AEPD (Spain) - EXP202202954

AEPD - EXP202202954
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(c) GDPR Article 6(1)(c) GDPR Article 9(1) GDPR Articulo 20(a), Ley Orgánica 3/2007, de 22 de marzo, para la igualdad efectiva de mujeres y hombres Articulo 26, Ley 12/1989, de 9 de mayo, de la Función Estadística Pública Ley 2/2021, de 7 de junio, de igualdad social y no discriminación por razón de identidad de género, expresión de género y características sexuales
Type:	Complaint
Outcome:	Upheld
Started:	31.01.2022
Decided:	26.01.2024
Published:
Fine:	n/a
Parties:	Consejería de Economía, Conocimiento y Empleo
National Case Number/Name:	EXP202202954
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	Agencia Española de Protección de Datos (in ES)
Initial Contributor:	lm

The DPA imposed warning fines on a government agency that included ‘nonbinary’ as a response in a form question about sex, finding that the response constituted processing of a special category of data and violated the principle of data minimization.

English Summary

Facts

On 31 January 2022, a complaint was filed with the Spanish DPA concerning a government webpage that required certain personal data to submit a form for conciliation of labor disputes to the Canary Islands’ Department of Economy, Knowledge and Employment (controller). In particular, the form included a question concerning sex/gender that obliged a response of man, woman, or nonbinary. The complainant argued that the nonbinary response required disclosure of personal data related to sexual orientation and that such data is beyond the scope of the controller’s legal basis and the form’s purpose.

The controller argued that there was no violation of Article 5(1)(c) or 9(1) GDPR and that it was in fact required to collect such information under Spanish law. In particular, Article 26 of Law 12/89 and Article 20(a) of Law 3/2007 obliges public institutions to collect sex/gender information in all forms for statistical purposes.

Holding

The DPA found that the controller exceeded its legal basis for processing under Article 6(1)(c) GDPR, violated the data minimisation principle under Article 5(1)(c) GDPR, and improperly processed a special category of information under Article 9(1) GDPR.

First, in finding a violation of Article 6(1)(c) GDPR, the DPA determined that the controller exceeded their legal basis for processing under Spanish legal requirements. A number of Spanish laws including Article 20 of Law 3/2007 and Article 26 of Law 12/1989 require public institutions to collect data about the applicant’s sex for statistical purposes and monitoring of gender equality. Article 26 of Law 12/1989 specifies ‘woman’ and ‘man’ as the responses to inquiries about sex. On the other hand, the DPA noted that no Spanish laws obliging sex to be documented require the nonbinary response to be included. Including it as a response thus exceeded the scope of the legal requirements that formed the basis for processing under Article 6(1)(c) GDPR.

Second, the DPA held that the nonbinary response collected personal data that was not necessary for the purpose of processing in violation of Article 5(1)(c) GDPR. It considered that the nonbinary response was not related to the purpose for which data was being collected in the form, which related to labor disputes between employers and employees.

Finally, the DPA determined that the controller processed special categories of information prohibited under Article 9(1) GDPR. Though it noted that gender identity and sexual orientation are distinct, the DPA determined that a response other than man or woman (in this case, nonbinary) can still be considered to relate to sexual life, even if the form does not explicitly refer to sexual orientation or sex life. There was no applicable exception to the prohibition on processing of special categories in this case under Article 9(2) GPDR. As a result, the DPA concluded that the nonbinary response violated Article 9(1) GDPR.

