AEPD (Spain) - PS/00003/2021
AEPD (Spain) - PS/00003/2021 | |
---|---|
Authority: | AEPD (Spain) |
Jurisdiction: | Spain |
Relevant Law: | Article 5(1)(c) GDPR Article 12 GDPR |
Type: | Complaint |
Outcome: | Upheld |
Started: | |
Decided: | |
Published: | |
Fine: | 300000 EUR |
Parties: | n/a |
National Case Number/Name: | PS/00003/2021 |
European Case Law Identifier: | n/a |
Appeal: | n/a |
Original Language(s): | Spanish |
Original Source: | AEPD (in ES) |
Initial Contributor: | Jennifer Vidal |
The Spanish DPA fined Page Group Europe €300,000 for violating Articles 12 and 5(1)(c) GDPR for non-compliance with the right of access and data minimization principle resulting from a documentation request for data subject’s authentication.
English Summary
Facts
The controller is Michael Page International, a company based in the United Kingdom, and the parent company of the PageGroup business group. It is an employment agency and operates under various brands, including “Michael Page”. It has subsidiaries in many European countries, with the Dutch subsidiary being the Michael Page entity International - Nederland B.V. The data subject, who is a Dutch citizen that had created an account on the web portal of the controller, submitted an access request on 28 September 2018. The controller, however, requested further documentation to verify the identity of the data subject. Since the data subject found this request to be excessive, he lodged a complaint with the Dutch DPA (AP).
After the AP contacted the Dutch subsidiary, the subsidiary explained that, although the corporate group's headquarters are located in the United Kingdom, the legal department (compliance team, responsible for managing access requests exercised by data subjects) is located in Barcelona, Spain. Hence, according to the Spanish DPA (AEPD), this establishment is the main establishment by the definition of Article 4(16) GDPR, and therefore declared its competency to act as the lead supervisory authority under Article 56(1) GDPR.
The AEPD then investigated the controller's procedure of dealing with access requests and concluded that these procedures complied with the GDPR. Hence, the DPA considered that there were no indications of infringement and that no further action was necessary. After sharing this draft decision with the other interested DPA's (see more info in comment), the Portuguese DPA (CNPD) and The Berlin DPA (BInBDI) opposed this conclusion after reviewing the contents of the Draft Resolution as interested authorities. They considered that there were multiple violations (Article 12, 5(1)(c), 25, and 32 GDPR) because, in order to make access to data subjects' personal data feasible, additional information should only be requested in case of doubts about the identity of the interested party.
The AEPD then reconsidered their initial decision.
Holding
The AEPD considered that the claim of the data subject right regarding the lack of attention to the right of access revealed a general action taken by the controller, the case demonstrates a guideline or policy applied to all those affected who are in the same case as the complainant.
The Spanish authority highlighted that the European regulation and the Spanish data protection law are clear in stating that the entitlement verification process must take place when there are reasonable doubts regarding the identity of the person who made the request, that is, the existence of doubts reasonable figures are a prediction to the collection of additional information to verify the identity.
In this regard, the AEPD concluded that Page Group Europe did not prove the existence of reasonable doubts that would justify the requirement to send documentation for authentication of the holder, but adopted the procedure as narrated by the complainant as a standard.
The AEPD stressed that the case does not present as one in which there are doubts about the identity of the applicant, since the request for access to personal data was made from the same e-mail address used by the complainant when registered the curriculum in the systems information of the defendant, which offered sufficient guarantees as to his identity. Additionally, the complainant is responsible for not complying with the request for access to personal data within the deadline, which only occurred after the processing of the complaint by the authority.
Additionally, the AEPD concluded that the controller violated article 5(1)(c) GDPR, highlighting that the procedure adopted to comply with the rights of personal data subjects goes beyond what is laid down in the regulations, resulting in inappropriate personal data processing activities not relevant and not necessary for the purpose of the case – which is the opposite of what Article 25 GDPR says regarding the context, risk and purposes of the processing activities.
Finally, the Spanish authority understood that the violation of article 12(2)(3) GDPR was proven due to the non-compliance with the right of access exercised by the claimant, emphasizing that this result was due to the strict requirements imposed for processing the data subject’s request, that was only answered in fact during the processing of the complaint by the authority.
Comment
Comments Michael Page Group:
Page Group Europe requested the initial criteria of the Spanish authority to be maintained and the consequent shelving of the punitive procedure or that the proposed fine be reconsidered, evaluating the warning provided for in the regulation after being notified of the initiation of a sanctioning procedure.
Page Group substantiated its requests taking into account, among others, the following arguments: good faith and the will to comply that governed its actions and the internal policies applied, inexistence of criteria to guide the review of its policies when the adequacy of the same to the GDPR between 2016-2018, the existence of studies and statistics that demonstrate the hypothesis that the request for the right to access the GDPR may be a point of vulnerability to social engineering attacks.
On sharing info with other DPA's - IMI System
In Article 60 cases (where there is cooperation between the lead DPA and other DPA's), the DPA's share information via the so-called IMI System. The AP corresponded information on the case via this system initially, and also the draft- and final decision where shared in this system for other DPA's to provide comments. In this procedure, many DPA's "declared their interest", namely the DPA's of the Netherlands; Belgium; Ireland; Poland; Italy; Hungary; Portugal; Cyprus; Austria, as well as the German states North Rhine-Westphalia; Rhineland-Palatinate, Mecklenburg-Western Pomerania; Berlin; and Bavaria.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/37 File No.: PS/00003/2021 RESOLUTION OF PUNISHMENT PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: Dated 03/03/2020, through the “Market Information System Interior” (hereinafter IMI), regulated by Regulation (EU) No. 1024/2012, of the European Parliament and of the Council, of October 25, 2012 (IMI Regulation), whose objective is to promote cross-border administrative cooperation, mutual assistance between the Member States and the exchange of information, was received in this Spanish Agency for Data Protection (AEPD) a claim dated 12/23/2018, formulated by A.A.A. (hereinafter the claimant) before the authority of Netherlands data protection (Autoreit Persoonsgegevens -AP). The transfer of This claim to the AEPD is made in accordance with the provisions of article 56 of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 04/27/2016, regarding the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Circulation of these Data (as successive General Data Protection Regulation or RGPD), taking into account its cross-border nature and that this Agency is competent to act as main controlling authority. The aforementioned claim is made against the entity "Michael Page International" for the following reasons: . The claimant, a Dutch citizen, opened an account in the Dutch version of the web portal of Michael Page International, accessible at the URL “***URL.1”, and sent by that channel, in March 2018, a Curriculum Vitae (CV) to obtain a position of work offered by the Dutch branch of the group PageGroup. a few months later, he requested access to his personal data through the e-mail address indicated in the Privacy Policy of the web portal, “***EMAIL.1”. In response to the aforementioned request for access, initially, the entity responsible required the claimant to contribute (...). However, after protesting the applicant, who considered the request for documentation excessive, Michael Page International rectified (…). . The claimant considers that there is no reason to request that information identification, (...), nor to send a CV in order to apply for a job. The claimant understands that authenticated access to the account, which is still active, should be sufficient to understand exercised the right of conformity and accredited the identity of the applicant in a system such as the one used by the person in charge, based on the use of a private account. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 2/37 A copy of the correspondence maintained by the complainant with the data controller following the request for access, formulated on 09/28/2018, which was also attached. this correspondence It is outlined in Proven Facts 4 to 9. The documentation for this claim was completed through an assistance volunteer in IMI, sent by the entity Autoreit Persoonsgegevens dated 05/12/2020, incorporating the query that the Dutch authority made to the establishment that the PageGroup group has in the Netherlands (Michael Page International - Nederland Bv), in the Dutch language, on decision making related to the means and purposes of the processing of personal data that affect residents of the Member States. In the response offered by that establishment to the aforementioned query, in the English, it is indicated that, despite the fact that the headquarters of the business group is in United Kingdom, the department in charge of managing requests for access for continental Europe is the Legal Compliance team, located in the Shared Services located in Barcelona (Spain). The mailing address of said department is indicated in the Privacy Policy of the Dutch version of the web page of the person in charge, accessible at the URL “***URL.2”. According to said answer, the Spanish establishment of the business group would be the main establishment, in the sense of the definition of article 4.16 of the GDPR. Thus, in accordance with the provisions of article 56.1 of the RGPD, dated 05/21/2020, the AEPD declared itself competent to act as a control authority main (LSA). According to the information included in the IMI System, in accordance with the established in article 60 of the RGPD, have declared themselves interested in this procedure, in addition to the control authority that has communicated the case (Countries the Netherlands), those of Belgium, Ireland, Poland, Italy, Hungary, Portugal, Cyprus and Austria, as well such as the German regions of North Rhine-Westphalia, Rhineland-Palatinate, Mecklenburg-Western Pomerania, Berlin and Bavaria Private Sector. SECOND: In accordance with the procedure established in the internal national legislation (article 64.3 of Organic Law 3/2018, of December 5, on Data Protection Personal Rights and Guarantee of Digital Rights -LOPDGDD), dated 06/11/2020, the AEPD transferred the aforementioned claim to the Spanish establishment of the group PageGroup based in ***LOCALITY.1, that is, the company PAGE GROUP EUROPE, S.L. (hereinafter PAGE GROUP EUROPE or claimed entity), to that within a period of one month prove that they have responded to the request of the claimant, report on the causes that led to the incidence produced and detail the measures adopted to avoid similar situations. In response to this request, PAGE GROUP EUROPE provided the communications maintained with the claimant and stated the following: . They explain that they are a company that is part of a business group dedicated to Human Resources services, specifically, to the selection of personnel. for this C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 3/37 reason, they process personal data of a large number of candidates in many countries of the world, being very common the exercise of rights by candidates. For the processing of the corresponding requests, in compliance of its duty of confidentiality and secrecy, has implemented a strict process of identity verification to ensure that candidates' personal data is not are transferred to third parties, who have been able to obtain the access credentials of people registered in their systems with the purpose of supplanting their identity and make the request on your behalf, through phishing attacks or social engineering. In the particular case of the claimant, they have not tried to put obstacles to the exercise of your rights, but to protect your personal data. (...). (...). On this question, provide a copy of the "Answer Models" used currently to verify the identity of the interested parties. (...). Subsequently, by letter dated 08/14/2020, this Agency requested PAGE GROUP EUROPE “copy of the response to the request for access raised by the claimant, since his identity has been proven through the process of claim, initiated before the control authority of the Netherlands and continued in this Agency”. After this request, the aforementioned entity proceeded to answer the request for access made by the claimant and provided this Agency with a copy of the communication, dated 08/27/2020, through which it informs it about the aspects of the treatment established in article 15 of the RGPD, as well as the annex with the personal data of the claimant in their possession. In the writing of response to this Agency indicates that the information was sent by mail electronic. THIRD: After reviewing the response provided by the claimed company, outlined in the previous Fact, this Agency appreciated that, at present, the procedures followed by PAGE GROUP EUROPE for the attention of rights in terms of data protection, in relation to the identification of applicants, conform to the applicable regulations. (...). In addition, it was taken into account that, after the intervention of this Agency, the request for claimant's access was addressed. Consequently, it was considered that there were no indications of infringement and that there was no no further action was necessary, nor was it necessary to urge the adoption of measures additional, therefore, on 11/10/2020, a Draft Resolution of claim file (Draft decision). FOURTH: On 11/10/2020, the Draft Decision was incorporated into the IMI System so that the interested authorities could express themselves in this regard. At the end of the established term, they formulated objections to the aforementioned file project the data protection authorities of Portugal (CNPD) and Berlin (The Berlin Commissioner for Data Protection and Freedom of Information -Berlin DPA). