AEPD (Spain) - PS/00493/2020
AEPD (Spain) - PS/00493/2020 | |
---|---|
Authority: | AEPD (Spain) |
Jurisdiction: | Spain |
Relevant Law: | Article 6(1) GDPR |
Type: | Complaint |
Outcome: | Upheld |
Started: | |
Decided: | |
Published: | 28.12.2021 |
Fine: | 6000 EUR |
Parties: | Real Club Naútico de Ribadeo |
National Case Number/Name: | PS/00493/2020 |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | Spanish |
Original Source: | AEPD (in ES) |
Initial Contributor: | FA |
The Spanish DPA fined a boating club €6000 for publishing a copy of a judgment containing the personal data of an individual without a valid legal basis under Article 6(1) GDPR.
English Summary
Facts
In September 2019, an individual filed a complaint with the Spanish DPA (AEPD) against a boating club regarding the publication of a non-redacted judgment containing their personal data by the club on its website and Facebook page.
In January 2020, after receiving a notice informing it of the investigation, the boating club responded that it removed the link to the judgment from the relevant pages, but argued that it nonetheless considered the publication to have been lawful due to the legitimate interest (per Article 6(1)(f) GDPR) it pursued.
However, in June 2020 the claimant provided evidence to the AEPD that the judgment was still available on the website if one entered its name into Google search.
Holding
In light of the above, the Spanish DPA held that the boating club unlawfully published the copy of the judgment containing the personal data of the individual, as it could not base such processing on a valid legal basis under Article 6(1) GDPR. It rejected the argument of the boating club that the publication was lawful under Article 6(1)(f) GDPR, citing the judgment in C-13/16 (‘Rīgas satiksme') as the appropriate test to be followed to determine whether processing can be based on legitimate interest:
"first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence.
After a balancing of the public's right to information against the complainant's fundamental right to the protection of their data, the AEPD held that the public benefit in publishing the judgment was insufficient to base the publication on legitimate interest per Article 6(1)(f) GDPR.
As such, the AEPD imposed a fine of €6000 on the boating club for its infringement of Article 6(1) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/16 File No.: PS/00493/2020 RESOLUTION OF PUNISHMENT PROCEDURE From the procedure instructed by the Spanish Agency for Data Protection and based on the following BACKGROUND FIRST: A.A.A. (hereinafter, the claimant) filed a claim on 09/24/2019 before the Spanish Agency for Data Protection. The claim is directed against REAL RIBADEO NAUTICAL CLUB with NIF G27122514 (hereinafter, the claimed). The The reasons on which the claim is based are the publication on the website and on Facebook of the claimed, of the judgment XXX/2019 of the (...) of *** DATE.1 that contains your data personal and those of other people, without anonymizing, even having been appealed (...) by he. The sentence against that of the ***COURT.1 of ***DATE.2, fully upheld the claim action filed by the claimant against the respondent, declaring that the fundamental right fundamental association of the actor and the nullity of the resolution issued by the defendant. Re- the one of the Hearing, appellant the claimed, the sanction of suspension of the ***CONDI- TION.1 with accessory (...), having been the claimant in period XXXX/YYYY, ***POST.1 of the claimed Club. The ruling classifies some actions of the claimant as “(…)” and (…). It also refers to data from other people, such as the previous one *** POSITION 2 of the Club to which another disciplinary was also instructed, or the holder of a vessel that was in (...) and data of persons identifiable as "The (...)". The Judgment partially upholds the claims of the defendant. Provides a copy of the impression of the website and Facebook page of the respondent, in which 3/05 the sentence is mentioned with a link to access it, with reference to sheet printing date of 12/08. SECOND: In accordance with the mechanism prior to the admission for processing of the claims made before the AEPD, provided for in article 65.4 of the Organic Law 3/2018, of 5/12, on the Protection of Personal Data and guarantee of digital rights (in hereinafter, LOPDGDD), which consists of transferring them to the Delegates of Protection of Data designated by those responsible or in charge of the treatment, or to these when they have not appointed them, and with the purpose indicated in the aforementioned article, the ***DATE.3 of your claim E/9792/2019 was transferred to the respondent so that proceed to its analysis and respond within a month. The respondent did not agree to the telematic notification, being the automatic rejection date 8/11/2019. turned to send by postal notification on 8/11/2019. On 01/14/2020, the respondent responded to this request, stating: 1) As a precaution they have canceled the links that allowed access to the full text of the judgment of the Club's website as well as FACEBOOK. It accompanies documents 1 and 2. In the copy of 1, it contains the page on which the owner still leaves to prove the withdrawal informative in which it appears "the (...) sentence that the Real Club náutico de Ribadeo fulfilled C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/16 with all the legal precepts for the (...) of Mr. A.A.A., ratifies the disciplinary file nario initiated at (...), so you will not be able to (...)”. “It is magnificent news that will be given own account in detail at our next assembly in August”, while after in "here you can see the sentence" nothing appears, declaring the defendant who has the link has been disabled. In 2, that mention is also appreciated. 