AEPD (Spain) - PS/00227/2020
From GDPRhub
| AEPD - PS/00227/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR Article 13 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 10.11.2020 |
| Published: | |
| Fine: | 12000 EUR |
| Parties: | RECAMBIOS VILLALEGRE S.L. |
| National Case Number/Name: | PS/00227/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Francesc Julve Falcó |
The Spanish DPA (AEPD) sanctioned the company RECAMBIOS VILLALEGRE S.L. with a fine of €12000 for publishing images of a person on social networks without a legal basis and for the lack of informative posters on the installed video surveillance system.
English Summary
Facts
On 23 July 2020, a citizen reported to the AEPD a harassment campaign that the company RECAMBIOS VILLALEGRE S.L. carried out through Facebook and WhatsApp against a homeless person who, according to the company, had stolen money from the office cash register.
The aforementioned company used images collected with security cameras that recorded the street pavement, without having an informative poster on the premises that mentioned the use of these cameras.
The same complainant presented another letter on July 25, 2020 to the AEPD informing that several newspapers had reported the alleged theft, that a quick trial had been held and that the indigent person had been acquitted for lack of evidence, since none of the published images could prove that the person had taken money from the offices.
Once again, the company published images of the person on Facebook with the aim of negatively affecting their reputation.
Dispute
Is the recording of personal images (without a notice board) and their subsequent publication on social networks (Facebook and WhatsApp) an infringement of Articles 6 and 13 GDPR?
Holding
The AEPD decided to impose, for infringement of Article 6 GDPR, a fine of € 10000 and, for infringement of Article 13 GDPR, a fine of € 2000.
In addition, the company was required, within one month, to remove the Facebook posting and the comments affecting the homeless person who was harassed, to put up an information poster of the recording of images with video surveillance cameras, and to have the information for those affected required by the GDPR.
Comment
As factors to be taken into account, in this case, were assessed:
The nature and seriousness of the infringement, taking into account the purpose of the processing operation in question as well as the level of the damage suffered; the intentionality or negligence of the infringement; that it concerns a small enterprise whose main activity is not linked to the processing of personal data That no recurrence is appreciated, since the commission of the infringement is not established, within the period of one year, of more than one infringement of the same nature.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/15
Procedure Nº: PS / 00227/2020
RESOLUTION OF SANCTIONING PROCEDURE
Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following
BACKGROUND
FIRST: Mr. A.A.A. (hereinafter, the claimant), dated July 23, 2020,
filed a claim with the Spanish Agency for Data Protection. The
The claim is directed against RECAMBIOS VILLALEGRE, S.L., with NIF B74393992
(hereinafter, the defendant) for facts that could be violating the
legislation on protection of personal data. The main reasons on which it bases
the claim are as follows:
«I am contacting you due to the harassment and threats that are
frying a poor indigent from the city of *** LOCALIDAD.1 (*** PROVINCIA.1)
because of a publication that the company Recambios Villalegre put in its
Facebook page at night of the day *** DATE.1. In said publication,
accuse this pauper (who makes his living begging) of having robbed them of
all the cash out of the register, and last but not least so
sees accusation, they attach a photograph taken of the aforementioned person from the cameras
surveillance gangs, something totally illegal, even more so when the aforementioned em-
The dam does not have an informative poster of the video-monitored area in its facilities.
As you can see in the screenshots attached to this claim, imagine-
They will see the great repercussion that this has had in the city since, at the
As of writing this text, the publication has been shared by XXXX people and
with hundreds of vexatious, insulting and even threatening comments.
It is worth mentioning that, although in the controversial publication they claim to have everything
perfectly engraved, it is striking that in the photograph provided it is not visible
the cash register nowhere, which is why it is sobering whether
mind has been a robbery or on the contrary some kind of revenge or enmity
of the company with the injured party.
As if that were not enough, all of the above, the aforementioned company has
also circulated by WhatsApp groups another photograph (which is attached
together with this claim) of this person taken in this case head-on, after
of what appears to be a vehicle and in which his face is perfectly recognizable
possible, multiplying even more if possible all the harassment and threats that
A man is suffering all over the city.