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 4/37 The CNPD states that PAGE GROUP EUROPE has implemented a rights attention procedure (...)., not having specified that in the case of the claimant had doubts regarding her identity. Consider that the The aforementioned entity has not adjusted its actions to the provisions of article 12.2 of the RGPD, which obliges the controller to facilitate the exercise of rights, unless can identify the applicant, in which case article 12.6 of the RGPD allows requesting additional identifying information. The CNPD also understands that the procedure followed by the entity responsible does not protect the data of the applicants, since the treatment of the documents identification requirements increases the risks for those affected (eg possible use for identity theft); (...). The Portuguese authority thinks that this violates the principle of minimization (article 5.1.c) of the RGPD), that of privacy by default and from the design (article 25 of the RGPD) and that of security measures (article 32 of the GDPR). The CNPD advocates a less intrusive way of verifying the identity of the applicant (e.g. electronic identification or submit the application through the account of user together with an additional authentication factor sent by a different channel). Berlin DPA, for its part, also appreciates infringement of article 12 of the RGPD, paragraphs 2, 3 and 6, for reasons similar to those stated by the Portuguese authority. Considers that additional information should only be requested if there are doubts about the identity of the interested party, requesting necessary and appropriate information for that verification, based on the applicant's available data; and do not share alleged justification on the possible risk of spoofing e-mail addresses. Likewise, (...), Berlin DPA understands that it cannot be used to carry out verifications, or, at least, it would not be the most appropriate way, and declares itself in accordance with the the claimant's appreciation according to which the registered access to the private account it would be more than enough. Berlin DPA points out a possible infringement of article 12.3 of the RGPD because the person in charge did not answer within a month counted from the remission of the request. He opposes the claim being rejected and considers it appropriate to identify the infractions and adopt corrective actions against the person in charge, so that it can correct their procedures to avoid putting the rights of others at risk applicants or the obstacles in their exercise. FIFTH: The objections raised by the authorities of the protection of data indicated in the previous Antecedent and, on 12/11/2020, it was agrees to admit for processing the claim communicated by the authority for the protection of data from the Netherlands (Autoreit Persoonsgegevens -AP), for the alleged infringement of what is established in article 15 of the RGPD, without prejudice to what may be determined in the course of processing said claim. SIXTH: Dated 02/26/2021, by the General Subdirectorate for Data Inspection you access the website "www.michaelpage.es" and obtain information available on PageGroup. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 5/37 In the corporate information that appears in the “Who we are” section of said website indicates: “PageGroup is the leading international consulting firm in the selection of qualified managers, intermediate and managers on a temporary and indefinite basis. It was established in the UK in 1976 and since 2001 listed on the London Stock Exchange. With a network of 140 own offices, We operate in 36 countries around the world. In Spain we offer nationwide coverage with physical offices in Madrid, Barcelona, Valencia, Seville, Bilbao and Zaragoza through the which we provide recruitment services and career opportunities at the local, regional and global. Within the group we have different brands, each an expert in its market” (...). (...). (...). SEVENTH: Dated 06/02/2021, in accordance with the provisions of article 64 of the LOPDGDD, sections 2 (third paragraph) and 3, a draft resolution of start of sanctioning procedure, motivated by the claim received through the IMI system that is outlined in the First Precedent. This project takes consideration the objections outlined in the Fourth Precedent (draft of revised decision). Following the procedure established in article 60 of the RGPD, dated 03/13/2020, the aforementioned project to open the sanctioning procedure was transmitted via the IMI System to the supervisory authorities concerned, letting them know that, in the event that no objections are raised within the two weeks from the consultation, the mandatory agreement to open the penalty procedure. None of the control authorities concerned has raised any objection to the draft agreement to open sanctioning proceedings adopted by the AEPD, understanding, therefore, that there is an agreement on it. EIGHTH: On 06/29/2021, the Director of the Spanish Protection Agency of Data agreed to initiate a sanctioning procedure against the entity PAGE GROUP EUROPE, in accordance with the provisions of articles 63 and 64 of Law 39/2015, of 1 of October, of the Common Administrative Procedure of the Public Administrations (hereinafter, LPACAP), for the alleged violation of articles 5.1.c) and 12 of the RGPD, typified in articles 83.5.a) and b) of the same Regulation, respectively; determining that the sanction that could correspond would amount to a total of 300,000 euros (250,000 euros for the infringement of article 5.1.c) and 50,000 euros for the infringement of article 12, both of the RGPD), without prejudice to what results of instruction. In the same agreement to open the procedure, it was warned that the infractions imputed, if confirmed, may lead to the imposition of measures, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 6/37 NINTH: Notification of the aforementioned initial agreement and extension of the term granted for make allegations, PAGE GROUP EUROPE filed a brief dated 07/21/2021, in which he requests that the initial criteria of the AEPD be maintained and that the file be agreed of the sanctioning procedure or, alternatively, that the fine be reconsidered proposal assessing the warning provided by the regulations. In short, the aforementioned entity bases its request on the following considerations: 1. Previously, it highlights the good faith and willingness to comply that has governed its actions and the internal policies applied, and expresses its intention to contribute with their allegations more information and clarity on the case, despite the fact that it entails a waiver of application of the proposed sanction reduction, in the convinced that they have followed the recommendations of the authorities and that their motivation was none other than an excess of zeal in the protection of personal data not to deliver data to a person other than the real owner of the data. He adds that the The question raised has to do with an interpretation of the norm, still recently application. 2. Understands contradictory that is expressed in the Foundations of Law of the opening agreement that the result of the transfer process “was not satisfactory”, when in the Second and Third Records it is indicated that the respondent gave response to the request for access made by the claimant, (...), concluding that there were no indications of infringement nor was it necessary to adopt measures additional. Based on this, it requests that the documents in the file be reviewed again. file, clarifying in this regard, in the event that that statement is motivated by the absence of a response to the first requirement of the authority of Netherlands, which in June 2019 provided access to the address ***EMAIL.2 to people from the Legal Compliance team on a temporary basis, (...), although, for some technical reason the connection was not effective until the end of August, without it being possible to retrieve emails received in the meantime. As soon as you became aware that the data protection authority of The Netherlands (Autoreit Persoonsgegevens -AP) had sent 2 emails on 07/23/2019, proceeded to contact it, although there is no record of having received a response. Subsequently, on 08/30/2019, the entity Autoreit Persoonsgegevens sent a letter directly to Michael Page International - Nederland Bv, to which he gave reply dated 09/27/2019. 3. In relation to the alleged infringement of article 5.1.c), he values the review of its internal policies that it carried out in 2016-2018 to adapt them to the new regulations, on which there were no guiding criteria at the time of interpret novel concepts such as the principle of data minimization or the privacy by design or by default, so it tried to combine measures and recommendations that remained in force with an interpretation of the new regulation aimed at strict compliance with it. (...). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 7/37 (...). (...). On the other hand, on the interpretation that Berlin DPA makes on the appropriate form To verify the identity of the interested parties who exercise a right, the entity claimed understands that such assessments derive from the local idiosyncrasy and can be motivated by historical issues, inherited from previous local regulations, cultural or compliance aspects, which will be defined and homogenized in the next years. (...). (...). On the other hand, the respondent entity claims to have studied that the authority of Countries The Netherlands has been active in regards to the illegal treatment of the BSN (number of personal identification) and has taken various enforcement measures prior to entry in force of the RGPD, among them: . Airbnb illegally treated the BSN (through complete copies of the documents of identity) and the DPA published its conclusions on the matter. No fine was imposed nor was any investigative report published after Airbnb changed its operations. . A freight company called Nippon Express processed copies complete identity documents and BSNs of the truck drivers entering on the premises to pick up the cargo. This was illegal according to the Dutch DPA and published an investigative report without sanctioning the company after modifying its procedures. As can be understood, and will be developed later, the claimed entity does not derives no benefit from delaying or allegedly hindering the exercise of a right that implies the delivery of information to the interested party. It's not about a low in a service or an opposition to a certain treatment that the entity had an interest in keeping. (...). Based on this, he requests that the allegations of the Berlin DPA and the CNPD be reconsidered. that changed the criteria of the AEPD, which decided to file the file as it did not appreciate intentionality in the action carried out by PAGE GROUP EUROPE, for the absence of benefit and the improvement implemented. (...). Considering this absence of further treatment and that the treatment carried out was very limited in time, as was the access to the information in question, the entity complained against considers that what is indicated in Considering 156 of the RGPD: “The conditions and guarantees in question may entail procedures specific for the interested parties to exercise said rights if it is appropriate to the light of the purposes pursued by the specific treatment, together with the measures C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 8/37 technical and organizational measures aimed at minimizing the processing of personal data attending to the principles of proportionality and necessity”; understood, after study it, that this measure was necessary, proportional and appropriate to protect the rights of the interested party. 5. With the aforementioned requirement, the respondent did not try to delay, hinder or hinder the exercise of rights by the affected party, nor did he obtain benefit from that practice, which required designing a specific procedure and investing resources in management and monitoring. If finally, it is determined that such procedure does not was designed correctly, the only thing that can be blamed is an excess of zeal in its willingness to comply, to ensure that data was not delivered to person other than its owner, but not that with this request they wanted to put obstacles to exercise. (...). 