section b).

Well, this RFEF has already said that it considered, and now it reiterates, that none of the

above criteria is applicable. Quite the contrary, because they should act as
extenuating

Scope or purpose of data processing operations, as well as the number
of interested parties affected and the level of damages they have suffered

(section a).

Scope or purpose of treatment operations: such criteria should not be applied to
the alleged lack of information. We now reiterate that the lack of information is not
a treatment operation and therefore such a criterion cannot be applied. holds the
motion for a resolution that “the lack of information is indeed an operation of

treatment because the information or the absence of information about the treatment of
the personal data of the interested party generates consequences for the treatment of
the data” (sic). With all due respect, we fail to understand the scope of the
affirmation of the motion for a resolution. Well, in reality, mere information is not
no data processing operation, and does not fit the definition of data processing

that collects the art 4.2 of the RGPD.

Therefore, that aggravating circumstance cannot be applied to the alleged lack of
information because this is not a treatment operation. And as for his
application to the alleged illicit transfer of the recordings to a media outlet,

the truth is that said assignment moves in the field of the exercise of a right
fundamental, the right to freedom of expression and information, which must be put into
relation to the right to data protection, a right that in numerous
Sometimes it has been pointed out that he must yield to the first. More in the case object of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 38/74








this procedure, referring to the treatment of data of representatives of
legal persons.


On the other hand, this RFEF reiterates that it cannot admit under any circumstances the judgment
that the AEPD does in the sense of considering that it “hides” in the seriousness of the
situation to illegally transfer personal data. As we have already said in our
allegations to the agreement to initiate the sanctioning procedure, it must be taken into
note that among other matters, the meeting on April 7 was discussing the
very serious issue of the health of footballers. No illicit purpose in the treatment,

therefore. Rather the complete opposite.

Without forgetting, furthermore, that perhaps what the complaint of the LNFP and the AFE hides
is an attempt to hide the true scope of the situation and to instrumentalize the
data protection, as well as using the AEPD tortiously to divert the

attention to what was the real problem that arose then: to adopt
measures against COVID-19 that take into account, as the RFEF intended, the
footballers' health, and not only and merely economic interests. Minimum number
affected: the representatives of the complainant entities are only two per
part of the LNFP and three by AFE.


That is, only five people. Without prejudice to the lack of legitimacy of the entities
complainants and that there is no evidence to this party that they declare to act on behalf of and
representation of none, one or more possible affected, the truth is that in
In any case, under no circumstances can it be considered that the rest of the attendees
to the meetings may be considered affected, since the lack of complaint on their part

(logical for the rest given the correct performance of the RFEF) must be understood in the
sense that they consider that they were correctly informed of the treatment of
their data and that they consider that communication to a media outlet is
protected by data protection legislation and by article 20 of the
Constitution.


To understand it otherwise would go against the presumption of innocence 17 that the
Constitution establishes and would suppose to consider a conduct as infringing without
evidence, which is typical of an inquisitorial regime and not contradictory.
The Instructor maintains in his proposed resolution that what must be taken into account
account is not the number of those affected, but the fact that "it is public and notorious that the

activity of the RFEF is linked to the massive treatment of personal data”. Well
well, that criterion is not the one derived from the RGPD. Indeed, we cannot share the
interpretation made by the Agency of the aggravating criterion of the number of interested parties
affected. It is evident that the RGPD refers to the fact that there is a number
number of interested parties affected by the possible infringement, not because the person responsible

generally treat a large or “massive” number of personal data.

This interpretation is corroborated by the European Committee for Data Protection,
that he endorsed and therefore assumed the content of the Guidelines on the application and
the setting of administrative fines for the purposes of Regulation 2016/679 adopted by

the Article 29 Working Group on October 3, 2017, which clearly
They provide that the factors provided for in article 83.2 of the RGPD must be evaluated
combined way, that is, in what interests us now, the number of stakeholders
along with the possible impact on them. And he adds: The number of interested parties must

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 39/74








evaluated to determine if it is an isolated event or symptomatic of a
more systematic rape or a lack of proper routines. This does not mean
that isolated events should not be sanctioned, since an isolated event could

affect many stakeholders. And it is evident that we are not faced with a fact
symptomatic or routine and that does not affect many interested parties, but exclusively
at most five people.

In the same sense, Recital 75 of the RGPD, which in order to determine the degree of
damages that may cause a possible infringement in terms of protection

of data must be taken into account, among other aspects "that the treatment implies
a large amount of personal data and affect a large number of data subjects”.

In other words, contrary to the interpretation made by the motion for a resolution, the
aggravating circumstance should only be applied if the infringement affects many interested parties.


What does not happen at all in our case (without prejudice to the fact that this RFEF understands
that in no case has committed any infraction)

The intentionality in the infraction, by the entity (section b).


The application of this aggravating criterion lacked any reason in the settlement agreement.
start and is also not supported by the motion for a resolution. Moreover, the truth is that
in no case has there been any intention on the part of the RFEF to infringe the legislation of
Personal data protection.


We cannot share the value judgment supported by the Instructor when stating in his
proposal (p. 41) that the RFEF acted "knowingly" of the damage it could cause. Y
on the other hand, regarding the transfer of the recordings to a communication medium
It has already been revealed and we reiterate now that before the AFE Press Release
containing a clearly false interpretation of the result of the meeting of 7
April 18, 2020, the RFEF first published a press release to establish the truth of

the facts and only later handed over part of the recording when a media outlet
communication requested his delivery, to guarantee the right to freedom of
information and to receive truthful information. We reiterate that it cannot be appreciated
intent in the infringement by the RFEF and therefore cannot be estimated
that meets such aggravating criterion.


The way in which the supervisory authority became aware of the infringement, since the
AEPD became aware of the infringement through the claim of the interested parties
(app. h).


In the pleadings brief to the initial agreement it was already made clear that the
AEPD has not been aware of the alleged infractions through the
claim of the interested parties, since they have not been these, but the LNFP entities and
AFE those who have filed the complaint. Given their status as legal persons,
it is possible to appreciate in them the condition of interested parties and therefore it is not possible
appreciate the aggravating criterion used by the AEPD. That the LNFP and the AFE have

capacity to act (p. 41 of the proposed resolution) does not affect the previous
conclusion, rather it reinforces it, since it is recognized that it was through such
entities, and not of the interested parties, through which the AEPD became aware of the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 40/74








alleged violations. The link between the activity of the offender and the performance of
processing of personal data, (section b). Finally, as we have already explained in
our allegations to the initial agreement, this criterion should not be applied either

aggravating.

Indeed, the activity carried out by the RFEF involves the processing of personal data,
but its activity is not linked to carrying out treatments. The activity that
is imputed to the RFEF (not informing the interested parties and giving some recordings to
media) does not imply that they are activities related to the

carrying out treatments, such as those carried out by companies of the
marketing sector, or the provision of cloud services, or social networks. Whether
interpreted otherwise the criterion to which we refer, the same would be applied to all
those responsible for treatment and would make such a criterion an application criterion
universal, making it an aggravating factor of general application to any activity

treatment, which is not what the data protection legislator wants. In
conclusion, as we said at the time and now reiterate, it is not possible
appreciate any of the aggravating criteria invoked by the AEPD.

On the contrary, the very small number of
affected, the lack of intentionality of the RFEF, the fact that the AEPD has not

had knowledge of the facts by complaint of the interested parties and the non-involvement
of the activity of the RFEF with the performance of data processing.

       TENTH. Regarding the testimonial evidence requested.


As has already been pointed out repeatedly in this pleadings brief, this
The party considers that the testimonial evidence is essential to demonstrate that the
attendees of the meeting were aware that it was being recorded and of the
information required by the RGPD and the Organic Law. We refer once again to
what is stated in our brief of allegations to the agreement to initiate the procedure

sanctioning party in order to consider the need to carry out said test.

Failure to do so, and the fact that the instructor reiterates that the testimonial evidence is not necessary,
renders this party defenseless, since it prevents proving an essential circumstance for
the resolution of the procedure of which these allegations are part. In
Consequently, this RFEF reiterates the proposed testimonial evidence, requesting once

more its practice, because otherwise, as we pointed out, a clear
helplessness to the RFEF. This implies a clear violation of article 24 of the
Constitution. By virtue of all of the above,

It is REQUESTED: 1.- Consider submitted in a timely manner ALLEGATIONS against the

Proposal for a resolution issued against the Royal Spanish Football Federation in the
Procedure No.: PS/00368/2021. 2.- Dictate resolution by which the file agrees
of the performances

Of the actions carried out in this procedure, of the information and

documentation presented by the parties, the following have been accredited:

                                 PROVEN FACTS


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 41/74








1º.- The claim presented by the ASSOCIATION OF SPANISH FOOTBALL PLAYERS
(AFE), by the NATIONAL PROFESSIONAL FOOTBALL LEAGUE (LNFP), and its Director
Deputy to the Presidency against the REAL SPANISH FOOTBALL FEDERATION
(RFEF), deals with the following aspects:


    - That the RFEF recorded, without the consent of the participants, including
       representatives of the AFE, the LNFP and other sports entities,
       a meeting that was held online, on 04/07/20, through the platform
       Zoom, entitled: "COVID 19 Monitoring Commission" and held to discuss the
       question of the impact of this health emergency on the world of football.
       In addition to the lack of information about the fact that the meeting was going to be

       recorded, of course, they were not informed of the processing of the data either
       data that were to be obtained through recording.

    - That subsequently, the RFEF disseminated through the media
       broadcasts (Cadena SER, and, later, to COPE), excerpts from the

       interventions that had taken place during the meeting, without the
       prior knowledge of the participants and of course, without their consent,
       who discovered him when his speeches were broadcast on the air on
       04/08/20.

    - That prior to this meeting, which had been publicized through the

       media, there had been a first, held in a
       in person on 03/12/20, at the RFEF headquarters. In this first meeting of the
       Covid-19 Monitoring Committee, if the participants had been indicated
       that the session was going to be recorded but they were not told anything else about the
       treatment of the personal data that were going to be obtained through the
       recording


2º.- From the documentation provided together with the claim documents,
find the following documents:

a).- Copy of the response made by the RFEF on 04/10/20 to the AFE, in relation to
the letter dated 04/09/20, in which it requests information from the RFEF, about

the recordings made at the meetings of the Monitoring Committee of the
Covid-19, where the following explanations offered by the RFEF are highlighted:

    - “[…] That, at the beginning of the first meeting, held on March 12, it was
       agreed, without opposition from any of the interveners, to record the
       committee talks for the record. In

       In any case, when the committee has met electronically, in the
       screens of each of the participants a pilot appears at all times
       red indicating that the recording of the entire meeting is taking place.

    - […] That this Union, after the meeting held on April 7, disseminated among the

       media a press release containing a version
       of what happened contrary to what had actually happened. What, with the
       purpose of preserving the right to receive truthful information provided for in the
       CE, the RFEF sent a press release to the media
       correcting the divergences and inaccuracies with the reality of what had

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 42/74








        happened in the meeting, accompanying, to the first means that asked us, the
        recordings that proved it […]” .


b).- Copy of email sent from the address ***EMAIL.1 on 04/11/20 to
the address: ***EMAIL.2 where the following is highlighted:

    - “(…) You know perfectly well that the operating rules of any
        body or working group are set in the first session and, as long as no
        modified, remain in force for subsequent meetings. That's how you did it to us

        expressed on many occasions in the meetings of the organs of the
        LNFP. And, consequently, you also knew perfectly well that all the
        meetings of the COVID-19 Monitoring Commission were being
        recorded (…)”


c).- Copy of response sent by the RFEF on 05/04/20, and addressed to the Director
Attached to the LNFP Presidency, as a result of the request made by him to the
RFEF, in relation to the processing of your personal data and where it highlights the
next afirmations:

    - “(…) In this sense, I inform you that the purpose of processing your data

        is to carry out the minutes, as well as to have reliable proof of the
        development of the topics and content discussed at the meeting.

