AEPD (Spain) - EXP202300692
From GDPRhub
| AEPD - EXP202300692 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 12.12.2022 |
| Decided: | |
| Published: | 20.06.2024 |
| Fine: | 42,000 EUR |
| Parties: | CUI ZSQ FOOD, S.L. |
| National Case Number/Name: | EXP202300692 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | lm |
A court held that a controller violated the GDPR’s confidentiality principle when one of its supervisors sent video surveillance footage of a data subject leaving their post for a longer bathroom break to a workplace group chat. The controller acknowledged its fault and paid a reduced fine of €42,000 in accordance with national law.
English Summary
Facts
On 12 December 2022, a data subject filed a complaint with the Spanish DPA (AEPD) against CUI ZSQ FOOD, S.L. (the controller) concerning the controller’s video surveillance system. The data subject alleged that the controller used the video surveillance to observe an employee’s absence from his post to use the toilet for 18 minutes and sent the footage to employees in a WECHAT group chat. The video was sent with a caption stating that it observed the employee using the toilet for 18 minutes. It asked the employees if they all thought that it was fair to do so, and if not, that the employee should have the money subtracted from his pay.
The controller argued that the message in the WECHAT group was the result of an angry outburst by the controller’s production overseer due to the employee’s prolonged absence. It did not admonish any employee because it considered that the only purpose of the message was to remind the workers that they should respect the company’s obligations for employees. The controller argued that no employee was identified in the message by name, and that it was not possible to identify the employee from the footage due to its quality.
The AEPD noted that the controller’s facility had several signs indicating a video surveillance zone prior to entering the recorded space. Its alleged purpose for the surveillance was monitoring the security of the workplace and employees, the quality of the products and the work of the employees. The controller claimed that all employees were given a privacy policy which mentioned the video surveillance system and these purposes. The retention period for video surveillance data was 30 days.
Holding
The AEPD found that the controller violated Article 5(1)(f) GDPR when one of its employees sent a video of the data subject to a WECHAT group. The distribution of the video surveillance footage lacked a legal basis and violated the confidentiality of the data subject’s personal data, along with the other employees visible in the video.
The AEPD recommended a sanction of €70,000. Pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €42,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/12
File No.: EXP202300692
RESOLUTION OF TERMINATION OF THE PAYMENT PROCEDURE
VOLUNTEER
From the procedure instructed by the Spanish Data Protection Agency and based
to the following
BACKGROUND
FIRST: On May 28, 2024, the Director of the Spanish Agency for
Data Protection agreed to initiate sanctioning proceedings against CUI ZSQ FOOD, S.L.
(hereinafter, the claimed party), through the Agreement transcribed:
<<
File No.: EXP202300692
AGREEMENT TO START SANCTIONING PROCEDURE
Of the actions carried out by the Spanish Data Protection Agency and in
based on the following
FACTS
FIRST: On December 12, 2022, a claim was filed with the
Spanish Data Protection Agency directed against CUI ZSQ FOOD, S.L. with
NIF B16277311 (hereinafter, the claimed part). The reasons on which the
claim are the following:
The complaining party states that he works in the claimed party and that in his
facilities have a video surveillance system that has been used by the
company, in the event of a person's absence for a period of 18 minutes from their
job, to threaten employees at work through a group
of the mobile phone application WE CHAT, showing two videos alluding to the period
absence of said person.
Along with the claim, a copy of the videos published in the chat and images are provided.
of the chat, in Chinese language, and translation into Spanish carried out by a translator-interpreter
Chinese jury.
The chat is called “Grupo cui zsq food noodle factory (35)”.
On May 19 11:57 A.A.A. sent a video. He also sent a voice message with the
following content: “Hello to the entire group, in this video you can see one of you
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/12
going to the bathroom at 9:00 at night, this is when it starts to go, it's not clear
who is it. It goes at 9:00 and comes back at 9:18, this period of time, how is that. Yeah
You all agree with that, well, if you don't, let him get the money."
Next, that person sends another voice message, with the following content:
“I'm sending you another video, this is from when he comes back.” And send a video.
Then send a new voice message, with the following content: “This is the video
Afterwards, when he comes back, it's 9:18 and a few seconds, look, he's from the group of
B.B.B.”
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), said claim was transferred to the claimed party, to
to proceed with its analysis and inform this Agency within a period of one month, of the
actions carried out to adapt to the requirements provided for in the regulations of
Data Protection.