Since this person has no recourse to try to solve
address the problem that they have intentionally caused, and after communicating
carme her decision to leave town (at best) for everything
what he is suffering, I feel obliged to communicate it to the AEPD with the
intention that they take the appropriate measures with the aforementioned company that has
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/15
abused excessively against this person.
It should be remembered that the Spanish Constitution of 1978 in its article 18,
protects and preaches the right to honor, personal and family privacy, as well
as well as its own image, a right that this company has flagrantly violated.
grante against this person.
For all the above, please take the necessary measures
arias to end this situation as soon as possible, as well as
proceed to impose the corresponding sanction on the aforementioned company in the case
that is coming.
P.S.: Three screenshots are attached that demonstrate all the ex-
affixed, as well as the link of the publication that the company made.
*** URL.1
One of the images sent is a photograph of a person dragging
A car.
The other image is the one included in the Facebook profile of the claimed entity,
that was published last *** DATE. 1 a post in which a photograph was included
corresponding with a frame of the images captured by the video surveillance camera.
lancia of the store, in which one can see on the other side of the threshold of the door of the store (the
mara captures an important part of the sidewalk without observing an information sign), for
outside, the silhouette of a man with a shopping cart. The publication is accompanied
ña of the following comment:
"This man who spends his days asking for help very politely for him
center of *** LOCALIDAD.1 and especially, by the terraces of the bars, today
In the afternoon we have entered our business and at one point we have
had to be in the back of the store, has entered inside the
counter and took all the money we had in cash.
The cameras have recorded it perfectly.
I beg for maximum dissemination for everyone's help.
The publication has been verified to remain available.
SECOND: The claim was admitted for processing by resolution of July 24
2020.
THIRD: The claimant submitted a new brief, dated July 25, 2020, in the
which states the following:
“Apologizing in advance for writing to you on the same subject with a
time interval of little more than 24 hours, I see myself in doing it due to changes
bios recently emerged with this issue. To put us in background, it is
of the case of the company *** LOCALIDAD.1 that published in its social networks the photo-
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/15
graph, taken completely illegally from a homeless person who had entered the premises at
beg. In said complaint before you yesterday, the citation was accused-
gives person to have committed a rather dubious robbery from our point of view,
but due to the implausible version argued by the company, it would have been
There has been a violation of the Data Protection Law for having published the photograph
of the alleged offender. Well, as you can see in the links below,
added, the impact of this incident has increased considerably
derable since it has been published in the most widely read newspapers in this area (*** DIARIO.1
and *** DAILY. 2) As both published, the arrest of said person by the
announces that the company had attended and had to attend the holding of a
fast, since the alleged theft exceeded XXX, today and for which
he was totally acquitted for lack of evidence. Proof of their immediate release can
Please confirm by reading the new publication that the complainant company has
post on their social networks in which they affirm what I expose here. Person accused of
a criminal offense has been released on the same day as the trial,
We believe that it is more than enough proof and there is no reason to submit
the accused to such a social exposure. And once again, that you settle for this
harassment, republish the images of this person to facilitate recognition
to other people. As I did yesterday, by capturing pan-
size of the social network of the aforementioned company, as well as in the different links in which
It has been published by the media.
I request your immediate withdrawal of these publications:
*** URL.2
*** URL.3
*** URL.4
FOURTH: On August 11, 2020, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure to the claimed, by the
alleged violation of article 6 of the RGPD, and article 13 of the RGPD, typified in
Article 83.5 of the RGPD.
FIFTH: The initiation agreement was electronically notified to the claimed. So required
ge Article 14.2 of Law 39/2015 of Common Administrative Procedure of the
Public Administrations (LPACAP) according to which “In any case they will be obliged
two to interact through electronic means with Public Administrations
to carry out any administrative procedure, at least,
the following subjects: a) Legal persons ”.
