AEPD (Spain) - TD/00164/2020
From GDPRhub
| AEPD - TD/00164/2020 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 12 GDPR Article 17 GDPR 12 LOPDGDD |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 12.01.2021 |
| Published: | |
| Fine: | None |
| Parties: | Associació Catalana per la Participació Política |
| National Case Number/Name: | TD/00164/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Francesc Julve Falcó |
The Spanish DPA (AEDP) accepted a complaint against 'Associació Catalana per la Participació Política' as the organisation failed to respond to a citizen's request for suppression (Article 17 GDPR).
English Summary
Facts
The complainant exercised a right of deletion against the respondent, but his request has not received the legally established response.
The AEPD admitted the complaint for processing and granted the respondent entity the option to present allegations within fifteen days.
The respondent did not reply to the AEPD and did not prove that it had responded to the claimant's request for deletion.
Dispute
Is the lack of response an infringement of the data subject's right to erasure (Article 17 GDPR)?
Holding
The AEPD upheld the complaint and urged the respondent to reply to the complainant within ten working days, stating whether it had complied with the right of erasure or whether it had refused the request for erasure, stating its reasons.
In the event of non-compliance, the AEPD considers that this could lead to a sanction, in accordance with article 58(2) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/5
File No.: TD / 00164/2020
RESOLUTION NO: R / 00011/2021
Considering the claim made on March 7, 2020 before this Agency by A.A.A. ,(to
from now on the complaining party), against ASSOCIACIÓ PER LA PARTICIPACIÓ
POLICY TO CATALUNYA, (from now on the claimed part), for not having been
duly attended to your right of deletion.
The procedural actions provided for in Title VIII of the Law have been carried out.
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD), the following have been verified
ACTS
FIRST: The complaining party exercised the right of deletion against the complained party, without
that your request has received the legally established reply. It contributes diverse
documentation related to the claim filed with this Agency and about the
exercise of the right exercised.
SECOND: Once the procedure provided for in article 65.4 of the LOPDGDD has been completed,
The claim was admitted for processing and the claimed entity was granted
hearing, so that within fifteen business days the allegations that
deemed convenient.
The claimed entity has not replied to this Agency nor has it proven that there is
responded to the request for the exercise of rights that was presented by the
complaining party.
FOUNDATIONS OF LAW
FIRST: The Director of the Spanish Agency for
Data Protection, in accordance with the provisions of section 2 of article 56 in
in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the
European Parliament and of the Council of April 27, 2016 on the protection of
natural persons with regard to the processing of personal data and the free
circulation of these data (hereinafter, RGPD); and in article 47 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD).
SECOND: Article 64.1 of the LOPDGDD, provides that:
"one. When the procedure refers exclusively to the lack of attention of
a request to exercise the rights established in articles 15 to 22 of the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/5
Regulation (EU) 2016/679, will start by agreement of admission for processing, which is
adopt in accordance with the provisions of the following article.
In this case, the period to resolve the procedure will be six months from
From the date the claimant was notified of the agreement to
admission for processing. After this period, the interested party may consider
estimated your claim. "
THIRD: Article 12 of Regulation (EU) 2016/679, of April 27, 2016,
General Data Protection (RGPD), provides the following:
"one. The person in charge of the treatment will take the appropriate measures to facilitate the
interested party all information indicated in articles 13 and 14, as well as any
communication pursuant to articles 15 to 22 and 34 regarding the treatment, in
concise, transparent, intelligible and easily accessible form, with clear language and
straightforward, particularly any information specifically directed at a child. The
Information will be provided in writing or by other means, including, if applicable,
by electronic means. When requested by the interested party, the information may
provided verbally provided that the identity of the interested party is proven by
other media.
2. The person in charge of the treatment will facilitate the interested party the exercise of their
rights under Articles 15 to 22. In the cases referred to in the
Article 11, paragraph 2, the controller shall not refuse to act at the request of the
interested party in order to exercise their rights under articles 15 to 22,
unless you can show that you are unable to identify the
interested.
3. The person responsible for the treatment will provide the interested party with information regarding their
proceedings on the basis of a request pursuant to Articles 15 to 22, and,
in any case, within one month from receipt of the request.
This period may be extended for another two months if necessary, taking into account
count the complexity and number of requests. The person in charge will inform the
interested party of any of said extensions within a period of one month from the
receipt of the request, indicating the reasons for the delay. When the
interested party submit the request by electronic means, the information is
will facilitate by electronic means when possible, unless the interested party
request that it be provided in another way.
4. If the person responsible for the treatment does not comply with the request of the interested party,
will inform without delay, and no later than one month after receiving the
request, the reasons for not acting and the possibility of submitting a
claim before a control authority and to exercise legal actions.
5. The information provided by virtue of articles 13 and 14 as well as all
communication and any action carried out pursuant to articles 15 to 22 and
34 will be free. When the requests are manifestly unfounded
or excessive, especially due to its repetitive nature, the person responsible for the
treatment may:
a) charge a reasonable fee based on the administrative costs incurred
to facilitate information or communication or carry out the requested action, or
b) refuse to act on the request.
The data controller will bear the burden of proving the character
manifestly unfounded or excessive of the request.
6. Without prejudice to the provisions of article 11, when the person responsible for the
treatment has reasonable doubts regarding the identity of the person
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/5
physicist making the request referred to in articles 15 to 21, may request
that the additional information necessary to confirm the identity of the
interested.
7. The information that must be provided to the interested parties by virtue of articles
13 and 14 may be transmitted in combination with standard icons that allow
provide easily visible, intelligible and clearly legible a
adequate overview of the planned treatment. The icons that are
submitted in electronic format will be machine readable.