The transfer, which was carried out in accordance with the rules established in Law 39/2015, of
October 1, of the Common Administrative Procedure of Administrations
Public (hereinafter, LPACAP), was collected on 01/20/2023 as stated in the
acknowledgment of receipt that appears in the file.
On 02/15/2023, this Agency received a written response indicating that the
The number of cameras in the surveillance system is a total of (…).
As document no. 1 annex, photographs of all the devices are provided.
(…). The first photograph shows the monitor, where the field of vision of
all devices. The first field of view image that appears on the
monitor corresponds to camera 1, the second image corresponds to camera 2, and so on
successively.
As document no. 2 annex, photographs of all devices and
of the monitor of (…).
The monitor is located in (…).
The measures taken to ensure that only authorized personnel access the
images and recordings are:
- (…).
- (…).
It is provided as document no. 3, the photographs of the signs that warn of the
existence of a video-surveillance area. These signs are installed in the part
exterior of all access doors to warehouses where there are cameras
(regardless of whether the cameras are located inside or outside the ships),
and one at the entrance to each enclosure.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/12
There is no contract in written form for the maintenance of the security system.
video surveillance. If there is any breakdown, the services of the
installer.
The recording time of the surveillance system images depends on the
capacity of the device, but the maximum is 30 days.
Regarding the requirement for information on the dissemination of two videos via application
WECHAT messaging service, it is reported that recently reviewed the
conversations held in the WECHAT group, it has not been possible to locate the
videos that are mentioned. Furthermore, in this group of workers of the
company only communicate in the Chinese language, which is unknown to
who answers the transfer of the claim, so to date there had not been any
able to carry out further investigations.
THIRD: On 02/20/2023, additional information was requested from the claimed party.
This request, which was carried out in accordance with the rules established in the LPACAP, was
collected on 02/20/2023 as stated in the acknowledgment of receipt that is in the
proceedings.
On 02/24/2023, this Agency received a written response indicating that the
The purpose of the installed video surveillance system is the security of the
facilities and the workers themselves, monitoring the quality control of the
products, as well as verify compliance with the obligations and duties of the
workers.
Indicates that all workers are given a policy document
of privacy of labor relations, in which, among other things, they are informed of the
existence of a video surveillance system and its purpose, that is, the
compliance with the obligations and duties of workers.
All the privacy policy documents of
labor relations signed by current workers.
Clear images of the captures made by each one are provided as Annex II.
of the chambers of (…); and as Annex III, same images from (…).
Regarding the dissemination of two videos in the group of workers in the application
WECHAT, after reviewing the images provided by the AEPD, conclude that
These videos and conversations are the result of a hot reaction on the part of the
person in charge of monitoring production, in case of absence for a period of time
of someone in their workplace, a fact that results in a
noticeable damage to the company and other workers.
It is explained that no worker was sanctioned or reprimanded for this
event, since the objective was none other than to remind all workers of the
importance of respecting the rules established for the proper functioning
of the company. As can be seen in the WECHAT conversations provided
By the AEPD, no worker is identified by name or surname.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/12
It is also not possible to identify any worker through the images
provided, given their quality, being that the only thing that is seen in the
same, is a worker returning to his job after hours, but without
identification may be possible, since the resolution of the cameras does not allow it, since
These are only intended to control the number of employees working on the line
of production at all times.
FOURTH: On 03/08/2023, additional information was requested again from the party
claimed.
This new request, which was carried out in accordance with the rules established in the
LPACAP, was collected on 03/08/2023 as stated in the acknowledgment of receipt that
work in the file.
On 03/10/2023, this Agency received a written response indicating that
He was notified of a requirement to again provide images of the field of vision of
the cameras, corrected in such a way that they do not focus on other people's properties.
That in order to evacuate said requirement, annexes are provided with the images of
the fields of view after having reoriented the cameras.
It is emphasized that some of the rustic lands that appear in the fields of
vision of some cameras (those identified in the annexes with a red arrow),
are also owned by the claimed part or are even part of the property itself.
ship enclosure.
FIFTH: On March 12, 2023, in accordance with article 65 of the
LOPDGDD, the claim presented by the complaining party was admitted for processing.
SIXTH: On March 15, 2023, the Director of the Spanish Agency for
Data Protection resolved to archive the proceedings considering that they were not
appreciated reasonable indications of the existence of an infringement in the area
competence of this Agency.