6. Regarding the alleged infringement of article 12 of the RGPD, the complainant formulates allegations with which it intends to respond to the arguments put forward manifest by the data protection authorities of Berlin and Portugal, without begins by insisting that the entity treats requests for access with care because they are not frequent in their activity, since it is the interested parties themselves who directly provide their personal data and have the information at their disposal. available in your personal area. Regarding what was indicated by Berlin DPA, which does not share the possible risk of impersonation of e-mail addresses, the claimed one shows that there are studies and statistics that demonstrate the hypothesis that the request for the right of GDPR access can be a point of vulnerability to engineering attacks Social. And adds: “To cite some of the aforementioned studies, James Pavur (DPhil Researcher Oxford University) and Casey Knerr (Security Consultant Dionach LTD) indicate in their publication “GDPArrrrr: Using Privacy Laws to Steal Identities” (the translation is ours for the purposes of homogeneity in the document language): “In this work, we have hypothesized that the right to request access can be a point of vulnerability to social engineering attacks. through an experiment spanning 150 organizations, we demonstrated the real-world feasibility of such attacks. We found that a large proportion of organizations do not adequately verify the identity of origin of access requests and that, as a result, the information deeply sensitive can be acquired in a repeatable and scalable manner by engineering Social. We suggest a series of corrective measures focused on individuals, companies and legislators, to help mitigate these attacks. (…) Applying for a government-issued photo ID is probably the most solid way of preventing this attack. However, organizations that are unable to adequately protect this data, or to verify its authenticity, should consider the possibility of subcontracting these services to a third party. Companies should also periodically evaluate their process for requesting access to the subject for vulnerabilities and train individual service representatives on the detection and response to such attacks. Incorporating access requests C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 9/37 malicious…” Recital 64 of the RGPD itself establishes that "the data controller must use all reasonable measures to verify the identity of the interested parties requesting access. Likewise, article 12.6 of the RGPD establishes that “When the person responsible for the treatment has reasonable doubts in relation to the Identity of the natural person making the request referred to in articles 15 to 21, you may request that additional information necessary to confirm the identity of the interested party. In Spain, the need to provide the DNI or equivalent document by the interested party was provided for in article 25 of the repealed, almost in its entirety, Real Decree 1720/2007. Said article indicated that the communication of the exercise of rights addressed to the controller should be accompanied by a photocopy of the national identity document of the interested party, or his passport or other document valid to identify you. The Spanish Agency for Data Protection (AEPD), in its "Guide for the Citizen” indicates that, “if the person in charge has doubts about the identity of the interested, you may request additional information to confirm it, such as the photocopy of ID, passport or other valid document. Likewise, the forms that the AEPD designed as models for the exercise of rights and which presents as models to be used by citizens, include the following statement: "two. It will be necessary to provide a photocopy of the D.N.I. or equivalent document that proves identity and is considered valid in law, in those cases in which the person in charge has doubts about his identity. In case of acting through Legal representation must also provide a DNI and a document accrediting the representation of the representative”. Therefore, it is a common practice, at least in Spain, the residence of our company, which does not violate the principle of data minimization, which requires that the personal data is adequate, pertinent and limited to what is necessary in relation to with the purposes for which they are processed. (...). (...). (...). 7. Emphasizes once again the good faith and degree of collaboration shown, having modified the internal rights management procedure as follows: (...). (...). 8. Refers to the filing of the proceedings initially adopted by the AEPD and the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 10/37 objections from the Portuguese (CNPD) and German (Berlin DPA) authorities, to put reveals the uncertainty caused by the lack of unity of criteria to verify online identity during the management of an access right. The RGPD does not establish, as the previous regulation did, the list of security measures. security that those responsible must adopt; now each person in charge must carry out your own risk analysis and determine what measures you need to take to mitigate them, and this was recognized by the AEPD, (...). This is an interpretation made based on risk analysis and from the good faith and the conviction of a good performance, applying the principles of minimization, privacy by design and by default, on a specific subject (request for identification in the right of access) on which there is no criterion or guide published. 9. Regarding the graduation criteria of the sanction, it states the following: . The negligence in the commission of the infraction must be appreciated when the conduct is away from recognized standards and, (...). In addition, he considers that it should be taken into account account the proactive attitude and demonstrated improvement. (...). . The assessment of the number of interested parties must consider the requests for exercises of rights received since the RGPD is fully applicable, already detailed. . It is the first time that the claimed entity is the subject of a procedure sanctioning party, thus far complying with the obligations set forth in the regulations applicable, as well as the criteria established by the supervisory authorities. In this regard, it requests that the imposition of a special warning be assessed attention to the nature, low seriousness and short duration of the infringement, to its unintentional character, to the measures taken to alleviate the damages suffered and the degree of responsibility demonstrated by the entity. PAGE GROUP EUROPE, with its statement of arguments at the opening of the procedure, provided the following documents: . Copy of the document called “Data request process of the RGPD of the EU". The provisions it contains on the validation of requests for rights and verification of the identity of the applicants are outlined in Fact tested 12. . Record of emails received during the interim of the technical failure in email from the DPD. . Mail dated 08/26/2019, sent to the authority of the Netherlands requesting the sending of missed communication. . Mail with the documentation sent in September 2019 to the authority of Netherlands data protection. TENTH: On 11/24/2021, a resolution proposal was issued in the sense following: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 11/37 1. That the Director of the AEPD sanction PAGE GROUP EUROPE, for a infringement of article 12 of the RGPD, typified in Article 83.5.b) of the RGPD and classified as minor for prescription purposes in article 74.c) of the LOPDGDD, with a fine amounting to 50,000 euros (fifty thousand euros). 2. That the Director of the AEPD sanction PAGE GROUP EUROPE, for a infringement of article 5.1.c) of the RGPD, typified in article 83.5.a) and qualified as very serious for prescription purposes in article 72.1.a) of the LOPDGDD, with a fine amounting to 250,000 euros (two hundred and fifty thousand euros). The aforementioned resolution proposal was notified to the entity PAGE GROUP EUROPE on the same date of 11/24/2021. In this notification, said entity was informed that, in accordance with the provisions of article 85.2 of the LPACAP, may, in any time prior to the resolution of the procedure, carry out the payment voluntary of the proposed penalty, which would mean a reduction of 20% of the amount of it. With the application of this reduction, the sanction would be established at 240,000 euros (two hundred and forty thousand euros) and its payment would imply the termination of the procedure. Likewise, it was noted that the effectiveness of this reduction is conditional upon the withdrawal or waiver of any action or remedy administratively against the sanction. ELEVENTH: On 12/02/2021, the claimed party has proceeded to pay the the sanction in the amount of 240,000 euros, making use of the reduction foreseen in the Article 85 of the LPACAP, which implies the termination of the procedure and entails the waiver of any administrative action or recourse against the sanction. TWELFTH: On 12/03/2021, this Agency received a document of the entity PAGE GROUP EUROPE, of 12/02/2021, through which it provides a copy of the receipt of the payment made, with which it intends to "close" the process. In this same letter, the aforementioned entity warns about the confidentiality of internal corporate processes. Of the actions carried out in this procedure and the documentation in the file, the following have been accredited: PROVEN FACTS 1. The entity Michael Page International is a company based in the United Kingdom, parent company of the PageGroup business group. It is dedicated to the selection of personnel and operates under various brands, including “Michael Page”. It has subsidiaries in many European countries, with the Dutch subsidiary being the Michael Page entity International - Nederland B.V. One of the Spanish subsidiaries of the Group, with headquarters in ***LOCALIDAD.1, PAGE GROUP EUROPE, S.L., is responsible, through its Compliance department Legal, to manage requests for the exercise of rights in terms of protection C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 12/37 of personal data that the interested parties formulate before the entities of the group PageGroup in Europe. The postal address of this Spanish subsidiary is indicated as data of contact for the exercise of these rights in the Privacy Policy of the entity, both in Spain and in the Netherlands version. 2. PageGroup websites include a form enabled for users to Interested parties can send their CV to the corresponding subsidiary entity. 3. The claimant, a Dutch citizen, opened an account on the web portal of Michael Page International - Nederland B.V., accessible at the URL “***URL.1”, and referred by that channel, in March 2018, a Curriculum Vitae (CV) to obtain a position of job offered by this Dutch subsidiary of the PageGroup group. 4. By email dated 09/28/2018, sent from the address “***EMAIL.3”, the same one that is registered in the PageGroup database, the claimant requested access to their personal data, expressly detailing in their request to be sent a copy of your data and your interest in knowing the purposes for which that the data is processed, the categories of personal data submitted to treatment, the recipients, as well as the legal basis of each operation of treatment. Said email was sent to the address “***EMAIL.1”, which coincides with the one indicated for such purposes in the Privacy Policy accessible through of the web portal. In this email, the claimant warns that she receives regular emails from the entity and that this proves that it has your personal data. 5. By email dated 10/02/2018, sent from the address “***EMAIL.1”, PageGroup responded to the complainant's email dated 09/28/2018 noting that in order to meet the request for access made, it was necessary confirm your identity and prove your address. (...). It is also indicated that said documentation can be sent to the address “***EMAIL.1” or to the department of Legal Compliance, by postal mail addressed to the address of PAGE GROUP EUROPE in ***LOCATION.1. (...). (...). 7. On 10/22/2018, the Legal Compliance Department of PageGRoup sent an email to the claimant, from the address “***EMAIL.1”, in the who reiterate the need to verify their identity and insist on the request for previous documentation. 8. Dated 11/11/2018, by email sent to the address “***EMAIL.1”, the claimant, after summarizing the facts and highlighting her interest in know the communications of personal data made to third parties and the data concrete shared, reiterated its previous statements on the documentation required to meet that request, which he considers excessive, and warned about the possibility of making a claim before the data protection authority of the countries Low. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 13/37 9. On 11/12/2018, PageGRoup's Legal Compliance Department sent an email to the claimant, from the address “***EMAIL.1”, reporting that they have reviewed their (...). 10. By letter dated 08/14/2020, this Agency requested PAGE GROUP EUROPE “Copy of the response to the request for access made by the claimant, all Once your identity has been proven through the claim process, initiated before the control authority of the Netherlands and continued in this Agency”. Following this request, the aforementioned entity proceeded to respond to the request for access formulated by the claimant and provided this Agency with a copy of the communication, dated 08/27/2020, which responds to the request for access made by the claimant, as well as the annex with the personal data of the same that are in power of PageGroup. In the response letter to this Agency, it is indicated that the Information was sent by email. (...). (...). 12. The entity PAGE GROUP EUROPE, with its brief of allegations at the opening of the procedure, has provided a copy of the document called "Process of EU GDPR data request. (...). (...). (...). (...). Regarding the delivery of the document through which the right of access and the corresponding information is provided to the interested party, the procedure designed by the claimed entity contemplates its sending by email, protected with a password that is sent in a different mail. