AEPD (Spain) - AEPD - EXP202414290
From GDPRhub
| AEPD - AEPD - EXP202414290 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Article 83(2)(a) GDPR Article 83(2)(b) GDPR Article 83(2)(k) GDPR Article 83(5)(a) GDPR Article 71 LOPDGDD Article 76(2)(b) LOPDGDD Article 85(3) LPACAP |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 07.10.2024 |
| Decided: | 18.03.2025 |
| Published: | 01.04.2025 |
| Fine: | 21,000 EUR |
| Parties: | Alvea Soluciones Tecnológicas, S.L |
| National Case Number/Name: | AEPD - EXP202414290 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | https://www.aepd.es/ (in ES) |
| Initial Contributor: | Marina Stoler |
The DPA fined a consulting firm €21,000 for unintentionally disclosing personal data of numerous job applicants to the other applicants due to linking to an internal Google spreadsheet in the communication with the applicants. Thus, violating Article 5(1)(f) GDPR.
English Summary
Facts
On 7 October 2024, a data subject filed a complaint to the DPA against Alvea Soluciones Tecnológicas, S.L. (the controller). They alleged that the controller sent an email to candidates for a job offer (data subjects) requesting the processing of their data. Further, such an email included a link to a Google form indicating the disclosure of the data subjects’ personal data by transmission of the controller to third companies that work with it (processors). The form entailed a spreadsheet with the name and ID of data subjects who had denied the processing of their data. Lastly, that spreadsheet could be accessed by anyone with the form’s URL.
On 17 October 2024, the DPA requested information on the measures taken by the controller to comply with the GDPR. In response, the controller admitted an administrative error, claiming that a new technician included both internal and external links in the email sent to the data subject, instead of just the external one. Furthermore, the controller has implemented several measures to address the error. Three measures were crucial for the development of the complaint. First, analysing the need for a Data Protection Officer (DPO), which led to the controller appointing one. Second, restricting access to the internal link, deactivating it. Third, proving that only the controller’s authorized members could open the internal link. On 23 October 2024, the controller informed the data subjects about the error in the previous email and requested its deletion.
On 15 November 2024, the complaint was allowed to proceed.
Holding
First, the DPA held that the controller had violated Article 5(1)(f)GDPR. The controller had enabled access to an internal spreadsheet containing candidates' personal data and had transmitted its link without any limitations or control. Therefore, under Articles 83(5)(a)GDPR and 71 Organic Law on Protection of Personal Data and Guarantee of Digital Rights 3/2018 (“LOPDGDD”), the DPA imposed an administrative fine on the controller because of the lack of confidentiality and integrity in processing personal data.
Secondly, the DPA set three criteria to determine the fine amount. First, the access to personal data of 10.837 people, and the potential damage to all data subjects included in the controller’s internal list (Article 83(2)(a)GDPR). Second, the controller’s negligence in ensuring confidentiality in the processing of personal data (Article 83(2)(b)GDPR). Third, an aggravating factor regarding the necessity of a careful processing of personal data by the controller, considering its business purpose and volume (Articles 83(2)(k)GDPR and 76(2)(b) LOPDGDD).
The fine was initially set at €35,000, but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €21,000, based on Article 85(3) Law 39/2015.
