AEPD (Spain) - PS/00116/2020
AEPD - PS/00116/2020 | |
---|---|
Authority: | AEPD (Spain) |
Jurisdiction: | Spain |
Relevant Law: | Article 13 GDPR Article 22(2) of the Spanish Law on Information Society Services (LSSI) |
Type: | Complaint |
Outcome: | Upheld |
Started: | |
Decided: | |
Published: | 03.11.2020 |
Fine: | 3000 EUR |
Parties: | La Casa Comprometida, S. Coop. |
National Case Number/Name: | PS/00116/2020 |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | Spanish |
Original Source: | AEPD decision (in ES) |
Initial Contributor: | Miguel Garrido de Vega |
The Spanish DPA (AEPD) imposed a €3000 fine on La Casa Comprometida, S. Coop. for infringing its information duties related to cookies, as per Article 22(2) Spanish Law on Information Society Services (LSSI). This law regulates cookies, connected to Article 13 GDPR.
English Summary
Facts
The decision is the consequence of a complaint submitted by a Spanish citizen stating that the website by the defendant did not provide information on cookies, so it did not comply with the data protection.
Dispute
As the defendant refused to receive the notices by the AEPD, the AEPD carried out an investigation procedure, and it discovered that the website did not offer information enough on cookies (i.e. how to manage or disable them) nor any option to refuse all the cookies. The AEPD started the corresponding sanction procedure.
Holding
Thus, the AEPD understood that the defendant has infringed its information duties in relation to cookies as per Article 22(2) LSSI, according to which, digital services providers may use data storage and retrieval devices on computers terminals of the recipients, provided that such recipients have given their consent after they have been provided with clear and complete information on their use and, in particular, on the purposes of data processing according to the data protection laws. Consequently, after considering some aggravating circumstances [(i) the existence of intentionality, and (ii) the period of time the defendant has been infringing its duties, taking into account that the claim is dated October 2019], the AEPD decided to impose a fine of 3,000 € to the defendant, and, additionally, required the defendant to its website as per indicated in the recent AEPD guide on the use of cookies, within the period of one (1) month since this resolution.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/5 Procedure Nº: PS / 00116/2020 938-0419 RESOLUTION OF SANCTIONING PROCEDURE In the sanctioning procedure PS / 00116/2020, instructed by the Spanish Agency for Data Protection, to the entity, LA CASA COMPROMETIDA, S.Coop. with CIF .: F95964086, owner of the website *** URL.1, (hereinafter, "the claimed entity"), by virtue of a complaint filed by D.A.A.A., and based on the following: BACKGROUND FIRST: On 10/03/19, you have an entry in this Agency, complaint filed by the claimant in which it indicated, among others, the following: “The web *** URL.1, dedicated to the online sale of various products, does not comply with the tual regulations on Data Protection due to, among others, the following circumstances cias: Lacks proper information about the cookies used ”. SECOND: In view of the facts set forth in the claim and the documents provided by the claimant, the Subdirectorate General for Data Inspection proceeded to carry out actions for its clarification, under the protection of the powers of investigation tion granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (RGPD). Thus, dated 12/19/19 and 01/07/20, both requests are addressed informative coughs to the claimed entity. According to the certificate of the Electronic Notifications and Electronic Address Service Authorized, of the Ministry of Territorial Policy and Public Administration, the requirement The sent to the claimed entity on 12/19/19, through the Notific @ service, was re- Chazado by the entity on 12/30/19. According to a certificate from the State Postal and Telegraph Society, the request to send do to the claimed entity on 01/07/20, through the SICER service, it was collected in destination 01/15/20, being the receiver: B.B.B. (*** NIF.1). THIRD: On 04/19/20 the website is consulted, checking the following Three aspects about the privacy policy and the cookie policy of the website: A) Regarding the Privacy Policy: At the bottom of the home page of the web, through the link to "Politics and Privacy dad ”, you access the page *** URL.2, which provides, among others, information tion about: the person responsible for the treatment, the collection, purpose, legitimation; the legal basis that applies; the rights of users and the revocability of consent. I lie; the purpose of the processing of personal data; the right to present a claim; the security applied to personal data and on the destinations natarios. B) About the Cookies Policy of the website: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/5 b.1.) When accessing the web page *** URL.3 (first layer), there is an information banner information on cookies at the bottom of the page, with the following legend: “This store uses cookies and other technologies so that we can improve your experience. rience on our sites ”- <<ACCEPT>> b.2.) If you access the cookie policy (second layer), through the link “Term- us and conditions ”, *** URL.4 provides, among others, information on: what are the cookies; what they use cookies for and what data is obtained. Regarding the management of cookies, the page does not provide any type of information on how to manage cookies. There is also no power option reject all cookies. FOURTH: On 06/17/20, the Director of the Spanish Agency for the Protection of Data agreed to initiate a sanctioning procedure against the claimed entity, by virtue of the powers established, for failing to comply with the provisions of article 22.2 of the LSSI, with an initial penalty of 3,000 euros (three thousand euros). FIFTH: Notified the initiation of the file on 06/29/20, to date, no It is clear that any response has been given to the initiation of the file within the period granted for this, for the appropriate legal purposes by the claimed entity. Of the actions carried out in this procedure, of the information and documents documentation presented by the parties, the following have been accredited: PROVEN FACTS 1º.- Regarding the Privacy Policy of the website denounced, it has been possible to prove that it provides information about: the person responsible for the treatment, the collection, purpose, legitimation; the legal basis that is applied; the rights of users and the revocability of consent; the purpose of the data processing personal, the right to file a claim; security applied to data of a personal nature and the recipients of personal data. 2nd.