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each Authority of Control and, as established in articles 47, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate this procedure. Article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Agency for Data Protection will be governed by the provisions of the RGPD, in this organic law, by the regulatory provisions issued in its C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 14/37 development and, in so far as they are not contradicted, on a subsidiary basis, by the rules general administrative procedures. Sections 1) and 2), of article 58 of the RGPD, list, respectively, the investigative and corrective powers that the supervisory authority may provide to the effect, mentioning in point 1.d), that of "notifying the person in charge or in charge of the treatment of alleged violations of this Regulation”; And in 2.i), the “impose an administrative fine under article 83, in addition to or instead of the measures mentioned in this section, according to the circumstances of each case". The case examined is motivated by a cross-border claim filed with the Dutch data protection authority (Autoreit Persoonsgegevens -AP), against a business group based in the United Kingdom. However, the department in charge of managing requests for access for continental Europe is the Legal Compliance team of the Group subsidiary PAGE GROUP EUROPE, based in Spain. This Spanish establishment PageGroup is the principal establishment of the Group, within the meaning of the definition of the article 4.16 of the RGPD. Thus, in accordance with the provisions of article 56.1 of the RGPD, the AEPD is the competent authority to act as the main control authority. The following "definitions" established in article 4 of the GDPR: “16) main establishment: a) with regard to a data controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions about the purposes and means of the treatment are taken in another establishment of the person in charge in the Union and the latter establishment has the power to enforce such decisions, in in which case the establishment that has adopted such decisions will be considered main establishment. “21) supervisory authority: the independent public authority established by a State member in accordance with the provisions of article 51”. “22) interested control authority: the control authority that is affected by the treatment of personal data because: a.- The controller or processor is established in the territory of the State member of that control authority; b.- Interested parties residing in the Member State of that control authority are substantially affected or likely to be substantially affected by the treatment, or c.- A claim has been filed with that control authority”. “23) cross-border treatment: a) the processing of personal data carried out in the context of the activities of establishments in more than one Member State of a person in charge or a person in charge of the processing in the Union, if the controller or processor is established in more than one Member state, or b) the processing of personal data carried out in the context of the activities of a single establishment of a controller or a processor in the Union, but which affects substantially or is likely to substantially affect data subjects in more than one State member". C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 15/37 According to the information included in the IMI System, in accordance with the established in article 60 of the RGPD, in this procedure they act in quality of "interested control authorities" the data protection authorities personals from the Netherlands, Belgium, Ireland, Poland, Italy, Hungary, Portugal, Cyprus and Austria, as well as the German regions of North Rhine-Westphalia, Rhineland- Palatinate, Mecklenburg-Western Pomerania, Berlin and Bavaria Private Sector. II Article 56.1 of the RGPD, regarding the "Competence of the supervisory authority main”, states the following: "1. Without prejudice to the provisions of article 55, the control authority of the establishment main or sole establishment of the controller or processor will be competent to act as lead supervisory authority for cross-border processing carried out by said person in charge or person in charge in accordance with the established procedure in article 60”. Said article 60 regulates the "Cooperation between the main control authority and the other interested control authorities”: "1. The main control authority will cooperate with the other control authorities stakeholders in accordance with this article, striving to reach a consensus. The main control authority and the control authorities concerned will exchange all relevant information. 2. The main control authority may at any time request other authorities of Control interested parties that provide mutual assistance in accordance with article 61, and may carry out conduct joint operations under article 62, in particular to carry out investigations or supervise the application of a measure related to a person in charge or a processor established in another Member State. 3. The main control authority shall promptly notify the other control authorities relevant information in this regard. It will transmit without delay a project of decision to the other control authorities concerned to obtain their opinion on the matter and will take due account of their views. 4. In the event that any of the interested control authorities raises an objection relevant and reasoned information on the draft decision within four weeks from consultation pursuant to paragraph 3 of this article, the lead supervisory authority will submit the matter, in case it does not follow what is indicated in the pertinent and motivated objection or considers that said objection is not pertinent or is not motivated, to the coherence mechanism referred to in article 63. 5. In the event that the main supervisory authority plans to follow what is indicated in the objection pertinent and reasoned received, it will submit to the opinion of the other control authorities stakeholders a revised draft decision. This revised draft decision is will submit to the procedure indicated in section 4 within a period of two weeks. 6. In the event that no other interested supervisory authority has objected to the draft decision transmitted by the main supervisory authority within the period indicated in the paragraphs 4 and 5, it will be considered that the main supervisory authority and the authorities of Stakeholders are in agreement with said draft decision and will be bound by East. 7. The main control authority will adopt and notify the decision to the main establishment or to the sole establishment of the person in charge or the person in charge of the treatment, as appropriate, and shall inform the interested control authorities and the Committee of the decision, including a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 16/37 summary of relevant facts and motivation. The supervisory authority before which the submitted a claim will inform the claimant of the decision. (…) 12. The main supervisory authority and the other interested supervisory authorities will reciprocally provide the information required within the framework of this article by electronic means, using a standardized form. On the issues regulated in these precepts, what is stated in Recitals 124, 125, 126 and 130 of the RGPD, in particular the following: (124) “… Said authority (the main authority) must cooperate with the other authorities interested…”. (125) “As the lead authority, the supervisory authority must closely involve and coordinate the control authorities interested in the decision-making process”. (126) “The decision must be agreed jointly by the main control authority and the interested control authorities…”. (130) “When the supervisory authority before which the claim has been filed is not the lead supervisory authority, the latter must cooperate closely with the former with in accordance with the provisions on cooperation and coherence established in this Regulation. In such cases, the lead supervisory authority, by taking measures designed to produce legal effects, including the imposition of administrative fines, must take into account account to the greatest extent possible the opinion of the supervisory authority before which the filed the claim and which must remain competent to perform any investigation on the territory of its own Member State in liaison with the supervisory authority competent". In accordance with the provisions of article 4.24 of the RGPD, it is understood by “pertinent and motivated objection” the following: “The objection to a proposal for a decision on the existence or not of an infringement of this Regulation, or on the conformity with the present Regulation of actions foreseen in relationship with the person in charge or the person in charge of the treatment, which clearly demonstrates the significance of the risks posed by the draft decision to the rights and freedoms of the interested parties and, where appropriate, for the free circulation of personal data within the Union”. In accordance with the provisions of the previous rules, in this case, referred to a claim filed with the supervisory authority of a State member (Netherlands), in relation to processing in the context of activities of an establishment of a person in charge that affect or are likely to affect substantially to data subjects in more than one Member State (data processing cross-border), the main control authority, in this case the Spanish Agency of Data Protection, is obliged to cooperate with the other authorities interested. The Spanish Agency for Data Protection, in application of the powers that conferred by the RGPD, is competent to adopt the decisions designed to produce legal effects, whether it be the imposition of measures that guarantee the compliance with regulations or the imposition of administrative fines. Nevertheless, is obliged to closely involve and coordinate the control authorities stakeholders in the decision-making process and take their opinion into account in the greater extent. It is also established that the binding decision to be adopted jointly agreed. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 17/37 Article 60 of the GDPR regulates this cooperation between the main control authority and the other interested control authorities. Section 3 of this article expressly establishes that the main supervisory authority will transmit to the other control authorities concerned, without delay, a draft decision to obtain its opinion on the matter and will take due account of its views, following the procedure provided for in sections 4 and following. The interested control authorities have a period of four weeks to raise reasoned objections to the draft decision, on the understanding that There is agreement on said project if no authority presents objections in the indicated period, in which case all of them are bound by the repeated project. Otherwise, that is, if any of the authorities concerned makes a relevant and reasoned objection to the draft decision, the supervisory authority principal may follow what is indicated in the objection, presenting the opinion of the other control authorities concerned a revised draft decision, which will be submitted to the procedure indicated in section 4 within two weeks. not to follow indicated in the objection or if it is considered that it is not pertinent, the authority of main control must submit the matter to the coherence mechanism contemplated in Article 63 of the GDPR. In the present case, the AEPD initially considered that there were no indications of infringement nor was it necessary to urge the adoption of additional measures to those implemented by PAGE GROUP EUROPE, for which, on 11/10/2020, a Project of Decision, by means of which it was submitted to the consideration of the rest of the authorities of interested control the file of the claim (Draft decision). At the end of the established period, they objected to the aforementioned Draft Decision the data protection authorities of Portugal (CNPD) and Berlin (The Berlin Commissioner for Data Protection and Freedom of Information -Berlin DPA), in the sense expressed in the Background of this agreement. Taking into account the reasons set out in the objections made, and in accordance with the provisions of section 1 of article 60 of the RGPD, before transcribed, which obliges the main supervisory authority to cooperate with the other authorities, striving to reach a consensus, the procedure was followed provided for in section 5 of the aforementioned article 60, instead of resorting to the coherence contemplated in article 63 of the RGPD. Although this Agency, as indicated by the entity complained of in its allegations, initially considered that there were no indications of infringement, once analyzed the observations or objections raised by the control authorities concerned revealed some circumstances that had not been sufficiently valued in the project file of actions (Draft decision), which will be set forth in the Foundations of Law that follow. For this reason, it was appropriate to prepare a Revised Draft Decision that contemplate the opening of a sanctioning procedure against PAGE GROUP EUROPE. This action is in accordance with the cooperation procedure regulated in article C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 18/37 60 of the GDPR; and takes into account the provisions of article 58.4 of the same Regulation, according to which the exercise of the powers conferred on the authority of control must respect the procedural guarantees established in Union law and of the Member States. The Spanish procedural regulations, specifically, Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (LPACAP), establishes that procedures of a sanctioning nature will always be initiated ex