Work in the file the Certificate issued by the Notification Service
Electronic and Authorized Electronic Address of the FNMT-RCM, which records-
cia of the sending of the initiation agreement, notification of the AEPD addressed to the claimed, through
through that means being the date of making available in the electronic headquarters of the
agency on 08/13/2020 and the automatic rejection date on 08/24/2020.
Article 43.2. of the LPACAP establishes that when the notification by means
electronic data is mandatory - as is the case in the present case - “it is
will be rejected when ten calendar days have elapsed from the commissioning
disposition of the notification without accessing its content. " (The underlining is from
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/15
AEPD)
Add that articles 41.5 and 41.1, third paragraph, of the LPACAP say, res-
pectively:
“When the interested party or his representative rejects the notification of an act
administrative action, will be recorded in the file specifying the circumstances
of the attempted notification and the means, considering the process completed and continuing-
I know the procedure. " (The underlining is from the AEPD)
"Regardless of the medium used, notifications will always be valid
that allow to have proof of their sending or making available, of the reception or
access by the interested party or their representative, of their dates and times, of the content
integrity, and the trustworthy identity of the sender and the recipient of the same. The accre-
The notification of the notification made will be added to the file ”.
Thus, considering that the notification of the initiation agreement to the claimed party is
carried out electronically by legal imperative (article 14 LPACAP) and that
the rejection of the notification after ten days, as provided in article 43.2
of the aforementioned law, the procedure was considered completed and the procedure continued its course.
so (ex article 41.5 LPACAP)
SIXTH: On September 26, 2020, the testing phase began, agreeing
practice the following:
1. For evidentiary purposes, the claim filed by the
claimant and the documentation provided.
2. RECAMBIOS VILLALEGRE S.L. is requested to inform us of the
following questions:
a) If you have filed a complaint for theft of XXX euros against the indigent who
points to the facebook of the entity.
b) If a judgment has been passed on that complaint and its result,
Accompanying a copy of it, if any.
c) If you have removed from your Facebook the images of the homeless person to whom you attributed the
theft of XXX euros from the cash register of your establishment and the recording of
those facts.
d) Provide documentary evidence of the informative poster of the video-monitored area with
the information required by data protection regulations.
The Notification of the test practice has been returned with the legend of
"Unknown".
SEVENTH: In accordance with article 73.1 of the LPACAP, the term to formulate
allegations to the Initiation Agreement is ten days computed from the following
of the notification.
Article 64.2. LPACAP, indicates that the accused will be informed of the right to
formulate allegations, the “right to a hearing in the procedure and the deadlines
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/15
for its exercise, as well as the indication that in case of not making allegations in
The term provided for the content of the initiation agreement may be considered
proposed resolution when it contains a precise pronouncement on the
the imputed responsibility ”. (The underlining is from the AEPD)
The agreement to initiate the disciplinary proceedings at hand contained a
Precise statement on the responsibility of the claimed entity: in the aforementioned
agreement was specified what was the offending conduct, the type of sanction in which it was
subsumable, the modifying circumstances of the described responsibility and the sanction
which in the opinion of the AEPD should be imposed.
In consideration of the foregoing and in accordance with the provisions of article
64.2.f) of the LPACAP, the agreement to initiate PS / 00227/2020 is considered Pro-
Resolution setting.
In view of all the actions, by the Spanish Protection Agency
of Data in this procedure the following are considered proven facts,
ACTS
FIRST: On July 23, 2020, it was received at the Spanish Agency for Pro-
Data protection a claim in which it was indicated that the company Recambios
Villalegre had published on his Facebook page, on *** DATE.1, that an individual
people had stolen all the cash they had in the register.
Accompanying the publication was an image of the accused person taken from his
video surveillance camera. They include the following information:
"This man who spends his days asking for help very politely for him
center of *** LOCALIDAD.1 and especially, by the terraces of the bars, today in the afternoon
we have entered our business and at a time when we have had to be
in the back of the store, he went inside the counter and took all the
money we had in cash. The cameras have recorded it perfectly. I beg
maximum diffusion for the help of all.