2) Add that the publication is made based on article 6.1 f) of the RGPD. The treatment of data is necessary, since public communication is essential for achieving of the legitimate interest pursued. Has a legitimate interest in publicly denouncing some serious acts committed by (...) of the Club, which damaged the image of the entity and its assets, the content of the ruling being convincing in recognizing not only irregularities but even actions that could entail a criminal offence. Regarding the weighting of the rights and interests in conflict, they will be taken into account: ta: The information is true as long as it appears incorporated in a non-revoked judicial resolution. given to the date of the date, the sentence does not contain any sensitive data, to the content of the sen- possession had public access, not through the publications made by the defendant but from social media. 3) Attach a copy of information disclosed by means of social communication as do- Documents 3,4,5 and 6 (digital newspapers (...), “***DIARIO.1”, “***DIARIO.2” and “***DIARIO.3” indi- stating that all of them are prior to the publication made "by this entity on the day ***FE- CHA.4”. Thus appears one of ***DATE.5 of the “***DIARIO.2” with the name of the claimant and the headline (…). The news commented on various aspects of the judicial resolution connected with the Club management. It indicates that the dissemination on its FACEBOOK page only reached 444 people. document 7, and that the news posted on the Club's website reached 138 people, documents ment 8. THIRD: On 03/13/2020, after analyzing the documentation that was in the file, resolution E/09792/2019 was issued by the Director of the AEPD, agreeing on the claim file. The resolution was notified to the claimant and claimed, to the first on 06/15/2020, considering the suspension of deadlines due to the state of alarm, and according to receipt notice that appears in the file. FOURTH: On 07/08/2020, RR 302/2020 was filed with the AEPD. of the claimant against the file resolution, in which he shows his disagreement with the contested resolution, arguing -among other arguments- that the judgment continues to be published on the website of the respondent as of 06/29/2020 through the following link: ***URL.1, the result of entering the words “judgment ***SENTENCIA.1”, (page 194/220) being the website found for the defendant. Accompany the search result with screen print and access to a 21-page pdf with the sentence as document 1 and 2, with the date printed on the left side of the sheet. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/16 The appeal is signed on 12/17/2020, estimating and agreeing the admission for processing of the claim. FIFTH: On 03/24/2021, the director of the AEPD agreed: “INITIATE PUNISHMENT PROCEDURE against REAL CLUB NÁÚTICO DE RIBADEO, with NIF G27122514, for the alleged infringement of article 6.1 of the RGPD of in accordance with article 83.5.a) of the RGPD. "For the purposes specified in the art. 64.2 b) of Law 39/2015, of October 1, of the Common Administrative Procedure of the Public Administrations, the sanction that could correspond would be a fine of 6,000 euros (six thousand euros) without prejudice to what result of the instruction. Regarding the notification of the start agreement, the certificate of the provider of the notification service and authorized electronic address, of the Factory National Currency and Stamp of 04/05/2021, of which the notification is sent to the claimed with availability 03/25/2021 and automatic rejection date 04/05/2021 that is produced after 10 calendar days have elapsed since it was made available for access according to paragraph two article 43 of law 39/2015 of 1/10. No claims are received. SIXTH: On 11/10/2021, a resolution proposal is formulated with the literal: “That the Director of the Spanish Agency for Data Protection sanction REAL CLUB NAUTICO DE RIBADEO, with NIF G27122514, for an infringement of article 6.1 of the RGPD, typified in article 83.5 of the RGPD, and for prescription purposes in article 72.1.b) of the LOPDGDD with a fine of 6,000 euros.” In it, it was stated: “This proposal is sent by postal mail with the extraordinary purpose that know the notification, although Law 39/2015, of 1/10, of Administrative Procedure Common of the Public Administrations, (LPCAP) establishes the obligation for the legal entities, including associations, to be related electronically with the Public Administrations. At the same time, in order to effective compliance with the measures that may be recorded in the resolution, if the infraction is confirmed, so that the infraction is not repeated or stops occur, since in accordance with article 58.2 d) of the RGPD, each control authority may “order the person responsible or in charge of the treatment that the operations of treatment comply with the provisions of this Regulation, where appropriate, in accordance with a certain way and within a specified period…”. You are also informed that the resolution will be notified electronically.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/16 SEVENTH: On 12/2/2021, allegations are received stating: 1) The situation that gave rise to the complaint originates from an existing conflict between the (...) of which the claimant was part and the one that preceded him (claimant during the period X-XX-XX to X-XX-XX and B.B.B. during the period X-XX-XX to XX-XX-XX). This new (...), from his inauguration, until the arrival of the motion for a resolution, it was only aware that, at the end of her predecessor's mandate, the AEPD had initiated a file at the request of the claimant, "and that it had been archived after completing the Club the indications of the Agency. It is therefore now, when this (...) is aware of the reopening of the file already that she was not informed of this by the claimant nor did she receive any notification from the AEPD. No no electronic notification has been received, or at least there is no record of it, regarding this particular, as things are, it should be noted that an email has been activated to interact with the Tax Agency, from 12/27/2019, being the replacement appeal dated 07-1-20 and the admission for processing of the claim on 12-17-20. Provide a "certificate maintenance telephone data and electronic address to receive notices from the AEAT ", in that they provide an email address and a mobile phone for sending informative notices, and paths crosses in the HIGH section. 