AN - SAN 1863/2021
From GDPRhub
| AN - SAN 1863/2021 | |
|---|---|
 | |
| Court: | AN (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 1 GDPR |
| Decided: | 14.05.2021 |
| Published: | 08.06.2021 |
| Parties: | Madrileña Red De Gas, S.A.U. |
| National Case Number/Name: | SAN 1863/2021 |
| European Case Law Identifier: | ECLI:ES:AN:2021:1863 |
| Appeal from: | AEPD PS-00188-2019 |
| Appeal to: | |
| Original Language(s): | Spanish |
| Original Source: | CENDOJ (in Spanish) |
| Initial Contributor: | n/a |
Madrileña Red De Gas, S.A.U appealed successfully the decision issued by the Spanish Data Protection Authority (AEPD) under Resolution PS/00188/2019 in which fined the company €12.000 for failing to comply with the principle of confidentiality provided for in Article 5(1)(f) GDPR by sharing the complainant's data with a third party.
English Summary
Facts
Madrileña Red De Gas, S.A.U stated that this decision was repugnant to the constitutional principle of non-retroactivity of the law as the presumed breach occurred in April 2018 before the GDPR came into force. Therefore, GDPR should not have applied.
The National Audience analysed Recital 171 GDPR and stated that this Regulation entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016, however, it will only be directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, therefore providing, the Member States and their respective Supervisory Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the Organic Law 15/1999, of December 13, Protection of Personal Data, and its Regulations, approved by the Royal Decree 1720/2007, of December 21, were fully valid and applicable to the case at hand.
Dispute
Is the argument of Madrileña Red De Gas valid? Should the National Audience allow the appeal and quash the decision issued by the AEPD on the basis violation of the principle of non-retroactivity of the law?
Holding
The National Audience held that the GDPR was not applicable when the events in question occurred and that it has been retroactively applied. It further clarified that the GDPR could have been applied if it had been more favorable. Consequently, the National Audience allowed the appeal and declared the nullity of the sanction imposed on Madrileña Red De Gas, S.A.U, ordering the refund of the amount of the fine if it had been paid.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1 JURISPRUDENCE Roj: SAN 1863/2021 - ECLI: ES: AN: 2021: 1863 Cendoj Id: 28079230012021100197 Organ: National Court. Contentious Chamber Headquarters: Madrid Section: 1 Date: 05/14/2021 Resource Number: 115/2020 Resolution No.: Procedure: Ordinary procedure Speaker: FERNANDO DE MATEO MENENDEZ Type of Resolution: Sentence NATIONAL AUDIENCE Contentious-Administrative Chamber SECTION ONE No. Resource. 0000115 / 2020 Resource Type: ORDINARY PROCEDURE General Registration No.: 01358/2020 Plaintiff: MADRILEÑA RED DE GAS SAU Attorney: RICARDO LUDOVICO MORE NO MARTÍN Defendant: SPANISH DATA PROTECTION AGENCY State Attorney Speaker IImo. Sr .: D. FERNANDO DE MATEO MENÉNDEZ JUDGMENT No.: IImo. Mr. President: D. EDUARDO MENÉNDEZ REXACH Ilmos. Messrs. Magistrates: Mrs. FELISA ATIENZA RODRIGUEZ Mrs. LOURDES SANZ CALVO D. FERNANDO DE MATEO MENÉNDEZ Mrs. NIEVES BUISAN GARCÍA Madrid, on the fourteenth of May, two thousand twenty-one. Seen by the Chamber, made up of the Magistrates related to the margin, the writ of appeal contentious-administrative number 115/20, filed by the Attorney General Mr. Ludovico Moreno Martín-Rico, on behalf of and on behalf of MADRILEÑA RED DE GAS, SAU , against the resolution of December 27, 2019 from the Director of the Spanish Data Protection Agency, confirming in replacement of the resolution of November 5, 2019, which imposes on the plaintiff a sanction of 12,000 euros, for an infringement of art. 5.1.f) of Regulation (EU) 2016/679 of the European Parliament and of Council of April 27, 2016, classified as very serious, for prescription purposes, in art. 72.1.a) of the aforementioned Regulation, relapses in the sanctioning procedure PS / 00188/2019. THE ADMINISTRATION has been part OF THE STATE , represented by the State Attorney. The amount of the appeal was set at 12,000 euros. 1 Page 2 JURISPRUDENCE FACTUAL BACKGROUND FIRST.