Search results

had breached Article 9 GDPR. The DPA imposed a sanction according to Article 83(5)(a) GDPR and Article 72(1)(e) of the Spanish Data Protection Law. After

processing of genetic data, biometric data for the purpose of unique identification of a person, or data concerning health, or data relating to a person's sexual

Spanish Data Protection Agency and based on the following BACKGROUND FIRST: D. A.A.A. (hereinafter, the claimant) on 20 September 2018 filed a complaint

of personal data and the free circulation of these data (hereinafter referred to as RGPD); and in article 47 of the Organic Law 3/2018, of 5 December, on

of the Personal Data Act and the Privacy Ordinance, cf. the Personal Data Act § 2 and the Privacy Ordinance Article 2. There has been a processing of personal

Article 5-1 e) of the Regulation provides that personal data must be kept in a form allowing the identification of the persons concerned for a period

Personal Data and the Free Movement of such Data) and Article 23 of the LOPDGDD (Organic Law 3/2018 of December 5, Protection of Personal Data and Guarantee

sedeagpd.gob.es Page 5 5/12 Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) in its article 72, under the heading

infringement of article 5.1(b), as defined in Article 83(5)(a) and considered for the purposes of the statute of limitations in Article 72(1)(a), a fine of EUR

follows: 1. A first communication was sent to all our staff on 19 November 2018 to remind them of their obligations in terms of data protection.This is attached

of the Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). As a result of the investigation

Statute of the Data Protection Agency (RD 428/1993) and the First transitory of the Organic Law 3/2018, of December 5, of Protection of Personal Data and guarantee

instructed by the Spanish Agency for Data Protection to VODAFONE ESPAÑA, S.A.U., considering the complaint filed by A.A.A., and based on the following, BACKGROUND

Irish Data Protection Authority as the main authority is Article 56 of the General Data Protection Regulation In accordance with paragraphs 3 and 5, it has

with the General Data Protection Regulation. According to section 8 of the Data Protection Act (5 December 2018/10), the data protection commissioner is

other than data protection. The data subject reiterated the initial request in the same terms. To this, the controller again alleged Article 12(5) GDPR and

personal data in accordance with Article 32 (2) of the Data Protection Regulation. First 3.2. Article 32 (2) of the Data Protection Regulation 2 Article 32 (2)

articles 5, par. 1, lit. a) and 13 of the Regulation. The data controller must process the data "lawfully, correctly and transparently" (Article 5, paragraph

there was a breach of personal data protection regulations. There was no evidence providing a clear violation of the General Data Protection Regulation

11/4In this sense, Organic Law 3/2018, of December 5, on the Protection ofPersonal Data and guarantee of digital rights article 6.1 of the RGPD,establishes