2) Prescription of the infraction. Complaint of 09/24/2019, which gave rise to the resolution notified to the claimant on 06/15/2020, E/9792/2019, which appeals for reconsideration, resolving on 12/17/2020 the admission to processing of the claim. Dated 03/24/2021 it was agreed “to restart the procedure that has not been effectively notified to this party until 11/18/2021, that is, two years and two months after the initial complaint, one year and five months from the reversal appeal.” “There being no term for the “a quo day”, it is necessary to resort to the applicable supplementary rule, Article 30, section 2, of Law 40/2015, of 1/10, indicates that "the limitation period for infractions will begin to be counted from the day on which the infraction was committed. task. In the case of continuous or permanent infractions, the term will begin to run since the offending conduct ended. “The limitation period for fines of less than 40,000 euros is one year according to Regulation (EU) 2016/679 and article 78 Organic Law 3/2018, of December 5. According to Article 75. Interruption of the prescription of the infraction: “The prescription shall be interrupted by the initiation, with the knowledge of the interested party, of the sanctioning procedure, restarting the prescription period if the file sanctioning party is paralyzed for more than six months for reasons not attributable to the alleged offender." 3) “Public nature of the ***POSITION.1 of the entity”, the ***POSITION.1 “(…) of the entity and to whom he entrusts his statute (literally) (...). Mentions article XX of the statutes that correlates the representation of the *** POSITION.1 of the Club before people physical or legal, (...). Provide a copy of the Statutes. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/16 4) The claimant (...) as ***POSITION.1 of the Club and as (...) years before the described circumstances. You can make a quick query through the internet browser, so that the person has (...). Accompanies four news urls from several years before of the publication of the judgment on its website. The facts related in the sentence created a situation of enormous conflict and had within the Club, and therefore "in the town of Ribadeo and region" a large public transcendence, both due to the relevance of the characters and the institution. The conflict was widely followed in the media. publishing all the parties the vicissitudes of each and every one of the details of the conflict. The facts related to the imputation caused a relevant consternation in the area and especially among members. There are multiple news links that They follow the procedure from the beginning. 5) The judicial procedure was not only directed against him but also because he had expelled (...) that were processed in different procedures with different results. Although the (...) in the judgment of first instance declared the nullity of the (...), the (...) revoked the sentence, which has been confirmed (…). However, it should be noted that the resolutions contained inculpatory and exculpatory elements and it was considered that their publication turned out to offer the most objective information, without any personal data different from those who were already in the media transcended, since the The only personal information was the name of the (...). There are many links that collect the evolution of the procedure in which the interested party, despite not holding the position, makes public statements about it, without object to being mentioned by name, including including a photograph in the news, for example in the news of 20XX on the first judicial resolution of the Court, there is the news that a judge annuls the sanction against the (...) of the Ribadeo Nautical Club and of the news echoes the “(…)”, when “(…)” Provides a copy of the link in the ***DIARIO.2. The resolution was also reported in the local and provincial media. of the Hearing (...) that give it a certain complexity because it corrects, the previous one and declares proceeding (...), and also includes exculpatory elements. Provide a link to the newspaper ***DIA- RIO.2 in which it indicates the news that is transposed: (...). (...). Also the sentence (...) in the news that appears includes the full name of (...). Contribute the link see the news of ***DIARIO.3 on this resolution (...). 6) There is a legitimate interest of the person claimed in the treatment covered by article 6.1. F) of the RGPD, alluding to the fact that it was a controversial situation between the previous two (...) that resulted in the annulment of the sanctions to ***POST.2 and ***POST.3 but that they kept the (...) of the ***POST.1. There was an obvious legitimate interest in safeguarding the prestige of the entity that obviously includes his public image being the (...) a public figure, reiterating his relevance public that derives from the Statutes. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/16 It was considered by the then ***PUESTO.1, appropriate to transfer the full text of the statement on the Club's website for more information on its members, since that this whole thing was causing a huge stir in the entity and is a means provided, considering that it does not contain "any personal information that affects to the private life of the (...) expelled, public figure”, echoing the media communication from the first resolution that was favorable. A partial translation of the information could have been interpreted as a bias in favor of the performance of the, in new at that time (...), since "not all the irregularities detected”. The publication in its entirety of content in the computer media intended the truthful information about what happened, action proportionate to the end pursued, of special relevance for the 900 members, more than half reside outside Ribadeo, and interested in the activities of the Club, who, being largely vacationers who only they resided for a time, they did not have an easy reach of being known when they were published in the media local and regional. 