8. The Commission shall be empowered to adopt delegated acts of conformity
with Article 92 in order to specify the information to be submitted to
through icons and the procedures for providing standard icons. "
FOURTH: Article 12 of the LOPDGDD determines the following:
1. The rights recognized in articles 15 to 22 of the Regulation (EU)
2016/679, may be exercised directly or through a legal representative or
voluntary.
2. The person responsible for the treatment will be obliged to inform the affected party about the
means at your disposal to exercise the rights that correspond to you. The
means must be easily accessible to the affected person. The exercise of
Right may not be denied for the sole reason of choosing the affected by another
medium.
3. The person in charge may process, on behalf of the person in charge, requests for
exercise made by those affected of their rights if so established in the
contract or legal act that binds them.
4. Proof of compliance with the duty to respond to the request to exercise
Your rights formulated by the affected party will fall on the person responsible.
5. When the laws applicable to certain treatments establish a
special regime that affects the exercise of the rights provided for in Chapter
III of Regulation (EU) 2016/679, the provisions of those will be followed.
6. In any case, the holders of parental authority may exercise on behalf of
and representation of minors under fourteen the rights of access,
rectification, cancellation, opposition or any other that could
correspond to them in the context of this organic law.
7. The actions carried out by the person in charge of the
treatment to meet requests for the exercise of these rights, without
prejudice to the provisions of articles 12.5 and 15.3 of the Regulation (EU)
2016/679 and in sections 3 and 4 of article 13 of this organic law. "
FIFTH: Article 17 of the RGPD provides that:
"one. The interested party shall have the right to obtain without undue delay from the person responsible
of the treatment the deletion of the personal data that concerns him, which
will be obliged to delete without undue delay the personal data when
any of the following circumstances concur:
a) the personal data is no longer necessary in relation to the purposes for which
that were collected or otherwise treated;
b) the interested party withdraws the consent on which the treatment of
in accordance with Article 6 (1) point (a) or Article 9 (2) point
a), and it is not based on another legal basis;
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/5
c) the interested party objects to the processing in accordance with article 21, paragraph 1, and
no other legitimate reasons for the treatment prevail, or the interested party
object to the processing pursuant to Article 21 (2);
d) the personal data has been unlawfully processed;
e) personal data must be deleted to fulfill an obligation
legal established in the Law of the Union or of the Member States that
apply to the person responsible for the treatment;
f) the personal data have been obtained in relation to the offer of services of
the information society mentioned in article 8, paragraph 1.
2. When you have made the personal data public and are obliged, by virtue of
the provisions of section 1, to delete said data, the person responsible for the
treatment, taking into account the available technology and the cost of your
implementation, adopt reasonable measures, including technical measures, with a view to
inform those responsible who are treating the personal data of the
request of the interested party to delete any link to these personal data,
or any copy or replica thereof.
3. Sections 1 and 2 will not apply when the treatment is necessary:
a) to exercise the right to freedom of expression and information;
b) for the fulfillment of a legal obligation that requires the treatment of
data imposed by the law of the Union or the Member States that
applies to the person responsible for the treatment, or for the fulfillment of a mission
carried out in the public interest or in the exercise of public powers conferred on the
responsable;
c) for reasons of public interest in the field of public health in accordance
with article 9, paragraph 2, letters h) and i), and paragraph 3;
d) for archival purposes in the public interest, scientific research purposes or
historical or statistical purposes, in accordance with article 89, paragraph 1, in the
To the extent that the right indicated in paragraph 1 could make it impossible to
seriously impede the achievement of the objectives of such treatment, or
e) for the formulation, exercise or defense of claims. "
SIXTH: In the case analyzed here, the complaining party exercised its right to
deletion and after the period established in accordance with the aforementioned regulations,
your request did not obtain the legally required response.
The aforementioned standards do not allow the request to be ignored as if it were not
had raised, leaving it without the answer that must be issued by the
responsible, even in the event that there is no data of the interested party in the
files of the entity or even in those cases in which it does not meet the
stipulated requirements, in which case the recipient of said request also comes
obliged to request the correction of the deficiencies observed or, where appropriate,
deny the request with reasons indicating the reasons why it is not applicable
consider the right in question.
Therefore, the request that is formulated obliges the person in charge to give an express response, in
In any case, using any means that justifies the receipt of the
reply.
Given that a copy of the necessary communication that must be addressed to the
claimant informing him of the decision he has taken regarding the
request to exercise rights, the claim that originated the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/5
present procedure.
Considering the cited precepts and others of general application,
the Director of the Spanish Agency for Data Protection RESOLVES:
FIRST: ESTIMATE the claim made by A.A.A. and urge ASSOCIACIÓ
FOR POLITICAL PARTICIPATION IN CATALUNYA with NIF G67207472, so that, in
within the ten business days following notification of this resolution,
Send the complaining party a certification stating that you have attended the
right of deletion exercised by the latter or is reasonedly denied indicating the
causes for which the requested deletion does not proceed. The actions carried out
As a consequence of this Resolution, they must be communicated to this
Agency in the same period. Failure to comply with this resolution could lead to
commission of the offense typified in article 72.1.m) of the LOPDGDD, which is
sanction, in accordance with art. 58.2 of the RGPD.
SECOND: NOTIFY this resolution to A.A.A. and ASSOCIACIÓ PER LA
POLITICAL PARTICIPATION IN CATALUNYA.
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the
LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may file, optionally, an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
count from the day after notification of this resolution or directly
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.
1034-080719
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