officio by agreement of the competent body, which must contain, among other indications, the identification of the person or persons allegedly responsible, the facts that motivate the initiation of the procedure, its possible qualification and the penalties that may apply The adoption of the draft agreement to initiate the sanctioning procedure is provided for in article 64 of the LOPDGDD, sections 2 (third paragraph) and 3, establishing the obligation to give formal knowledge to the interested party. This notification interrupts the prescription of the infraction. The Revised Draft Decision prepared by the AEPD, in the form of a draft opening of sanctioning procedure, was submitted to the consideration of the interested authorities, so that they could formulate the objections that they deem pertinent or give their consent. For this, it was transmitted through of the IMI System to those authorities, letting them know that, in the event that the raised objections within two weeks of the consultation, the mandatory agreement to open sanctioning proceedings. None of the interested control authorities raised any objection, so it was understood that there was agreement on the aforementioned project. Consequently, on 06/29/2021, the AEPD agreed to initiate this sanctioning procedure, according to the arguments and accusations contained in the Revised Draft Decision. On the other hand, section 4 of the aforementioned article 64 of the LOPDGDD establishes that The processing times established in this article will be automatically suspended when it is necessary to collect information, consultation, request for assistance or mandatory pronouncement of a body or agency of the European Union or of a or several control authorities of the Member States in accordance with the provisions in the RGPD, for the time between the request and the notification of the statement to the Spanish Data Protection Agency. III In accordance with the provisions of article 55 of the RGPD, the Spanish Agency for Data Protection is competent to perform the functions assigned to it in its article 57, among them, that of enforcing the Regulation and promoting the awareness of controllers and data processors about the obligations incumbent on them, as well as dealing with the claims presented by a concerned and investigate the reason for them. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 19/37 Correlatively, article 31 of the RGPD establishes the obligation of those responsible and those in charge of the treatment to cooperate with the control authority that requests it in the performance of their duties. In the event that they have appointed a data protection delegate, article 39 of the RGPD attributes to it the function of cooperate with that authority. Similarly, the domestic legal system, in article 65.4 of the LOPDGDD, has foreseen a mechanism prior to the admission to processing of the claims that are formulated before the Spanish Agency for Data Protection, which consists of giving transfer of the same to the data protection delegates designated by the responsible or in charge of the treatment, for the purposes provided in article 37 of the aforementioned norm, or to these when they have not been designated, so that they proceed to the analysis of said claims and to respond to them within a month. In accordance with this regulation, prior to the admission for processing of the claim that gives rise to this procedure, it was transferred to the responsible entity to proceed with its analysis, respond to this Agency within a month and prove that they have provided the claimant with the due response, in the event of exercising the rights regulated in articles 15 to 22 of the GDPR. The result of said transfer was not satisfactory, considering the procedure followed by the project file of actions (Draft decision) and the objections formulated in this regard, so that the continuation of actions for the purification of the possible responsibilities revealed. In consecuense, dated 12/11/2020, for the purposes provided in article 64.2 of the LOPDGDD, the Spanish Agency for Data Protection agreed to admit the claim for processing communicated by the Dutch data protection authority (Autoreit Persoonsgegevens -AP) for alleged infractions related to the exercise of the rights recognized to the holders of personal data. Said admission agreement The procedure determined the opening of this sanctioning procedure. Dealing exclusively with a claim for lack of attention to a request of exercise of the rights established in articles 15 to 22 of the RGPD, it follows the procedure regulated in article 64.1 of the LOPDGDD, according to which: "1. When the procedure refers exclusively to the lack of attention to a request for exercise of the rights established in articles 15 to 22 of Regulation (EU) 2016/679, will be initiated by agreement of admission to processing, which will be adopted in accordance with the provisions of the next article. In this case, the term to resolve the procedure will be six months from the date on which the claimant was notified of the agreement for admission to processing. After this period, the interested party may consider their claim upheld.” On the contrary, when the procedure does not refer exclusively to the attention to a request for the exercise of rights, the purging of administrative responsibilities in the framework of a sanctioning procedure, being the exclusive competence of this Agency to assess whether there are responsibilities administrative that must be purged in a procedure of this nature and, in consequently, the decision on its opening. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 20/37 In this case, there are elements that justify the exercise of the activity penalty, considering that with the procedure provided for in article 64.1 of the The aforementioned LOPDGDD would not duly restore the guarantees and rights of the interested. The origin of the actions is determined by a claim made by a specific interested party, whose purpose is the lack of attention to the right of access exercised by the claimant before the claimed entity. With this, it could be thought that We are facing the procedure regulated in article 64.1 of the LOPDGDD. However, this claim by an individual person has revealed a general action of the person in charge, resulting in this specific case being the reflection of a common guideline or policy applied to all those affected persons who are in the same case as the claimant. When an action that is considered wrong derives from a general policy adopted by the data controller, so that it is not a matter of punctual errors in a case, the infraction does not reside exclusively in the case examined but in that general action adopted by the responsable. To do otherwise would be inconsistent with the purpose and will of the Community legislator, expressly embodied in the RGPD when it indicates that it corresponds to the control authorities enforce the rule. Consequently, this procedure analyzes the impact of the general action followed by PAGE GROUP EUROPE in the management and resolution of requests for exercises of rights of access and portability formulated by the interested parties, (...). In view of the deficiencies noted in the procedure designed by the entity claimed regarding data protection regulations, it turns out that such deficiencies have a general scope, so that all the interested parties who had formulated the indicated requests, and not only the claimant. Thus, it is concluded in view of the information and statements that the entity itself claimed has provided this Agency, in which it recognizes that the process of attention of rights responded to the design made by it and exposes the reasons that led him to implement a strict identity verification process, which It is based, among other reasons that are outlined in the Background, on the nature of the Human Resources services it provides, (...). Defend your system arguing that it responds to an excess of zeal of the entity. (...). The information provided by the respondent entity, moreover, is consistent with the action developed in relation to the specific request for access of the claimant Therefore, it is not understood that PAGE GROUP EUROPE, in its allegations to the opening of the procedure, state that you made a mistake in explaining the aforementioned rights management process and to modify its earlier approach to C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 21/37 expose circumstances that do not conform to reality. The truth, according to accredited in the proceedings, is that the identity verification scheme designed by the respondent applied to all cases of exercise of rights of access and portability, in general, and not only in cases where there are doubts about the identity of the applicant, as he now points out in his allegations; (...). On the other hand, PAGE GROUP EUROPE states in its pleadings that has followed the recommendations of the authorities, however, it does not mention what they are those recommendations that would justify the procedure that follows. Throughout the text of his pleadings brief, he only refers to the “Guide for El Ciudadano” prepared by the AEPD and the instructions contained in the forms for the exercise of rights that this Agency makes available to citizens through through your website. In both cases, as the respondent entity points out, informs citizens about the possibility that those responsible may request photocopy of the DNI or equivalent document, but it is warned that this must be considered when the person in charge has doubts about the identity of the applicant and also that The electronic signature can be used instead of the identification document. The content of those documents does not contradict the criteria set out in This act. It should be noted that the specific objective covered by these guides is to provide guidance on best practices in the most general cases, so that cover all the specific assumptions that may arise and this means that the guidance they contain should be completed as appropriate. Finally, it is interesting to highlight at this time that the conclusions presented They are then obtained by applying the rules established by the RGPD and the LOPDGDD, without considering repealed regulations, such as Royal Decree 1720/2007, nor cultural aspects or historical issues inherited from local regulations, to which referred to by the entity claimed in its pleadings brief. IV The rights of individuals regarding the protection of personal data are regulated in articles 15 to 22 of the RGPD and 13 to 18 of the LOPDGDD. I know contemplate the rights of access, rectification, deletion, opposition, right to limitation of treatment and right to portability. The formal aspects related to the exercise of these rights are established in the articles 12 of the RGPD and 12 of the LOPDGDD. Article 12 “Transparency of information, communication and modalities of exercise of rights” of the RGPD establishes the following: "1. The person responsible for the treatment will take the appropriate measures to facilitate the interested party all information indicated in articles 13 and 14, as well as any communication with in accordance with articles 15 to 22 and 34 regarding the treatment, in a concise, transparent, intelligible and easily accessible, in clear and simple language, in particular any information specifically targeted at a child. The information will be provided in writing or by other means, including, if applicable, by electronic means. When requested by the interested party, the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 22/37 Information may be provided verbally as long as the identity of the interested party is proven. By other means. 2. The person responsible for the treatment will facilitate the interested party in the exercise of their rights under of articles 15 to 22. In the cases referred to in article 11, paragraph 2, the person responsible will not refuse to act at the request of the data subject in order to exercise their rights under Articles 15 to 22, unless you can show that you are unable to identify the interested. 3. The data controller will provide the interested party with information regarding their actions on the basis of a request under articles 15 to 22, and, in any case, in the period of one month from receipt of the request. This period may be extended for another two months if necessary, taking into account the complexity and number of requests. The responsible will inform the interested party of any of said extensions within a month to from receipt of the request, indicating the reasons for the delay. When the interested submit the application electronically, the information will be provided electronically. electronic when possible, unless the interested party requests that it be provided in another way. mode." 4. If the person in charge of the treatment does not process the request of the interested party, he will inform him without delay, and no later than one month after receipt of the request, of the reasons for its non-action and the possibility of presenting a claim before a control authority and to exercise legal actions. 5. The information provided under articles 13 and 14 as well as all communication and any action carried out under articles 15 to 22 and 34 will be free of charge. When the requests are manifestly unfounded or excessive, especially due to its repetitive nature, the data controller may: a) charge a reasonable fee in depending on the administrative costs incurred to facilitate the information or communication or perform the requested action, or b) refuse to act on the request. The responsible of the treatment will bear the burden of demonstrating the manifestly unfounded or excessive request. 