- Once the appeal was admitted and after the appropriate procedural steps had been taken, transfer was granted to the plaintiff so that, within twenty days, formalize the claim, which was carried out by means of brief presented on July 2, 2020, which, after presenting the facts and legal grounds that it considered timely, he ended up requesting that a judgment be issued, "by which with an estimate of the present remedy and imposition of the procedural costs to the defendant Administration, annul the Resolution of December 27 of 2019, from the Director of the Spanish Data Protection Agency (file NUM000), in attention to the reasons set forth in the First and Second Legal Bases of this brief; subsidiarily (Third Legal Basis), the sanction is reduced to a warning, proceeding to return to my principal of the payments made in the corresponding amount " . SECOND .- Formalized demand was forwarded the same to the defendant for the answer within twenty days, which he did by means of the pertinent brief, alleging the facts and grounds deemed pertinent, requesting that a judgment be rendered dismissing the appeal, fully confirming the contested resolution as being in compliance with the Law, with express imposition of costs to the appellant. THIRD.- Once the demand has been answered, by means of ordinance proceedings of February 9 and March 8, 2021, The plaintiffs were granted a period of ten days to formulate conclusions. Once presented the corresponding writings, the proceedings were pending voting and ruling, which took place on 11 May of the current year. BEING SPEAKER the Magistrate Ilmo. Mr. Don Fernando de Mateo Menéndez . FOUNDATIONS OF LAW FIRST.- The plaintiff challenges the resolution of December 27, 2019 of the Director of the Spanish Agency for Data Protection, which confirms in replacement the resolution of November 5, 2019, by which the plaintiff is imposed a penalty of 12,000 euros, for an infringement of art. 5.1.f) of of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, classified as very serious, for the purposes of prescription, in art. 72.1.a) of the aforementioned Regulation, relapses in the procedure sanctioner PS / 00188/2019. The proven facts on which the sanction is based are the following: "1º In the lease presented by the claimant, it can be seen that it was held on 09/16/17. The rented house is located at AVENIDA000 - NUM001 28915, Leganés Madrid. The owner of the same is, Mrs. Mercedes with DNI NUM002 and the tenants are, Mr. Ignacio and Ms. Noemi. It is also observed that, in the twentieth point of the contract, "Notifications", it is indicated as mail electronic address of the lessee for the purposes of notifications, "ADDRESS000" and telephone number NUM003. 2nd On April 4, 6, and 7, 2018, three emails are sent from the address: Rosa, ADDRESS001 (Apple email used when using a device from this company), to the address: ADDRESS002, with subject: "History of readings Mercedes" and with the text: "Good afternoon, with DNI NUM002 , I request consumption history from 12/31/10 to 09/15/12. Sent from my iPhone 5. 3rd On 04/13/18 an email is sent from ADDRESS002 to Rosa, ADDRESS001 with Subject: Mercedes Reading History, and with the message: "Thank you for contacting Madrid Gas Network. In response to your request for reference NUM004, we detail the requested readings ... " The information is then divided into three columns: the first column indicates the "registration date", with 15 readings, ranging from 12/31/10 to 11/08/12; The second column details the "consumption in meters cubic "and the third column indicates the" type of reading ", if it has been estimated, provided or real" . SECOND .- The offense for which the plaintiff has been sanctioned is that of art. 5.1.f) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter RGPD), which establishes: "1. The personal data will be: (...) "f) processed in such a way as to guarantee adequate security of personal data, including the protection against unauthorized or illegal processing and against accidental loss, destruction or damage, by applying appropriate technical or organizational measures (<< integrity and confidentiality >>) ". two Page 3 JURISPRUDENCE While art. 72.1.a) of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, which is applied in the appealed resolution, considers very serious : "1. Based on what is established in article 83.5 of Regulation (EU) 2016/679, they are considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned in that and, in particular, the following: a) The processing of personal data violating the principles and guarantees established in article 5 of the Regulation (EU) 2016/679 " . THIRD .