SEVENTH: On April 14, 2023, the claimant filed an appeal
power of reconsideration against the aforementioned resolution, in which he alleges that
unjustifiably disclosed a security video without the consent of the
workers as a way to intimidate at work. Furthermore, in these images
can see and identify the person, so it should be considered a violation
of the Data Protection Law and, furthermore, in the employment contract
there is no communication regarding data protection and even less than the possibility
recording images and disseminating them among employees. Regarding the posters of
information, its implementation must have been after its removal, since before
They didn't exist. In short, it is alleged that said installation does not comply with the guide on
the use of video surveillance by this Agency. The
sworn translation of the WECHAT group including the videos among others
documentation.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/12
EIGHTH: On September 7, 2023, by virtue of article 118 of the
LPACAP, a hearing procedure was granted to the claimed party so that within the period
maximum of ten business days to formulate the allegations and present the documents and
supporting documents that you deem appropriate.
This procedure, which was carried out in accordance with the standards established in the LPACAP, was
collected on 09/08/2023 as stated in the acknowledgment of receipt that is in the
proceedings.
On September 15, 2023, this Agency receives, in a timely manner,
writing from the claimed party in which it alleged allegations to the aforementioned appeal. In these
allegations, in summary, stated that:
- The documents provided by the complaining party with its appeal document
They are copies of the conversations already included in the original file and the
The claimed party has already clarified everything that was considered necessary in this regard,
having finally agreed to archive the proceedings due to the lack
of rational indications of the existence of an infringement in the area
jurisdiction of the AEPD, since no evidence was provided by the party
complainant that no worker in the alleged video was identified
concrete.
- The allegations made by the complaining party in its appeal are
are limited to being a mere reproduction of those formulated in the initial claim,
but without alleging error in the assessment of the evidence by the Administration or
challenge any of the grounds of its resolution.
- In accordance with art. 118.1 of the Common Administrative Procedure Law, it is not
may take into account in the resolution of the appeal, facts, documents or
allegations of the appellant, when having been able to contribute them in the process of
allegations he has not done so.
NINTH: On September 19, 2023, the Director of the Spanish Agency
of Data Protection decided to uphold the aforementioned optional appeal for reconsideration,
based on the fact that the dissemination in a messaging application of a video in which
identifies a female person in their work environment who is absent from work
temporary form of his position and rejoining minutes later, without there being a
legal basis that supports said treatment, is contrary to the regulations of
Data Protection.
This resolution, which was notified to the claimed party in accordance with the regulations
established in the LPACAP, was collected on September 28, 2023, as
It appears in the acknowledgment of receipt that is in the file.
TENTH: According to the report collected from the AXESOR tool on December 13
May 2024, the entity CUI ZSQ FOOD, S.L. It is a type company (…)
established in 2009, and had XX employees and a turnover of
***QUANTITY.1 euros in 2022.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/12
FOUNDATIONS OF LAW
Yo
Competence
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
of data.
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."
II
Previous issues
In the present case, in accordance with the provisions of article 4.1 and 4.2 of the RGPD,
involves processing personal data, since the party
claimed collects and preserves images of its workers, including
other treatments.
The claimed party carries out this activity in its capacity as responsible for the
treatment, given that it is the one who determines the purposes and means of such activity, by virtue
of article 4.7 of the GDPR.
III
Unfulfilled obligation. Integrity and confidentiality
Article 5 “Principles relating to processing” of the GDPR establishes:
"1. The personal data will be: (…)
f) processed in such a way as to ensure adequate data security
personal data, including protection against unauthorized or unlawful processing and
against its loss, destruction or accidental damage, through the application of measures
appropriate technical or organizational measures (“integrity and confidentiality”).”
In the present case, as can be seen from the facts, A.A.A. shipped on May 19
2022 to a WECHAT group with all its employees a video in which you can
see a person leaving their job and another video in which that person
person returns. As recognized by the claimed party in its allegations, said
person was in charge of monitoring production, whose conduct qualifies
as a hot reaction (...) to the absence for a prolonged time of
someone in their workplace, a fact that results in significant harm to
the company and the other workers.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/12
However, such dissemination lacked any legal basis and violated the
confidentiality of the personal data of the aforementioned worker as well as the rest of the
employees visible in the recording.
Therefore, in accordance with the evidence available herein
moment of agreement to start the sanctioning procedure, and without prejudice to what
results from the instruction, it is considered that the known facts could be
constituting an infraction, attributable to the claimed party, for violation of the
article 5.1.f) of the RGPD.