6. Without prejudice to the provisions of article 11, when the data controller has reasonable doubts in relation to the identity of the natural person who makes the request to which referred to in articles 15 to 21, you may request that additional information be provided necessary to confirm the identity of the interested party. 7. The information that must be provided to the interested parties under articles 13 and 14 may be transmitted in combination with standardized icons that allow the provision of easily visible, intelligible and clearly legible form an adequate overview of the planned treatment. The icons that are presented in electronic format will be legible mechanically. 8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 in order to specify the information to be presented through icons and the procedures for providing standardized icons”. For its part, article 12 “General provisions on the exercise of rights” of the LOPDGDD, in sections 2 and 4, adds the following: "two. The person responsible for the treatment will be obliged to inform the affected party about the means at its disposal. disposition to exercise the corresponding rights. Media should be easily accessible to the affected. The exercise of the right may not be denied for the sole reason for the affected party to opt for another means”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 23/37 "4. Proof of compliance with the duty to respond to the request to exercise their rights formulated by the affected party will fall on the person responsible”. It also takes into account what is expressed in Considerations 59 and following of the GDPR. In accordance with the provisions of these rules, the data controller must arbitrate formulas and mechanisms to facilitate the interested party in the exercise of their rights, which will be free (without prejudice to the provisions of articles 12.5 and 15.3 of the GDPR); is obliged to respond to requests made no later than one month, unless you can show that you are unable to identify the interested; as well as to express their reasons in case they do not respond to the request. From the foregoing, it follows that the request for the exercise of rights made by the The interested party must be answered in any case, falling on the person in charge proof of compliance with this duty. This obligation to act is not enforceable when the data controller can demonstrate that it is not in a position to identify the interested party (in cases referred to in article 11.2 of the RGPD). In cases other than those provided for in this article, in which the data controller has reasonable doubts in relation to with the identity of the applicant, may require additional information necessary to confirm that identity. In this regard, Recital 64 of the RGPD is expressed in the following terms: “(64) The controller must use all reasonable measures to verify the identity of data subjects requesting access, in particular in the context of services online and online identifiers. The person in charge must not keep personal data with the sole purpose of being able to respond to possible requests. Regarding the right of access, the RGPD stipulates in its article 15 what following: "1. The interested party shall have the right to obtain confirmation from the data controller as to whether Personal data concerning you is being processed or not and, in such a case, the right of access to personal data and the following information: a) the purposes of the treatment; b) the categories of personal data in question; c) the recipients or categories of recipients to whom they were communicated or will be communicated the personal data, in particular recipients in third parties or organizations international; d) if possible, the expected term of conservation of the personal data or, if not possible, the criteria used to determine this period; e) the existence of the right to request from the controller the rectification or deletion of data or the limitation of the processing of personal data relating to the interested party, or to object to such processing; f) the right to file a claim with a supervisory authority; g) when the personal data has not been obtained from the interested party, any information available on its origin; h) the existence of automated decisions, including profiling, to which C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 24/37 refers to article 22, sections 1 and 4, and, at least in such cases, significant information on the logic applied, as well as the importance and the foreseen consequences of said treatment for the interested party. 2.When personal data is transferred to a third country or an international organization, the interested party shall have the right to be informed of the appropriate guarantees under article 46 relating to the transfer. 3. The data controller will provide a copy of the personal data subject to treatment. The person in charge may receive for any other copy requested by the interested party a reasonable fee based on administrative costs. When the interested party submits the request by electronic means, and unless he requests that it be provided in another way, the Information will be provided in a commonly used electronic format. 4. The right to obtain a copy mentioned in section 3 will not negatively affect the rights and freedoms of others”. Like the rest of the rights of the interested party, the right of access is a personal right. Allows the citizen to obtain information about the treatment that is being made of your personal data, the possibility of obtaining a copy of the personal data that concerns you and that is being processed, as well as the information listed in the article cited above. In the present case, the claimant, a Dutch citizen, opened an account in the Dutch version of the web portal of the entity Michael Page International, accessible at the URL “***URL.1”, and sent through that channel, in March 2018, a Curriculum Vitae (CV) for the achievement of a job offered by the Dutch subsidiary of the PageGroup group. Subsequently, on 09/28/2018, you exercised the right of access to your data by email sent to the address "***EMAIL.1", which coincides with the one indicated for such purposes in the Privacy Policy of the web portal, expressly indicating in this request your interest in knowing the data processed, the purposes for which they are processed, the recipients and the shared data, as well as the legal basis of each treatment operation (this request is adjusted to the content of the right of access established by the aforementioned article 15 of the RGPD, which, according to been exposed, not only implies informing the applicant about the personal data or categories of data that are processed, so that the character is not understood exception attributed to it by the entity complained against when it alleges that these requests of access are not frequent since it is the interested parties themselves who facilitate directly your personal data and have the information available to you in your area personal). The request made by the claimant is sent from the same email address email of the claimant that is registered in the PageGroup database, which, according to the interested party, had been used by the subsidiary of the Group to send you job offers and commercial communications. (...). Also on two occasions, by email, dated 10/20 and 11/11//2018, the claimant warned that the required identification constitutes a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 25/37 excessive data processing or an impediment to the exercise of your right and pointed out expressly that the identification process is simplified considering that it has account on the entity's website. It would not be until 11/12/2018, once the claimant communicated her intention to lodge a complaint with the Dutch data protection authority, when PAGE GROUP EUROPE modified its initial requirements, (…). On the issue of verifying the identity of applicants for rights, the rules set forth above are clear in stating that this verification process should be limited to the specific cases in which the controller has doubts "reasonable" in relation to the identity of the natural person making the request. Article 12.6 of the RGPD refers to all requests for rights and admits the possibility of requesting, in those cases, "additional information" necessary to confirm the identity of the interested party. In particular, in relation to requests of access in the context of online services, Recital 64 of the same Regulation refers to the possibility that the person in charge uses all the “measures reasonable” to verify the identity of the interested parties. The rules that regulate the exercise of rights do not establish, therefore, the need to provide any specific identification document so that they can be served, they do not even require that verification of identity be carried out through documentation. They refer to the possibility of collecting “additional information” and to the use of “reasonable measures”, corresponding to the person in charge to determine what information and what measures are reasonable in each case, taking into account the concurrent circumstances and always resorting to the least invasive means to the privacy of applicants. All this, under the previous condition that It is a case in which there are “reasonable doubts” about the identity of the applicant. PAGE GROUP EUROPE has not justified that these reasonable doubts existed in relation to the identity of the claimant. On the contrary, the actions of this entity responds to the rights management procedure designed by itself, in its condition of responsible, (...), without previously analyzing whether or not those reasonable doubts. (...). The circumstance occurs, in this case, that the claimant was registered in the information systems of the responsible entity, which had a wide information about it; and that the request for access to personal data is formulated from the same e-mail address of the claimant that already was in the database of said entity. It is not understood, therefore, that this case has been treated as one of those assumptions in which there are doubts about the identity of the applicant (...), when he had least intrusive means to ensure that the information would be forwarded to the data subject the data in question, such as having contrasted some of the data already available. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 26/37 PAGE GROUP EUROPE knew the contact details of the complainant, so that the request received from the email address that said entity had registered in its systems and the sending to this address of the requested information with the access offered sufficient guarantees, in the opinion of this Agency, to have responded to the request received. Furthermore, considering that no circumstance that led the claimed entity to think of an impersonation of identity or in a computer attack. The rigorous requirements imposed on the claimant to process her request for access motivated this request to remain unanswered, despite the two warnings made by the claimant herself about excessive requests for documentation that was sent to him; which determined that the claimant choose to go to the Dutch data protection authority instead of continue with the processing of your request, as you had warned in your email email dated 11/11/2018. Consequently, PAGE GROUP EUROPE is responsible for ensuring that the term established to meet the claimant's request had elapsed without given the due response, providing the information requested. The right of access was finally attended to on 08/27/2020, during the processing of the claim carried out by this Agency as the authority of main control, prior express request of this Agency dated 08/14/2020. TO In this regard, it should be specified that the corresponding response to the request of access cannot be manifested on the occasion of a mere administrative procedure, as is the transfer of the claim to the claimed party in compliance with what established in article 64.3 of the LOPDGDD. Consequently, in accordance with the exposed evidence, the aforementioned facts represent a violation of the provisions of article 12, sections 2 and 3, of the RGPD, due to non-compliance with the right of access exercised by the claimant, which gives rise to the application of the corrective powers that article 58 of the aforementioned Regulation granted to the Spanish Data Protection Agency. v (...). As stated in the previous Legal Basis, this action of the claimed entity responds to the rights management procedure designed by herself, as data controller, (...). The claimant considered that there was no reason to require that information identification as necessary for the attention of the right, considering that it was not required to open an account on the web portal or to submit your CV. understand the claimant that authenticated access to the account, which was still active in the time the request is addressed to the responsible entity, it should be sufficient to understand exercised the right and accredited their identity in a system such as the used by the controller, based on the use of a private account. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 27/37 Regarding this matter, the arguments expressed by the authorities of control CNPD and Berlin DPA, which are listed in the Fourth Precedent, (...); that this procedure does not protect applicants' data and increases the risks for those affected; that this documentation is not required of the interested parties to open an account or send a CV; that additional information should only be requested if there are doubts about the identity of the interested party, requesting necessary information and appropriate for that verification, based on the applicant's available data. Both control authorities advocate a less intrusive way of checking the identity of the applicant, (...), (eg electronic identification or send the application to via the user account along with an additional authentication factor submitted by a different channel); and agree with the claimant that access to the account private should be understood enough. And they also serve, because they coincide, the arguments expressed in the foundation of preceding right, on the possibility of requesting additional information necessary to confirm the identity of the interested party only when the person in charge has reasonable doubts in relation to the identity of the applicant of the right (article 12.6 of the GDPR). (...). The assessment of these facts requires taking into account, likewise, what is established in Articles 25 and 32 of the RGPD, which establish the following: “Article 25. Data protection by design and by default. 