- argues the appellant first, the nullity for infringement of the principle of legality of arts. 9.3, and 25 of the Constitution, and 26 of Law 40/2015, of October 1. It is argued that the sanctioning resolution is based on the RGPD, which does not result from the application of in accordance with art. 99.2 of the same, since the alleged infringing act occurred in April 2018. And, Much less would Organic Law 3/2018, of December 5, on the Protection of Personal Data be plausible and Guarantee of Digital Rights, which had not yet been published. For which the principle has been violated constitutional of criminal non-retroactivity, enshrined in arts. 9.3 and 25 of the Constitution. For his part, the legal representative of the State Administration, argues in this regard that art. 99 of the GDPR establishes its entry into force 20 days after its publication in the DOUE, which occurred on May 4 of 2016. That is why it cannot be understood that in the present case we are faced with an application retroactive of its provisions. FOURTH .- Art. 9 of the Constitution in section 3 establishes that: " The Constitution guarantees the principle of legality, the normative hierarchy, the publicity of the rules, the non-retroactivity of the provisions unfavorable or restrictive sanctioning of individual rights, legal security, responsibility and the interdiction of the arbitrariness of the public powers ". By virtue of this principle, indirectly enshrined in section 1 of this same provision, all Public powers are subject to the law. In art. 25 of the Constitution, the principle of legality is specified in the sanctioning sphere. In virtue of its first section, "no one can be convicted or punished for actions or omissions that at the time If they occur, they do not constitute a crime, offense or administrative offense, according to the legislation in force in that moment " . This principle takes on a special meaning in the scope of the Administration's activity by specifying art. 103, paragraph 1 of the constitutional text, submission to the law of administrative activity. As established the Constitutional Court, among others, in Sentence 129/2003, of June 30, the material aspect of art. 25.1 of the Constitution "carries with it the requirement that the punitive norm allows predicting with a sufficient degree of certainty of the behaviors that constitute infractions " . And as reasoned by said Court in its Order number 251/2004, of July 12: " The material guarantee derived of the principle of typicality is not exhausted in the elaboration of the norm, but extends to its application, in whose moment the public powers are also subject to the principle of typicity "in the sense that, by On the one hand, they are in a situation of strict subjection to the sanctioning regulations and, on the other, they are extensive interpretation and analogy in malam partem, that is, exegesis and application of the norms, is prohibited outside the assumptions and the limits they determine "(STC 52/2003 of 17 March, FJ 5) . In this scope, the task of this Court is to "externally supervise that the interpretation adopted responds to minimum rules of interpretation, so that it can be affirmed that the sanctioned decision was a foreseeable result, insofar as it is reasonable, of what was decided by popular sovereignty, which is why constitutionally those others incompatible with the literal tenor of the applicable or inappropriate precepts to the securities that they are intended to protect (STC 52/2003, of March 17, FJ 5 and the SSTC that are cited there) ". Thus, it appears in the administrative file that the sanctioned events occurred in April 2018, acknowledging this circumstance in the sanctioning resolution. On the other hand, art. 99 of the RGPD establishes: "1. This Regulation will enter into force twenty days after its publication in the Official Journal of the European Union. 