AEPD (Spain) - E/03379/2021

AEPD - E/03379/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 13 GDPR Article 22 LSSI
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	09.04.2021
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	E/03379/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD decision (in ES)
Initial Contributor:	n/a

The Spanish DPA found that websites that do not qualify as "service providers" under the Spanish legislation on e-commerce and information society services, have no obligation to ask for consent before placing analytical cookies.

English Summary

Facts

A data subject made a complaint to the Spanish DPA alleging that the website of an Spanish political party (Podemos) placed analytical cookies when visiting such website before asking for consent, neither it offered the option for rejecting cookies or opting out afterwards.

Dispute

Does a website that does not fall under the definition of a service provider of an information society service need to comply with the requirements of Spanish Society Services Act (LSSI) implementing the e-Privacy Directive?

Holding

The Spanish DPA analyzed the provisions of the Spanish legislation related to electronic commerce and information society services (LSSI) and concluded that only the websites that fall under the definition of "service provider" (with an economic activity) have to comply with the requirements of said legislation.

It therefore decided that, given that the website of the political party "Podemos" is not a "service provider" in the meaning of the Spanish legislation, the complaint could not be upheld.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/6








     Procedure Nº: E / 03379/2021

                   RESOLUTION OF ACTION FILE


Of the actions carried out by the Spanish Agency for Data Protection and
based on the following,
                                       FACTS


FIRST: On 11/02/20, a letter submitted by
D. A.A.A., (hereinafter, “the claimant”), indicating, among others, the following:

“As of November 2, 2020, when accessing the public website of the political party
PODEMOS (https://podemos.info/), analytical cookies are downloaded, without having
given consent in this regard. The cookie banner that appears when accessing the

web does not report the existence of analytical cookies or the property of this-
tas. The banner does not allow the user to individually manage consent by category.
cookie category or reject all of them to continue browsing without being downloaded.
guen ”.


SECOND: In view of the facts presented in the claim and the documents
provided by the claimant, the SG of Data Inspection proceeded to carry out
actions for its clarification, under the protection of the powers of investigation
granted to the control authorities in article 57.1 of Regulation (EU) 2016/679
(GDPR). Thus, dated 12/04/20, an information request is addressed to training

policy, “PODEMOS, PARTIDO POLÍTICO”, (claimed entity).

THIRD: Based on the preliminary information that is available and when it is appreciated
Rational indications of a possible violation of the regulations on protection
tion of data, dated 03/03/21, the Director of the Spanish Agency for the Protection of
Data,

In accordance with article 65 of the LOPDGDD, it agreed to admit the complaint for processing
submitted by the claimant.

                            FOUNDATIONS OF LAW


                                            I
The Director of the Spanish Agency is competent to resolve this Procedure
of Data Protection, in accordance with the provisions of art. 43.1, paragraph
second, of Law 34/2002, of July 11, on Services of the Society of the
Information and Electronic Commerce (LSSI).


                                            II
Article 22.2 of the aforementioned LSSI Law establishes that: 2. Service providers
will be able to use data storage and retrieval devices on computers
terminals of the recipients, provided that they have given their
consent after clear and complete information has been provided to them

on its use, in particular, on the purposes of data processing, with
in accordance with the provisions of Organic Law 15/1999, of December 13, on Protection
of Personal Data.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/6








Article 2 of the same law establishes: 1. This Law shall apply to the
service providers of the information society established in Spain and to
the services provided by them.


The LSSI Annex defines: a) "Information society services" or
"Services": any service normally provided for consideration, remotely, by way of
electronically and at the individual request of the recipient. The concept of service of the
The information society also includes unpaid services for their
recipients, insofar as they constitute an economic activity for the

service provider.
       ...
c) "Service provider" or "provider": natural or legal person that provides
an information society service.

The report 0083/2014 of the Legal Office of the Agency in response to a

consultation on the subjective scope of application of the LSSI in relation to
regulation of information storage and retrieval devices
notes:

"It is proposed what is the subjective scope of application of this article 22.2 LSSI,
basically questioning whether it applies only to the service providers of the

information society or in the field of any communication service
electronic devices that install cookies; and specifically if the consulting University can
be considered a service provider of the information society.