The DPA imposed undisclosed warning sanctions for the controller’s violations of Article 5(1)(c) and 9(1) GDPR pursuant to Article 83(5)(a) GDPR. It also ordered the controller to bring processing operations into compliance by removing the nonbinary response in form inquiries of sex/gender from not only in the form arising in the case but also more broadly in the processing of forms and documents before its public institutions altogether.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

17/26
And in its article 72, it considers for the purposes of prescription, which are: “Infringements
considered very serious:
1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that involve
a substantial violation of the articles mentioned therein and, in particular, the
following:
a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679.
(…)”.
VII
Second unfulfilled obligation: violation of article 9.1 of the GDPR
Article 9 of the GDPR states:
"1. The processing of personal data that reveals ethnic origin is prohibited
or racial, political opinions, religious or philosophical convictions, or affiliation
union, and the processing of genetic data, biometric data aimed at identifying
univocally to a natural person, data relating to health or data relating to
“the sexual life or sexual orientation of a natural person.”
And in section 2:
"2. Section 1 will not apply when one of the circumstances occurs
following:
a) the interested party gave explicit consent for the processing of said data
personal data for one or more of the specified purposes, except when the Right to
the Union or the Member States establishes that the prohibition referred to in
section 1 cannot be lifted by the interested party;”
Also article 9.1 of the LOPDGDD that:
"1. For the purposes of article 9.2.a) of Regulation (EU) 2016/679, in order to avoid
discriminatory situations, the mere consent of the affected person will not be enough to
lift the prohibition on the processing of data whose main purpose is to identify
your ideology, union membership, religion, sexual orientation, beliefs or racial origin or
ethnic."
There is a special category of personal data, collected in the article
9.1 RGPD, which differs from the rest of personal data in that its processing is
is prohibited. However, this prohibition is not applicable in certain cases
when any of the exceptions contemplated in article 9.2 do not apply
of the GDPR.
The Sentence handed down by the T.C. 67/2022, of 06/02/022, appeal for protection 6375-
2019, considers the question raised to be of special constitutional importance because
allows him to establish doctrine on a problem related to a fundamental right that does not
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
18/26
had been sufficiently treated, defining in the presence of what cause of
discrimination we find when analyzing the assumption that is presented for its
analysis, starting from the distinction between the notions of sex and gender, without forgetting
personal conditions such as sexual orientation and identity
gender.
“Sex, which allows people to be identified as female living beings,
masculine or intersex, is given by a complex series of characteristics
morphological, hormonal and genetic, to which certain
physical characteristics and potentialities that define us. Features such as
example and without intending to formulate an exhaustive description, the internal genitalia and
external factors, hormonal structure and chromosome structure (characteristics
primary) or muscle mass, hair distribution and height (characteristics
high schools).
These biological characters, which may not be mutually exclusive in
statistically exceptional situations, such as those that occur in people
intersex, tend to formulate a binary classification, and only exceptionally
tertiary, of the living beings of the human species.”
For its part, although gender is connected to the realities or characteristics
biological, does not fully identify with them, but rather defines the social identity
of a person based on the social, educational and cultural constructions of the
roles, personality traits, attitudes, behaviors and values
that are associated or attributed, differentially, to men and women, and that include
norms, behaviors, roles, external appearance, image and social expectations
associated with one or another gender. While sex is linked to the concurrence of
a series of objectively identifiable or measurable physical characters, the characters
associated with gender are relative and circumstantial and can vary from one society to
another and from one historical time to another.”
And he continues “Sex and gender are not mutually exclusive, but neither are they
synonyms, in such a way that their translation to the legal field requires assuming the difference
existing between the two to evaluate the normative consequences of such a distinction and
ensure adequate respect for legal certainty (art. 9.3 CE). He comes to verify the
distinction between both notions, from the legal point of view, the mention
differentiated to sex and gender, as diverse characteristics of the human being,
contained in art. 4.3 of the Council of Europe Convention on prevention and control
against violence against women and domestic violence (Istanbul Convention,
of 2011), when it establishes that the "application by the parties of the provisions of the