    - (...) In the case at hand, these categories are the data of
        identification: the institution to which each one belongs, the image and the voice.


    - (...) The personal data that concerns you referred to in your request, I
        report that they were also communicated to Cadena Ser, the only means of
        communication that requested it. However, as it is information from
        public interest and with social significance, it may be provided to as many media

        they could request it.

    - (...) The retention period may be indefinite, unless the
        exercise of the rights of deletion, opposition or rectification by the parties
        interested.


    - (…) In the case at hand, your request is based on letter b) of section 1
        of article 18 of the RGPD. In other words, you consider that the processing of your data
        carried out by the RFEF is "illicit" and therefore requests the limitation of its
        treatment. However, it does not justify in any way the alleged illegality of the
        treatment nor is there any decision or resolution of the AEPD or the Courts

        so establish it. Regardless of this, the RFEF is ratified in the
        treatments carried out which are perfectly adjusted to
        right. Consequently, there are no circumstances to estimate its
        request for limitation of treatment”.


3.- Of the affirmations made by the RFEF, in the different writings sent to this
Agency as a result of the requirements made by this Organization,
highlight the following:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 43/74








    - That the first meeting, on 03/12/20, held in person in which
       11 people attended, it was recorded with the knowledge of the attendees,
       because this was communicated by the President of the RFEF at the beginning of the
       meeting and about which none of the attendees showed any objection. With
       Regarding this, a recording and transcription of said part of the

       meeting where you can read: "(...) We are recording the meeting so that
       keep a record of everything, okay?, and nothing, because you have the word you, C. (02:25)
       C2 of the League: Thank you very much L. Good morning everyone (...).

    - That the second meeting, held on 04/07/20, was held online, at
       through the Zoom platform, where 26 people connected and who also

       was recorded, but that this fact was not communicated to the attendees why,
       according to the federation itself: “(…) It is obvious that, as indicated in the aforementioned
       reply, the information provided at the first meeting is applicable to the
       successive, also taking into account that between the first and the second
       Commission meeting did not last a month (...).


It should be noted that, according to the data provided by the RFEF, at the first meeting
11 people attended and in the second 26 connected (15 more people than in the
first). However, according to the RFEF, those attending the second meeting that took place
connected online, they could verify that the videoconference session was
being recorded since a red pilot light appeared, located in the part

top left of the computer screen, along with an indication that
reported “recording”, and indicates that none of the people connected to the meeting
expressed disagreement on this aspect.

4º.- Regarding the fact that the RFEF did not inform those attending the meetings of the
management that was going to be carried out on the personal data obtained, the RFEF affirmed

that:

    - a).- How the attendees were informed that the sessions were going to be recorded.
       Consequently, the duty of information required by articles 13 of the
       RGPD and 11 of the LOPDGDD was fulfilled.


    - b).- that he was informed of the end of the processing of personal data by telling the
       beginning of the first meeting that the meeting was going to be recorded: “(…) to leave
       proof of everything (…)”.

    - c) That the RFEF has a "privacy policy" in the URL:
       https://www.rfef.es/proteccion-datos where you can get all the

       information regarding this matter.

5º.- The RFEF acknowledges that only after the second meeting did it draw up a
document with the ends required in article 13 of the RGPD that provides
those attending the online meetings: "(...) after the meeting of April 4

of 2020, and for other online meetings of the collegiate bodies of the RFEF,
prepared an informative clause that is attached as DOCUMENT No. 3 in which
all the extremes required by art. 13 of the RGPD and art 11 of the
LOPDGDD (…)”.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 44/74








6º.- Regarding the assignment of the recording of the meeting on 04/07/20, made by the
RFEF to the media and where, therefore, personal data was transferred
of the participants in it, the following statements made should be highlighted

by the RFEF:

    - That after the meeting of 04/07/20, the AFE immediately made public a note of
        press with what, in his opinion, had happened at the meeting.

    - That the RFEF, understanding that the AFE press release misrepresented

        totally what had been discussed at the meeting, and that he sent messages
        incorrect, issued a press release denying the claims that the
        AFE had transmitted to society.

    - That, according to the RFEF, this situation of confusion caused the Cadena

        SER, ask the RFEF for the recordings of the meeting to corroborate the
        statements that it defended.

    - That the RFEF agreed to deliver to Cadena Ser the recording of the meeting
        considering that it was dealing with nothing more and nothing less than
        the effects on football (one of the most mediatic activities that exist and

        with an economic and social impact that no one can doubt); - the
        declaration of the state of alarm, which implied the suspension of the
        celebration of all professional soccer matches” and for “the need to
        clarify the truth in a contrasted way in relation to the issues
        discussed at the meeting.


    - That the transfer of the recording and, therefore, of the personal data of the
        attendees to the meeting, to the Cadena Ser, was taking advantage of the right of
        truthful information collected in article 20 of the EC and based on the
        legitimacy provided by article 6.1.e) of the RGPD.


                            FOUNDATIONS OF LAW

I.- Competition:

The Director of the Spanish Agency is competent to resolve this procedure.

Data Protection, in accordance with the provisions of art. 58.2 of the RGPD in
the art. 47 of LOPDGDD.

II.- Response to the allegations presented by the RFEF to the Proposal for
Resolution:


       A).- Response to the allegations presented in the SECOND point:
       “On the facts declared proven”.

We must start by recalling the statements made by the RFEF in this

sense:

a).- (...) all those attending the second meeting were aware that, like
that the first, the session was being recorded (…)”.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 45/74









b.- “(…) that of the 15 more people who attended the second meeting, 13
belong to the RFEF and therefore were perfectly aware of the rules by

which govern the meetings (...)”

c).- (...) on behalf of the AFE the same people also attended both
meetings, although the second was also attended by a person from Legal Services,
which is not affected by this proceeding (...)”.


d).- (...) when the Commission has met telematically, on the screens of each
one of the interveners appears a red light that informs that the operation is taking place.
recording of the entire meeting (...)”, (statement made in the pleadings brief to the
initiation of the file on 09/23/21).


In addition to the above, it should be noted that, at the second meeting, the one held in
04/07/21, one more person attended, representing the Club Commission of
women's football in the First and Second Division, which has not been taken into
consideration by the Federation to form its allegations.

It should also be noted that the only evidence provided by the Federation to

try to corroborate the above statements is the document that is designated
as "Document No. 1" presented to this Agency on 09/23/21, where
transcribes the meeting of 03/12/20. From said transcript we must highlight what was said
by the RFEF representative at the beginning of the meeting: “(…) I remind you, when
go to intervene click here, we are recording the meeting so that it remains

proof of everything, okay?, and nothing, well you have the word you, C. (02:25) (...).

Apart from what is indicated in the previous paragraph, there is no other evidence that
corroborate the statements made by the RFEF, when it states that all the
attendees at the two meetings (the one on 03/12/20 and the one on 04/07/20), knew that they were going to

be recorded,

But above all, and even more important to elucidate the resolution of this
procedure is that at no time does the RFEF provide evidence that could
corroborate that those attending both meetings knew the extremes that marks the
rule on the management of personal data obtained by the person in charge. This is,

that they were informed of the aspects indicated in article 13 of the RGPD, in
relation to the personal data obtained from the recordings made by the RFEF.

Well, in this sense, it should be noted that RGPD is not limited to placing the
responsibility on a passive responsible party, who will have to face the

consequences of possible breaches of data protection, but rather
takes a proactive approach, requiring the controller to take action
preventive measures aimed at eliminating the risks of its non-compliance and, furthermore, that it is
in a position to demonstrate that it has implemented these measures and that they are
the right ones.


Thus we have how, on the one hand, recital 74 of the RGPD indicates that: "You must
be established the responsibility of the data controller for any
processing of personal data carried out by himself or on his behalf. In particular,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 46/74








The person responsible must be obliged to apply timely and effective measures and must
be able to demonstrate the conformity of the treatment activities with the present
Regulation, including the effectiveness of the measures. These measures must take into

account the nature, scope, context and purposes of the treatment, as well as the
risk to the rights and freedoms of natural persons.

On the other hand, we have what is established in article 5.2 of the RGPD, when it establishes
that: “the data controller will be responsible for compliance with the
provided in section 1 and capable of demonstrating it”, which obliges him to: “having

taking into account the nature, scope, context and purposes of the treatment as well as the
risks of varying probability and severity to the rights and freedoms of
natural persons, the controller will apply technical measures and
appropriate organizational structures in order to guarantee and be able to demonstrate that the treatment is
in accordance with the Regulations”.


Well, from all the above, we can highlight the following
points:

In the first place, at the meeting of 03/12/20, from the phrase that the person in charge of the RFEF
says at the beginning of the meeting, (remember that it is the only reference that exists to

meetings were going to be recorded): “(…) We are recording the meeting so that
I keep a record of everything, okay? And nothing, well, you have the floor...”
It appears at no time that those attending the meeting were informed
that subsequent meetings would also be recorded. Therefore, the statement
that the RFEF does in the sense, "(...) We reiterate that all those attending the

second meeting were aware that, like the first, the session was
being recorded (…)”, cannot be taken into consideration.

Second, at the 04/07/20 meeting, 15 people attended who did not attend
to the first meeting, and therefore did not have to know what was said in the first

meeting, including the fact that it was recorded.

Thirdly, the RFEF limits itself to affirming that, “(…) of the 15 more people
attended the second meeting, 13 belong to the RFEF and therefore were
perfectly aware of the rules by which the meetings are governed (...), without
provide the slightest evidence that could corroborate the assertion.


Fourth and last, we must remember that, in addition to the 13 people who
attended the second meeting and that belonged to the RFEF, 2 people attended
more, belonging to the AFE and the Commission of Women's Soccer Clubs of
First and Second Division, respectively, which did not have to have

knowledge that the meeting was going to be recorded or the content of the first
meeting

Apart from the previous points, where it has been verified that there were at least
13 people, (those attending the second meeting) who were not informed

conveniently that their meeting was going to be recorded, which has not been
demonstrated in any case, is that the RFEF informed the attendees that the
meetings of the extremes marked by article 13 of the RGPD, regarding the management
was going to make of the personal data obtained in the two recordings made.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 47/74









That is, what has been confirmed throughout this process is that the RFEF does not
never informed those attending the meetings of the following points

established in article 13 of the RGPD: a) the identity and contact details of the
responsible and, where appropriate, his representative; b) the contact details of the delegate
data protection, where appropriate; c) of the purposes of the treatment to which they are destined
the personal data and the legal basis of the treatment; d) recipients or
categories of recipients of personal data, where appropriate; e) where appropriate, the
intention of the controller to transfer personal data to a third country or

International Organization; f) the period during which the data will be kept
or, when this is not possible, the criteria used to determine this
term; g) the existence of the right to request from the data controller access to
the personal data related to the interested party, and its rectification or deletion, or the
limitation of its treatment, or to oppose the treatment, as well as the right to

data portability; and h) the right to file a claim with a
controlling authority.

Nor were those attending the meeting on 04/07/20 informed that the recording was
to be transferred to the media as established in article 13.3 of the
RGPD: “When the person in charge of the treatment projects the subsequent treatment of

personal data for a purpose other than that for which it was collected,
will provide the interested party, prior to said further treatment, information
about that other purpose and any additional information relevant to the meaning of paragraph 2”.