For an adequate hermeneutic of the article and for a systematic exposition,

We start from the general systems of interpretation of norms that our right
establishes that they are none other than those referred to in article 3.1 of the Code
Civil:

“The rules will be interpreted according to the proper meaning of their words, in relation to

the context, the historical and legislative antecedents, and the social reality of the time in
that have to be applied, attending fundamentally to the spirit and purpose ”.

Thus, the criteria of literal interpretation are established (the proper sense of the
words, which when sufficient should prevail since in claris non fit
interpretatio); the systematic (the situation of the precept in the law, title and chapter of the

herself); historical interpretation, including not only historical background, but
also related norms from which the study proceeds; interpretation
according to social reality; and the teleological interpretation of the norm, the spirit and
purpose.


Taking into account such criteria, the literal tenor and the systematic position of the
precept. Article 22.2 LSSI appears within Title III of said standard, on
commercial communications electronically. The rubric of the precept is
"Rights of recipients of services"; and literally art. 22.2 begins
defining who will be obliged by the standard, who will be able to use devices

storage and recovery of data, speaking of "the providers of
services".


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/6








These are, therefore, concepts of the LSSI, which all have a
definition established in the standard itself: on the one hand, both the heading of the article
as the literal wording of the article speaks of the addressee, who according to section d) of the

Annex of the LSSI is the “natural or legal person who uses, whether or not for reasons
professionals, a service of the information society. That is, we are not
speaking of all kinds of users, but of recipients in the legal sense. For another
On the other hand, the Annex of the LSSI defines in its section c) the service provider as the
“Natural or legal person that provides a service of the company of the
information". And by service of the information society, section a) understands

"Any service normally provided for consideration, remotely, electronically and
at the individual request of the recipient. The concept of service of the society of the
information also includes unpaid services by their recipients,
insofar as they constitute an economic activity for the provider of
services".


And it is that art. 1 LSSI, when identifying the object of the standard, indicates that “it is the object of the
this Law regulating the legal regime of the services of the society of the
information and contracting by electronic means… ”. And that is why article 2
determines the scope of application of the LSSI, in terms of the services offered and
borrowed from those established in Spain or offered through an establishment

in Spain, but always talking about service providers. That is, the LSSI
is subjectively applied to service providers of the company of the
information, not to any other subject. The concepts used by art. 22.2 LSSI,
We reiterate, they are legal concepts, as they are “services of the society of the
information "," service provider "and" recipient ", which are defined in the

rule.

Therefore, the criteria to determine whether a service or website is included within
of the scope of application of the Law on Information Society Services is whether
whether or not it constitutes an economic activity for its provider. All services that are

offered in exchange for a price or consideration are, therefore, subject to the Law.

However, the free nature of a service does not determine by itself that it is not
is subject to the Law. There are many free services offered through
Internet that represent an economic activity for their provider (such as
sponsors' income) and, therefore, would be included within their scope of

app. On the other hand, the activities that are not incardinable in the
concept studied for not constituting an economic activity for the provider.

Thus, article 22.2 has been integrated into the LSSI using concepts of said
rule; and it is about legal concepts, not vulgar, that have a definition

established in the law itself, which delimits them. Furthermore, the Explanatory Memorandum itself
of the LSSI - already in its initial drafting, of course - it stated in section II that
welcomes in said law “a broad concept of services of the information society,
that includes, in addition to the contracting of goods and services electronically, the
provision of information through said medium (such as that made by newspapers or

magazines that can be found on the net), the intermediation activities related to
to the provision of access to the network, to the transmission of data over networks of
telecommunications, to the realization of temporary copy of the Internet pages
requested by users, to the accommodation on the information servers themselves,

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/6








services or applications provided by others or the provision of instruments of
search or links to other Internet sites, as well as any other service that
is provided at the individual request of users (downloading of video files or

audio ...), provided that it represents an economic activity for the provider. These
services are offered by telecommunications operators, providers of
access to the Internet, portals, search engines or any other subject that
have an Internet site through which you can carry out any of the activities
indicated, including electronic commerce ”.