- About the Cookies Policy of the website, it has been verified that, in the same- ma, there is an information banner about cookies with the legend: “This store uses cookies and other technologies so that we can improve your experience on our sites. uncles" If the cookie policy is accessed, through the corresponding link, the provides information about: what cookies are or what they use cookies for, but, res- C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/5 Regarding the management of cookies, the page does not provide any information. There is also no option to reject all cookies. FOUNDATIONS OF LAW I Competition: - About the Privacy Policy: The Director of the Spanish Agency is competent to resolve this procedure of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR in the art. 47 of LOPDGDD. - About the Cookies Policy: The Director of the Spanish Agency is competent to resolve this procedure of Data Protection, in accordance with the provisions of art. art. 43.1, paragraph second, from the LSSI. II The joint assessment of the documentary evidence in the procedure brings to the conclusion knowledge of the AEPD a vision of the denounced action that has been reflected It gives in the facts declared proven above related. A) .- Of the actions carried out, in relation to the Privacy Policy of the page na website claimed, it is found that, in the present case, according to the evidence that are available at this time of the agreement to initiate the sanctioning procedure, It is considered that the Privacy Policy of the claimed website is not contradicted ce with the provisions of article 13 of the RGPD. III B) .- Of the actions carried out, in relation to the Cookies Policy, of the page website reported, it has been possible to verify that: In the first Layer, (initial page): The banner about cookies that is displayed when accessing der to the page provides information that is not very concise or intelligible. In the second Layer, "Terms and conditions", through the corresponding link, It is found that there is no information on the management of cookies or the possibility of its configuration in a granular way and / or the possibility of accepting / re reject all cookies. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/5 The facts presented suppose, on the part of the claimed entity, the commission of the infraction of article 22.2 of the LSSI, classified as "slight" in article 38.4 g), of the aforementioned Law, which may be sanctioned with a fine of up to € 30,000, in accordance with Article 39 of the aforementioned LSSI. After the evidence obtained in the preliminary investigation phase, and without prejudice to whatever results from the instruction, it is considered that the sanction should be ner in accordance with the following criteria established in art. 40 of the LSSI: - The existence of intentionality, an expression that must be interpreted as equi- value to degree of guilt according to the Judgment of the Hearing National of 11/12/07 relapse in Appeal no. 351/2006, corresponding to the entity denounced the determination of a system for obtaining consent informed service that conforms to the mandate of the LSSI. - Period of time during which the offense has been committed, since it is the claim for the month of October 2019, (section b). Based on these criteria, it is deemed appropriate to impose on the claimed entity a penalty of 3,000 euros (three thousand euros), for the violation of article 22.2 of the LSSI. Therefore, in accordance with the foregoing, by the Director of the Spanish Agency Data Protection Policy, RESOLVES FIRST: IMPOSE the entity LA CASA COMPROMETIDA, S.Coop. with CIF .: F95964086, owner of the website *** URL.1 a penalty of 3,000 euros (three thousand euros) ros), for the violation of article 22.2) of the LSSI, regarding its Cookies Policy. SECOND: REQUIRE the entity LA CASA COMPROMETIDA, S.Coop. for what, within a month from this act of notification, proceed to take the measures adequate to adapt the website of their ownership, in accordance with the current legislation people, for which, you can use the information in the "Guide on Cookies" edited by the Spanish Agency for Data Protection in November 2019. THIRD: NOTIFY this resolution to the entity, THE HOUSE COMMITTED DA, S.Coop. Warn the sanctioned person that the sanction imposed must be effective once this resolution is enforceable, in accordance with the provisions of article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of the Ad- Public Ministries (LPACAP), within the voluntary payment period indicated in article C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/5 68 of the General Collection Regulation, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, me- when entering the restricted account number ES00 0000 0000 0000 0000 0000, opened on behalf of the Spanish Agency for Data Protection at Banco CAIXABANK, S.A. or otherwise, it will be collected in the executive period. Notification received and once executive, if the execution date is found between the 1st and the 15th of each month, both inclusive, the deadline for making the vo- luntario will be until the 20th day of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediate business month. In accordance with the provisions of article 82 of Law 62/2003, of December 30- of fiscal, administrative and social order measures, this Resolution is will be made public, once it has been notified to the interested parties. The publication is made- It will be in accordance with the provisions of Instruction 1/2004, of December 22, of the Agency Spanish Data Protection Agency on the publication of its Resolutions. Against this resolution, which puts an end to administrative proceedings, and in accordance with established in articles 112 and 123 of the LPACAP, the interested parties may interpose ner, optionally, appeal for reconsideration before the Director of the Spanish Agency of Data Protection within a period of one month from the day following the notification fication of this resolution, or, directly administrative contentious appeal before the Contentious-administrative chamber of the National Court, in accordance with the provisions set out in article 25 and section 5 of the fourth additional provision of the Law 29/1998, of 07/13, regulating the Contentious-administrative Jurisdiction, in the two months from the day following notification of this act, according to the provisions of article 46.1 of the aforementioned legal text. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the final resolution through administrative channels if the interested party do manifests its intention to file a contentious-administrative appeal. Of being In this case, the interested party must formally communicate this fact in writing addressed to the Spanish Agency for Data Protection, presenting it through the Re- Electronic registry of the Agency [https://sedeagpd.gob.es/sede-electronicaweb/], or to through any of the other registers provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. You must also forward the documentation to the Agency that certifies the effective filing of the contentious-administrative appeal. If the Agency had no knowledge of the filing of the contentious-administrative appeal trative within a period of two months from the day following notification of this resolution, would terminate the precautionary suspension. Mar España Martí Director of the Spanish Agency for Data Protection. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es