1. Taking into account the state of the art, the cost of the application and the nature, scope, context and purposes of the treatment, as well as the risks of varying probability and severity that involves processing for the rights and freedoms of natural persons, the controller of the treatment will apply, both at the time of determining the means of treatment and in the time of the treatment itself, appropriate technical and organizational measures, such as pseudonymization, designed to effectively apply the principles of protection of data, such as data minimization, and integrate the necessary guarantees in the treatment, to In order to comply with the requirements of this Regulation and to protect the rights of interested. 2. The data controller will apply the appropriate technical and organizational measures with with a view to guaranteeing that, by default, only the personal data that are necessary for each of the specific purposes of the treatment. This obligation is will apply to the amount of personal data collected, the extent of its treatment, its term of conservation and its accessibility. Such measures shall in particular ensure that, for default, the personal data are not accessible, without the intervention of the person, to a indeterminate number of natural persons. 3.A certification mechanism approved under Article 42 may be used as a element that proves compliance with the obligations established in sections 1 and 2 of this article. “Article 32. Security of the treatment. 1. Taking into account the state of the art, the application costs, and the nature, the scope, context and purposes of the treatment, as well as risks of probability and severity C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 28/37 variables for the rights and freedoms of natural persons, the person in charge and the person in charge of the treatment will apply appropriate technical and organizational measures to guarantee a level appropriate to the risk, which, where appropriate, includes, among others: a) pseudonymization and encryption of personal data; b) the ability to ensure confidentiality, integrity, availability and resilience permanent treatment systems and services; c) the ability to restore the availability and access to personal data in a fast in the event of a physical or technical incident; d) a process of regular verification, evaluation and assessment of the effectiveness of the measures technical and organizational to guarantee the security of the treatment. 2. When evaluating the adequacy of the level of security, particular consideration will be given to the risks presented by the processing of data, in particular as a consequence of the accidental or unlawful destruction, loss or alteration of transmitted personal data, stored or otherwise processed, or unauthorized communication or access to such data. (…)”. In this case, the system designed by PAGE GROUP EUROPE establishes demands for the attention of the rights of the interested parties that go beyond what is foreseen in the regulations that regulate these rights; and they don't respond to any of the criteria and factors referred to in the aforementioned article 25.1 of the RGPD, such as the context, the risks or the purpose of the treatment. (...). (...). (...). (...). As a result of all this, (...), it gives rise, in the indicated circumstances, to the processing of personal data that is inappropriate, irrelevant and not necessary for this specific purpose of the treatment, contrary to the principles of data protection, especially, to the principle of "data minimization", regulated in article 5.1.c) of the GDPR: “Article 5 Principles relating to the treatment 1.The personal data will be: c) adequate, pertinent and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”)”. Regarding the scope of this principle, Recital 39 of the RGPD indicates that "the data personal data should only be processed if the purpose of the processing cannot be achieved reasonably by other means. There is no need to insist on the fact that in the cases analyzed it is not necessary to collection of identification documentation of the people requesting a right, to the other, less intrusive, reliable means of identification exist; and even less necessary is the collection of various identity documents. (...). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 29/37 It also considers the claim that (...), make their action compatible with the respect for the principle of minimization, as necessary, proportional and suitable for protect the rights of the interested party, thus complying with what is indicated in the Recital 156 of the RGPD, according to which "The conditions and guarantees in question may entail specific procedures for the interested parties to exercise said rights. rights if it is appropriate in light of the purposes pursued by the treatment together with the technical and organizational measures aimed at minimizing the processing of personal data in accordance with the principles of proportionality and need". However, this Recital refers to processing for archive in the public interest and it cannot be brought up in the case at hand. Consequently, the facts cited, in relation to the processing of data that entails the rights management procedure followed by PAGE GROUP EUROPE for the verification of the identity of the interested parties, suppose a violation of the provisions of article 5.1.c) of the RGPD, which gives rise to the application of the corrective powers that article 58 of the aforementioned Regulation grants to the Spanish Data Protection Agency. SAW In the event that there is an infringement of the provisions of the RGPD, between the corrective powers available to the Spanish Data Protection Agency, as a control authority, article 58.2 of said Regulation contemplates the following: “2 Each control authority will have all the following corrective powers indicated below: continuation: (…) b) sanction any person responsible or in charge of the treatment with a warning when the treatment operations have violated the provisions of this Regulation;” (...) d) order the person responsible or in charge of the treatment that the treatment operations be comply with the provisions of this Regulation, where appropriate, of a given manner and within a specified time; (…) i) impose an administrative fine under article 83, in addition to or instead of the measures mentioned in this section, according to the circumstances of each case particular;". According to the provisions of article 83.2 of the RGPD, the measure provided for in letter d) above is compatible with the sanction consisting of an administrative fine. 7th The exposed facts do not comply with the provisions of articles 12 and 5.1.c) of the RGPD, with the scope expressed in the previous Legal Foundations, which means the commission of offenses typified, respectively, in sections 5.b) and 5.a), of article 83 of the RGPD, which under the heading “General conditions for the imposition of administrative fines” provides the following: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 30/37 "5. Violations of the following provisions will be sanctioned, in accordance with the section 2, with administrative fines of a maximum of EUR 20,000,000 or, in the case of a company, of an amount equivalent to a maximum of 4% of the total annual turnover of the previous financial year, opting for the highest amount: a) the basic principles for the treatment, including the conditions for the consent to tenor of articles 5, 6, 7 and 9. b) the rights of the interested parties according to articles 12 to 22”. In this regard, the LOPDGDD, in its article 74, considers a "minor" infraction to effects of prescription the infractions of a merely formal nature of the articles mentioned in article 83.5 of the RGPD and, specifically, "c) Not attending to the requests to exercise the rights established in articles 15 to 22 of the Regulation (EU) 2016/679, unless the provisions of the article 72.1.k) of this Organic Law”. For its part, section 1.a) of article 72 of the LOPDGDD considers, as “very serious”, for purposes of prescription: "1. Based on the provisions of article 83.5 of Regulation (EU) 2016/679, considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned therein and, in particular, the following: a) The processing of personal data violating the principles and guarantees established in the Article 5 of Regulation (EU) 2016/679” . In order to determine the administrative fine to be imposed, the provisions of articles 83.1 and 83.2 of the RGPD, precepts that indicate: "1. Each control authority will guarantee that the imposition of administrative fines with in accordance with this article for the infringements of this Regulation indicated in the sections 4, 9 and 6 are in each individual case effective, proportionate and dissuasive. 2. Administrative fines will be imposed, depending on the circumstances of each case individually, in addition to or as a substitute for the measures referred to in article 58, section 2, letters a) to h) and j). When deciding to impose an administrative fine and its amount In each individual case, due account shall be taken of: a) the nature, seriousness and duration of the offence, taking into account the nature, scope or purpose of the treatment operation in question as well as the number of affected parties and the level of damages they have suffered; b) intentionality or negligence in the infringement; c) any measure taken by the person responsible or in charge of the treatment to alleviate the damages suffered by the interested parties; d) the degree of responsibility of the data controller or processor, taking into account of the technical or organizational measures that they have applied by virtue of articles 25 and 32; e) any previous infringement committed by the person in charge or the person in charge of the treatment; f) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate the possible adverse effects of the infringement; g) the categories of personal data affected by the infringement; h) the way in which the supervisory authority became aware of the infringement, in particular if the The person responsible or the person in charge notified the infringement and, if so, to what extent; i) when the measures indicated in article 58, section 2, have been ordered previously against the person in charge or the person in charge in question in relation to the same C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 31/37 matter, compliance with said measures; j) adherence to codes of conduct under Article 40 or certification mechanisms approved under article 42, and k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infraction”. For its part, article 76 “Sanctions and corrective measures” of the LOPDGDD has: "1. The sanctions provided for in sections 4, 5 and 6 of article 83 of the Regulation (EU) 2016/679 will be applied taking into account the graduation criteria established in the section 2 of the aforementioned article. 2. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679, also may be taken into account: a) The continuing nature of the offence. b) The link between the activity of the offender and the performance of data processing personal. c) The profits obtained as a result of committing the offence. d) The possibility that the conduct of the affected party could have induced the commission of the crime. infringement. e) The existence of a merger by absorption process subsequent to the commission of the infraction, that cannot be attributed to the absorbing entity. f) Affectation of the rights of minors. g) Have, when not mandatory, a data protection officer. h) Submission by the person in charge or person in charge, on a voluntary basis, to alternative conflict resolution mechanisms, in those cases in which there are controversies between them and any interested party”. In this case, considering the seriousness of the infractions found, the imposition of a fine and, where appropriate, the adoption of measures. cannot accept the request made by PAGE GROUP EUROPE for the imposition of other powers corrective measures, such as the warning, which is planned for natural persons and when the sanction constitutes a disproportionate burden (considering 148 of the GDPR). In this respect, this Agency does not agree that the infringements declared are of little seriousness, considering the effects that have been determined in the exercise of the rights recognized to the interested parties; nor the short duration of the same alleged by the respondent, given that the irregular process of managing those rights has been imposed since the moment it was GDPR applies. In accordance with the precepts indicated, in order to set the amount of the penalties to impose in the present case, it is considered appropriate to graduate the fines of according to the following criteria: 1. Infringement of article 12 of the RGPD, typified in article 83.5.b) and qualified as minor for purposes of prescription in article 74.c) of the LOPDGDD: The following graduation criteria are considered concurrent as aggravating: . Article 83.2.a) of the RGPD: “a) the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the operation