Article 18 of Law 40/2015, of October 1, on the Legal Regime of the Sector

Public (LRJSP), makes it possible for the meetings of a collegiate body to be
recorded for the purpose of accompanying the minutes of the session and giving proof of legitimacy and
integrity and thus it is marked in said article: “(…) The file resulting from the recording,
together with the certification issued by the Secretary of the authenticity and integrity of the
itself, and how many documents in electronic format were used as documents

of the session, may accompany the minutes of the sessions (...)”.

In accordance with the above, the RFEF did have the necessary legitimacy to record the
sessions of the "COVID-19 Monitoring Commission", but only to support the
minutes of the meeting and in this sense the attendees should have been informed according to
marks article 13 of the RGPD: “1. When data is obtained from an interested party

personal data relating to him, the data controller, at the time these
are obtained, it will provide you with all the information indicated below: (...)”, between the
found in point c): “the purposes of the treatment to which the data is intended
data and the legal basis of the treatment”.


Well, in the present case, the data controller, that is, the
RFEF, had the obligation to inform those attending the meetings of the purpose to which
were going to allocate the personal data obtained from the recordings and the legal basis that
supported it, in addition to the other aspects indicated in the aforementioned article 13 of the
GDPR. However, the RFEF representative only reported at the first meeting

that it was going to be recorded: “(…) We are recording the meeting so that it remains
proof of everything, okay?, and nothing, well, you have the floor…” but without offering
no additional information.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 48/74








With this concise and generic information on the purpose to which the
data collected in the recording: “(…) so that everything is recorded, okay?
(...), does not identify, at all, any specific purpose of the treatment nor, of course,

Nor does it provide information on the “legal basis” that supports it. Let us also remember that, in the
meeting of 04/07/20, held by videoconference (via Zoom), they were not even
reminded connected attendees that their interventions were going to be recorded.

To finish this point, we must remember that the RFEF itself confirms, in its letter
dated 09/23/21 that, after having held the second meeting, a

informative clause detailing the points contained in article 13 of the
RGPD, from which, it follows that, before the meetings of 03/12/20 and the
04/07/20, there was no type of document in the RFEF that reported on these
extremes to meeting attendees.


In these extremes it was indicated by the RFEF: "On the other hand, it must also
be taken into account as a relevant fact in these proceedings that, with
after the meeting of April 4, 2020, and for other online meetings of the
collegiate bodies of the RFEF, an informative clause was drawn up that is attached
as DOCUMENT Nº 3 in which all the extremes required by the
article 13 of the RGPD and article 11 of the Organic Law 3/2018. This clause is

It has been incorporating online meeting calls for some time now. To that end and
As evidence of this, DOCUMENT No. 4 is attached as a copy of an email from
call for an online meeting in which the document "Meetings
virtual. Informative Clause data protection.pdf”.


In another section of the second point, the RFEF alleges that it facilitated the recording of the
meeting on 04/07/20 to a media outlet, (Cadena Ser), based on the
"public interest" and reiterates that, "(...) what was at stake was full respect for the
fundamental right to freedom of expression and information (…)”.


Well, we must start this section by remembering what recital 50 indicates
of the RGPD, when it says that:

”The processing of personal data for purposes other than those for which they have been
initially collected should only be allowed when compatible with the purposes
of your initial collection. In such a case, no separate legal basis is required, other than

which allowed the collection of personal data.

If the treatment is necessary for the fulfillment of a mission carried out in the interest
public or in the exercise of public powers vested in the data controller,
the tasks and purposes for which the contract must be considered compatible and lawful.

Further treatment can be determined and specified in accordance with the Right of
the Union or the Member States. Further processing operations for purposes
archive in the public interest, scientific and historical research purposes or
Statistical data should be considered compatible lawful processing operations.


The legal basis established in the Law of the Union or of the Member States
for the processing of personal data can also serve as a legal basis for the processing of personal data.
further treatment.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 49/74








In order to determine whether the purpose of further processing is compatible with the purpose of
initial collection of personal data, the data controller, after having
fulfilled all the requirements for the legality of the original treatment, you must take into account

account, among other things, any relationship between these purposes and the purposes of the
intended further processing, the context in which the data was collected, in
particular the reasonable expectations of the data subject based on their relationship with the
responsible for its subsequent use, the nature of the personal data, the
consequences for data subjects of the intended further processing and the existence of
adequate guarantees both in the original treatment operation and in the

further processing operation

If the interested party gave their consent or the treatment is based on the Law of the
Union or of the Member States which constitutes a necessary measure and
proportionate in a democratic society to safeguard, in particular,

important objectives of general public interest, the controller must be empowered
for the further processing of personal data, regardless of the
compatibility of purposes.

The application of the principles established by this document must be guaranteed.
Regulation and, in particular, the information of the interested party on those other purposes and

about your rights, including the right to object. The indication of possible acts
crimes or threats to public safety by the person responsible for the
treatment and transmission to the competent authority of the data regarding cases
individuals or diverse cases related to the same criminal act or threat
for public safety, it must be considered that it is in the legitimate interest of the

responsable. However, such transmission should be prohibited in the legitimate interest of the
controller or further processing of personal data if the processing is not
compatible with an obligation of legal, professional or binding secrecy by another
concept".


We must also remember what Recital 45 of the GDPR says:

“When it is carried out in compliance with a legal obligation applicable to the person responsible
of the treatment, or if it is necessary for the fulfillment of a mission carried out in
public interest or in the exercise of public powers, the treatment must have a
based on the law of the Union or of the Member States.


This Regulation does not require that each individual treatment be governed by a
specific rule. One standard may be sufficient as a basis for several operations
of data processing based on a legal obligation applicable to the person responsible for the
treatment, or if the treatment is necessary for the fulfillment of a mission

carried out in the public interest or in the exercise of public powers.

The purpose of the treatment must also be determined under the Law of the
Union or States. In addition, such a rule could specify the conditions
General provisions of this Regulation that govern the legality of the treatment of

personal data, establish specifications for the determination of the person in charge
of the treatment, the type of personal data object of treatment, the interested parties
affected, the entities to which the personal data can be communicated, the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 50/74








limitations of the purpose, the term of conservation of the data and other measures to
guarantee lawful and fair treatment.


It must also be determined under the Law of the Union or of the States
members if the data controller carrying out a mission in the public interest or
in the exercise of public powers must be a public authority or another person
physical or legal public law, or, when done in the public interest, including
health purposes such as public health, social protection and service management
health, private law, as a professional association.


Therefore, so that the processing of personal data can be legitimized by
"public interest" before, by the consent of the affected, must have been
conferred an official power either to the person in charge of the treatment, or to the third party to
which it communicates the data and the data processing must be necessary for the

exercise of said power. But this "official power or mission of public interest"
must be conferred or attributed by law or other legal regulations. Now if the
processing involves an invasion of privacy or is otherwise required in
under national law, to ensure the protection of persons
concerned, the legal basis must be sufficiently specific and precise when
to define the type of data processing that can be allowed”.


Well, the RFEF, to transfer the personal data collected in the recordings of
meetings to the media, avails itself of the right recognized in the
article 20 of the CE, and in the following points:


    - That in view of the social and media impact caused by the suspension of the
        football activities as a result of the declaration of the state of
        alarm; That various media outlets echoed the
        meetings held by the Covid-19 Monitoring Commission.


    - That because the AFE, one of the entities present at the meetings,
        immediately made public, on the same day of the meeting, a press release, in
        the one that echoed his perception of the meeting, totally misrepresenting what
        treated in it, sending an incorrect message to society and the media
        communication.


    - That this situation of confusion caused Cadena SER to ask the RFEF
        to provide him with part of the recordings of the meeting.

    - That because it was being treated, nothing more and nothing less, than the
        effects on football (one of the most mediatic activities that exist and with

        an economic and social impact that no one can doubt) and given the
        responsibility of the RFEF and given the need to clearly clarify
        confirmed the truth in relation to the issues discussed at the meeting.

    - That also taking into account the right to freedom of information and

        expression recognized by article 20 of the Constitution, issued a note of
        press correcting inaccuracies and discrepancies with the reality of what
        It had happened at the meeting.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 51/74








    - That a media outlet requested the recordings that proved that the
        RFEF was the one that adjusted to the truth. Faced with such a situation, the RFEF considered
        that the transfer of the data requested by Cadena SER

        was protected in the public interest in accordance with article 6.1.e) of the
        GDPR.

    - That it was also taken into account that the data that was going to be transferred was
        representatives of legal persons, in their professional relationships and in
        no private case.


Of the points indicated, on what the RFEF is based to transfer personal data
included in the recordings made to the media, it follows
that one of the most important reasons for it, if not the only one, was to corroborate and give
validity to the press release that he had previously sent, where he contradicted

what was expressed in the press release sent by the AFE,

It must be remembered that the RFEF had already exercised its right to express and disseminate
freely their opinions through a press release, making use, as
indicates the Federation itself of the right recognized in article 20 of the CE.


To finish, with respect to the affirmation made by the RFEF when it indicates that
only official opinions of the
organizations that were summoned by the mouth of their representatives, indicate in this
point that, the transfer of the recording of the meeting by the RFEF to the media
of communication and its subsequent disclosure by these to all of Spain also put in

knowledge of public opinion, personal opinions or comments that had no
nothing to do with the topic of the meeting, such as a sample
obtained from the transcript of the recording released to the media,
provided along with the claim documents: "(...) I ask you to get that from
AFE. News has reached us that other things are coming. I have

called players with whom you have spoken. You have told them, they have told me,
that we are not defending them, that we are some (...)”

    B).- Response to the allegations presented in point THIRD: “About the
    recording of the meetings of the COVID19 Monitoring Commission”


On the possibility or not of access to the minutes of a collegiate body and if these are
public or not, indicate that concepts as different as they are should not be confused, the
minutes of a meeting of a collegiate body, defined in article 18.1 of the LRJSP,
paragraph 1, with the possible recording of the meeting and its purpose, defined in article
18.1 of the LRJSP, paragraph 2. The fact that there is a right of access to the record of

a meeting of a public collegiate body, based on the provisions of the
Law 19/2013, on Transparency and Good Governance, does not imply that it can be accessed
also to the recording of the meeting, since they do not have the same content or purpose:

As established in article 18.1 of the LRJSP (first paragraph): 1. From each session

held by the collegiate body, the minutes will be drawn up by the Secretary, who will specify
necessarily: - the attendees, - the agenda of the meeting, - the circumstances
of the place and time in which it was celebrated, - the main points of the
deliberations, - as well as the content of the agreements adopted.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 52/74









For its part, point 5 of article 19 of the aforementioned LRJS Law: "The minutes shall include,
request of the respective members of the body, the vote against the agreement

adopted, their abstention and the reasons that justify it or the meaning of their vote
favorable. Likewise, any member has the right to request the transcription
of your speech or proposal, provided that, in the absence of a recording of the
meeting annexed to the minutes, contribution in the act, or in the period indicated by the President, the
text that faithfully corresponds to his intervention, thus being recorded in the
record or attaching a copy to it.


The latter means that, in the minutes of the meetings of the collegiate bodies
includes “the main points of the deliberations” and does not include the transcript
of the intervention or proposal or the opinions or personal comments of the
interveners, unless expressly so indicated.


Therefore, a recording of the meeting of a collegiate body is not the same as the
minutes of the session, because in the recordings, as has been shown in the case
that concerns us, in addition to recording personal data of the attendees, such as the voice
of intervener or his identification with name and surnames, there is also a recording of
opinions, personal comments or thoughts that have nothing to do with the

matter discussed at the meeting.

