AN - SAN 1863/2021

AN - SAN 1863/2021
Court:	AN (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 9(3) Spanish Constitution
Decided:	14.05.2021
Published:	03.06.2021
Parties:	Madrileña Red De Gas, S.A.U.
National Case Number/Name:	SAN 1863/2021
European Case Law Identifier:	ECLI:ES:AN:2021:1863
Appeal from:	AEPD PS-00188-2019
Appeal to:
Original Language(s):	Spanish
Original Source:	CENDOJ (in Spanish)
Initial Contributor:	Paola L

The Spanish National High Court annulled a decision of the Spanish DPA for not complying with the constitutional principle of non-retroactivity of the law, given that the alleged infringement had happened before the GDPR came into effect.

English Summary

Facts

A gas distribution company appealed the decision PS/00188/2019 of the Spanish DPA (AEPD) for considering that it was against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the Spanish Constitution, as the the Spanish DPA fined the controller in accordance with the GDPR, and the alleged infringement had occurred in April 2018, before the GDPR came into effect. Therefore, GDPR should not had applied.

Holding

The Spanish National High Court (AN) analysed Recital 171 GDPR and noted that the Regulation had entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016,

However, the Regulation only became directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, therefore providing, the Member States and their respective Supervisory Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes.

Therefore, both Directive 95/46 and the former Spanish Data Protection Act were fully valid and applicable to the case at hand at the time of the infringement, while the AEPD applied the GDPR to the case.

The AN held that the GDPR was not applicable when the alleged infringement happened, in April 2018, and that it had been retroactively applied by the AEPD, what goes against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the Spanish Constitution.

The Court further clarified that the GDPR only could have been applicable if it had been more favourable to the infringer than the law that was in effect at the moment.