7) “In the resolution that is transferred to us, there is not a single personal data that affects the complainant's private life. There is no home address, email or number of personal identification. “The information contained in the sentence is referred to in the regional press in great detail” 8) “This (...) contacts the technician who maintains the page and asks him to check the facts and eliminate any access that could have been hidden to the sentence”, “find the statement file in the media library so the document although it was no longer accessible from the web, it was still available through links indexed in search engines, deleting the file from the folder.” “It is no longer accessible from the seekers”. He considers that at the time they canceled the website he did not have adequate knowledge because he was unaware of the existence of the media library, and Although they acted in good faith, I was not aware of that aspect, considering that there was no intent. A call to the Club could have led to the definitive deletion of the file. "The reopening of the file is produced by the survival of an indirect channel -Google- by the that the sentence was still being accessed, due to a technical error, not to bad will, and The Club received no notification of the problem. 9) The entity is a non-profit sports association. It also provides: - The news that result from the indicated links. -Copy of "actions on the website of the claimed" in which it is stated that an order was given delete the document, which checks the web and that “it had been deleted from the web, the entry in the that said document appeared and had even deleted from the ticket bin. But, surely due to ignorance on the matter, he had not eliminated the document from the media page. So the document, although not from the web, was still available from links indexed in search engines” “We proceeded to eliminate of said document from the media area, being totally inaccessible”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/16 PROVEN FACTS 1) On 09/24/2019, the claimant claims against the respondent for being exposed in open in pdf format, on its website and on its Facebook, on 05/03/2019, a sentence of the (...) of ***DATE.1 that contains your personal data, also stating that you had been appealed (...). The sentence resolves at the request of the defendant the appeal on the sanction of suspension of the ***CONDITION.1 of three years with (...) who had been imposed by the claimant. The claimant was in the period ***PERIODO.1, ***POSITION.1 of the claimed Club, and the sanction originates because the new (...) arising from the elections of November XXXX detects a series of irregularities that end in the sanction imposed on the reclaimed. The sentence reviews the actions of the claimant in different matters related to the management of the Club (...), its repercussion with (...) the Club, and if it appears justified sanction. In the sentence, the then *** position 2 of the Club is made identifiable, also informing disciplinary file was followed. 2) Although after the transfer of the claim to the respondent made by the AEPD, the claimed on 01/14/2020 that it had canceled the access links to the full text of both links, the claimant proves, by entering 06/29/2020 in the search engine GOOGLE the words “sentencia ***SENTENCIA.1” the return of the url ***URL.1, which is a 21-page pdf with the judgment object of the claim. 3) The digital media (...) exposed the news of the sentence as example, on ***DATE.5 with the name of the claimant and the headline “(…)” and that the claimant he states that he will appeal it (...). The news commented on various aspects of the judicial resolution connected with the management of the Club. 4) After the proposal, the respondent states that she removed the document that enabled the access in the browser. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of Regulation (EU) 2016/679 of the Parliament European and Council of 04/27/2016 regarding the protection of natural persons in the regarding the processing of personal data and the free circulation of these data (as far hereafter, GDPR); recognizes each control authority, and according to what is established in the articles Articles 47 and 48 of Organic Law 3/2018, of 5/12, on the Protection of Personal Data and ga- guarantee of digital rights (hereinafter LOPDGDD), the Director of the Agencia Es- Spanish Data Protection Authority is competent to initiate and resolve this procedure. unto II On the fact that the initiation agreement was not notified, there is a certificate from the Fa- National Currency and Stamp Factory that verifies its availability, with respect to a entity obliged to communicate with these means. It is also credited that on other occasions telematic shipments have been produced to the claimed, and he did not access them either. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/16 mos. The method of sending the proposal was made in order to facilitate the knowledge and defense sa of your rights to avoid non-collection of the shipment again. The initiation agreement notifies and the passage of time without accessing it produces the effects of having been notified fallen. Regarding the prescription of the infraction, it is taken as the end date of the same, and as more favorable to the claimant, since it does not provide the date of completion of the data deletion, the of the notified proposal, which serves for the cessation of the infraction: 11/18/2021, and this Infraction carries a three-year statute of limitations, according to the article of the LO- PDGDD. Counting from any date, filing of the claim: 09/24/2019, fe- the date in which he responded to the transfer, or that of 01/14/2020 in which he stated that they had been eliminated data, or from the date of agreement to start the sanctioning procedure, 03/24/2021, the infraction would not be prescribed, as article 72.1.b) of the LOPDGDD. III The RGPD defines in its article 4: 1) "personal data": any information about an identified or identifiable natural person ("the interested"); An identifiable natural person shall be deemed to be any person whose identity can be determined, directly or indirectly, in particular by means of an identifier, such as for example a name, an identification number, location data, an identifier online or one or more elements of the physical, physiological, genetic, psychic, economic, cultural or social of said person;” 2) “processing”: any operation or set of operations performed on data personal data or sets of personal data, whether by automated procedures or not, such as the collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of authorization of access, collation or interconnection, limitation, suppression or destruction; 7) “controller” or “controller”: the natural or legal person, authority public, service or other body that, alone or jointly with others, determines the ends and means of the treatment; if the law of the Union or of the Member States determines the purposes and means of treatment, the person responsible for treatment or the specific criteria for its appointment may be established by the Law of the Union or of the Member States; The defendant exposes a complete sentence with the data of a person, member of the Club to the that (...), and (...) of the Club that appeared in two spaces, the website and FACEBOOK of the claimed party, if well as of 06/29/2020, it only refers to the website of the claimed party when a search in the GOOGLE search engine with the terms “sentencia ***SENTENCIA.1” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/16 The defendant had stated in the previous transfer that she had removed the links precautionary to the sentence. These facts suppose the commission of the defendant of an infraction of article 6.1 of the RGPD that indicate the legitimate bases for the treatment: "one. The treatment will only be lawful if at least one of the following conditions is met: a) the interested party gave his consent for the processing of his personal data for one or several specific purposes; b) the treatment is necessary for the execution of a contract in which the interested party is part or for the application at the request of the latter of pre-contractual measures; c) the treatment is necessary for the fulfillment of a legal obligation applicable to the data controller; d) the treatment is necessary to protect the vital interests of the interested party or another Physical person; e) the treatment is necessary for the fulfillment of a mission carried out in the interest public or in the exercise of public powers vested in the data controller; f) the treatment is necessary for the satisfaction of legitimate interests pursued by the responsible for the treatment or by a third party, provided that said interests are not prevail the interests or the fundamental rights and freedoms of the interested party that require the protection of personal data, in particular when the interested party is a child.” The defendant, a party to the civil judicial proceeding, establishes the technical and organizational and decides as responsible to enable access to the judgment in full with all personal data when adding it to your website and on FACEBOOK. Probably was not properly deindexed and is accessible through search engines, throwing the same literal as when the links existed. The sentence treats the data of the claimant in relation to the challenge of the disciplinary sanction imposed by the claimed, sports association. The (...) of the Club that succeeded that of the claimant, detected a series of irregularities and initiated the aforementioned disciplinary file. The judgment reviews the actions of the imputed claimant reproaching him for his conduct in the management of the Club affairs. It refers to the right of association and the private disciplinary sphere and the application and statutory legitimacy of the Club. The defendant is the one who exposed it in the open, not only for the partners, the sentence. He argues in the transfer of the claim that there was in his day, as a legitimizing basis, the article 6.1.f) of the RGPD considering that your right to information and has a legitimate interest in communicating the facts to the general public, (...), adding that days before several written media outlets had echoed the news identifying the claimant with the facts. To be legitimate data processing based on legitimate interest, three must be fulfilled: cumulative requirements, namely, first, that the data controller or third party zero or third parties to whom the data is communicated pursue a legitimate interest; second Firstly, the need to process personal data to satisfy the legitimate interest C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/16 persecuted, and, thirdly, the requirement that rights and freedoms do not prevail. fundamental rights of the interested party (judgment of May 4, 2017, Rīgas satiksme, C- 13/16, EU:C:2017:336, paragraph 28). In this case, the concurrence of two fundamental rights recognized in the Constitution: the fundamental right to the protection of personal data of the people whose data appear collected in the judicial resolutions, mainly the claimant and the fundamental right to freedom of information of the association, the Club that publishes collide and the defendant considers that he has