On the other hand, the statement made by the RFEF in assuring that, “(…) of the 15
people who attended the second meeting, of which 13 are part of the
RFEF itself and they knew perfectly well that the session was going to be recorded as well as the

purpose of the recording and that another person was a person of the Services
Lawyers of the AFE (...)”, without providing, as the norm establishes, the slightest proof or
document with which it can be corroborated that the people who attended the
meetings knew that the meetings were going to be recorded and the ends collected
in article 13 of the RGPD, I have tried to attribute the burden of proof to this Agency

when the rule establishes the opposite: a) Considering 74: “(…) responsible
must be obliged to apply timely and effective measures and must be able to demonstrate
compliance of processing activities with this Regulation, including
the effectiveness of the measures (...)” and b) article 5.2 of the RGPD: “the person responsible for the
treatment will be responsible for compliance with the provisions of section 1 and
capable of demonstrating it”, according to which “taking into account the nature, scope,

context and the purposes of the treatment as well as the risks of different probability and
severity for the rights and freedoms of natural persons, the person responsible for the
treatment will apply appropriate technical and organizational measures in order to guarantee and
be able to demonstrate that the treatment is in accordance with this Regulation”.


The only proof provided by the RFEF where it tries to demonstrate that the treatment of
personal data made by the Federation conforms to the RGPD is the document that
elaborated after having celebrated the two meetings with the: “clauses
informative in which the extremes collected in article 13 of the RGPD are detailed ",
as confirmed by the Federation itself in its letter of 09/23/21: “(…) it must also

be taken into account as a relevant fact in these proceedings that with
after the meeting of April 4, 2020, and for other online meetings of the
collegiate bodies of the RFEF, an informative clause was drawn up that is attached
as DOCUMENT Nº 3 in which all the extremes required by the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 53/74








article 13 of the RGPD and article 11 of the Organic Law 3/2018. This clause is
It has been incorporating online meeting calls for some time now. To that end and
As evidence of this, DOCUMENT No. 4 is attached as a copy of an email from

call for an online meeting in which the document "Meetings
virtual. Informative Clause data protection.pdf (...)”.

Therefore, no evidence has been found to corroborate that the person responsible
of data processing, that is, the RFEF, will inform those attending the
meetings of 03/20/20 and 04/07/20, that, first of all, the meetings were going to be

recorded and secondly, and more importantly, of the extremes required in the
article 13 of the RGPD because it only provides, as document No. 3, a sheet
briefing, drawn up after having held the two meetings and which will serve
to provide those attending the "on-line" meetings to be held with
subsequently, the mandatory information marked in the RGPD.


       C).- Response to the allegations made in point FOUR:
       “On the publication by various media of
       information regarding the meetings of the COVID-19 Monitoring Commission
       19”.


Regarding the allegations made in the sense that, “(…) Law 19/2013 allows and even
obliges to make public the minutes of collegiate bodies (...)”, this must begin
point recalling once again, the difference between the drafted minutes of the meeting of
a collegiate body, (defined in article 18.1 of the LRJSP, paragraph 1), according to the
which will consist of the list of attendees, the agenda of the meeting,

the circumstances of the place and time in which it was celebrated, the main points of
the deliberations, as well as the content of the agreements adopted, differentiating it
with the possible recording of the meeting and its purpose, (defined in article 18.1 of the
LRJSP, paragraph 2), according to which, said recording together with the certification issued
by the Secretary of the authenticity and integrity of the record, and how many documents in

electronic support are used as documents of the session, they may accompany the
minutes of the session.

Regarding the allegations presented in this point, regarding the right
recognized in article 20 of the Constitution, reiterate what is stated in the
section A).- of reply to the allegations presented in the SECOND point.


       D).- Response to the allegations presented in point FIVE: “About
       the lack of legitimacy of the denouncing entities”.

We must start this section by recalling what, with regard to the initiation of a

administrative procedure, establishes the LPACAP:

Article 54, on initiation classes, indicates that: "The procedures may
be initiated ex officio or at the request of the interested party.


Article 63, on the specialties at the beginning of the procedures
sanctioning, establishes: “1. Procedures of a punitive nature
shall always be initiated ex officio by agreement of the competent body (...)”


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 54/74








Article 58, on ex officio initiation, establishes that: “Proceedings are
shall be initiated ex officio by agreement of the competent body, either on its own initiative or
as a consequence of a higher order, at the reasoned request of other bodies or by

complaint."

Article 62.1 defines the complaint as: “1. the act by which any person, in
compliance or not with a legal obligation, informs a body
administrative the existence of a certain fact that could justify the initiation
ex officio of an administrative procedure”.


Finally, Article 59. On the initiation of the sanctioning procedure by its own
initiative, defines this concept as: "action derived from direct knowledge
or indirect of the circumstances, behaviors or facts object of the procedure by the
body that has attributed the power of initiation.


Well, article 77 of the RGPD establishes the right that the interested parties have to
file a claim with the supervisory authority: “1. Without prejudice to any
other administrative recourse or judicial action, all interested parties shall have the right to
file a claim with a supervisory authority, in particular in the State
member in which he has his habitual residence, place of work or place of

alleged infringement, if you consider that the processing of personal data that
concern infringes this Regulation (...)”. Understanding by interested, according to
establishes article 4.1.a) of the LPACAP to: “Those who promote it as holders of
individual or collective rights or legitimate interests.


In addition to the possibility for any interested party to file a claim with
the control authority, that is before the AEPD, there is the possibility that this
Agency initiates a sanctioning procedure on its own initiative, in accordance with the
established in Article 64.2 of the LOPDGDD: “2. When the procedure has
purpose of determining the possible existence of a violation of the provisions

in Regulation (EU) 2016/679 and in this organic law, it will start by
initiation agreement adopted on its own initiative or as a result of a claim”.

In the case at hand, both the AFE and the LNFP appeared before this
Agency, on 04/16/20, filing a claim that, among other things, indicated
that, The RFEF had recorded the meetings of the Anti-Covid-19 Commission, held

on 03/12/20 and 04/07/20, and with it, personal data of those who attended them,
without the mandatory consent of the participants and who subsequently had
broadcast extracts of the audio files among some of the media
communication, such as the SER chain or COPE, without those affected by the recording
would have been aware of it and therefore had no opportunity to oppose

that your personal data were disseminated through the media.

Given this claim, on 06/10/20, the AEPD sent a letter to the RFEF
requesting information regarding the claims presented, in accordance
with the provisions of article 65.4 of the LOPDGDD Law: “4. Before settling on

the admission to processing of the claim, the Spanish Agency for Data Protection
may send the same to the data protection delegate who may have, where appropriate,
designated the person in charge or in charge of the treatment or the supervisory body
established for the application of codes of conduct for the purposes set forth in

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 55/74








articles 37 and 38.2 of this organic law. The Spanish Agency for the Protection of
Data may also send the claim to the person in charge or in charge of the
treatment when a data protection delegate has not been appointed or

adhered to extrajudicial conflict resolution mechanisms, in which
In this case, the person in charge or person in charge must respond to the claim within the
of one month".

On 08/27/20, the Director of the Spanish Data Protection Agency issued
agreement of admission of processing of the presented claims, in accordance

with article 65 of the LPDGDD Law, when appreciating possible rational indications of a
violation of the rules in the field of competence of the Spanish Agency
Data Protection.

And on 07/30/21, the Board of Directors of the Spanish Agency for Data Protection,

issued an agreement to initiate sanctioning proceedings to the RFEF, upon appreciating evidence
reasonable violation of the RGPD, as established in article 63 and 58 of the
LPACAP : “1. Procedures of a sanctioning nature will always be initiated
ex officio by agreement of the competent body (...)”, on its own initiative (article 58
LPACAP), and having knowledge of the existence of a certain fact that
could justify the ex officio initiation of an administrative procedure, (article

62.1 of the LPACAP).

On the other part of the allegations, where the RFEF indicates the need to
differentiate “(…) the processing of personal data of natural persons that affect
your private life than that of data that exclusively affects your professional life in

as members of a legal entity (...)”, recall the following
previously explained aspects:

    - The object of the RGPD, established in its article 1 is: “1.- Establish the rules
        relating to the protection of natural persons with regard to

        processing of personal data and the rules relating to free movement.
        2. The Regulation protects the fundamental rights and freedoms of
        natural persons and, in particular, their right to data protection
        personal.

    - The RGPD will apply, as established in its article 2: "to the total treatment

        or partially automated processing of personal data, as well as non-
        automated data contained or intended to be included in a file.

    - The RGPD defines, in its article 4, "personal data" as: "all information
        about an identified or identifiable natural person ("the interested party"); I know

        An identifiable natural person shall be deemed to be any person whose identity can be
        be determined, directly or indirectly, in particular by means of an identifier,
        such as a name, an identification number, data of
        location, an online identifier or one or more elements of the
        physical, physiological, genetic, mental, economic, cultural or social identity of

        said person”.

    - And defines the "processing of personal data" as: "any operation or
        set of operations carried out on personal data or sets of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 56/74








        personal data, whether by automated procedures or not, such as
        collection, registration, organization, structuring, conservation, adaptation or
        modification, extraction, consultation, use, communication by transmission,

        dissemination or any other form of authorization of access, collation or
        interconnection, limitation, suppression or destruction”;

Therefore, the RGPD does not differentiate between categories or classes of personal data, in the sense of
differentiate personal data that affects or defines your private life from personal data
that affects or defines you from the angle of your professional or work life, because according to

The RGPD defines “personal data” (art. 4 of the RGPD): “all information about a
identified or identifiable natural person (“the interested party”)”; considering himself as
“identifiable natural person” means any person whose identity can be determined,
directly or indirectly, by means of an identifier, such as a name, a
identification number, a location data, an online identifier or one or

various elements of the physical, physiological, genetic, psychic,
economic, cultural or social of said person.

Well, based on the definition established in the RGPD on what is
a personal data, an example could be: the identifier, "President of ...". East
identifier refers to and identifies a single natural person, who may be

differentiated from any other person, since only a single natural person may
have that category. Therefore, the treatment that could be done with said
identifier, (President of …), is fully regulated in the RGPD and in the
LOPDGDD.


However, the above, make it clear that, although the RGPD, does not differentiate categories or
classes of personal data depending on whether they are data that affect private life
(such as the name), or are data of a professional or employment nature (such as
for example, "President of ..."), if there is a certain differentiation of data, in
those called by the RGPD, such as: “special category data”, but only to those

effects of being specially protected against other data of a character
personal. These data are defined in its article 9 and are the ones that can reveal the
ethnic or racial origin of the person, their political opinions, religious convictions or
philosophical or their union affiliation; also your genetic, biometric or data
relating to sexual health, life or orientation.


On the other hand, the RFEF refers to article 19 of the LOPDGDD indicating that,
“(…) clearly differentiates the processing of data for private purposes from that for
professionals (…)".

Well, it should be clarified that the aforementioned article 19 of the LOPDGDD refers to

to the processing of contact data of individual entrepreneurs and professionals
liberals and so indicates:

1. Unless proven otherwise, it will be presumed covered by the provisions of article
6.1.f) of Regulation (EU) 2016/679 the treatment of contact data and in its

case those related to the function or position held by natural persons who
provide services in a legal person provided that the following are met
requirements:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 57/74








       a) That the treatment refers only to the data necessary for its processing.
       professional location.


       b) That the purpose of the treatment is only to maintain relations of
       any kind with the legal person in which the affected person lends his
       services.

2. The same presumption will operate for the treatment of the data related to the
individual entrepreneurs and liberal professionals, when they refer to them

solely in that condition and are not processed to establish a relationship with the
themselves as natural persons.