this Convention, in particular measures to protect the rights of
victims, must be ensured without any discrimination, based in particular on the
sex, gender […] sexual orientation, gender identity, […] or any other
situation". Regardless of the normative scope given to the notions of
sex and gender, neither one nor the other can be defined in a strict sense as rights,
but as conditions or states that have an impact on the exercise of rights
fundamental and that make up one of the many identity elements that can
come to define the right to personal self-determination or to develop, with full
respect for human dignity (art. 10 CE), one's own personal identity.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
19/26
Also the T.C. in his sentence he refers to the sexual orientation and identity of
gender, pointing out that “Sexual orientation and gender are also personal conditions.”
gender identity, the first referring to the preference for establishing relationships
affective relationships with people of either sex, and the second to the identification of a
person with gender-defining characteristics that may or may not coincide with
the sex attributed to it, by virtue of the predominant biological characteristics that
presented since birth. But in addition to being personal conditions, they are
elements fundamentally linked to the right to develop a
certain private and family life (art. 8 ECHR), as derived from a
consolidated jurisprudence of the European Court of Human Rights that attributes
to the concept of "private life" a broad definition, which encompasses the right to
physical and psychological integrity of a person, including in that notion of integrity
your sexual life and sexual orientation…; some aspects of physical identity and
social of the person…; or the gender identity of trans people… Furthermore, the
art. 8 ECHR protects the right of transgender people to personal development and
physical and moral security.”
It must be remembered that the variable present in the form was “sex/gender”, and
the possible answers or options “man/woman/non-binary”.
The model form with the question raised by the respondent does not comply with the
purpose pursued, supposedly to obtain data for statistical purposes,
issue that has already been explained in the previous foundations and that violates the
principle of minimization because it is considered that the data collected in this way does not
They are necessary and excessive.
On the other hand, the inclusion of the non-binary response/option within the variable
sex/gender is also not related strictlyu sensu to the sex option, which would be the
included in the standard for statistical purposes in order to effectively guarantee the
integration of the gender perspective in its scope of action in accordance with
Article 20.a) of Organic Law 3/2007, for the effective equality of women and
men and article 11 of law 1/2020, Canary Islands on Equality between Women and
Men, who similarly establish: a) Systematically include the variable
sex in the statistics, surveys and data collection that they carry out”, but rather
would link with a question of gender identity and that is introduced in the
form without any justification.
The inclusion of said response in the “sex” variable alters the meaning of the norms
since in the planned data collection the concept would normally be modified
accepted when moving to the concept of “felt sex”, embedded in the identity of
gender.
The completion of said variable is based on the standards defined by the INE,
which in relation to the statistical variable "sex" indicates the following: "Sex is
refers to the biological sex of the person. According to the WHO, “sex” refers to the
biological and physiological characteristics that define men and women”, while
What “gender” refers to refers to the social and cultural construction that defines
different emotional, affective, intellectual characteristics, as well as the
behaviors that each society assigns as typical and natural of men or
of women, but there may be people who do not identify with these characteristics
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
20/26
of men and women and thus, apart from the masculine and feminine there would be other genders. Of
In this way, there are as many genders as there are identities, and therefore as many identity identities.
gender as people.
While “sexual orientation” is the emotional, romantic, sexual and
psychological that the person feels in a sustained way over time and is described
different from gender identity.
The Universal Declaration of Human Rights, the International Covenant on Rights
Civil and Political Rights and the International Covenant on Economic, Social and
Cultural rights include in their guarantees on non-discrimination, lists of fundamentals
prohibited from discrimination. These lists do not explicitly mention the orientation
sexual or gender identity, but conclude with the expressions “any other
condition” or “any other social condition.” The use of these expressions shows
that the intention was for these lists to be open and illustrative; In other words, the
foundations of discrimination are not closed.
It is clear that sexual orientation and gender identity are different aspects. In
its jurisprudence, general observations and concluding observations, the organs of the
