AEPD (Spain) - PS/00173/2020
| AEPD - PS/00173/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(d) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 09.10.2020 |
| Fine: | 3000 EUR |
| Parties: | Spanish citizen |
| National Case Number/Name: | PS/00173/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | Miguel Garrido de Vega |
9 October 2020 - The Spanish Data Protection Agency (AEPD) decided to impose a fine up to 3,000 € on a Spanish citizen (the defendant) for the infringement of the accuracy principle, as per Article 5(1)(d) of the GDPR.
English Summary
Facts
The decision is the consequence of a complaint submitted by another Spanish citizen (the claimant) stating that its former company and the agency advising such had infringed the data protection legislation, as they improperly identified him as the author of a traffic offense; the claimant attached several evidences that his/her labour relationship ended nine days before the traffic offense took place (working life report, letter of dismissal and penalty).
Dispute
The Spanish company Estevez y Maeso (the advising agency) answered to the first AEPD investigation requests stating that: (i) it maintained a contract relationship with the defendant, who required to process personal data, (ii) the defendant came to the agency with the notice of a traffic offense due to an improper parking of a professional car that, in that moment, was being driven by an employee of him (the claimant), and required the agency to issue the documentation identifying the claimant as driver before the public administration. The AEPD started the corresponding sanction procedure.
Holding
Thus, the AEPD understood that the defendant has infringed the accuracy principle included at Article 5(1)(d) GDPR. Consequently, after considering some circumstances [(i) the local scope of the processing activity made by the defendant, (ii) the number of persons affected by the processing activity, (iii) the damage to the claimant, who, not being an employee of the agency anymore, has needed to issue this claim, (iv) there is no evidence that the defendant has adopted any measures in order to prevent such issues to happen again in the future, (v) there has been no collaboration of the defendant with the AEPD, (vi) there is no evidence of wilful misconduct by the defendant, even being this issue a very serious breach of the law, (vii) the link between the activity of the defendant and the processing of personal data, and (viii) the defendant is a physical person], the AEPD decided to impose a fine of 3,000 € to the defendant.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