SECOND: The publication has been shared by XXXX people and a number of
mere vexatious, insulting and even threatening comments.
Likewise, the claimed company has also circulated by groups of
WhatsApp another photograph (which is attached to this claim) of this person all-
in this case from the front, from what appears to be a vehicle and in which her face
is perfectly recognizable, multiplying even more if possible all the harassment and threats
You know that this poor man is suffering all over the city.
THIRD: The claimed company does not have posters informing that it is a
video surveillance area.
FOUNDATIONS OF LAW
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/15
I
By virtue of the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), recognizes each
Control Authority, and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, Protection of Personal Data and guarantees
aunt of digital rights (hereinafter, LOPDGDD), the Director of the Es-
The Data Protection Office is competent to initiate and resolve this procedure.
to.
Article 63.2 of the LOPDGDD determines that: «The procedures
processed by the Spanish Agency for Data Protection will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in their development and, as long as they do not contradict them, in a
subsidiary, by the general rules on administrative procedures. "
II
The physical image of a person, in accordance with article 4.1 of the RGPD, is data
personal protection and their protection, therefore, is the object of said Regulation. In article 4.2
of the RGPD defines the concept of "processing" of personal data.
It is, therefore, pertinent to analyze whether the processing of personal data (image
of natural persons) carried out through the capture of photography and video
reported is in accordance with the provisions of the RGPD.
III
In the first place and referring to the publication of the images indicated in the
the claims made, article 6.1 of the RGPD, establishes the assumptions
coughs that allow the processing of personal data to be considered lawful:
"1. The treatment will only be lawful if it meets at least one of the following
terms:
a) the interested party gave their consent for the processing of their data
personal for one or more specific purposes;
b) the treatment is necessary for the performance of a contract in which the
interested is part or for the application at the request of this of measures
pre-contractual;
c) the treatment is necessary for the fulfillment of a legal obligation
applicable to the person responsible for the treatment;
d) the treatment is necessary to protect vital interests of the interested party or of
another natural person.
e) the treatment is necessary for the fulfillment of a mission carried out in
public interest or in the exercise of public powers conferred on the person responsible
of the treatment;
f) the treatment is necessary for the satisfaction of legitimate interests
pursued by the controller or by a third party, provided that
the interests or the rights and freedoms do not prevail over said interests
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/15
fundamental data of the interested party that require the protection of personal data,
in particular when the interested party is a child.
The provisions of letter f) of the first paragraph shall not apply to the
treatment carried out by public authorities in the exercise of their functions. "
On this question of the legality of the treatment, the
Recital 40 of the aforementioned RGPD, when it states that “For the
treatment is lawful, personal data must be processed with consent
of the interested party or on any other legitimate basis established in accordance with Law, and
either in this Regulation or by virtue of other Union law or the
Member States to which this Regulation refers, including the need to
comply with the legal obligation applicable to the person responsible for the treatment or the need to
execute a contract with which the interested party is a party or in order to take measures
at the request of the interested party prior to the conclusion of a contract. "
In relation to the above, it is considered that there is evidence that the
treatment of data of the person who appears in the images object of this
claim has been made without justifying cause of those included in article 6
of the RGPD.
The RGPD applies to personal data, which is defined as' data
personal information ": any information about an identified or identifiable natural person (" the
interested"); an identifiable natural person shall be any person whose identity
can be determined, directly or indirectly, in particular by means of an identifier,
such as a name, an identification number, location data, a
online identifier or one or more elements of physical identity,
physiological, genetic, psychic, economic, cultural or social of said person.
The person whose data the complainant has processed is perfectly identifiable
since their identity can be determined, directly or indirectly, in particular
through the images and comments that the company has included on Facebook
claimed.
IV
Second, the photograph that is extracted from the video surveillance system
installed by the claimed invades the sidewalk of the street from which you enter the premises.