3. Those responsible or in charge of the treatment referred to in article 77.1
of this organic law may also treat the data mentioned in the two

previous sections when this is derived from a legal obligation or is necessary
for the exercise of its powers

As established in the first section of the aforementioned article 19, the treatment of
personal data referring to contact data or those relating to the function or
position held in an organization or company, it will be lawful if it is necessary to

the satisfaction of legitimate interests pursued by the data controller or
by a third party, provided that said interests do not prevail the interests or
fundamental rights and freedoms of the interested party and that require the protection of
personal data, in particular when the interested party is a child (art. 6.1.f) of the
RGPD), and provided that the treatment refers solely and exclusively to the

necessary for their professional location and that the purpose of the treatment is
solely to maintain relations with the legal person in which the affected
provide its services, (art. 19.1 of the LOPDGDD).

In the case at hand, the recordings made of the meetings held in

the RFEF contained personal data that identified the people who attended the
the same, as was the recorded voice and identification data (name and/or surnames)
when they were named together with the position they held in the entity to which they
they represented. These data were later released to the media and
spread throughout Spanish society. This data processing has nothing to do with
do with what is stipulated in article 19.1 of the LOPDGDD, that is, it has nothing to do with

do with: "(...) that the treatment refers only to the data necessary for its
professional location and that the purpose of the treatment is solely to maintain
relations of any kind with the legal person in which the affected person lends his
services (…)”.


However, regarding this article 19, it is clarified in section V, of the Preamble of
the LOPDGDD the following: “(…) Title IV includes «Provisions applicable to
specific treatments", incorporating a series of assumptions that in no case
should be considered exhaustive of all lawful processing. Inside them fits
appreciate, in the first place, those with respect to which the legislator establishes a

presumption "iuris tantum" of prevalence of the legitimate interest of the controller when
carried out with a series of requirements, which does not exclude the legality of this type of
treatments when the conditions laid down in the


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 58/74








text, although in this case the person in charge must carry out the weighting
legally required, as the prevalence of their legitimate interest is not presumed.


Together with these assumptions, others are included, such as video surveillance, files
advertising exclusion or internal complaint systems in which the legality of the
treatment comes from the existence of a public interest, in the terms
established in article 6.1.e) of Regulation (EU) 2016/679. Finally, it is done
reference in this Title to the legality of other treatments regulated in Chapter IX
of the regulation, such as those related to the statistical function or for purposes of

archive of general interest. In any case, the fact that the legislator refers to the
legality of the treatments does not undermine the obligation of those responsible for adopting
all the measures of active responsibility established in Chapter IV of the
European regulation and in Title V of this organic law (...)”.


Well, even if the presumption established in art. 19 of
LOPDGDD, because when the RFEF transfers the personal data contained in the
recording to the media to, according to them, corroborate the statements
made in the previously sent press release, it was clear that he was not
performing a treatment, "professional with the sole purpose of maintaining relationships
of any kind with the legal person in which the affected party lends his

services".

But it is that there is no other legal basis that legitimizes the treatment of the
personal data made by the RFEF when transferring them to the media for
its national diffusion, because as has been confirmed throughout this

procedure, the only legitimacy that the RFEF had for the treatment of the data
obtained in the recordings made in the meetings was
exclusively to cover the minutes of the sessions held. Any other
processing of data outside of said context should have previously had the
knowledge and of course, the free and voluntary consent of the people,

whose voices and personal data were included in the recordings. this didn't happen
and, therefore, the RFEF did not have the necessary legitimacy to transfer said data to the
media.

       E).- response to the allegations presented in the SIXTH point: “On the
       nature of the data subject to treatment.


The RFEF affirms at this point that: “(…) the fact that those who were summoned
to the meetings, and therefore those who participated in them, were the LNFP and
AFE, which obviously had to express their respective positions through
their representatives. The data that was transferred was that of such entities through

their representatives (…)”.

It should be remembered again how the RGPD defines, in its article 4, the data
personal: “(…) all information about an identified or identifiable natural person
(...)”;


In our case, the recording of the voice and the identification (name and surname) of the
people who participated in the meetings, regardless of what they were
saying out on their own behalf or on behalf of a third party (legal person), are

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 59/74








personal data that identifies the natural person who is intervening
at the meeting.


The GDPR considers an “identifiable natural person” to be any person whose identity can be
be determined, directly or indirectly, in particular by means of an identifier, such as
for example a name, an identification number, location data, a
online identifier or one or more elements of physical identity,
physiological, genetic, psychic, economic, cultural or social of said person;


Well, in the case at hand, the people who took part in the meetings
were fully identified by various identifiers, such as his voice
recorded while they intervened, and the name, surnames and the position they held when
they were named. These last data also recorded.


On the other hand, the RGPD, defines in its article 4, the processing of personal data
of a natural person as: "(...) any operation or set of operations
made on personal data or sets of personal data, either by
automated procedures or not, such as the collection, registration, organization,
structuring, conservation, adaptation or modification, extraction, consultation,
use, communication by transmission, broadcast or any other form of

Authorization of access, collation or interconnection, limitation, deletion or destruction (...) ;

Therefore, the RGPD does not differentiate the way or manner, or based on what, or on
representation of who, the interested party provides their personal data to the
responsable. The only reference made by the RGPD is to the destination or purpose to which

will assign the personal data obtained from natural persons.

Apart from all the above, in our case, what has been confirmed is that, in
the meetings convened by the RFEF, on 03/12/20 and 04/07/20, there was a
recording of the interventions of the attendees, together with the identification data

of the people involved, and these personal data (the identification of the
intervener and his voice), were made available to the media
without the knowledge of those affected, and, therefore, without their consent.

       F).- Response to the allegations presented in the SEVENTH point: “About
       the alleged lack of information offered to the people who attended the

       meetings of the COVID-19 Monitoring Committee”.

Regarding the affirmation made by the RFEF when indicating that all those attending the
meetings were aware that the sessions were being recorded, indicate what
following:


According to the transcript of the first meeting held on 03/12/20 at the
headquarters of the RFEF, there is a moment when the representative of the RFEF says
textually the following: “(…) We are recording the meeting so that it remains
proof of everything, okay?, and nothing, well you have the word you, C. (02:25)(…)”.


Without going into the assessment for now that, at the second meeting, they were not even informed
attendees that the meeting was going to be recorded, does not exist, apart from what is indicated in
the preceding paragraph, no other evidence to substantiate the statements made by

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 60/74








RFEF, in the sense that all attendees, both at the first meeting (that of the
03/12/20) and the second (04/07/20), they were aware that their
interventions and, therefore, their personal data were recorded.


On the RFEF's allegations, on the knowledge of those attending the
meetings regarding the processing of your personal data, when it says
that: “(…) This information is available to interested parties on the website of
the RFEF, as the resolution proposal itself points out, with the exception, perhaps, of the
purpose of the treatment. But this information was already expressly provided by the

President of the RFEF when pointing out that the purpose of the recording was to leave
record of what was discussed in the meetings (...).

It should be noted that the RFEF does not provide evidence that can corroborate that the
attendees at both meetings knew the extremes that the norm marks on

data protection, that is, that they were informed of aspects indicated in the
article 13 of the RGPD, in relation to the management that was going to be made of the data
data obtained from the recordings by the RFEF. As we have indicated
On several occasions throughout this procedure, the RGPD does not limit itself to placing the
liability over a passive liability, but instead takes a proactive approach,
demanding that the person responsible adopt preventive measures aimed at eliminating the

risks of its non-compliance and, furthermore, that it is in a position to demonstrate that it has
implemented these measures and that they are adequate to achieve the purpose
persecuted This principle, as we have had occasion to indicate above, is
collected, among others, in recital 74 of the RGPD and in article 5.2 of the RGPD.


For all these reasons, the following points should be highlighted:

At the meeting of 03/12/20, from the phrase that the person in charge of the RFEF says to the
beginning of this, noting that it is the only reference that exists to the fact that the
meetings were going to be recorded: “(…) We are recording the meeting so that it remains

proof of everything, okay?, and nothing, well, you have the word you…”, it does not come off in
no time that those attending the meeting on 03/12/20 were informed
in addition to the aspects included in article 13 of the RGPD, as established by the standard.
The same happens with those attending the second meeting, with the aggravating circumstance, if possible, that,
in this one, they were not even informed that it was also going to be recorded.


Therefore, it has been verified that the RFEF did not inform the
attendees to the meetings of the aspects indicated in article 13 of the RGPD. This
is, I do not report: a) the identity and contact details of the person in charge and, in its
case, of his representative; b) the contact details of the data protection officer
data, if any; c) of the purposes of the treatment to which the data is destined

personal and the legal basis of the treatment; d) recipients or categories of
recipients of personal data, where appropriate; e) if applicable, the intention of the
responsible for transferring personal data to a third country or organization
international; f) the period during which the personal data will be kept or, when
not possible, the criteria used to determine this period; g) the existence of

right to request access to personal data from the data controller
relating to the interested party, and its rectification or deletion, or the limitation of its treatment,
or to oppose the treatment, as well as the right to data portability; and h) the
right to file a claim with a supervisory authority.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 61/74









In addition, those attending the meeting on 04/07/20 were not informed that the
recording was going to be released to the media as established by the

article 13.3 of the RGPD: “When the data controller projects the
further processing of personal data for a purpose other than that for which it was
collected, will provide the interested party, prior to said further treatment,
information about that other purpose and any additional information relevant under the
section 2”.
The RFEF alleges that, "(...) there is evidence that in the privacy policy of the

The RFEF website identifies the data controller and provides all the information
other information required (…)”.

Well, indicate at this point that article 13 of the RGPD establishes that: “1.-
When personal data relating to him is obtained from an interested party, the person in charge

of the treatment, at the moment in which these are obtained, it will facilitate (...)”, and according to
record, this never happened, because the attendees at the first meeting,
held in person, they did not have to be connected at any time to
the website of the Federation, it is not even clear that they had informative equipment
in their power to connect, they were not even informed of the existence of the website
of the Federation where they could consult their "Privacy Policy".


In addition, it should be noted that the information provided in the "Privacy Policy"
Privacy” of a web page is with respect to the treatment of personal data
that can be obtained from the users of this and not on the treatment of the data
that are obtained by other means or in other places, such as in the

case that concerns us, when they are obtained from the recordings made in the
meetings held face-to-face or via videoconference.

Moreover, if we access the "Privacy Policy" of the RFEF website, whose
link is located at the bottom of it, called <<protection of

data>> the web redirects to a new page, https://www.rfef.es/proteccion-datos
where you can read, in the section "PERSONAL DATA THAT WE WILL TREAT", what
following: “By virtue of its relationship with the Royal Spanish Football Federation
We may process the following categories of personal data: 1. Identification data
like, name and surnames, NIF/Passport/NIE. 2. Contact information: address,
telephone, address (including postal and electronic address), etc. 3. Data of your

personal characteristics, such as marital status, gender, date and place of birth, age,
nationality or profession. 4. Special categories of data when they are
strictly necessary, such as health data. 5. Navigation data for the
RFEF website.


And in the section "PURPOSES FOR WHICH WE PROCESS YOUR DATA"
can read: “The collection of personal data may be for the purpose of managing
requests for press accreditation, match tickets and courses,
complete and process forms in general as well as send communications about
activities, products or services offered by the RFEF”, which, of course, has no

nothing to do with the purposes for which the personal data of
the people who attended the two meetings and whose personal data were
engravings.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 62/74








Finally, we must remember that, as recognized by the RFEF itself, only
after having held the two indicated meetings, that is, the one on 03/12/20 and the
of 04/07/20, prepared a document with informative clauses to provide the

attendees and only to “on-line” meetings, the extremes required in article 13 of the
RGPD: “(…) must be taken into account as a relevant fact in these
actions that, after the meeting of April 4, 2020, and for other
online meetings of the collegiate bodies of the RFEF, a clause was drawn up
information that is attached as DOCUMENT No. 3 in which all the
extremes required by article 13 of the RGPD and article 11 of the Organic Law

3/2018. Said clause has been incorporated for some time in the calls for
online meetings. To this end and as evidence of this, it is attached as a DOCUMENT
No. 4 copy of an e-mail convening an online meeting in which the
document “Virtual meetings. Informative Clause data protection.pdf (...)”.