As we can see, the LSSI does not apply to all types of electronic communications, but
only to the services of the information society; though your need arises from
the extraordinary expansion of the Internet, its purpose is not to regulate communications
but only the services of the information society (Titles II, III and
VI) and especially electronic contracting (Title IV), together with the actions of

cessation of protection of consumer interests (Title V).

And it is that the subjective and objective scope of law 34/2002 coincides with that of the
Directive that transposes: as stated in the Statement of Motives of the LSSI in its
section I, the purpose of the LSSI is none other than "incorporation into the legal system
Spanish law of Directive 2000/31 / EC ”(together with the partial incorporation of the

Directive 98/27 / CE which is alien to the problem at hand). "

The subjective scope of application of the LSSI has been delimited, it should be noted, regarding the
nature of political parties, which are configured as an instrument of
formation of the popular will, as established in article 6 of the Constitution

Española, which establishes the following:

“Political parties express political pluralism, attend the formation and
manifestation of the popular will and are a fundamental instrument for
political participation. Its creation and the exercise of its activity are free within the

respect for the Constitution and the law. Its internal structure and operation must be
democratic. "

To which must be added what the Constitutional Court has indicated, in the
Legal Basis of its Judgment 48/2003, which considers that the parties
politicians are empowered to exercise the right to freedom of information,

In order to configure said public opinion, said sentence being of the following tenor:

(On the political parties) “These are, therefore, associations qualified by the
constitutional relevance of its functions; functions that are summarized in his vocation
to integrate, mediate or immediately, the titular bodies of public power through

electoral processes. (…) The parties are thus legal institutions.
policies, an element of communication between the social and the legal that makes the
integration between rulers and ruled, ideal of the democratic system.
By shaping and expressing the popular will, the parties contribute to reality
of the political participation of citizens in public affairs (art. 23 CE) ... "


And he continues by saying: “Their functional qualification does not detract from the associative nature
which is at the base of the parties, but raises an institutional reality above it
diverse and autonomous that, as an instrument for political participation in

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/6








processes of shaping the will of the State, justifies the existence of a
normative regime that is also its own, taking into account the specificity of these
functions. The constitutional relevance of the parties is given by claiming a

qualified purpose of public interest and whose aspiration the State uses to provide
the integration of the procedures for the formation of the general will ... "

                                            III
Of the actions carried out by the inspection services of this Agency, it has been
verified that the claimed web page constitutes the institutional portal of a party

political and that its content is related to the exercise of the
functions that are its own and that have already been described in the previous paragraphs,
which can be concluded that the activity of the denounced portal does not qualify the political party
in question as an information society service provider.
Additionally, this criterion coincides with that established by the Secretary of State for

Telecommunications and for the Information Society as the competent body in
the application of the provisions of the LSSI, with the due exceptions, such as
establishes article 43 of the same law

From the foregoing, it is not possible to incardinate the political parties, with respect to the
activity developed through its institutional website, as Providers of

Information Society Services and, therefore, these organizations are not
They are under the scope of the aforementioned standard.

Therefore, in accordance with the foregoing, by the Director of the Spanish Agency
ñola of Data Protection.

                                     HE REMEMBERS:

FIRST: PROCEED WITH THE FILING of these actions.

SECOND: NOTIFY this resolution to PODEMOS, POLITICAL PARTY and

to D.A.A.A ..

In accordance with the provisions of article 50 of the LOPDGDD, this Re-
solution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by

the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, and in accordance with the provisions of the
arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may inter-
place, optionally, an appeal for reconsideration before the Director of the Spanish Agency
Data Protection Policy within a month from the day after the

notification of this resolution or directly administrative contentious appeal before
the Contentious-Administrative Chamber of the National Court, in accordance with
set out in article 25 and in section 5 of the fourth additional provision of the Law
29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, in the
period of two months from the day following notification of this act,

according to the provisions of article 46.1 of the aforementioned Law.

Mar Spain Martí
Director of the Spanish Agency for Data Protection.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/6


































































































C / Jorge Juan, 6 www.aepd.es

28001 - Madrid sedeagpd.gob.es