It is, therefore, pertinent to analyze whether the processing of personal data (image
of natural persons) carried out through the video surveillance system of the
claimed is in accordance with the provisions of the RGPD.
Article 5.1.c) of the RGPD, regarding the principles of treatment, provides that
personal data will be "adequate, relevant and limited to what is necessary in
relation to the purposes for which they are processed ("data minimization"). » East
article enshrines the principle of data minimization in data processing
personal. It assumes that said treatment is adjusted and proportional to the purpose to
the one that is addressed, and the processing of excessive data must be restricted or
proceed to the suppression of them.
The relevance of the data processing must occur both in the field
of the collection of the data as in the subsequent treatment that is carried out of the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/15
themselves.
Article 12.1 of the RGPD states: “1. The data controller will take the
appropriate measures to provide the interested party with all the information indicated in the articles
the 13 and 14 "The RGPD lists the categories of information that must be provided to
an interested party in relation to the processing of their personal data in cases where
those that are collected from the same (article 13) or are obtained from another source (article 14).
12.7 indicates: “The information that must be provided to interested parties by virtue of
Articles 13 and 14 may be transmitted in combination with standard icons
that allow to provide in an easily visible, intelligible and clearly legible way
an adequate overview of the planned treatment "
Article 22 of the LOPDGDD establishes the specificities of the treatment of
data for video surveillance purposes, indicating the following:
"1. Individuals or legal entities, public or private, may carry out the
Image processing through camera or video camera systems with the
purpose of preserving the safety of people and property, as well as their
installations.
2. Images of public roads may only be captured to the extent that it is
Essential for the purpose mentioned in the previous section.
However, it will be possible to capture the public road in a greater extension
when necessary to guarantee the security of goods or facilities
strategic or infrastructure related to transport, without in any case
may involve capturing images from inside a private home.
3. The data will be deleted within a maximum period of one month from its
collection, except when they had to be kept to prove the commission of
acts that threaten the integrity of people, property or facilities. In that
In this case, the images must be made available to the competent authority in
a maximum period of seventy-two hours from the knowledge of the
existence of the recording.
The blocking obligation provided for in the
Article 32 of this organic law.
4. The duty of information provided for in article 12 of the Regulation (EU)
2016/679 will be understood to be fulfilled by placing an information device
in a sufficiently visible place identifying, at least, the existence of the treatment,
the identity of the person in charge and the possibility of exercising the rights provided in the
Articles 15 to 22 of Regulation (EU) 2016/679. It may also be included in the
informational device a connection code or internet address to this
information.
In any case, the data controller must keep available to the
affected the information to which the aforementioned regulation refers.
5. Under article 2.2.c) of Regulation (EU) 2016/679, it is considered
Excluded from its scope the treatment by a natural person of images
that only capture the interior of your own home.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/15
This exclusion does not cover the treatment carried out by a security entity
private that had been hired for the surveillance of a home and had access
to the images.
6. The treatment of personal data from images and
sounds obtained through the use of cameras and video cameras by the Forces
and Security Bodies and by the competent bodies for surveillance and control in
prisons and for the control, regulation, surveillance and discipline of the
traffic, will be governed by the transposition legislation of Directive (EU) 2016/680,
when the treatment is for prevention, investigation, detection or
prosecution of criminal offenses or execution of criminal sanctions, including
protection and prevention against threats to public safety. Outside
of these assumptions, said treatment will be governed by its specific legislation and
supplementary by Regulation (EU) 2016/679 and this organic law.
7. What is regulated in this article is understood without prejudice to the provisions of
Law 5/2014, of April 4, on Private Security and its development provisions.
8. The treatment by the employer of data obtained through
cameras or video cameras is subject to the provisions of article 89 of this law
organic. "
V
In order that the duty of information provided for in article 12 of the
RGPD is complied with in a concise and understandable way for the affected party, the aforementioned
Article 22 of the LOPDGDD provides for a "layered information" system.