       G).- Response to the allegations presented in point EIGHTH: “About
       the alleged illicit treatment of the personal data of those attending the
       meetings. Data protection and freedom of information and expression.

The RFEF alleges at this point that: “(…) the transfer of the recording by part of the
meeting of April 7, 2020 to Cadena SER took place in order to guarantee the

right to freedom of information and to receive truthful information recognized in the
article 20 of the Constitution”, and that: “(…) It was the media outlet who, in
exercise of such fundamental right, asked the RFEF to facilitate that recording (...)”

The RFEF recognizes, in another point of its allegations that, in use of that right

issued a press release that she sent to the media, according to her to:
“(…) correct the inaccuracies and discrepancies with the reality of what had happened
at the meeting (…). Therefore, at no time was the RFEF restricted from the right to
communicate truthful information by any means of communication.


Another very different thing is that the media, for, according to them,
"corroborate what was said in the press release sent by the RFEF", ask them for the
recordings of the meetings and that this one to show that he was telling the truth and
thereby contradict the statements made by the AFE in its press release,
provide without taking into account that personal data existed in said recording
of the interveners protected by the RGPD.


The exercise of the right to which the RFEF avails itself was already obtained when the RFEF
sends a press release to the media with the information that
considered appropriate. The fact that he later provided the recording with the
personal data of the participants obeys, as recognized by the RFEF itself,

"demonstrate that they were telling the truth and contradict the statements made by the AFE in
your press release.

Apart from all of the above, it must be taken into account, when using the right
recognized in article 20 of the CE, which this article also states, in its

point 4 the following: “These freedoms have their limit in the respect for the rights
recognized in this Title, in the precepts of the laws that develop it and,
especially, in the right to honour, to privacy, to one's own image and to
protection of youth and childhood.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 63/74









We must also keep in mind what is indicated in recital 153) of the RGPD,
when it indicates that: “The Law of the Member States must reconcile the norms

governing freedom of expression and information, including journalistic expression,
academic, artistic or literary, with the right to protection of personal data
in accordance with this Regulation. The processing of personal data for purposes
exclusively journalistic or for purposes of academic, artistic or literary expression
must be subject to exceptions or exemptions from certain provisions of the
this Regulation if so required to reconcile the right to protection of

personal data with the right to freedom of expression and information
enshrined in article 11 of the Charter”.

And what is stipulated in article 85 of the RGPD, when it establishes that:


“1. Member States shall reconcile by law the right to data protection
under this Regulation with the right to freedom of
expression and information, including treatment for journalistic purposes and purposes of
academic, artistic or literary expression.

2.For the treatment carried out for journalistic purposes or for the purpose of expression

academic, artistic or literary, Member States shall establish exemptions or
exceptions to the provisions of chapters II (principles), III (rights of the
interested), IV (responsible and in charge of the treatment), V (transfer of data
to third countries or international organizations), VI (authorities of
independent control), VII (cooperation and coherence) and IX (provisions related to

specific situations of data processing), if they are necessary to reconcile the
right to the protection of personal data with freedom of expression and
information. 3. Each Member State shall notify the Commission of the provisions
legislative measures it adopts in accordance with paragraph 2 and, without delay, any
subsequent modification, legislative or otherwise, of the same.


Therefore, the RGPD expressly includes the need for Member States
must reconcile by law the right to the protection of personal data with the
right to freedom of expression and information, including processing for
journalistic and academic, artistic or literary expression purposes and adds in his article
85.2 that for the treatment carried out for the aforementioned purposes, the Member States

must establish exemptions or exceptions regarding, among others, the provisions of
different chapters of the Regulation where the principles, rights of the
interested, responsible and in charge of treatment, transfer of data
etc., whenever they are necessary to reconcile the right to
protection of personal data with freedom of expression and information. For

Therefore, the right to freedom of expression and information versus the right
fundamental to data protection cannot be understood in an absolute way.

In the case at hand, the personal data obtained by the RFEF, through the
recordings made of the meetings held, had the purpose, according to the

Federation, for: "(...) that there be a record of everything (...)". It didn't even contain
the slightest reference to the aspects established in article 13 of the RGPD. Well
well, these data were later transferred to the media, to
corroborate, according to the Federation itself, the statements that it had

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 64/74








carried out previously through a press release sent to the media.
communication, making use, therefore, of the aforementioned fundamental right of expression and
information, with the sending of the press release.


The fact that after sending the press release he gave the personal data
obtained in the recordings to the media exceeds the principles
collected in article 5.1, in sections b and c) where it is established that the data
personal will be:


b) collected for specific, explicit and legitimate purposes, and will not be processed
subsequently in a manner incompatible with those purposes; according to article 89,
paragraph 1, the further processing of personal data for archiving purposes in
public interest, scientific and historical research purposes or statistical purposes are not
deemed incompatible with the original purposes ("purpose limitation");


c) adequate, pertinent and limited to what is necessary in relation to the purposes for which
that are processed ("data minimization");

       H).- Response to the allegations presented in point NINTH:
       Application of aggravating criteria


       a).- On the aggravating circumstance applied with respect to article 76.2.b) of the
       LOPDGDD: “b) The link between the activity of the offender and the performance of
       processing of personal data”.


Article 4 of the Resolution of January 24, 2011, of the Presidency of the Council
Superior of Sports, by which the Statutes of the Royal Federation are published
Española de Fútbol establishes the following RFEF Competences:

“The government, administration, management, organization and regulation of football, in

all their specialties. In its virtue, it is proper to it: a) To exercise the power of
ordinance. b) Control the official competitions at the state level, without prejudice to
the competitions of the National Professional Football League. c) Hold the
representation of FIFA and UEFA in Spain, as well as that of Spain in the
international activities and competitions held inside and outside the
state territory. To this end, the RFEF is responsible for selecting the

footballers who have to integrate any of the national teams. d) Authorize the
sale or transfer, outside the national territory, of television transmission rights
of official professional competitions, and, likewise, any other
state level. e) Train, qualify and qualify, within the scope of their powers, the
referees, as well as the coaches, or personnel who develop technical tasks of

management or assistants, whose degree is imposed on the clubs that participate in
national or international competitions. f) Ensure compliance with the
provisions by which it is governed. g) Protect, control and supervise its associates,
functions that will be extensive, except in the case of clubs attached to the League
National Professional Soccer, to their economic activity. h) Promote

and organize sports activities aimed at the public. i) Issue the report on the
Statutes and regulations of the National Professional Football League which, as a requirement
prior to its approval by the Higher Sports Council, provides for article 41.3 of
the Sports Law. j) Hire the personnel necessary for the fulfillment of its

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 65/74








functions and the provision of its services. k) Comply with and enforce the statutes,
regulations, guidelines and decisions of FIFA, UEFA and its own, as well as
Like the rules of the game. l) Prepare the rules and provisions that make up its

legal system. m) Carry out international sports relations. n)
Ensure the purity of matches and competitions. o) In general, how many
activities do not oppose, undermine and destroy its corporate purpose.

This aggravating circumstance is applied, therefore, due to the high level of involvement of the RFEF's activity
with the processing of personal data, considering the level of

implementation of the entity and the activity it develops, in which they are involved
personal data of thousands of interested parties, players, referees, coaches, managers
and in general all the natural persons that make up the RFEF. this circumstance
determines a higher degree of demand and professionalism and, consequently, of
responsibility of the Federation in relation to the processing of data.


       b).- Regarding the aggravating circumstance applied with respect to article 83.2.a) of the RGPD: “The
       scope or purpose of the data processing operation, as well as the
       number of interested parties affected and the level of damages they have suffered.
       suffered”


The number of interested parties affected by the two recordings was 37 people,
with respect to which personal data processing was carried out without having
conveniently informed of the aspects established in article 13 of the RGPD
and subsequent data processing in an unlawful manner by transferring the recording of the
second meeting, where 26 people attended, to the media without

they were previously notified of this fact nor were they asked for the mandatory consent
established in article 6.1.a) of the RGPD.

Regarding the seriousness and level of damages suffered by the interested parties, it is
notorious that the transfer to the media of national coverage, of the

Recorded personal data and its subsequent dissemination to the entire society conditions and
It seriously harms your intimacy and privacy.
As for damages caused by the lack of due information, it is clear and notorious
the damage caused to the interested parties because it deprived them of the possibility of exercising the rights
rights collected in articles 15 to 22 of the RGPD.


     c).- Regarding the aggravating circumstance applied with respect to article 83.2.b) of the RGPD: “the
     intentionality or negligence in the infringement.

Deny the concurrence of a negligent action by the RFEF in this case,
would be equivalent to acknowledging that their conduct -by action or omission- has been diligent.

Obviously, we do not share this view of the facts, since it has been
accredited lack of due diligence in their actions.

It is very illustrative, the SAN of October 17, 2007 (rec. 63/2006), based on
that it is an entity whose activity entails a continuous treatment of

data as has been verified in the previous point, indicates that "... the Court
Supreme has understood that there is imprudence whenever a
legal duty of care, that is, when the offender does not behave with due diligence
required. And in assessing the degree of diligence, special consideration must be given to the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 66/74








professionalism or not of the subject, and there is no doubt that, in the case now examined,
when the activity of the appellant is of constant and abundant data handling of
personal character must insist on rigor and exquisite care to adjust to the
legal provisions in this regard.


Likewise, the fact that the RFEF has subsequently implemented the
meetings of 03/12/20 and 04/07/20, modifications in the management of the treatment of
data. publishing a guide with the aspects included in article 13, corroborates the
fact that previously it did not carry out a diligent management in the treatment of the
data it manages.


Well, the sanctions are imposed for the lack of due diligence when
obtain the personal data of those attending the meetings, where it has been
demonstrated that they did not obtain the pertinent information that the RGPD marks in their
article 13 and for the subsequent use of said data, illegally, when
were released to the media without the prior consent of the

affected. The infringing act consists in the fact that the RFEF, as responsible for the
treatment of the personal data obtained in the recordings, has not been able to
demonstrate reliably that in said treatment has complied with the principles of
protection of data collected in the RGPD, by not having adopted the measures
adequate for the protection of the data object of the treatment. Especially when such and
as we have pointed out in the SAN of October 17, 2007 (rec. 63/2006) cited: "

(...) when the activity of the appellant is of constant and abundant management of
data of a personal nature must insist on rigor and exquisite care for
comply with the legal provisions in this regard (...)".

Negligence as an aggravating circumstance is then connected, not with the offending type itself
(which includes much more than due diligence), but with facts surrounding

this, since we find ourselves with an entity that performs data processing
on a large scale, in a systematic and continuous manner, and that extreme
care in complying with its data protection obligations, as
and as the jurisprudence establishes. Especially when you have means of all kinds
more than enough to fulfill adequately. It is not the same if the offense is
committed by the RFEF than by a natural person or a small company. At

In the first case, non-compliance is more reprehensible. This is inferred from recital 148
of the RGPD that imposes being to the concurrent circumstances to qualify a
infringement as serious or minor for the purposes of the RGPD.