Consequently, the AN upheld the appeal and annulled the sanction imposed by the AEPD on the controller, ordering the refund of the amount of the fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Page 1
JURISPRUDENCE
Roj: SAN 1863/2021 - ECLI: ES: AN: 2021: 1863
Cendoj Id: 28079230012021100197
Organ: National Court. Contentious Chamber
Headquarters: Madrid
Section: 1
Date: 05/14/2021
Resource Number: 115/2020
Resolution No.:
Procedure: Ordinary procedure
Speaker: FERNANDO DE MATEO MENENDEZ
Type of Resolution: Sentence
NATIONAL AUDIENCE
Contentious-Administrative Chamber
SECTION ONE
No. Resource. 0000115 / 2020
Resource Type: ORDINARY PROCEDURE
General Registration No.: 01358/2020
Plaintiff: MADRILEÑA RED DE GAS SAU
Attorney: RICARDO LUDOVICO MORE NO MARTÍN
Defendant: SPANISH DATA PROTECTION AGENCY
State Attorney
Speaker IImo. Sr .: D. FERNANDO DE MATEO MENÉNDEZ
JUDGMENT No.:
IImo. Mr. President:
D. EDUARDO MENÉNDEZ REXACH
Ilmos. Messrs. Magistrates:
Mrs. FELISA ATIENZA RODRIGUEZ
Mrs. LOURDES SANZ CALVO
D. FERNANDO DE MATEO MENÉNDEZ
Mrs. NIEVES BUISAN GARCÍA
Madrid, on the fourteenth of May, two thousand twenty-one.
Seen by the Chamber, made up of the Magistrates related to the margin, the writ of appeal
contentious-administrative number 115/20, filed by the Attorney General Mr. Ludovico
Moreno Martín-Rico, on behalf of and on behalf of MADRILEÑA RED DE GAS, SAU , against the resolution
of December 27, 2019 from the Director of the Spanish Data Protection Agency, confirming in
replacement of the resolution of November 5, 2019, which imposes on the plaintiff a sanction of
12,000 euros, for an infringement of art. 5.1.f) of Regulation (EU) 2016/679 of the European Parliament and of
Council of April 27, 2016, classified as very serious, for prescription purposes, in art. 72.1.a) of the aforementioned
Regulation, relapses in the sanctioning procedure PS / 00188/2019. THE ADMINISTRATION has been part
OF THE STATE , represented by the State Attorney. The amount of the appeal was set at 12,000 euros.
1
Page 2
JURISPRUDENCE
FACTUAL BACKGROUND
FIRST.- Once the appeal was admitted and after the appropriate procedural steps had been taken, transfer was granted to the
plaintiff so that, within twenty days, formalize the claim, which was carried out by means of
brief presented on July 2, 2020, which, after presenting the facts and legal grounds that it considered
timely, he ended up requesting that a judgment be issued, "by which with an estimate of the present remedy and
imposition of the procedural costs to the defendant Administration, annul the Resolution of December 27
of 2019, from the Director of the Spanish Data Protection Agency (file NUM000), in attention to
the reasons set forth in the First and Second Legal Bases of this brief; subsidiarily
(Third Legal Basis), the sanction is reduced to a warning, proceeding to return to my
principal of the payments made in the corresponding amount " .
SECOND .- Formalized demand was forwarded the same to the defendant for the answer
within twenty days, which he did by means of the pertinent brief, alleging the facts and grounds
deemed pertinent, requesting that a judgment be rendered dismissing the appeal,
fully confirming the contested resolution as being in compliance with the Law, with express imposition of
costs to the appellant.
THIRD.- Once the demand has been answered, by means of ordinance proceedings of February 9 and March 8, 2021,
The plaintiffs were granted a period of ten days to formulate conclusions. Once presented
the corresponding writings, the proceedings were pending voting and ruling, which took place on 11
May of the current year.
BEING SPEAKER the Magistrate Ilmo. Mr. Don Fernando de Mateo Menéndez .
FOUNDATIONS OF LAW
FIRST.- The plaintiff challenges the resolution of December 27, 2019 of the Director of the
Spanish Agency for Data Protection, which confirms in replacement the resolution of November 5,
2019, by which the plaintiff is imposed a penalty of 12,000 euros, for an infringement of art. 5.1.f) of
of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, classified as
very serious, for the purposes of prescription, in art. 72.1.a) of the aforementioned Regulation, relapses in the procedure
sanctioner PS / 00188/2019.
The proven facts on which the sanction is based are the following: "1º In the lease
presented by the claimant, it can be seen that it was held on 09/16/17. The rented house is
located at AVENIDA000 - NUM001 28915, Leganés Madrid. The owner of the same is, Mrs. Mercedes
with DNI NUM002 and the tenants are, Mr. Ignacio and Ms. Noemi.
It is also observed that, in the twentieth point of the contract, "Notifications", it is indicated as mail
electronic address of the lessee for the purposes of notifications, "ADDRESS000" and telephone number NUM003.
2nd On April 4, 6, and 7, 2018, three emails are sent from the address: Rosa,
ADDRESS001 (Apple email used when using a device from this company), to the address:
ADDRESS002, with subject: "History of readings Mercedes" and with the text: "Good afternoon, with DNI NUM002
, I request consumption history from 12/31/10 to 09/15/12. Sent from my iPhone 5.
3rd On 04/13/18 an email is sent from ADDRESS002 to Rosa,
ADDRESS001 with Subject: Mercedes Reading History, and with the message: "Thank you for contacting
Madrid Gas Network. In response to your request for reference NUM004, we detail the requested readings ... "