United Nations treaties have uniformly held that
sexual orientation and gender identity are prohibited grounds of
discrimination under international law. Furthermore, it has been a long time since
special procedures of the Human Rights Council have recognized the
discrimination that exists due to sexual orientation and gender identity.
In the same sense, various mechanisms for the protection of Human Rights
international level, such as the Committees, have affirmed that States have the
obligation to protect people from discrimination due to their orientation
sexual. This position is reflected in decisions of the Human Rights Committee
Humans – (Toonen v. Australia case 1994) and in general observations of the
Committee on Economic, Social and Cultural Rights, of the Committee on Human Rights
of the child of the committee against torture, of the committee for the elimination of discrimination
against women. For example, in its general comment, the human rights committee
economic, social and cultural aspects points out that the States parties must ensure
that a person's sexual preferences do not constitute an obstacle to doing
reality the rights recognized by the pact. Gender identity is also
recognized as a prohibited ground of discrimination. The Committee on the Rights of
Niño has interpreted that the right to non-discrimination in article 2 of the
Convention on the Rights of the Child includes sexual orientation and identity of
gender.
Now, the introduction of gender identity, identifying its holder, would have
must be carried out in any case, as long as there is a relationship between what is being asked, with
the purpose for which you want to obtain it so that the data must be processed, without
try to obtain the data for the sake of having it, without any specific purpose and, in this case,
the form “Prior conciliation in labor disputes” and whose purpose is for the
employers and workers involved in labor-related claims achieve
compromise and agreement avoiding judicial proceedings, the inclusion of the
gender issue, nor is this aspect examined or considered, so it lacks
It makes no sense to introduce a response with that scope, without any connection to the object
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
21/26
of the same. In that sense, no need is seen in the treatment of said
response when filling out the form.
In any case, a form is presented in which, although it does not explicitly refer to
sexual orientation or sexual life, it can be deduced that if the
male/female response and the non-binary option is noted, it can be considered
related to sexual life, since basically what is being discussed
Manifesto is a question that could be related to expressing your beliefs
since gender identity is an internal issue for each person, as derived from the
definition made by the Inter-American Committee on Human Rights in
compliance with resolution AG/RES. 2653 (XLI-O/11): Human Rights,
Sexual Orientation and Gender Identity, 04/23/2012 which defines it as: “The
Gender identity is the internal and individual experience of gender as each
person experiences it deeply, which may or may not correspond to sex
signed at the moment of birth, including the personal experience of the body (which
could involve modifying bodily appearance or function through
medical, surgical or other techniques, provided that it is freely
chosen) and other expressions of gender, including clothing, speech
and manners.”
That is, he is questioning his perceived sex, with which he identifies, if
coincides with that assigned at birth: female/male, or non-binary, when their sex is felt,
with which he identifies, does not coincide with the one assigned at birth, which goes beyond the objective and
the purpose of the form within the context of Prior Conciliation, which is not
oriented or established in that sense and people should not be forced to
express or declare about your personal and intimate beliefs. This prohibition,
finds its foundation, as indicated in the transcribed precept, in avoiding
discriminatory situations, such as those that could occur when there is an inventory or
record in which the sexual orientation of the people is recorded or collection of the
gender identity without a specific purpose or legitimate basis or belief.
The same ruling of the TC referred to in section 2, of this same
foundation points out in reference to gender identity that: “As it has been
recognized, as an argumentative presupposition in the previous legal basis, the
Gender identity is a circumstance that has to do with the free development of
personality, closely linked to respect for human dignity (art. 10.1 CE),
and this trait of identity, when it does not fit hetero-normative parameters
classics, that is, where gender identity and sex of the person are not
absolutely coincident, can make the individual a creditor of a position of
historically rooted social disadvantage of those prohibited by art. 14 CE.”
However, the prohibition of article 9.1 is not applicable in certain cases when
any of the exceptions contemplated in article 9.2 of the RGPD apply and,
In that sense, in accordance with the aforementioned, in the present case there is no
exception to article 9.2 of the RGPD that lifts the prohibition contained therein.
Therefore, it is concluded that the defendant has violated article 9.1 of the RGPD which