Finally, the DPA held that the controller should adopt two measures. One concerns the implementation of measures to prevent emails and other client communications from granting access to third-party data. Another consists of obtaining a DPO assessment of deployed controls.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/13 File No.: EXP202414290 RESOLUTION TERMINATING THE PROCEDURE FOR RECOGNITION OF LIABILITY AND VOLUNTARY PAYMENT From the procedure initiated by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On March 18, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against ALVEA SOLUCIONES TECNOLÓGICAS, S.L. (hereinafter, ALVEA), through the agreement transcribed below: << File No.: EXP202414290 AGREEMENT TO INITIATE SANCTIONING PROCEDURE Regarding the actions taken by the Spanish Data Protection Agency and based on the following FACTS FIRST: On 10/07/2024, a complaint was filed with the Spanish Data Protection Agency against ALVEA SOLUCIONES TECNOLÓGICAS, S.L. with Tax Identification Number (NIF) B88024450 (hereinafter, the respondent). The grounds for the complaint are as follows: the complainant states that the respondent company calls by phone offering job openings and subsequently sends an email to provide the data of the person they called. It also indicates that the aforementioned email contains a Google form indicating that the data will be transferred to other entities that work with the company in question, but the information provided in the form ends up in a spreadsheet accessible to anyone with the URL to said document. The form also contains the names and ID numbers of individuals who have not consented to the transfer of their data. It also states that another section of the form that must be filled out indicates that the data will be retained for a maximum period of 18 months, which is also not met, since the spreadsheet contains data from 2020. The complainant provides the following documentation: a) an EXCEL document with 10,837 individuals and the consent clause of the form sent by the company in question, showing the names, surnames, and ID numbers of the users who completed the form (the complainant's data does not appear); b) Notepad with the two email links: Form: https://docs.google.com/forms/d/e/1FAIpQLSd3vvsytJKQc9nphefEPvLZ_ufo4B6 SGPkx9Pmv75KhwgxrYw/viewform and Excel: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/13 https://docs.google.com/spreadsheets/d/1vBD-5hzQ7WowIZ- yxcoLK6kG5TRE7k55p41bcXlh3I/edit?pli=1&gid=262149063#gid=262149063; c) screenshot of the email sent by the respondent company to the complainant, showing the two links and attaching the possible EXCEL document of consent with the users, with an undetermined date; d) screenshot of a portion of the EXCEL document with the 10,837 individuals. SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), on October 17, 2024, the respondent was notified of this complaint so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the data protection regulations. The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was notified on October 18, 2024, as recorded in the acknowledgment of receipt included in the file. On November 14, 2024, the respondent responded, stating that it had analyzed the complaint and acknowledged that an administrative error had occurred, which it describes as a one-off error, involving the inclusion of a link for internal use next to the registration link sent to candidates requesting their consent and the transfer of application processing. The respondent adopted the following measures: 1. Evaluate the need to appoint a Data Protection Officer (DPO), given the recent increase in the volume of such processing and the increase in the number of employees. The newly appointed DPO has coordinated the management of this information request with the current consulting firm, and will evaluate the appropriate controls to be implemented. 2. The day after the incident was discovered, a security measure was implemented, which consisted of limiting access to said internal link. The link was disabled, and therefore the data was no longer accessible from the aforementioned link. 3. Additionally, it was verified and confirmed that only previously authorized personnel can open this link, confirming that this measure has been effective. 4. Another measure was implemented so that ALVEA's technical recruitment staff only have access to the essential data of candidates who have given their consent in the last 18 months, given that the remaining data remains blocked until completely deleted, after the legal retention periods have expired. 5. All of this has been reflected and updated in the candidate recruitment management procedure that has been communicated internally. This process allows for the elimination of threats arising from unintentional administrative errors such as the one that occurred. 6. On 10/23/2024, an email was sent to the candidate, the purpose of which is outlined in the subject line: "Subject of email: Information on an ALVEA error C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/13 related to your selection process and requesting deletion of the previously sent email." The candidate states that after receiving the notification from the AEPD, they immediately met with the external data protection consulting firm, urging them to gather information regarding the incident reported by the Agency to reflect it in the appropriate Security Incident Report. The analysis shows that the administrative error stemmed from a recently hired recruitment specialist who, despite having received onboarding training at the appropriate company, sent the email to the candidate requesting registration, including two links, both the internal and external links, instead of only the latter. THIRD: On November 15, 2024, in accordance with Article 65 of the LOPDGDD (Spanish Data Protection Act), the complaint filed by the complainant was admitted for processing. FOURTH: According to the report collected from the AXESOR tool, the company ALVEA SOLUCIONES TECNOLÓGICAS, S.L. It is a company established in 1918, with a turnover of €7,264,681 in 2023. LEGAL BASIS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and as established in Articles 47, 48.1, 64.2, and 68.1 of the LOPDGDD (Spanish Data Protection Act), the