IV
Classification and classification of the violation of article 5.1.f) of the RGPD
The known facts could constitute an infringement, attributable to the party
claimed, typified in 83.5 RGPD, which under the heading “General conditions
for the imposition of administrative fines” provides:
"5. Violations of the following provisions will be sanctioned, in accordance with the
paragraph 2, with administrative fines of a maximum of EUR 20 000 000 or,
In the case of a company, an amount equivalent to a maximum of 4% of the
global total annual business volume of the previous financial year, opting for
the largest amount:
a) the basic principles for the treatment, including the conditions for the
consent under articles 5, 6, 7 and 9; (…)”
For the purposes of the limitation period for infringements, the alleged infringement
prescribes after three years, in accordance with article 72 of the LOPDGDD, which qualifies as very
serious the following behavior:
"1. Based on what is established in article 83.5 of Regulation (EU) 2016/679,
considered very serious and will prescribe violations that involve three years
a substantial violation of the articles mentioned therein and, in particular, the
following:
a) The processing of personal data violating the principles and guarantees
established in article 5 of Regulation (EU) 2016/679. (…)”
V
Sanction proposal
For the purposes of deciding on the imposition of an administrative fine and its amount,
in accordance with the evidence currently available
agreement to initiate the sanctioning procedure, and without prejudice to what results from the
instruction, it is considered appropriate to graduate the sanction to be imposed in accordance with
the following criteria established by article 83.2 of the RGPD:
- The nature, severity and duration of the infraction, taking into account the
nature, scope or purpose of the processing operation in question
as well as the number of interested parties affected and the level of damage and
damages they have suffered (section a): due to the improper dissemination of two
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/12
videos in which you can see a worker who was absent and returned to her
job, as well as other workers on the production line, in
a chat with all employees (at least 51 employees in 2022) of the
company, with the presumed intention of warning - upon being classified as fact
as a notable detriment to the company and other workers -, in order to
to avoid possible similar behavior from other workers.
Likewise, it is considered that it is appropriate to graduate the sanction to be imposed in accordance with the
following criteria established in section 2 of article 76 “Sanctions and measures
“corrective measures” of the LOPDGDD:
- The linking of the offender's activity with the performance of treatments
of personal data (section b): this is a company used to
capturing images of its, at least, 51 workers in 2022, when counting
with 37 cameras in its facilities.
The balance of the circumstances contemplated in article 83.2 of the RGPD, with
regarding the infraction committed by violating the provisions of article 5.1.f) of the
RGPD, allows initially setting an administrative fine of €70,000
(SEVENTY THOUSAND EUROS).
V
Adoption of measures
If the violation is confirmed, it could be agreed to impose on the person responsible the adoption of
appropriate measures to adjust its actions to the regulations mentioned in this
act, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD, according to the
which each control authority may “order the person responsible or in charge of the
treatment that the processing operations comply with the provisions of the
this Regulation, where appropriate, in a certain manner and within a
specified period…” The imposition of this measure is compatible with the sanction
consisting of an administrative fine, as provided in art. 83.2 of the GDPR.
It is warned that failure to comply with the possible order to adopt measures imposed by
This body in the sanctioning resolution may be considered as a
administrative offense in accordance with the provisions of the RGPD, classified as
infringement in its article 83.5 and 83.6, and such conduct may be motivated by the opening of a
subsequent administrative sanctioning procedure.
Therefore, in accordance with the above, by the Director of the Agency
Spanish Data Protection,
HE REMEMBERS:
FIRST: START SANCTIONING PROCEDURE against CUI ZSQ FOOD, S.L., with
NIF B16277311, for the alleged violation of article 5.1.f) of the RGPD, typified in the
article 83.5 of the GDPR.
SECOND: APPOINT C.C.C. as instructor. and, as secretary, to D.D.D.,
indicating that they may be challenged, if applicable, in accordance with the provisions of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/12
articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Sector
Public (LRJSP).
THIRD: INCORPORATE into the sanctioning file, for evidentiary purposes, the
claim filed by the complaining party and its documentation, as well as the
documents obtained and generated by the General Subdirectorate of Inspection of
Data in the actions prior to the start of this sanctioning procedure.
FOURTH: THAT for the purposes provided for in art. 64.2 b) of law 39/2015, of 1
October, of the Common Administrative Procedure of Public Administrations, the
sanction that could correspond would be an administrative fine of €70,000
(SEVENTY THOUSAND EUROS), without prejudice to what results from the instruction.
FIFTH: NOTIFY this agreement to CUI ZSQ FOOD, S.L., with NIF
B16277311, granting him a hearing period of ten business days to formulate
the allegations and present the evidence that you consider appropriate. In his writing of
allegations must provide your NIF and the file number that appears in the
heading of this document.