C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 32/37 of treatment in question as well as the number of interested parties affected and the level of damages they have suffered. . The nature of the infraction, since the lack of attention to the right of access, due to its content, affects the ability of the claimant to exercise true control over your personal data. . The nature of the damage caused to the interested person, who saw unattended one of your basic rights in terms of data protection personal, despite the communications sent by the same insisting in your interest. . Article 83.2.d) of the RGPD: “d) the degree of responsibility of the person in charge or of the data processor, taking into account the technical or organizational measures that they have applied by virtue of articles 25 and 32”. The imputed entity does not have adequate procedures in place for performance in the collection and processing of personal data, in what refers to the management of requests for the exercise of rights, so that the infringement is not the consequence of an anomaly in the functioning of said procedures but a defect in the personal data management system designed by the person in charge. Said procedure was adopted by the respondent to own initiative establishing requirements that exceeded the forecasts applicable regulations. . Article 76.2.b) of the LOPDGDD: “b) The link between the activity of the offender with the processing of personal data”. The high link between the activity of the offender and the performance of treatment of personal data, considering the activity that it develops in the sector of Human Resources and the level of implementation of the entity (in the Background Sixth, some details about this implantation are collected). . Article 83.2.k) of the RGPD: “k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as the financial benefits obtained or losses avoided, directly or indirectly, through the infringement”. The large company status and turnover of PageGroup and PAGE GROUP EUROPE (in the Sixth Antecedent some details are collected when respect). It is also considered that there are extenuating circumstances following: . Article 83.2.f) of the RGPD: “f) the degree of cooperation with the control authority in order to remedy the infringement and mitigate possible adverse effects of the offence”. The right of access exercised by the claimant was finally addressed by the claimed entity, although it was necessary the intervention of the authorities of control. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 33/37 PAGE GROUP EUROPE, in its pleadings brief, has not made any statement any regarding the criteria and factors assessed to classify this infraction. Considering the exposed factors, the valuation reached by the fine, for the Violation of article 12 of the RGPD, it is 50,000 euros (fifty thousand euros). 2. Infringement due to non-compliance with the provisions of article 5.1.c) of the RGPD, typified in article 83.5.a) and classified as very serious for prescription purposes in article 72.1.a) of the LOPDGDD: The following graduation criteria are considered concurrent as aggravating: . Article 83.2.a) of the RGPD: “a) the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the operation of treatment in question as well as the number of interested parties affected and the level of damages they have suffered. . The nature, seriousness and duration of the offence, taking into account the nature, scope or purpose of the processing operations to be carried out treats. The infringement affects fundamental aspects of data protection (...), according to the rights management procedure implemented by the claimed at the time the GDPR became applicable, which has not remained rectified until the opening of the procedure. . The number of interested parties: the infringement affects all the interested parties that have exercised the right of access or portability, although it is necessary consider the significance that the offending conduct may have had on all the entity's clients, very numerous considering the level of its international implementation. . The nature of the damage caused to the interested persons, which their rights have been limited and the risk to their privacy has increased. . Article 83.2.b) of the RGPD: "b) the intention or negligence in the infringement". The negligence appreciated in the commission of the infraction. In this respect, the argument made by PAGE GROUP cannot be accepted EUROPE, according to which negligence must be assessed when the conduct is deviate from recognized standards. If a performance deviates from the established by the norm it cannot be said that it responds to the standards. In addition, in relation to the claimant's request for access, the aforementioned entity, (...), he did not attend to the right until the intervention of the control authorities. . Article 83.2.d) of the RGPD: “d) the degree of responsibility of the person in charge or of the data processor, taking into account the technical or organizational measures that they have applied by virtue of articles 25 and 32”. The imputed entity does not have adequate procedures in place for C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 34/37 performance in the collection and processing of personal data, so that the infringement is not the result of an anomaly in the functioning of these procedures but a defect in the data management system personal designed by the person in charge. . Article 76.2.a) of the LOPDGDD: “a) The continuous nature of the infraction”. (...). It is a plurality of actions that follow the performance designed by PAGE GROUP EUROPE, which violate the same precept. . Article 76.2.b) of the LOPDGDD: “b) The link between the activity of the offender with the processing of personal data”. The high link between the activity of the offender and the performance of treatment of personal data, taking into account the reasons already expressed when exposing the prior offense ranking factors. . Article 83.2.k) of the RGPD: “k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as the financial benefits obtained or losses avoided, directly or indirectly, through the infringement”. . The volume of data and processing that constitutes the object of the file, taking into account the level of information that the requested person has accessing its services. . The large company status and turnover of PageGroup and PAGE EUROPE GROUP. It is also considered that there are extenuating circumstances following: . Article 83.2.c) of the RGPD: “Any measure taken by the person in charge or in charge of the treatment to alleviate the damages suffered by the interested”. . Article 83.2.f) of the RGPD: “The degree of cooperation with the control authority in order to remedy the infringement and mitigate possible adverse effects of the offence”. PAGE GROUP EUROPE has designed a new management procedure for rights that corrects the objections that have given rise to the commission of the infractions. However, it is taken into account that this remedy has not been produced until after the opening of the procedure has been agreed. Considering the exposed factors, the valuation reached by the fine, for the Violation of article 5.1.c) of the RGPD, is 250,000 euros (two hundred and fifty thousand euros). None of the considered graduation factors is attenuated by the fact that that the claimed entity has not been subject to a sanctioning procedure with previously, a circumstance that has been alleged by the claimed entity so that C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 35/37 be considered a mitigating factor. In this regard, the AN Judgment of 05/05/2021, rec. 1437/2020, indicates that “Considers, on the other hand, that the non-commission of a crime should be considered as mitigating previous offense. Well, article 83.2 of the RGPD establishes that you must have into account for the imposition of the administrative fine, among others, the circumstance "e) any previous infraction committed by the person in charge or the person in charge of the treatment". This is an aggravating circumstance, the fact that concurrence of the budget for its application entails that it cannot be taken into consideration, but does not imply or allow, as claimed by the plaintiff, its application as a mitigating factor”. PAGE GROUP EUROPE also refers in its allegations to two actions followed by the Dutch data protection authority for processing illegal identification documents in which companies were not sanctioned involved, although, according to the claimed entity itself, it is about actions prior to the entry into force of the GDPR. In addition, they are not provided details that determined said agreements. viii The infractions committed may lead to the imposition of the person responsible for the adoption of appropriate measures to adjust its actions to the aforementioned regulations in this act, in accordance with the provisions of the aforementioned article 58.2.d) of the RGPD, according to which each control authority may "order the person in charge or in charge of the treatment that the treatment operations comply with the provisions of the this Regulation, where appropriate, in a certain way and within a specified period…”. The non-attention of the requirements of this organism can be considered as a serious administrative infraction by “not cooperating with the Control authority” in the face of such requirements, and such conduct may be assessed the time of opening an administrative sanctioning procedure with a fine pecuniary In such a case, in the resolution that is adopted, this Agency may require the entity responsible so that, within the period determined, it adapts to the regulations of protection of personal data the treatment operations carried out and the mechanisms and procedures that it follows to deal with requests to exercise rights formulated by the interested parties, with the scope expressed in the Legal basis of this agreement. Likewise, the measures that could be adopted in the resolution that puts an end to the procedure, in relation to the treatment activities and the exercise of rights, will be applicable in all the countries of the European Union in which operates PageGroup. (...). (...). (...). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 36/37 (...). However, the aforementioned entity has contributed with its brief of allegations to the opening of the procedure the document called “RGPD data request process of the EU”, through which it establishes the management that it currently follows in relation to requests to exercise rights. (...). (...). (...). It is considered that these new measures implemented by PAGE GROUP EUROPE conform to the criteria assessed in these actions, in relation to the procedures for managing requests for the exercise of rights and the means to validate the identity of the applicants, not resulting in the imposition of additional measures. IX Article 85 of Law 39/2015, of October 1, on Administrative Procedure Common to Public Administrations (LPACAP), under the heading "Termination in sanctioning procedures” provides the following: "1. Once a sanctioning procedure has been initiated, if the offender acknowledges his responsibility, resolve the procedure with the imposition of the appropriate sanction. 2. When the sanction is solely pecuniary in nature or it is possible to impose a sanction pecuniary and another of a non-pecuniary nature but the inadmissibility of the second, the voluntary payment by the alleged perpetrator, at any time prior to the resolution, will imply the termination of the procedure, except in relation to the replacement of the altered situation or the determination of compensation for damages caused for committing the offence. 3. In both cases, when the sanction is solely pecuniary in nature, the competent to resolve the procedure will apply reductions of at least 20% on the amount of the proposed sanction, these being cumulative with each other. The aforementioned reductions must be determined in the notification of initiation of the procedure and its effectiveness will be conditioned to the withdrawal or renunciation of any action or resource in via administrative against the sanction. The reduction percentage provided for in this section may be increased regulations”. The entity PAGE GROUP EUROPE, during the period granted to it for formulate allegations to the proposed resolution, has proceeded to the voluntary payment of sanction with the legally foreseen reduction, which determines the end of the procedure and entails the waiver of any action or resource in administrative against the penalty. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es, 37/37 Therefore, in accordance with the applicable legislation, the Director of the Agency Spanish Data Protection RESOLVES: FIRST: DECLARE the termination of procedure PS/00003/2021, followed against the entity PAGE GROUP EUROPE, S.L. for violations of articles 12 and 5.1.c) of the RGPD, typified in articles 83.5.b) and 83.5.a) of the same Regulation, respectively; in accordance with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to the entity PAGE GROUP EUROPE, SL In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by Articles 48.6 of the LOPDGDD and 114.1.c) of Law 39/2015, of October 1, of the Common Administrative Procedure of the Public Administrations, the interested parties may file a contentious-administrative appeal before the Contentious Chamber. of the National High Court, in accordance with the provisions of article 25 and in section 5 of the fourth additional provision of Law 29/1998, of July 13, regulation of the Contentious-Administrative Jurisdiction, within a period of two months to count from the day following the notification of this act, as provided in the Article 46.1 of the aforementioned Law. 938-231221 Sea Spain Marti Director of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es