It is classified in article 83.5.e) of the aforementioned Regulation.
VII
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
22/26
Classification of the violation of article 9.1 RGPD
The infraction attributed to the defendant is classified in article 83.5
a) of the RGPD, which considers that the violation of “the basic principles for the
processing, including the conditions for consent pursuant to articles 5,
6, 7 and 9” is punishable, in accordance with section 5 of the aforementioned article 83 of the
cited Regulation.
The LOPDGDD in its article 71, Infractions, states that: “They constitute infractions
the acts and conduct referred to in sections 4, 5 and 6 of article 83 of the
Regulation (EU) 2016/679, as well as those that are contrary to this law
organic”.
And in its article 72, it considers for the purposes of prescription, which are: “Infringements
considered very serious:
1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe after three years the infractions that involve
a substantial violation of the articles mentioned therein and, in particular, the
following:
(…)
e) The processing of personal data of the categories referred to in the article
9 of Regulation (EU) 2016/679, without any of the circumstances occurring
provided for in said precept and in article 9 of this organic law.
(…)”.
VIII
Regime applicable to Public Administrations
Article 83 “General conditions for the imposition of administrative fines” of the
GDPR in section 7 establishes: “Without prejudice to the corrective powers of the
supervisory authorities under Article 58(2), each Member State
may establish rules on whether, and to what extent, fines may be imposed
administrative to authorities and public organizations established in said State
member."
The LOPDGDD in its article 77, Regime applicable to certain categories of
responsible or in charge of the treatment, establishes the following:
"1. The regime established in this article will apply to the treatments of
who are responsible or in charge:
(…)
c) The General Administration of the State, the Administrations of the communities
autonomous and the entities that make up the Local Administration.
(…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
23/26
2. When the persons responsible or in charge listed in section 1 commit
any of the infractions referred to in articles 72 to 74 of this law
organic, the competent data protection authority will dictate
resolution declaring the violation and establishing, where appropriate, the measures that
appropriate to adopt to cease the conduct or correct the effects of the infraction
that had been committed, with the exception of that provided for in article 58.2.i of the
Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27,
2016.
The resolution will be notified to the person responsible or in charge of the treatment, to the body of the
that depends hierarchically, if applicable, and to those affected who have the condition
of interested party, if applicable.
3. Without prejudice to what is established in the previous section, the authority for the protection of
data will also propose the initiation of disciplinary actions when there are
sufficient evidence for this. In this case, the procedure and sanctions to apply
will be those established in the legislation on disciplinary or sanctioning regime that
results of application.
Likewise, when the infractions are attributable to authorities and managers, and are
prove the existence of technical reports or recommendations for the treatment that
had not been duly attended to, in the resolution in which the
sanction will include a reprimand with the name of the responsible position and
will order the publication in the Official State or autonomous Gazette that
correspond.
4. The resolutions that
fall in relation to the measures and actions referred to in the sections
previous.
5. They will be communicated to the Ombudsman or, where appropriate, to similar institutions
of the autonomous communities the actions carried out and the resolutions issued
under this article.
6. When the competent authority is the Spanish Data Protection Agency,
This will publish on its website with due separation the resolutions referring to
the entities of section 1 of this article, with express indication of the identity
of the person responsible or in charge of the treatment who had committed the infraction.
When the jurisdiction corresponds to an autonomous authority for the protection of
data will be, regarding the publicity of these resolutions, to what is provided by its
specific regulations.”
In the case examined, the present sanctioning procedure has its cause in the
presumption that the defendant, as stated in the facts, has violated the
regulations on the protection of personal data in relation to the
principle of minimization and the prohibition of data processing especially
protected or sensitive.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
24/26
In accordance with the evidence available, said conduct constitutes,
by the person complained of the violation of the provisions of articles 5.1.c) and 9.1 of the
GDPR.
It should be noted that the RGPD, without prejudice to the provisions of its article 83,
Article 77 contemplates the possibility of declaring the infringement and establishing the
appropriate measures to correct the processing of personal data that is not