Non-compliance has degrees, resulting in this being more burdensome due to the
circumstances described, fully entering the field of negligence.


       d).- About the aggravating circumstance applied with respect to article 83.2.h): “The way in
       that the supervisory authority was aware of the infringement, in particular if the
       responsible or the person in charge notified the infraction and, if so, in what
       measure":


From the entire process, it has been confirmed that the RFEF has not implemented
appropriate procedures for action in the collection and processing of personal data
personal nature, so that the infringement is not the result of an anomaly
punctual in the operation of said procedures, but a defect of the system of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 67/74








management of personal data by the person in charge, that the control authority,
in this case, the AEPD has learned from the claims
presented by the AFE and by the LNEF. Furthermore, taking into account the high degree of

diffusion that the recording has had through the media and, therefore,
therefore, the wide dissemination that the personal data included in them have had.

       I).- On the request made in point TENTH. Regarding the test
       requested testimony.


The instruction considered that the information and documentation provided to the
procedure was sufficient to be able to elucidate whether or not there was an infringement of the
current regulations on data protection. This is so because the present
sanctioning administrative procedure is initiated after having made the AEPD a
intense inspection work, which has been documented incorporated into the file

and that constitutes sufficient evidence for this resolution.

In the present case, the information provided by the parties is assumed to be true. No
However, the foregoing, as established in article 24.2 of the CE, also applicable in
In this case, it recognizes the right of the claimed entity, “to use all means
evidence pertinent to his defense”, leaving it to his discretion to be able to present how many

means of evidence it deems pertinent throughout the procedure.

In the case at hand, the RFEF has not presented at any time of the
procedure any document or evidence that corroborates that those attending the
meetings were aware that they were going to be recorded. Neither has

provided any evidence to show that he had been informed
conveniently to those attending the meetings of the aspects indicated in the
article 13 of the RGPD.

Therefore, the testimonial evidence requested by the RFEF is considered not to be

necessary in this case, in application of the principle of “procedural economy” since it is already
sufficiently accredited the facts attributable to the claimed, and, therefore,
must reject the request for the practice of evidence as unnecessary, under the
provided for in article 77.3 of the LPACAP.

III.- On the infringement of article 13 of the RGPD committed by the lack of information

offered to those attending the meetings of the COVID-19 Monitoring Committee.

In the present case, it has been established that those attending the second meeting,
held on 04/07/20, they were not informed that it was going to be recorded. Apart from that,
It has been verified that none of those who attended the two meetings, that of the

03/12/20 and 04/07/20, was duly informed of the management that was
would perform on your personal data as established by the norm

In this sense, article 13 of the RGPD establishes the information that must be
provide the interested party at the time of obtaining their personal data:


“1. When personal data relating to him is obtained from an interested party, the
responsible for the treatment, at the time these are obtained, will provide you with:


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 68/74








a) the identity and contact details of the person in charge and, where appropriate, of their
representative; b) the contact details of the data protection officer, in his
case; c) the purposes of the treatment to which the personal data is destined and the basis
legal treatment; d) when the treatment is based on article 6, paragraph 1,
letter f), the legitimate interests of the person in charge or of a third party; e) the recipients or

the categories of recipients of personal data, if any; f) where appropriate, the
intention of the controller to transfer personal data to a third country or
international organization and the existence or absence of an adequacy decision
of the Commission, or, in the case of the transfers indicated in articles 46 or 47 or
Article 49, paragraph 1, second paragraph, reference to adequate guarantees or
appropriate and the means to obtain a copy of them or the fact that

have lent.

2. In addition to the information mentioned in section 1, the person in charge of the
treatment will facilitate the interested party, at the moment in which the data is obtained
personal, the following information necessary to guarantee data processing

fair and transparent: a) the period during which the personal data will be kept or,
when this is not possible, the criteria used to determine this period; b) the
existence of the right to request access to data from the data controller
related to the interested party, and its rectification or deletion, or the limitation of its
treatment, or to oppose the treatment, as well as the right to the portability of the
data; c) when the treatment is based on article 6, paragraph 1, letter a), or the

Article 9, paragraph 2, letter a), the existence of the right to withdraw consent in
any time, without affecting the legality of the treatment based on the
consent prior to its withdrawal; d) the right to file a claim with
a control authority; e) if the communication of personal data is a requirement
legal or contractual, or a necessary requirement to enter into a contract, and if the
The interested party is obliged to provide personal data and is informed of the

possible consequences of not providing such data; f) the existence of decisions
you automate, including profiling, referred to in article 22,
paragraphs 1 and 4, and, at least in such cases, significant information about the logic
applied, as well as the importance and expected consequences of said treatment
for the interested party”.


Therefore, the known facts constitute an infraction, attributable to the
claimed, for violation of article 13 of the RGPD, by not informing
conveniently, to those attending the two meetings, of the precepts collected in
said article.

Article 72.1.h) of the LOPDGDD, considers "very serious", for prescription purposes,

“The omission of the duty to inform the affected party about the processing of their data
in accordance with the provisions of articles 13 and 14 of the RGPD”

This infraction can be sanctioned with a maximum fine of €20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the

global total annual turnover of the previous financial year, opting for the
of greater amount, in accordance with article 83.5.b) of the RGPD.




C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 69/74








In accordance with the precepts indicated, in order to set the amount of the penalty to
impose, it is considered appropriate to graduate the sanction to be imposed in accordance with the
following aggravating criteria established in article 83.2 of the RGPD:


    - The scope or purpose of the data processing operation, as well as the
        number of interested parties affected and the level of damages they have suffered.
        suffered, (paragraph a), since the number of interested parties affected, by the two
        recordings was made up of 37 people, with respect to whom a
        processing of personal data without having properly informed them of

        the aspects established in article 13 of the RGPD and data processing
        later illegally by giving the recording of the second meeting, where
        26 people attended, the media without being notified
        previously this fact nor were they asked for the mandatory consent.


    - The intention or negligence of the infraction, by the entity,
        (section b), assuming that it is an entity whose activity leads
        coupled with a continuous processing of personal data of, players,
        coaches, referees, technicians and other personnel at your service, as well as, in
        our case, personnel from outside said body, is considered to be of special
        It is important to remember at this point, the SAN of October 17, 2007 (rec.

        63/2006), where it is stated that the following: “…the Supreme Court is
        understanding that recklessness exists whenever a legal duty is neglected
        of care, that is, when the offender does not behave with diligence
        required. And in assessing the degree of diligence, it must be weighed
        especially the professionalism or not of the subject, and there is no doubt that, in the

        case now examined, when the activity of the appellant is constant and
        abundant handling of personal data, it must be insisted on the rigor and
        exquisite care to adjust to the legal precautions in this regard".
        Therefore, if we stick to the jurisprudence of the Supreme Court, we could even consider
        this section as a qualified aggravating circumstance, when verifying the lack of diligence

        should be demonstrated by the RFEF in this case, with respect to the management of the
        personal data included in the recordings made.

    - The way in which the supervisory authority became aware of the infringement,
        that the AEPD became aware of the infringement through the claim of
        interested parties, (section h), because of the entire process, it has been verified

        that the RFEF did not have adequate action procedures in place
        proactive in the collection and processing of personal data,
        so that the infraction is not the consequence of a punctual anomaly in the
        operation of these procedures, but rather a defect in the system of
        management of personal data by the person in charge, that the authority of

        control, in this case, the AEPD, has been aware from the
        claims filed by the AFE and by the LNEF.

It is also considered that it is appropriate to graduate the sanction to be imposed in accordance with the
following aggravating criteria, established in article 76.2 of the LOPDGDD:


    - The link between the activity of the offender and the performance of treatment of
        personal data, (section b), considering the level of implementation of the
        entity and the activity it develops, in which data is involved

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 70/74








        information of thousands of interested parties: players, referees, coaches,
        directors and in general all the natural persons that make up the RFEF, according to
        can be observed in article 4 of the Resolution of January 24, 2011, of

        the Presidency of the Higher Sports Council, by which the
        Statutes of the Royal Spanish Football Federation. this circumstance
        determines a higher degree of demand and professionalism and,
        consequently, of responsibility of the Federation in relation to the
        data processing


The balance of the circumstances contemplated in article 83.2 of the RGPD, with
Regarding the infraction committed by violating the provisions of article 13 of the RGPD,
allows a penalty of 100,000 euros (one hundred thousand euros) to be set.

IV.- On the infringement of article 6.1 of the RGPD committed by not requesting the

necessary consent of those involved in the recording of 04/07/20 before
proceed to give it to the media.

The RGPD deals, in its article 5.1, with the principles that must govern the treatment
of the personal data by the person in charge of these, and mentions among them the
following: “The personal data will be:


a) processed in a lawful, loyal and transparent manner in relation to the interested party ("lawfulness,
loyalty and transparency»);

b) collected for specific, explicit and legitimate purposes, and will not be processed

subsequently in a manner incompatible with those purposes; according to article 89,
paragraph 1, the further processing of personal data for archiving purposes in
public interest, scientific and historical research purposes or statistical purposes are not
deemed incompatible with the original purposes ("purpose limitation");


c) adequate, pertinent and limited to what is necessary in relation to the purposes for which
that are processed ("data minimization"); (…)

In turn, section 2 states that: 2. The data controller will be
responsible for compliance with the provisions of paragraph 1 and able to demonstrate it
("proactive responsibility").


In turn, article 6.1 of the RGPD, establishes the following on the legality of the treatment
of personal data:

“The processing of personal data will be lawful if it meets one of the following

terms:

a) the interested party gave their consent for the processing of their personal data
for one or more specific purposes;


b) the treatment is necessary for the execution of a contract in which the interested party
is part of or for the application at the request of the latter of pre-contractual measures;



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 71/74








c) the treatment is necessary for the fulfillment of a legal obligation applicable to the
data controller;


d) the treatment is necessary to protect the vital interests of the interested party or another
Physical person;

e) the treatment is necessary for the fulfillment of a mission carried out in the interest
public or in the exercise of public powers vested in the data controller;


f) the treatment is necessary for the satisfaction of legitimate interests pursued
by the person in charge of the treatment or by a third party, provided that on said
interests do not override the interests or fundamental rights and freedoms of the
interested party that require the protection of personal data, in particular when the
interested is a child. The provisions of letter f) of the first paragraph shall not be

application to the treatment carried out by the authorities in the exercise of their functions.
(…)

In the present case, it has been verified throughout the procedure that the
treatment of the personal data obtained by the RFEF in the two meetings
convened to deal with the health emergency of COVID-19, in the field of Soccer,

could be legitimized under article 6.1.c) of the RGPD, where it is established
that the processing of personal data will be lawful if “it is necessary for the
compliance with a legal obligation applicable to the data controller”. This
es, to draw up the minutes of the meeting, and this was confirmed, initially by the
Federation itself: “(…) The purpose of the recording was to make the record, as well as

have reliable evidence of the development of the topics and the content discussed in the
meeting".

However, article 5.1.b) of the RGPD establishes that personal data will be
treaties solely and exclusively for: “certain, explicit and legitimate purposes,

and will not be further processed in a manner incompatible with those purposes.”

In the present case, the personal data of those attending the second meeting
obtained by the RFEF through the recording made were later transferred to
the media, without the knowledge and consent of those affected.


Therefore, the transfer of the personal data of those attending the second meeting to the
means of communication should have been preceded by the corresponding consent of
those affected, as established in article 6.1.a) of the RGPD, "the treatment of the
personal data will be lawful if the interested party gave their consent for the treatment
of your personal data for one or more specific purposes. situation that, in this

case, it did not occur.

The exposed facts suppose on the part of the RFEF the commission of the infraction of the
article 6.1 of the RGPD, when carrying out an illicit treatment of the personal data of the
personnel who attended the second meeting of the Follow-up Commission of the

COVID-19, when they were released to the media without consent
expression of those involved.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 72/74








Article 72.1.b) of the LOPDGDD, considers "very serious", for prescription purposes,
“The processing of personal data without the concurrence of any of the conditions of
legality of the treatment established in article 6 of the Regulation”.