The information is then divided into three columns: the first column indicates the "registration date", with
15 readings, ranging from 12/31/10 to 11/08/12; The second column details the "consumption in meters
cubic "and the third column indicates the" type of reading ", if it has been estimated, provided or real" .
SECOND .- The offense for which the plaintiff has been sanctioned is that of art. 5.1.f) of the Regulation
(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter RGPD), which establishes:
"1. The personal data will be:
(...)
"f) processed in such a way as to guarantee adequate security of personal data, including the
protection against unauthorized or illegal processing and against accidental loss, destruction or damage,
by applying appropriate technical or organizational measures (<< integrity and confidentiality >>) ".
two
Page 3
JURISPRUDENCE
While art. 72.1.a) of Organic Law 3/2018, of December 5, on the Protection of Personal Data
and guarantee of digital rights, which is applied in the appealed resolution, considers very
serious : "1. Based on what is established in article 83.5 of Regulation (EU) 2016/679, they are considered very
serious and will prescribe after three years the infractions that suppose a substantial violation of the articles
mentioned in that and, in particular, the following:
a) The processing of personal data violating the principles and guarantees established in article 5 of the
Regulation (EU) 2016/679 " .
THIRD .- argues the appellant first, the nullity for infringement of the
principle of legality of arts. 9.3, and 25 of the Constitution, and 26 of Law 40/2015, of October 1.
It is argued that the sanctioning resolution is based on the RGPD, which does not result from the application of
in accordance with art. 99.2 of the same, since the alleged infringing act occurred in April 2018. And,
Much less would Organic Law 3/2018, of December 5, on the Protection of Personal Data be plausible
and Guarantee of Digital Rights, which had not yet been published. For which the principle has been violated
constitutional of criminal non-retroactivity, enshrined in arts. 9.3 and 25 of the Constitution.
For his part, the legal representative of the State Administration, argues in this regard that art. 99 of the GDPR
establishes its entry into force 20 days after its publication in the DOUE, which occurred on May 4
of 2016. That is why it cannot be understood that in the present case we are faced with an application
retroactive of its provisions.
FOURTH .- Art. 9 of the Constitution in section 3 establishes that: " The Constitution guarantees the
principle of legality, the normative hierarchy, the publicity of the rules, the non-retroactivity of the provisions
unfavorable or restrictive sanctioning of individual rights, legal security, responsibility and
the interdiction of the arbitrariness of the public powers ".
By virtue of this principle, indirectly enshrined in section 1 of this same provision, all
Public powers are subject to the law.
In art. 25 of the Constitution, the principle of legality is specified in the sanctioning sphere. In virtue of
its first section, "no one can be convicted or punished for actions or omissions that at the time
If they occur, they do not constitute a crime, offense or administrative offense, according to the legislation in force in that
moment " .
This principle takes on a special meaning in the scope of the Administration's activity by specifying art.
103, paragraph 1 of the constitutional text, submission to the law of administrative activity. As established the
Constitutional Court, among others, in Sentence 129/2003, of June 30, the material aspect of art. 25.1
of the Constitution "carries with it the requirement that the punitive norm allows predicting with a sufficient degree of
certainty of the behaviors that constitute infractions " .
And as reasoned by said Court in its Order number 251/2004, of July 12: " The material guarantee derived
of the principle of typicality is not exhausted in the elaboration of the norm, but extends to its application, in
whose moment the public powers are also subject to the principle of typicity "in the sense that, by
On the one hand, they are in a situation of strict subjection to the sanctioning regulations and, on the other, they are
extensive interpretation and analogy in malam partem, that is, exegesis and application of the norms, is prohibited
outside the assumptions and the limits they determine "(STC 52/2003 of 17 March, FJ 5) . In this
scope, the task of this Court is to "externally supervise that the interpretation adopted
responds to minimum rules of interpretation, so that it can be affirmed that the sanctioned decision was
a foreseeable result, insofar as it is reasonable, of what was decided by popular sovereignty, which is why
constitutionally those others incompatible with the literal tenor of the applicable or inappropriate precepts
to the securities that they are intended to protect (STC 52/2003, of March 17, FJ 5 and the SSTC that are cited there) ".
Thus, it appears in the administrative file that the sanctioned events occurred in April
2018, acknowledging this circumstance in the sanctioning resolution.
On the other hand, art. 99 of the RGPD establishes: "1. This Regulation will enter into force twenty days after its
publication in the Official Journal of the European Union.