2. It will be applicable as of May 25, 2018 " . And, in this sense, in recital 171 of the aforementioned RGPD, it is stated: "Directive 95/46 / EC must be repealed by these Regulations. Any treatment already started on the date of application of this Regulation must comply with this Regulation within two years from the date of its entry into force. When the treatment is based on consent in accordance with Directive 95/46 / EC, it is not necessary 3 Page 4 JURISPRUDENCE that the interested party give his consent again if the form in which the consent was given conforms to the conditions of this Regulation, so that the person in charge can continue said treatment after the date of application of this Regulation. The decisions of the Commission and the authorizations of the authorities based on Directive 95/46 / EC remain in force until they are modified, replaced or repealed " . Therefore, the RGPD entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016, however, it will only be directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, providing, therefore, the Member States and their respective Control Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the Organic Law 15/1999, of December 13, Protection of Personal Data, and its Regulations, approved by the Royal Decree 1720/2007, of December 21, were fully valid and applicable to the case at hand. Thus, in the appealed resolutions it has been applied by the Spanish Agency for Data Protection, the RGPD to the sanctioned acts, classifying them in art. 5.1.f) thereof. What's more, the Law also applies Organic 3/2018, of December 5, regarding the application of an aggravating factor provided for in art. 76.2.b), and in Regarding the consideration as very serious of the infringement for the purposes of the prescription of the same of art. 72.1.a) of the outlined Organic Law. And said Law, in accordance with its Sixteenth Additional Provision, It entered into force the day after its publication in the Official State Gazette, which was on December 6 of 2018. Therefore, a regulation that was not applicable when the events occurred has been retroactively applied. sanctioned facts. We must add that the aforementioned regulation could have been applied if it had been more favorable - art. 26.2 of Law 40/2015, of October 1 -, but as indicated in the Judgment of the Court Supreme Court of October 30, 2009 - appeal no. 334/2006, FJ6º-, and, in the same sense, in the Judgments of said Court of November 12 and 26, 2020, relapses respectively, in appeals numbers 4,039 / 2019 and 5.285 / 2019: "[...] the retroactive application of the most beneficial rule must be made by determining what disposition is more favorable, by means of the contrast between both, anterior and posterior, considered in a global, ... " . And this contrast does not exist in the contested resolutions, in which there is not even mention any to Organic Law 15/1999, of December 13, and in which the RGPD and Organic Law 3/2018 apply, of December 5, as if it were the regulations that were in force when the sanctioned events occurred, in April 2018. Consequently, by virtue of the foregoing, this ground for challenge should be upheld, and, therefore, the present contentious-administrative appeal, declaring the nullity of the sanction imposed, with the consequences inherent to said declaration, such as the refund of the amount of the fine if the same had been paid, something that does not appear in the proceedings. FIFTH .- In accordance with art. 139.1 of the Jurisdiction Law, it is appropriate to impose the procedural costs to the party defendant. HAVING SEEN the cited articles, and others of general and pertinent application. WE FAILED: That considering the contentious-administrative appeal filed by the Attorney General Mr. Ludovico Moreno Martín-Rico, on behalf of and on behalf of MADRILEÑA RED DE GAS, SAU , against the resolution of December 27, 2019 of the Director of the Spanish Data Protection Agency, which confirms in replacement the resolution of November 5, 2019, which imposes on the plaintiff a penalty of 12,000 euros, for an infringement of art. 5.1.f) of the Regulation (EU) 2016/679 of the Parliament Council and Council of April 27, 2016, classified as very serious, for the purposes of prescription, in the art. 72.1.a) of the aforementioned Regulation, relapses in the sanctioning procedure PS / 00188/2019, we declare the nullity of the aforementioned resolutions for not being in accordance with the law, with the consequences inherent to said statement; with express imposition of the procedural costs to the defendant. This judgment is subject to a cassation appeal, which must be prepared before this Chamber in the 30 days from the date following notification; in the brief of preparation of the appeal Compliance with the requirements established in art. 89.2 of the Jurisdiction Law justifying the objective appeal interest it presents. Thus, by this our Judgment, we pronounce it, send it and sign it. PUBLICATION.- Given, read and published was the previous Judgment in public hearing. Attest. Madrid a. 4 Page 5 JURISPRUDENCE THE LETTER OF THE ADMINISTRATION OF JUSTICE. 5