This infraction can be sanctioned with a maximum fine of €20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
global total annual turnover of the previous financial year, opting for the
of greater amount, in accordance with article 83.5.b) of the RGPD.


In accordance with the precepts indicated, in order to set the amount of the penalty to
impose, it is considered appropriate to graduate the sanction in accordance with the following
aggravating criteria established by art 83.2:

    - The scope or purpose of the data processing operation, as well as the

        number of interested parties affected and the level of damages they have suffered.
        suffered, (paragraph a), since the number of interested parties affected, by the two
        recordings was made up of 37 people, with respect to whom a
        processing of personal data without having properly informed them of
        the aspects established in article 13 of the RGPD and data processing
        later illegally by giving the recording of the second meeting, where

        26 people attended, the media without being notified
        previously this fact nor were they asked for the mandatory consent.

    - The intention or negligence of the infraction, by the entity,
        (section b), assuming that it is an entity whose activity leads

        coupled with a continuous processing of personal data of, players,
        coaches, referees, technicians and other personnel at your service, as well as, in
        our case, personnel from outside said body, is considered to be of special
        It is important to remember at this point, the SAN of October 17, 2007 (rec.
        63/2006), where it is stated that the following: “…the Supreme Court is

        understanding that recklessness exists whenever a legal duty is neglected
        of care, that is, when the offender does not behave with diligence
        required. And in assessing the degree of diligence, it must be weighed
        especially the professionalism or not of the subject, and there is no doubt that, in the
        case now examined, when the activity of the appellant is constant and
        abundant handling of personal data, it must be insisted on the rigor and

        the exquisite care to adjust to the legal precautions in this regard".
        Therefore, if we stick to the jurisprudence of the Supreme Court, we could even consider
        this section as a qualified aggravating circumstance, when verifying the lack of diligence
        should be demonstrated by the RFEF in this case, with respect to the management of the
        personal data included in the recordings made.


    - The way in which the supervisory authority became aware of the infringement,
        that the AEPD became aware of the infringement through the claim of
        interested parties, (section h), because of the entire process, it has been verified
        that the RFEF did not have adequate action procedures in place

        proactive in the collection and processing of personal data,
        so that the infraction is not the consequence of a punctual anomaly in the
        operation of these procedures, but rather a defect in the system of
        management of personal data by the person in charge, that the authority of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 73/74








       control, in this case, the AEPD, has been aware from the
       claims filed by the AFE and by the LNEF.


It is also considered that it is appropriate to graduate the sanction to be imposed in accordance with the
following aggravating criteria, established in article 76.2 of the LOPDGDD:

    - The link between the activity of the offender and the performance of treatment of
       personal data, (section b), considering the level of implementation of the
       entity and the activity it develops, in which data is involved

       information of thousands of interested parties: players, referees, coaches,
       directors and in general all the natural persons that make up the RFEF, according to
       can be observed in article 4 of the Resolution of January 24, 2011, of
       the Presidency of the Higher Sports Council, by which the
       Statutes of the Royal Spanish Football Federation. this circumstance

       determines a higher degree of demand and professionalism and,
       consequently, of responsibility of the Federation in relation to the
       data processing

The balance of the circumstances contemplated in article 83.2 of the RGPD, with
Regarding the infraction committed by violating the provisions of article 6.1 of the

RGPD, allows you to set a penalty of 100,000 euros (one hundred thousand euros).

V.- Total Final Sanction.

The balance of the circumstances contemplated above, with respect to the

infraction committed by violating the provisions of articles 13 and 6.1 of the RGPD,
allows a total penalty of 200,000 euros (two hundred thousand euros) to be set; €100,000
for the infringement of art. 13 of the RGPD and 100,000 euros for the infringement of art. 6.1 of the
GDPR.


Therefore, in accordance with the foregoing, by the Director of the Agency
Spanish Data Protection,
                                     RESOLVES:

FIRST: IMPOSE, to the ROYAL SPANISH FOOTBALL FEDERATION, (RFEF)
with CIF.: Q2878017I, a total penalty of 200,000 euros (two hundred thousand euros):

100,000 euros for the infringement of article 13 of the RGPD and 100,000 euros for the
violation of article 6.1 of the RGPD.

SECOND: NOTIFY this resolution to the REAL SPANISH FEDERATION
DE FUTBOL, (RFEF) and the claimants about the result of the claim.


Warn the sanctioned party that the sanction imposed must be made effective once it is
enforce this resolution, in accordance with the provisions of article 98.1.b)
of Law 39/2015, of October 1, of the Common Administrative Procedure of the
Public Administrations (LPACAP), within the voluntary payment period indicated in the

Article 68 of the General Collection Regulations, approved by Royal Decree
939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by depositing it in the restricted account Nº ES00 0000 0000 0000
0000 0000, opened in the name of the Spanish Agency for Data Protection in the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es, 74/74








Bank CAIXABANK, S.A. or otherwise, it will be collected in
executive period.


Received the notification and once executed, if the date of execution is
between the 1st and 15th of each month, both inclusive, the term to make the payment
voluntary will be until the 20th day of the following month or immediately after, and if
between the 16th and last day of each month, both inclusive, the payment term
It will be until the 5th of the second following month or immediately after.


In accordance with the provisions of article 82 of Law 62/2003, of 30
December, of fiscal, administrative and social order measures, this
Resolution will be made public, once it has been notified to the interested parties. The
publication will be carried out in accordance with the provisions of Instruction 1/2004, of 22
December, of the Spanish Agency for Data Protection on the publication of their

Resolutions.

Against this resolution, which puts an end to the administrative procedure, and in accordance with the
established in articles 112 and 123 of the LPACAP, the interested parties may
file, optionally, an appeal for reconsideration before the Director of the Agency
Spanish Data Protection Authority within a month from the day

following the notification of this resolution, or, directly contentious appeal
before the Contentious-Administrative Chamber of the National High Court,
in accordance with the provisions of article 25 and paragraph 5 of the provision
additional fourth of Law 29/1998, of 13/07, regulating the Jurisdiction
Contentious-administrative, within two months from the day after

to the notification of this act, as provided in article 46.1 of the aforementioned text
legal.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the firm resolution in administrative proceedings if the

The interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact by
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/],
or through any of the other registers provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. You must also transfer to the Agency the documentation

that proves the effective filing of the contentious-administrative appeal. If the
Agency was not aware of the filing of the contentious appeal-
within a period of two months from the day following the notification of the
This resolution would terminate the precautionary suspension.


Sea Spain Marti
Director of the Spanish Data Protection Agency









C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
@@ Line 68: / Line 68: @@
 === Holding ===
-With regard to the information obligation from [[Article 13 GDPR|Article 13 GDPR]], the AEPD considered the following. First, that the controller could not prove that the participants had been informed that the meeting was being recorded. Only at the beginning of the first meeting did the representative of the controller warn the participants that the meeting was being recorded so everything that was said in the meeting could be documented. However, no more information was given, and the fact that future meetings would also be recorded was not mentioned. Additionally, there were participants in the second meeting that had not attended the first meeting; and during the second meeting participants were not informed about the recording.
+With regard to the information obligation from [[Article 13 GDPR|Article 13 GDPR]], the AEPD considered different issues. First, that the controller could not prove that the participants had been informed that the meeting was being recorded. It was only at the beginning of the first meeting where the representative of the controller warned the participants that the meeting was being recorded, in order to document everything that was said in the meeting. Yet, no more information was given, and the fact that future meetings would also be recorded was not mentioned. Additionally, there were participants in the second meeting that had not attended the first meeting; and during the second meeting participants were not informed about the recording.
-Therefore, the controller did not and could not prove that the participants in the meeting had been informed about the processing of personal data as required by [[Article 13 GDPR|Article 13 GDPR]]. And, as highlighted by the DPA, the controller did not provide the information required by [[Article 13 GDPR#3|Article 13(3) GDPR]] about further processing of the data (in this case, sharing it with radio broadcasters).
+Therefore, the controller did not and could not prove that the participants in the meeting had been informed about the processing of personal data as required by [[Article 13 GDPR|Article 13 GDPR]]. And, as highlighted by the DPA, the controller did not provide either the information required by [[Article 13 GDPR#3|Article 13(3) GDPR]] about further processing of the data (in this case, sharing the recording with two radio broadcasters). Therefore, the AEPD concluded that the controller had breached [[Article 13 GDPR]].
-The AEPD concluded that the controller had a valid legal basis for the processing of personal data in the first place, since Article 18 of the [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10566 Spanish Act for the Regulation of the Public Sector] (LRJSP) allows public bodies to record their meetings and to store them in order to keep a literal record of the minutes.
+On the other hand, the AEPD concluded that the controller had a valid legal basis for the processing of personal data in the first place, since Article 18 of the [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10566 Spanish Act for the Regulation of the Public Sector] (LRJSP) allows public bodies to record their meetings and to store them in order to keep a literal record of the minutes.
-However, having a valid legal basis does not prevent the controller from properly informing the data subjects about all the mandatory points included in [[Article 13 GDPR|Article 13 GDPR]]. According to the AEPD, saying 'we are recording the meeting so we can keep record of everything that will be said' at the beginning of the meeting does not amount to providing the mandatory information, and it cannot be considered to provide basic information about the legal basis and the purposes of the processing.
+However, having a valid legal basis does not prevent the controller from properly informing the data subjects about all the mandatory points included in [[Article 13 GDPR|Article 13 GDPR]]. According to the AEPD, saying 'we are recording the meeting so we can keep record of everything that will be said' at the beginning of the meeting does not amount to providing the mandatory information, and it cannot be considered to be providing basic information about the legal basis and the purposes of the processing.
-With regard to the second processing of data, in which the recording was shared with the radio broadcasters, the AEPD highlighted Recital 50 GDPR, that states that "the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected". For this subsequent processing, the controller relied on the right of freedom of information and freedom of expression, since they considered that the had the legitimacy to refute the allegedly false press release by the AFE and to substantiate such refutation by providing a record of what was exactly said during the meeting. In this regard, the AEPD noted that the recording of the meeting also contained comments of a personal and private nature.
+Regarding the transparency obligations of public bodies with respect to the minutes of their meetings, the AEPD noted that the obligation to disclose the minutes does not include the recording itself but a written record of certain aspects. Therefore, while this allows to record the meeting and to provide access to the written minutes, it does not allow to share the actual recording of it.
-Regarding the transparency obligations of public bodies with respect to the minutes of their meetings, the AEPD noted that the obligation to disclose the minutes does not include the recording itself but a written record of certain aspects.
+With regard to the second and subsequent processing of data, in which the recording was shared with the radio broadcasters, the AEPD highlighted Recital 50 GDPR, that states that "the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected". For this subsequent processing, the controller relied on the right to freedom of information and freedom of expression, since the controller considered that it had the legitimacy to refute the allegedly false press released by the AFE and to substantiate such refutation by providing a literal record and the recording of what was exactly said during the meeting. However, the authority reasoned that such right could have been vindicated just by sharing the written record of the meeting, and not the actual recording. In this regard, the AEPD remarked that the recording of the meeting also contained comments of a personal and private nature. Therefore, if needed, they should have shared the minimum data necessary to achieve that purpose, according to the minimization principle. Therefore, by sharing the recording of the meeting, the AEPD considered that the controller breached [[Article 6 GDPR|Article 6(1) GDPR]], for processing personal data without a valid legal basis.
+For the violation of [[Article 13 GDPR]], the AEPD fined the controller €100,000. For the violation of [[Article 6 GDPR|Article 6(1) GDPR]], the AEPD fined the controller another €100,000.
-(IN PROGRESS)
 == Comment ==