the right to the aforementioned exposition. However, the relevance of the position and responsibility of the claimant is not public character, it is an association, in fact the news is offered in local newspapers, It is not a criminal matter either, but a civil matter that concerns the members of the Club, and it must be question whether said purpose of informing can be feasible without exposing personal data contained in a sentence in which one has been a claimed party and at the same time disciplinary instructor, and if this is in accordance with the principle of proportionality and adequacy in the use of the data. On the other hand, this prevalence among rights must be based on exceptions to the application of data protection regulations “only to the extent that they result necessary to reconcile the right to privacy with the rules governing the freedom of expression and information. In this sense, and expressing ourselves in the terminology established in the LOPDGDD, the exceptions to the application of said rule must be understood as manifestations of the principle of proportionality, enshrined in the Article 5.1 c) of the Organic Law, according to which "Personal data will only be may collect for treatment, as well as submit them to such treatment, when they are adequate, relevant and not excessive in relation to the scope and purposes determined, explicit and legitimate for which they have been obtained”. Does this mean that The disclosure of information containing personal data should be considered lawful. in the cases and areas in which said disclosure is adequate, pertinent and not excessive in relation to the free exercise of freedom of information. In this way, the information to be disclosed should be that which is necessary so that information are relevant to the interests of the association can be known by their members, understanding public relevance as that which serves the general interest in the information and does so by referring to a public matter such as facts or events that affect all citizens. However, this is not about expressing information or communicating facts that are not discussed are real, but a document, the sentence integrates in open, with all the details, not aspects or comments of it, which are exposed outside the circle of Club members, to whom the Statutes are applicable, and in pdf format which means more versatility in sending, downloading and forwarding. The information of the management of the association, the loss of their property or assets affects the 900 associated with said entity, by circle to which the management of those interests reaches and they could have been informed of the sense of it. The respondent indicates that since many of the partners do not reside in the municipality, and that the integrated publication contributes to the objectivity of the information, being reasons for exposure. It is not disputed that it may be important and that they are the partners who must be informed and could have had knowledge, although it could be and the scope of exposure, knowledge, should have been limited only to associates, not There is a need for universal dissemination of the same, in the aforementioned format. With the exposure of discloses the data of the claimant in the exercise of their functions of the association and the information of its management that concerns the associates in a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/16 civil matter. Proportionality is not fulfilled in the treatment for the purpose of inform the partners and the affected rights of the claimant are not considered, so the prevalence of the legitimate interest in the open exhibition of the civil sentence integrates and its possible consultation in the search engine. On the other hand, the fact that the judicial proceedings are public does not justify that these data were revealed in an area other than the judicial process, and that they are exposed in addition to a complete form outside the scope in which it is properly affected and concerned by the performances of the (...). It has been the defendant who has decided to include a copy of the effective judgment on his website. performing a technical operation in which it has made it possible for anyone to have Knowledge of the sentence integrates with the data of the claimant. For this, the claimed associated the sentence to its website, considering that the automated treatment by which offers on its website and through the search engine, obtaining the sentence is a treatment of data. In the present case, moreover, the judgment was not final, his appeal was pending. The respondent treats the claimant's data exposing the entirety of the sentence in its open web, not restricted to its partners. In this case, the information exercise of the claimed is only related to the faculties it represents, its associates and the management related to them. The prevalence of the right to freedom of information on the right to data protection must be interpreted consistently with what is provided in the data protection regulations, considering this exception to the application of data protection regulations only to the extent that they result necessary to reconcile the right to privacy with the rules governing the freedom of expression and information. In this sense, to inform, in this case the sentence integrates, completely dealing with everything related to the matter in an irrelevant way and excessive by an entity that represents the interests of a group, individuals, a association not of a public nature, and treating the data for all people by having universal access on its website, not being a criminal matter but an internal disciplinary one, considering that the treatment that takes place through the incorporation and automation of the consultation on its website, does not respond to the scheme of article 6.1.f) of the RGPD, since the right to know the full sentence does not prevail