2. It will be applicable as of May 25, 2018 " .
And, in this sense, in recital 171 of the aforementioned RGPD, it is stated: "Directive 95/46 / EC must be repealed
by these Regulations. Any treatment already started on the date of application of this Regulation
must comply with this Regulation within two years from the date of its entry into force.
When the treatment is based on consent in accordance with Directive 95/46 / EC, it is not necessary
3
Page 4
JURISPRUDENCE
that the interested party give his consent again if the form in which the consent was given conforms to the
conditions of this Regulation, so that the person in charge can continue said treatment after the date
of application of this Regulation. The decisions of the Commission and the authorizations of the authorities
based on Directive 95/46 / EC remain in force until they are modified, replaced or
repealed " .
Therefore, the RGPD entered into force 20 days after its publication in the Official Journal of the European Union, that is,
on May 24, 2016, however, it will only be directly applicable and mandatory in all its elements in
each Member State as of May 25, 2018, providing, therefore, the Member States and their
respective Control Authorities, of a period of 2 years for their preparation, application and interpretation of
the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the Organic Law
15/1999, of December 13, Protection of Personal Data, and its Regulations, approved by the
Royal Decree 1720/2007, of December 21, were fully valid and applicable to the case at hand.
Thus, in the appealed resolutions it has been applied by the Spanish Agency for Data Protection,
the RGPD to the sanctioned acts, classifying them in art. 5.1.f) thereof. What's more, the Law also applies
Organic 3/2018, of December 5, regarding the application of an aggravating factor provided for in art. 76.2.b), and in
Regarding the consideration as very serious of the infringement for the purposes of the prescription of the same of art.
72.1.a) of the outlined Organic Law. And said Law, in accordance with its Sixteenth Additional Provision,
It entered into force the day after its publication in the Official State Gazette, which was on December 6
of 2018.
Therefore, a regulation that was not applicable when the events occurred has been retroactively applied.
sanctioned facts. We must add that the aforementioned regulation could have been applied if it had been more
favorable - art. 26.2 of Law 40/2015, of October 1 -, but as indicated in the Judgment of the Court
Supreme Court of October 30, 2009 - appeal no. 334/2006, FJ6º-, and, in the same sense, in the Judgments of said
Court of November 12 and 26, 2020, relapses respectively, in appeals numbers 4,039 / 2019
and 5.285 / 2019: "[...] the retroactive application of the most beneficial rule must be made by determining what
disposition is more favorable, by means of the contrast between both, anterior and posterior, considered in a
global, ... " . And this contrast does not exist in the contested resolutions, in which there is not even mention
any to Organic Law 15/1999, of December 13, and in which the RGPD and Organic Law 3/2018 apply,
of December 5, as if it were the regulations that were in force when the sanctioned events occurred,
in April 2018.
Consequently, by virtue of the foregoing, this ground for challenge should be upheld, and, therefore,
the present contentious-administrative appeal, declaring the nullity of the sanction imposed, with the
consequences inherent to said declaration, such as the refund of the amount of the fine if the same
had been paid, something that does not appear in the proceedings.
FIFTH .- In accordance with art. 139.1 of the Jurisdiction Law, it is appropriate to impose the procedural costs to the party
defendant.
HAVING SEEN the cited articles, and others of general and pertinent application.
WE FAILED:
That considering the contentious-administrative appeal filed by the Attorney General Mr.
Ludovico Moreno Martín-Rico, on behalf of and on behalf of MADRILEÑA RED DE GAS, SAU , against the
resolution of December 27, 2019 of the Director of the Spanish Data Protection Agency, which
confirms in replacement the resolution of November 5, 2019, which imposes on the plaintiff a
penalty of 12,000 euros, for an infringement of art. 5.1.f) of the Regulation (EU) 2016/679 of the Parliament
Council and Council of April 27, 2016, classified as very serious, for the purposes of prescription, in the
art. 72.1.a) of the aforementioned Regulation, relapses in the sanctioning procedure PS / 00188/2019, we declare the
nullity of the aforementioned resolutions for not being in accordance with the law, with the consequences inherent to said
statement; with express imposition of the procedural costs to the defendant.
This judgment is subject to a cassation appeal, which must be prepared before this Chamber in the
30 days from the date following notification; in the brief of preparation of the appeal
Compliance with the requirements established in art. 89.2 of the Jurisdiction Law
justifying the objective appeal interest it presents.
Thus, by this our Judgment, we pronounce it, send it and sign it.
PUBLICATION.- Given, read and published was the previous Judgment in public hearing. Attest. Madrid a.
4
Page 5
JURISPRUDENCE
THE LETTER OF THE ADMINISTRATION OF JUSTICE.
5