President of the Spanish Data Protection Agency is competent to resolve this procedure. II Procedure Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development, and, insofar as they do not contradict them, in a subsidiary manner, by the general rules on administrative procedures." In accordance with Article 64 of the LOPDGDD, and taking into account the characteristics of the alleged infringement, a sanctioning procedure shall be initiated. The procedure shall have a maximum duration of twelve months, counting from the date of the initiation agreement. After this period, the procedure shall expire, and, consequently, the proceedings shall be closed, in accordance with the provisions of Article 64 of the LOPDGDD. If no objections are made to this initial agreement within the stipulated period, it may be considered a proposed resolution, as established in Article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/13 III Breached obligation: violation of Article 5.1.f) of the GDPR The facts complained of materialize in the sending to the complaining party, in the candidate selection process carried out by the respondent party, of a link providing access to an internal list of candidates containing their personal data, which could lead to a violation of the regulations on personal data protection. Article 5.1.f) “Principles relating to processing” of the GDPR states: “1. Personal data shall be: (…) f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by applying appropriate technical or organizational measures (“integrity and confidentiality” (…)”. The documentation in the file provides clear evidence that the respondent violated Article 5 of the GDPR, principles relating to processing, by allowing access to personal data belonging to third parties, motivated by providing a link that provided unlimited and uncontrolled access to an internal list of candidates prepared by the respondent. In its response of 11/14/2024, the respondent acknowledged, in relation to the incident that occurred, that "...it has analyzed the complaint and acknowledges that, despite all the activities undertaken over the years and the due diligence measures adopted and mentioned in the previous point, a specific administrative error occurred when including a link for internal use alongside the correct registration link sent to candidates to request their consent and transfer of processing of their application. (...) From the analysis carried out, it is clear that the administrative error arose from a recently hired recruitment technician who, despite having received the appropriate onboarding training at the company, sent the email to the candidate requesting registration, including two links, both the internal and the external link, instead of only the latter (...)" After analyzing the information provided by the respondent, it is observed that all of the indicated measures were adopted after the complaint was forwarded by this Agency, so no prior measures are observed that could have prevented the incident. Therefore, in accordance with the evidence available in this agreement to initiate sanctioning proceedings and without prejudice to the results of the investigation, it is considered that the facts disclosed could constitute an infringement, attributable to the respondent, for violation of Article 5.1.f) of the GDPR. IV Classification of the infringement of Article 5.1.f) of the GDPR and classification for the purposes of the statute of limitations In accordance with the evidence available and without prejudice to the results of the investigation, it is considered that the respondent did not adequately guarantee the confidentiality of personal data. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 5/13 The infringement attributed to the entity is classified under Article 83.5 a) of the GDPR, which considers that the infringement of "the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9" is punishable, in accordance with section 5 of the aforementioned Article 83 of the aforementioned Regulation, "with administrative fines of up to €20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total global annual turnover of the preceding financial year, whichever is higher." The LOPDGDD (Organic Law on the Protection of Personal Data) in its Article 71, "Infractions" states that: "The acts and conduct referred to in sections 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements." And in its Article 72, for the purposes of statute of limitations, it considers the following: "Infractions considered very serious: 1. Based on the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein, and in particular, the following, are considered very serious and will be subject to a three-year statute of limitations: a) The processing of personal data in violation of the principles and guarantees established in Article 5 of Regulation (EU) 2016/679 (...)" V Proposed sanction for infringement of Article 5.1.f) of the GDPR In order to establish the appropriate administrative fine to be imposed, the provisions contained in Articles 83.1 and 83.2 of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each individual case, effective, proportionate, and dissuasive. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due account shall be taken of: a) the nature, gravity, and duration of the infringement, taking into account into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage suffered; b) the intentionality or negligence of the breach; c) any measures taken by the controller or processor to mitigate the damage suffered by the data subjects; d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32; e) any previous breach committed by the controller or processor; C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/13 f) the degree of cooperation with the supervisory authority in order to remedy the breach and mitigate the potential adverse effects of the breach; g) the categories of personal data affected by the breach; h) the manner in which The supervisory authority became aware of the infringement, in particular whether the controller or processor notified the infringement and, if so, to what extent; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or certification mechanisms approved pursuant to Article 42; and (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement. In relation to letter k) of Article 83.2 of the GDPR, the LOPDGDD, in its Article 76, "Sanctions and Corrective Measures," establishes that: "2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continuous nature of the infringement. b) The connection between the offender's activity and the processing of personal data. c) The benefits obtained as a result of committing the infringement. d) The possibility that the affected party's conduct could have led to the commission of the infringement. e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity. f) The impact on the rights of minors. g) The availability of a data protection officer, when not mandatory. h) Submission by the controller or processor, on a voluntary basis, to alternative dispute resolution mechanisms, in cases where there are disputes between them and any interested party." In accordance with the provisions transcribed, for the purposes of determining the amount of the penalty to be imposed in this case for the violation of Article 5.1.f) of the GDPR, classified in Article 83.5.a) of the GDPR, for which the respondent is held responsible, the following factors are considered concurrent: - The severity of the violation (Article 83.2.a) of the GDPR): in this case, data of 10,837 people has been accessed, including the names, surnames, and ID numbers of the users who completed the form. Therefore, although this sanctioning procedure arises from a complaint, the scope of the potential victims of this same circumstance would affect all those whose data has been disclosed. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/13 - Intentionality or negligence in the infringement (Article 83.2.b) of the GDPR): A serious lack of diligence is observed in compliance with the obligations imposed by data protection regulations, by allowing access to personal data, violating its confidentiality; in this regard, we can cite the SAN of 10/17/2007, which, although issued before the GDPR came into force, its ruling is perfectly applicable to the case we are analyzing. The ruling, after alluding to the fact that entities whose activities involve continuous processing of client and third-party data must observe an adequate level of diligence, specified that "(...) the Supreme Court has considered that negligence exists whenever a legal duty of care is disregarded, that is, when the offender fails to behave with the required diligence. And in assessing the degree of diligence, the professionalism or lack thereof of the subject must be especially considered, and there is no doubt that, in the case now under consideration, when the appellant's activity involves constant and extensive handling of personal data, rigor and exquisite care must be emphasized to comply with the legal provisions in this regard." - The activity of the allegedly infringing entity is linked to the processing of personal data of both clients and third parties. In the activity of the defendant entity in which the events occurred, the processing of personal data is essential. Therefore, given its purpose and business volume, the significance of the conduct that is the subject of this complaint is undeniable (Article 76.2.b) of the LOPDGDD in relation to Article 83.2.k of the GDPR). For the purposes of deciding on the fine and its amount, in accordance with the evidence available at the time of the initiation of the sanctioning procedure, and without prejudice to the outcome of the investigation, taking into account the criteria of Article 83.2 of the GDPR with respect to the infringement committed, violation of Article 5.1.f) of the GDPR, an initial fine of €35,000 can be set. VI Adoption of Measures The corrective powers that the GDPR confers on the AEPD as the supervisory authority are listed in Article 58.2, paragraphs a) to j). If the infringement committed is confirmed, the controller will be required, in the resolution adopted, to adopt appropriate measures to bring its actions into compliance with the regulations mentioned in this act, in accordance with the provisions of the aforementioned Article 58.2 d) of the GDPR, according to which each supervisory authority may "order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period..." The imposition of this measure is compatible with the sanction of an administrative fine, as provided for in Article 83.2 of the GDPR. Therefore, it would be considered appropriate to order the respondent, within six months of the final sanctioning resolution issued, to bring the processing operations covered by this procedure into compliance with applicable regulations. The text of this agreement establishes the facts that allegedly led to the violation of data protection regulations, from which it is clear what measures to be adopted. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 8/13 This agreement clearly indicates the type of specific procedures, mechanisms, or instruments to implement them, which are the responsibility of the respondent, as it is fully familiar with its organization and must decide, based on proactive responsibility and a risk-based approach, how to comply with the GDPR and the LOPDGDD. In this case, the measures to be adopted include, among others, the improvement of those already implemented, communicated by the respondent in response to the transfer action, to avoid incidents such as the one that occurred and to guarantee the principle of confidentiality in the processing of data in accordance with Article 5.1.f) of the GDPR, specifically: - Measures to prevent emails or other communications to its clients from providing means that allow them to access data other than that provided by the recipients themselves. - Evaluation by the DPO of the controls effectively implemented. It is noted that failure to comply with the order imposed by this body may be considered an administrative violation under the provisions of the GDPR, classified as a violation in Articles 83.5 and 83.6, and such conduct may lead to the opening of a subsequent administrative sanctioning procedure. Therefore, in light of the above, the President of the Spanish Data Protection Agency, IT IS AGREED: FIRST: TO INITIATE SANCTIONING PROCEEDINGS against ALVEA SOLUCIONES TECNOLÓGICAS, S.L., with Tax Identification Number (NIF) B88024450, for