If within the stipulated period you do not make allegations to this initial agreement, the same
may be considered a proposal for a resolution, as established in the article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP).
In accordance with the provisions of article 85 of the LPACAP, you may recognize your
responsibility within the period granted for the formulation of allegations to the
present initiation agreement; which will entail a 20% reduction in the
sanction that may be imposed in this procedure. With the application of this
reduction, the penalty would be established at 56,000.00 euros, resolving the
procedure with the imposition of this sanction.
Likewise, you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which
will mean a 20% reduction in the amount. With the application of this reduction,
The penalty would be established at 56,000.00 euros and its payment will imply termination
of the procedure, without prejudice to the imposition of the corresponding measures.
The reduction for the voluntary payment of the penalty is cumulative with that corresponding
apply for recognition of responsibility, provided that this recognition
of the responsibility becomes evident within the period granted to formulate
allegations at the opening of the procedure. The voluntary payment of the referred amount
in the previous paragraph may be done at any time prior to the resolution. In
In this case, if both reductions were to be applied, the amount of the penalty would remain
established at 42,000.00 euros.
In any case, the effectiveness of any of the two mentioned reductions will be
conditioned upon the withdrawal or waiver of any action or appeal pending.
administrative against the sanction.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/12
In the event that you choose to proceed with the voluntary payment of any of the amounts
indicated above (56,000.00 euros or 42,000.00 euros), you must make it effective
by depositing it into the IBAN account number: ES00-0000-0000-0000-0000-0000
(BIC/SWIFT Code: CAIXESBBXXX) opened in the name of the Spanish Agency of
Data Protection in the banking entity CAIXABANK, S.A., indicating in the
concept the reference number of the procedure appearing in the heading
of this document and the reason for the reduction of the amount to which it applies.
Likewise, you must send proof of income to the General Subdirectorate of
Inspection to continue the procedure in accordance with the quantity
entered.
The procedure will have a maximum duration of twelve months from the date
of the initiation agreement. After this period, its expiration will occur and, in
consequently, the archive of actions; in accordance with the provisions of the
article 64 of the LOPDGDD.
Finally, it is noted that in accordance with the provisions of article 112.1 of the LPACAP,
There is no administrative appeal against this act.
935-18032024
Sea Spain Martí
Director of the Spanish Data Protection Agency
>>
SECOND: On June 13, 2024, the claimed party has proceeded to pay
the penalty in the amount of 42,000 euros making use of the two reductions
provided for in the initiation Agreement transcribed above, which implies the
recognition of responsibility.
THIRD: The payment made, within the period granted to formulate allegations to
The opening of the procedure entails the renunciation of any action or appeal pending.
administrative against sanction and recognition of responsibility in relation to
the facts referred to in the Initiation Agreement.
FOUNDATIONS OF LAW
Yo
Competence
In accordance with the powers that article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD), grants each
control authority and as established in articles 47, 48.1, 64.2 and 68.1 of the
Organic Law 3/2018, of December 5, on Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), is competent to
initiate and resolve this procedure the Director of the Spanish Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/12
of data.
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with a
subsidiary, by the general rules on administrative procedures."
II
Termination of the procedure
Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common Public Administrations (hereinafter, LPACAP), under the heading
“Termination in sanctioning procedures” provides the following:
"1. A sanctioning procedure has been initiated, if the offender recognizes his responsibility,
The procedure may be resolved with the imposition of the appropriate sanction.
2. When the sanction has only a pecuniary nature or a penalty can be imposed
pecuniary sanction and another of a non-pecuniary nature but the
inadmissibility of the second, the voluntary payment by the alleged responsible, in
Any time prior to the resolution, will imply the termination of the procedure,
except in relation to the restoration of the altered situation or the determination of the
compensation for damages caused by the commission of the infringement.
3. In both cases, when the sanction has only a pecuniary nature, the
body competent to resolve the procedure will apply reductions of, at least,
20% of the amount of the proposed penalty, these being cumulative with each other.
The aforementioned reductions must be determined in the initiation notification.
of the procedure and its effectiveness will be conditioned on the withdrawal or resignation of
any administrative action or appeal against the sanction.
The reduction percentage provided for in this section may be increased
“regularly.”
According to what was stated,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: DECLARE the termination of procedure EXP202300692, of
in accordance with the provisions of article 85 of the LPACAP.
SECOND: NOTIFY this resolution to CUI ZSQ FOOD, S.L..
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Administrative Litigation Chamber of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/12
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.
936-040822
Sea Spain Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