It is recommended that the first layer or modality inserted in the
video surveillance area warning contains the most important information, details
of the purpose of the treatment, the identity of the person in charge and a description of the
rights of the interested party, legal basis of the treatment and identification of the person in charge
of the treatment and form of contact. The importance of providing this information
in advance arises, in particular, from recital 39 of the RGPD, not being
necessary to specify the precise location of the surveillance equipment; but nevertheless,
The surveillance context should be clear.
Thus, in summary, on the poster or badge of the video-monitored area, you must inform
about:
-The existence of the treatment (video surveillance).
-The identity of the person responsible for the treatment or the video surveillance system, and
the address of the same.
-The possibility of exercising the rights recognized in articles 15 to 22
of the RGPD.
-Where to obtain more information about the processing of personal data.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/15
The information in the second layer should be available in one place
easily accessible to the interested party, be it an information sheet at a reception, cashier
etc. or placed in a visible public space, or refer to a web address with the
rest of the elements of article 13 of the RGPD.
Article 13 of the RGPD establishes the information that must be provided when
the personal data is obtained from the interested party, which is the following:
"1. When personal data relating to him are obtained from an interested party, the
responsible for the treatment, at the time these are obtained, will provide
all the information indicated below:
a) the identity and contact details of the person in charge and, where appropriate, their re-
presenter;
b) the contact details of the data protection officer, if applicable;
c) the purposes of the treatment to which the personal data are destined and the legal basis
ridic of the treatment;
d) when the treatment is based on article 6, paragraph 1, letter f), the interests
legitimate interests of the person in charge or a third party;
e) the recipients or categories of recipients of the personal data, in their
case;
f) where appropriate, the intention of the person responsible to transfer personal data to a
third country or international organization and the existence or absence of a decision of
adequacy of the Commission, or, in the case of the transfers indicated in the articles
46 or 47 or article 49, paragraph 1, second paragraph, reference to guarantees
appropriate or appropriate and the means to obtain a copy of these or the fact that
that have been borrowed.
2. In addition to the information mentioned in section 1, the person responsible for the
treatment will facilitate the interested party, at the time the personal data is obtained
sonal, the following information necessary to guarantee data processing
loyal and transparent:
a) the period during which the personal data will be kept or, when not
where possible, the criteria used to determine this deadline;
b) the existence of the right to request the data controller for access
to the personal data relating to the interested party, and its rectification or deletion, or the limitation-
treatment, or to oppose treatment, as well as the right to portability
data quality;
c) when the treatment is based on article 6, paragraph 1, letter a), or the
Article 9, paragraph 2, letter a), the existence of the right to withdraw consent in
any time, without affecting the legality of the treatment based on the
feeling prior to withdrawal;
d) the right to file a claim with a supervisory authority;
e) if the communication of personal data is a legal or contractual requirement, or
a necessary requirement to sign a contract, and if the interested party is obliged
do to provide personal data and is informed of the possible consequences
cias that not provide such data;
f) the existence of automated decisions, including profiling, to
referred to in article 22, paragraphs 1 and 4, and, at least in such cases, information
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/15
significant on the applied logic, as well as the importance and consequences
views of said treatment for the interested party.
3. When the person responsible for the treatment plans the subsequent treatment of data
personal data for a purpose other than that for which it was collected will provide
to the interested party, prior to said subsequent treatment, information about that other
purpose and any additional pertinent information pursuant to section 2.
4. The provisions of paragraphs 1, 2 and 3 shall not apply when and in
the extent to which the interested party already has the information. "
The second part of the claim is specified in that the claimed entity
It does not have a poster informing about the presence of the cameras.
In accordance with the foregoing, this Agency considers that there are indications about the
existence of video surveillance cameras installed in the claimed entity without the
necessary informational badge.
SAW
The corrective powers available to the Spanish Protection Agency
Data, as the control authority, are established in article 58.2 of the RGPD.