the alleged violation of Article 5.1.f) of the GDPR, as defined in Article 83.5.a) of the GDPR. SECOND: TO APPOINT R.R.R. as Investigator and S.S.S. as Secretary, indicating that either of them may be challenged, if appropriate, in accordance with the provisions of Articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP). THIRD: INCORPORATE into the sanctioning file, for evidentiary purposes, the claim filed by the claimant and its documentation, as well as the documents obtained and generated by the Inspection Services; all of which are included in the file. FOURTH: THAT for the purposes set forth in Article 64.2.b) of the LPACAP and Article 58.2.b) of the GDPR, the sanction that may be imposed for the violation of Article 5.1.f) of the GDPR would be €35,000 (ten thousand euros), without prejudice to the outcome of the investigation. FIFTH: NOTIFY this Agreement to ALVEA SOLUCIONES TECNOLÓGICAS, S.L., with Tax ID No. B88024450, expressly informing it of its right to a hearing in the proceedings and granting it a period of TEN BUSINESS DAYS to submit any allegations and propose any evidence it deems appropriate. In its written submission, it must provide its Tax ID No. and the procedure number shown in the heading of this document. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/13 If it does not submit any allegations to this initial agreement within the stipulated period, it may be considered a resolution proposal, as established in Article 64.2.f) of the LPACAP. Pursuant to Article 85 of the LPACAP (Spanish Civil Code), you may acknowledge liability within the period granted for submitting allegations to this initiation agreement; this will result in a 20% reduction in the appropriate penalty imposed in this proceeding. With the application of this reduction, the penalty would be set at €28,000, and the proceeding would be resolved with the imposition of this penalty. Likewise, you may, at any time prior to the resolution of this proceeding, voluntarily pay the proposed penalty, which will result in a 20% reduction in its amount. With the application of this reduction, the penalty would be set at €28,000, and its payment would result in the termination of the proceeding, without prejudice to the imposition of the corresponding measures. The reduction for voluntary payment of the fine is cumulative with the reduction applicable for acknowledgment of liability, provided that this acknowledgment of liability is made clear within the period granted for submitting allegations upon opening the procedure. Voluntary payment of the amount referred to in the preceding paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the amount of the fine would be set at €21,000. In any case, the effectiveness of either of the two aforementioned reductions will be conditional on the withdrawal or waiver of any administrative action or appeal against the fine. For these purposes, if either of them is invoked, the applicant must send the Subdirectorate General for Data Inspection express notification of the withdrawal or waiver of any administrative action or appeal against the fine. If you choose to voluntarily pay any of the amounts indicated above (€8,000 or €6,000), you must do so by depositing it into account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) opened in the name of the Spanish Data Protection Agency at the bank CAIXABANK, S.A., indicating in the entry the reference number of the procedure shown in the heading of this document and the reason for the reduction in the amount you are claiming. You must also send proof of payment to the Subdirectorate General of Inspection along with notification of your withdrawal or waiver of any administrative action or appeal against the penalty in order to continue with the procedure in accordance with the amount paid. In compliance with Articles 14, 41, and 43 of the LPACAP (Spanish Civil Procedure Act), you are hereby advised that, from now on, notifications sent to you will be sent exclusively electronically, through the Single Authorized Electronic Address (dehu.redsara.es), and that if you do not accept them, your rejection will be recorded in the file, deeming the procedure completed and continuing. You are hereby informed that you may provide this Agency with an email address to receive notification of the availability of notifications, and that failure to provide this notification will not prevent the notification from being considered fully valid. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/13 Finally, please note that, pursuant to Article 112.1 of the LPACAP (Spanish Civil Procedure Act), no administrative appeal may be filed against this act. Lorenzo Cotino Hueso President of the Spanish Data Protection Agency >> SECOND: On March 31, 2025, ALVEA proceeded to pay the fine of €21,000.00, making use of the two reductions provided for in the initiation agreement transcribed above, which implies the acknowledgment of liability in relation to the events referred to in the initiation agreement and their legal classification. THIRD: On April 1, 2025, by resolution correcting errors issued by the Presidency of the Spanish Data Protection Agency, the aforementioned initial agreement was partially corrected. The corresponding examination revealed material errors. These errors were corrected as follows: - Section FOUR of the AGREEMENT, on page 8, should read "THAT for the purposes provided for in Article 64.2.b) of the LPACAP and Article 58.2.b) of the GDPR, the penalty that may be imposed for the violation of Article 5.1.f) of the GDPR would be €35,000 (thirty-five thousand euros), without prejudice to the outcome of the investigation." - In the fourth paragraph on page 9, it should read: "If you choose to voluntarily pay any of the amounts indicated above (€28,000 or €21,000), you must do so by depositing it into account No. IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) opened in the name of the Spanish Data Protection Agency at the bank CAIXABANK, S.A., indicating in the statement the reference number of the procedure that appears in the heading of this document and the reason for the reduction in the amount you are claiming." FOURTH: The initiation agreement transcribed above indicated that, if the infringement was confirmed, it could be agreed that the controller would be required to adopt appropriate measures to bring its actions into compliance with the regulations mentioned in this act, in accordance with the provisions of the aforementioned Article 58.2 d) of the GDPR, according to which each supervisory authority may "order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specific manner and within a specified period...". Having acknowledged responsibility for the infringement, the measures included in the initiation agreement may be imposed. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/13 LEGAL BASIS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the President of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development, and, insofar as they do not contradict them, in a subsidiary capacity, by the general rules on administrative procedures." II Termination of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading "Termination of Sanctioning Procedures," provides the following: "1. Once a sanctioning procedure has been initiated, if the offender acknowledges responsibility, the procedure may be terminated with the imposition of the appropriate sanction. 2. When the sanction is solely monetary in nature, or when one monetary sanction and another non-monetary sanction may be imposed, but the inadmissibility of the second has been justified, voluntary payment by the alleged offender, at any time prior to the resolution, will entail the termination of the procedure, except with regard to restoring the altered situation or determining compensation for damages caused by the commission of the offense. Infraction. 3. In both cases, when the sanction is solely monetary in nature, the competent body to resolve the procedure will apply reductions of at least 20% on the amount of the proposed sanction, which may be combined. These reductions must be specified in the notification of initiation of the procedure, and their effectiveness will be conditional on the withdrawal or waiver of any administrative action or appeal against the sanction. The percentage reduction provided for in this section may be increased by regulation. III Voluntary Payment and Acknowledgment of Liability C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/13 In accordance with the provisions of the aforementioned Article 85 of the LPACAP (Spanish Civil Code), the notified initiation agreement provided information on the possibility of acknowledging liability and voluntarily paying the proposed penalty, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the penalty would be set at €21,000.00, and its payment would imply the termination of the procedure, without prejudice to the imposition of the corresponding measures. Following notification of the aforementioned initiation agreement, ALVEA has proceeded to acknowledge liability and voluntarily pay the penalty, taking advantage of the two proposed reductions. Pursuant to Section 3 of Article 85 of the LPACAP, the effectiveness of the aforementioned reductions will be conditional on the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP, as well as the Supreme Court's jurisprudence on this matter, the exercise of voluntary payment by the alleged liable party does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of their initiation. Similarly, Article 88 of the aforementioned law establishes that the resolution that concludes the procedure will decide all issues raised by the interested parties and any other issues arising from it. Therefore, in accordance with applicable legislation and having assessed the criteria for graduating sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE the commission of the violations and CONFIRM the sanctions determined in the operative section of the initiation agreement transcribed in this resolution and in accordance with the terms of the aforementioned rectification of material errors. The sum of the aforementioned amounts results in a total of €35,000.00. After ALVEA SOLUCIONES TECNOLÓGICAS, S.L. has made prompt payment and acknowledged liability, pursuant to Article 85 of the LPACAP, the aforementioned total is reduced by 40%, resulting in a final amount of €21,000.00. The effectiveness of the aforementioned reductions is subject, in all cases, to the withdrawal or waiver of any administrative action or appeal. SECOND: DECLARE the termination of procedure EXP202414290, in accordance with the provisions of Article 85 of the LPACAP. THIRD: ORDER ALVEA SOLUCIONES TECNOLÓGICAS, S.L. to notify the Agency within 6 months of this resolution becoming final and enforceable of the adoption of the measures described in the legal grounds of the initiation agreement transcribed in this resolution. FOURTH: NOTIFY this resolution to ALVEA SOLUCIONES TECNOLÓGICAS, S.L. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/13 FIFTH: In accordance with the provisions of Article 85 of the LPACAP (Spanish Civil Code), which conditions the reduction for voluntary payment and acknowledgment of liability on the withdrawal or waiver of any action or appeal in administrative proceedings, this resolution will become final in administrative proceedings and fully enforceable upon notification. In accordance with the provisions of Article 50 of the LOPDGDD (Spanish Civil Code), this resolution will be made public once it has been notified to the interested parties. Against this resolution, which terminates the administrative process as provided for in Art. 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an administrative appeal before the Contentious-Administrative Division of the National Court, in accordance with the provisions of Article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law. However, in accordance with the provisions of Article 90.3.a) of the LPACAP, the final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeaepd.gob.es/sede-electronica-web/], or through one of the other registries provided for in Article 16.4 of the aforementioned Law 39/2015, of October 1. They must also forward to the Agency the documentation proving the effective filing of the contentious-administrative appeal. If the Agency does not become aware of the filing of the contentious-administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension. 1259-260325 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es