adapt to its forecasts, when the persons responsible or in charge listed in the
section 1 commit any of the infractions referred to in articles 72
to 74 of this organic law.
Additionally, article 58 of the RGPD contemplates in section 2 d) that each
control authority may “order the person responsible or in charge of the treatment to
processing operations comply with the provisions of this
Regulation, where appropriate, in a certain manner and within a period
specified…".
IX
Corrective measures
Once the violations have been confirmed, it is appropriate to impose on the person responsible the adoption of
appropriate measures to adjust its actions to the regulations mentioned in this
act, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD, according to the
which each control authority may “d) order the person responsible or in charge of the
treatment that the processing operations comply with the provisions of the
this Regulation, where appropriate, in a certain manner and within a
specified period.” The imposition of this measure is compatible with the sanction
consisting of a warning, as provided in art. 83.2 of the GDPR.
Therefore, it would be considered appropriate to order the defendant so that within the period of
six months from the finality of this resolution to adapt the
treatments that are the subject of this procedure to the applicable regulations and
communicate to this organization. The text of this agreement establishes which
were the events that gave rise to the violation of the regulations for the protection of
data, from which it is clearly inferred what measures to adopt, without prejudice
that the type of procedures, mechanisms or specific instruments to
implementing them corresponds to the sanctioned party, since it is the one who fully knows
your organization and must decide, based on proactive responsibility and focus
of risks, how to comply with the RGPD and the LOPDGDD.
These measures could be specified, in which the requirements of the
regulations on data protection regarding the processing carried out
evading the processing of the forms related to “Prior conciliation in
labor conflicts” of claims and legal demands of a labor nature.
non-binary response/option within the sex/gender variable included in the standard a
statistical effects, as well as in all those procedures, forms,
applications and documents processed before their public bodies, implementing the
relevant measures.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
25/26
Please note that failure to comply with the order imposed by this body may be
considered as an administrative offense in accordance with the provisions of the RGPD,
classified as an infraction in its articles 83.5 and 83.6, and such conduct may be motivated by
opening of a subsequent administrative sanctioning procedure.
Therefore, in accordance with the applicable legislation and evaluated the criteria of
graduation of sanctions whose existence has been proven,
The Director of the Spanish Data Protection Agency,
RESOLVES:
FIRST: Impose on the DEPARTMENT OF ECONOMY, KNOWLEDGE AND
EMPLOYMENT, with NIF S3511001D,
- For violation of article 5.1.c) of the RGPD, typified in article 85.3.a) of the RGPD,
a warning sanction and.
- For a violation of article 9.1 of the RGPD, typified in article 83.5.e) of the
RGPD, a warning sanction.
SECOND: File the DEPARTMENT OF ECONOMY, KNOWLEDGE AND
EMPLOYMENT, with NIF S3511001D, for the violation of article 6.1 of the RGPD, classified
in article 83.5.a) of the RGPD.
THIRD: ORDER the DEPARTMENT OF ECONOMY, KNOWLEDGE AND
EMPLOYMENT, with NIF S3511001D, which by virtue of article 58.2.d) of the RGPD, in the
within six months from when this resolution is final and enforceable, accredit
having proceeded to comply with what is stated therein, adjusting its actions to
the data protection regulations, in the terms established in the Fundamentals
of Law IX, especially regarding the treatments it carries out, avoiding in the
processing of forms and documents before their public bodies, not
only, as in the case analyzed, those related to “Prior conciliation in conflicts
“borales” of claims and legal demands of a labor nature, the
non-binary response/option within the sex/gender variable, implemented and
collected for statistical purposes, implementing and establishing the relevant measures.
FOURTH: NOTIFY this resolution to the DEPARTMENT OF ECONOMY,
KNOWLEDGE AND EMPLOYMENT.
FIFTH: COMMUNICATE this resolution to the Ombudsman, in accordance
with the provisions of article 77.5 of the LOPDGDD.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
26/26
Director of the Spanish Data Protection Agency within a period of one month to
count from the day following the notification of this resolution or directly
contentious-administrative appeal before the Contentious-administrative Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.
Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP,
may provisionally suspend the final resolution through administrative channels if the
interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Data Protection Agency, presenting it through
of the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal
administrative. If the Agency was not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.
Sea Spain Martí
Director of the Spanish Data Protection Agency