Among them are the power to sanction with warning -article 58.2
b) -, the power to impose an administrative fine in accordance with article 83 of the
RGPD -article 58.2 i) -, or the power to order the person in charge of the
treatment that the treatment operations conform to the provisions of the
GDPR, where applicable, in a certain way and within a period of time
specified -article 58. 2 d) -.
It has been proven that the facts presented do not comply with the provisions of
Articles 6.1. and 13 RGPD, so they could involve the commission of paths
offenses typified in article 83.5 of the RGPD, which provides the following:
"Violations of the following provisions will be sanctioned, in accordance with
with paragraph 2, with administrative fines of maximum EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:
a) the basic principles for the treatment, including the conditions for the
consent in accordance with articles 5, 6, 7 and 9;
b) the rights of the interested parties in accordance with articles 12 to 22; […]. "
For the purposes of the statute of limitations for infractions, the infraction indicated in
The previous paragraph is considered very serious and prescribes after three years, according to the
Article 72.1 of the LOPDGDD, which establishes that:
"Based on what is established in article 83.5 of Regulation (EU) 2016/679
are considered very serious and will prescribe after three years the infractions that suppose
a substantial violation of the articles mentioned therein and, in particular, the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/15
following:
b) The processing of personal data without the concurrence of any of the
conditions of legality of the treatment established in article 6 of the Regulation
(EU) 2016/679.
(…)
h) The omission of the duty to inform the affected party about the treatment of their
personal data in accordance with the provisions of articles 13 and 14 of the Regulation
(EU) 2016/679 and 12 of this Organic Law. "
VII
In order to determine the administrative fine to be imposed, the
provisions of articles 83.1 and 83.2 of the RGPD, precepts that indicate:
"Each supervisory authority will guarantee that the imposition of fines
administrative under this article for the infractions of this
Regulations indicated in paragraphs 4, 9 and 6 are in each individual case
effective, proportionate and dissuasive. "
"Administrative fines will be imposed, depending on the circumstances of
each individual case, as an additional or substitute for the measures contemplated in the
Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine
administrative and its amount in each individual case will be duly taken into account:
a) the nature, severity and duration of the offense, taking into account the
nature, scope or purpose of the processing operation in question
as well as the number of affected stakeholders and the level of damage and
damages they have suffered;
b) intentionality or negligence in the infringement;
c) any measure taken by the controller or processor
to mitigate the damages suffered by the interested parties;
d) the degree of responsibility of the person in charge of the
treatment, taking into account the technical or organizational measures that have
applied by virtue of articles 25 and 32;
e) any previous infringement committed by the person in charge or the person in charge of the
treatment;
f) the degree of cooperation with the supervisory authority in order to
remedy the violation and mitigate the possible adverse effects of the violation;
g) the categories of personal data affected by the infringement;
h) the way in which the supervisory authority learned of the infringement,
in particular if the person in charge or the person in charge notified the infraction and, in such
case, to what extent;
i) when the measures indicated in Article 58 (2) have been
previously ordered against the person in charge or the person in charge
in relation to the same matter, compliance with said measures;
j) adherence to codes of conduct under Article 40 or to mechanisms
certification approved in accordance with Article 42, and
k) any other aggravating or mitigating factor applicable to the circumstances of the
case, such as financial benefits obtained or losses avoided, direct
or indirectly, through the infringement. "
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/15
Regarding section k) of article 83.2 of the RGPD, the LOPDGDD, article 76,
"Sanctions and corrective measures", provides:
"2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679
The following may also be taken into account:
a) The continuing nature of the offense.
b) The linking of the offender's activity with the performance of treatments
of personal data.
c) The benefits obtained as a result of the commission of the offense.
d) The possibility that the affected person's conduct could have led to the
commission of the offense.
e) The existence of a process of merger by absorption subsequent to the commission of
the infringement, which cannot be attributed to the absorbing entity.
f) Affecting the rights of minors.
g) Have, when not mandatory, a data protection officer.
h) The submission by the person in charge or in charge, with character
voluntary, to alternative dispute resolution mechanisms, in those
assumptions in which there are controversies between those and any interested party. "
In the present case, the following in particular have been taken into account
elements:
The nature and severity of the offense, taking into account the purpose
of the treatment operation in question as well as the level of data
damages and losses they have suffered;
b) intentionality or negligence in the infringement;
That it is a small company whose main activity is not related to
cula with the processing of personal data.