by any person, on the affected party's right to privacy, given the broad terms in which it is produces, not necessary in its universal dissemination when it affected the interests and efforts of the associates. The ***POSITION.1 represents the institution, both in public spheres as private, against individuals or legal entities, private or public, which does not mean that is or holds in itself a public representation as claimed by the defendant. The right of the claimant, so that their data is not used either in a surprising way, or in social networks, or web associated with an integral sentence with access for third parties must then prevail over the general exposure obtained from the search. Therefore, the allegation of the defendant of legitimacy of data processing is not upheld. of the publication of the full judgment of the claimant as optional based on his interest alleged legitimate IV Article 83.5 a) of the RGPD, considers that the infringement of “the basic principles for the treatment, including the conditions for consent under articles 5, 6, 7 and C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/16 9” is punishable, in accordance with section 5 of the aforementioned article 83 of the aforementioned Regulation. regulation, with administrative fines of a maximum of €20,000,000 or, in the case of a company, of an amount equivalent to a maximum of 4% of the total turnover annual global of the previous financial year, opting for the highest amount. Article 58.2 of the RGPD provides: "Each control authority will have all the following corrective powers indicated below: d) order the person in charge or in charge of the treatment that the operations of treatment comply with the provisions of this Regulation, where appropriate, in accordance with a certain way and within a specified period; i) impose an administrative fine under article 83, in addition to or instead of the measures mentioned in this section, according to the circumstances of each case particular; The infraction is typified in article 72 of the LOPDGDD, which indicates: "one. Based on the provisions of article 83.5 of Regulation (EU) 2016/679, considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned therein and, in particular, the following: b) The processing of personal data without the concurrence of any of the conditions of legality of the treatment established in article 6 of Regulation (EU) 2016/679.” v The determination of the sanctions that should be imposed in this case requires observing the provisions of articles 83.1 and 2 of the RGPD, precepts that, respectively, have ne the following: "one. Each control authority will guarantee that the imposition of administrative fines in accordance with this article for the infringements of this Regulation indicated in sections 4, 9 and 6 are in each individual case effective, proportionate and dissuasive.” "two. Administrative fines will be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures referred to in article 58, section 2, letters a) to h) and j). When deciding to impose an administrative fine and its amount aunt in each individual case will be duly taken into account: a) the nature, seriousness and duration of the offence, taking into account the nature, scope or purpose of the treatment operation in question, as well as the number of affected parties and the level of damages they have suffered; b) intentionality or negligence in the infringement; c) any measure taken by the controller or processor to alleviate the damages suffered by the interested parties; d) the degree of responsibility of the person in charge or of the person in charge of the treatment, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/16 account of the technical or organizational measures they have applied under articles 25 and 32; e) any previous infringement committed by the person in charge or the person in charge of the treatment; f) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate the possible adverse effects of the infringement; g) the categories of personal data affected by the infringement; h) the way in which the supervisory authority became aware of the infringement, in particular lar if the person in charge or the person in charge notified the infringement and, if so, to what extent; i) when the measures indicated in article 58, section 2, have been ordered previously against the person in charge or the person in charge in question in relation to the same matter, compliance with said measures; j) adherence to codes of conduct under Article 40 or to certification mechanisms fication approved in accordance with article 42, and k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” Within this section, the LOPDGDD contemplates in its article 76, entitled "Sanctions and corrective measures": "one. The sanctions provided for in sections 4, 5 and 6 of article 83 of the Regulation (EU) 2016/679 will be applied taking into account the graduation criteria established in the section 2 of the aforementioned article. 2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679, also may be taken into account: a) The continuing nature of the offence. b) The link between the activity of the offender and the performance of data processing personal. c) The profits obtained as a result of committing the offence. d) The possibility that the conduct of the affected party could have led to the commission of the infringement. e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the absorbing entity. f) Affectation of the rights of minors. g) Have, when not mandatory, a data protection officer. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 14/16 h) Submission by the person in charge or person in charge, on a voluntary basis, to alternative conflict resolution mechanisms, in those cases in which there are disputes between them and any interested party. 3. It will be possible, complementary or alternatively, the adoption, when appropriate, of the remaining corrective measures referred to in article 83.2 of the Regulation (EU) 2016/679.” In accordance with the precepts transcribed, in order to set the amount of the sanction of a fine to impose in the present case for the infringement of article 83.5.a) of the RGPD, of which holds the claimed party responsible, they are considered concurrent as aggravating following factors that reveal greater unlawfulness and/or culpability in the conduct of the reclaimed: -Article 83.2.a) RGPD: Nature, seriousness and duration of the infraction taking into account account the nature, scope or purpose of the treatment operation in question as well such as the number of interested parties affected and the level of damages they have suffered. suffered. Originally, the entire sentence, despite the possibility of being able to appeal, appeared exposed at the same time in two links, the web and the FACEBOOK page, not implementing ultimately an effective data removal mechanism. -Article 83.2.b) GDPR. “Intentionality or negligence in the infringement”: Aspect that relates the execution of the action to the subject, in the sense of not only imputability of the infraction to its responsible, but the fact of being able to aggravate or reduce the sanction according to the degree of guilt. Regarding the imputability to the responsible subject, the principle of guilt, prevents the admission in the sanctioning administrative law of the strict liability, although it is also true that the absence of intentionality It is secondary since this type of infraction is normally committed by a guilty or negligent action which is sufficient to integrate the subjective element of the guilt. What is valued in this section is its analysis for the graduation of the sanction (art. 40 LRJPAC), observing the specific diligence displayed in the action by the responsible, which excludes the imposition of a sanction, solely based on the mere result, that is to say to the principle of strict liability. The succession in the (...)s does not exempt of the administrative responsibility for the actions produced in the preceding ones, nor may suppose an eventual change, a blur in the enforceability of behaviors that have been produced and recognized. Having the claimed the possibility of having acted differently than you did, the claim was moved and not all links were removed to the sentence, proving lack of diligence. -Article 83.2.c) “any measure taken by the data controller or data processor to alleviate the damages suffered by the interested parties” Failing to eliminate of the data, it follows that it did not have adequate and effective measures to eliminate the data. Considering the exposed factors, the valuation reached by the fine for the im- putada is 6,000 euros, without prejudice to what results from the instruction of the procedure. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 15/16 Therefore, in accordance with the applicable legislation and having assessed the graduation criteria of the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE REAL CLUB NÁUTICO DE RIBADEO, with NIF G27122514, by an infringement of article 6.1 of the RGPD, in accordance with article 83.5 a) of the RGPD and 72.1.b) of the LOPDGDD, a fine of 6,000 euros. SECOND: NOTIFY this resolution to the REAL CLUB NÁUTICO DE RIBADEO. THIRD: Warn the sanctioned person that he must make the imposed sanction effective once that this resolution is enforceable, in accordance with the provisions of art. 98.1.b) of Law 39/2015, of October 1, of the Common Administrative Procedure of the Public Administrations (hereinafter LPACAP), within the voluntary payment period established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, through its entry, indicating the NIF of the sanctioned and the number of procedure that appears in the heading of this document, in the restricted account nº ES00 0000 0000 0000 0000000, opened in the name of the Spanish Protection Agency of Data in the banking entity CAIXABANK, S.A.. Otherwise, it will be processed collection in executive period Received the notification and once executed, if the date of execution is between the days 1 and 15 of each month, both inclusive, the term to make the voluntary payment will be until the 20th day of the following month or immediately after, and if it is between the days 16th and last of each month, both inclusive, the payment term will be until the 5th of the second following or immediately following business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution It will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a period of one month from the day following the notification of this resolution or directly contentious appeal before the Contentious-Administrative Chamber of the National High Court, with in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative Jurisdiction, within two months from the day following the notification of this act, according to the provisions of article 46.1 of the aforementioned Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, it may be precautionary suspension of the firm decision in administrative proceedings if the interested party expresses its intention to file a contentious-administrative appeal. If this is the case, the The interested party must formally communicate this fact in writing addressed to the Agency Spanish Data Protection, presenting it through the Electronic Registry of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 16/16 Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the remaining records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the filing effectiveness of the contentious-administrative appeal. If the Agency were not aware of the filing of the contentious-administrative appeal within two months from the day following the notification of this resolution, it would end the suspension precautionary 938-26102021 Sea Spain Marti Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es