That no recidivism is appreciated, as the commission does not appear, within the term of
one year for more than one offense of the same nature.
VIII
In accordance with the provisions of article 58.2 d) of the RGPD, according to which
Each supervisory authority may 'order the controller or processor
that the processing operations comply with the provisions of this Regulation-
ment, where appropriate, in a certain way and within a specified timeframe.
do […]. ”, you are required to adapt the data processing involved in video surveillance.
the compliance of the veterinary center to the requirements established in the RGPD, and specifically, to
the placement in a visible place of an information device.
It is noted that not meeting the requirements of this body may be
considered as an administrative offense in accordance with the provisions of the RGPD,
classified as an offense in its articles 83.5 and 83.6, being able to motivate such conduct the
opening of a subsequent administrative sanctioning procedure.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/15
Therefore, in accordance with the applicable legislation and the criteria of
graduation of sanctions whose existence has been proven,
The Director of the Spanish Agency for Data Protection RESOLVES:
FIRST: IMPOSE RECAMBIOS VILLALEGRE S.L., with NIF B74393992, for
an infringement of Article 6 of the RGPD, typified in Article 83.5.a) of the RGPD, a
fine of 10,000 euros (ten thousand euros).
SECOND: IMPOSE RECAMBIOS VILLALEGRE S.L., with NIF B74393992, for
an infringement of article 13 of the RGPD, typified in Article 83.5.b) of the RGPD, a
a fine of 2,000 euros (two thousand euros).
THIRD: REQUEST RECAMBIOS VILLALEGRE S.L., with NIF B74393992, to
that according to art. 58.2 d) RGPD, and within a month from the notification
tion of this resolution:
-Remove the images uploaded to Facebook and the comments that identify the
person whose data is subject to treatment.
-Credit having proceeded to the placement of the information device in the
video-monitored areas or to complete the information offered in it (you must
identify, at least, the existence of a treatment, the identity of the person in charge and
the possibility of exercising the rights provided for in said precepts), locating this
device in a sufficiently visible place, both in open and closed spaces.
-Credit that you keep available to those affected the information to which
the aforementioned RGPD refers to.
FOURTH: NOTIFY this resolution to RECAMBIOS VILLALEGRE S.L.
FIFTH: Warn the sanctioned person that the sanction imposed a
Once this resolution is enforceable, in accordance with the provisions of the
art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter LPACAP), within the payment period
voluntary established in art. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003,
of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number
of procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency
Spanish Data Protection in the bank CAIXABANK, S.A .. In case
Otherwise, it will be collected in the executive period.
Once the notification has been received and once it is executed, if the date of execution is
finds between the 1st and 15th of each month, both inclusive, the deadline to carry out the
voluntary payment will be until the 20th of the following or immediately subsequent business month, and if
is between the 16th and last days of each month, both inclusive, the term of the
Payment will be up to the 5th of the second following or immediate business month.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/15
In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which ends the administrative procedure according to art.
48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the
LPACAP, the interested parties may optionally file an appeal for reversal
before the Director of the Spanish Agency for Data Protection within a period of
month from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.
Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the
LPACAP, the final resolution may be suspended in an administrative way
If the interested party expresses his intention to file a contentious appeal-
administrative. If this is the case, the interested party must formally communicate this
made by writing to the Spanish Agency for Data Protection,
Presenting it through the Electronic Registry of the Agency
[https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest
records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. Too
must forward to the Agency the documentation that proves the effective filing
of the contentious-administrative appeal. If the Agency is not aware of the
filing of the contentious-administrative appeal within a period of two months from the
day after the notification of this resolution, would terminate the
precautionary suspension.
938-300320
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
