AEPD (Spain) - EXP202206316
From GDPRhub
| AEPD - EXP202206316 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 19.04.2022 |
| Decided: | 26.10.2023 |
| Published: | |
| Fine: | 7,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | EXP202206316 |
| European Case Law Identifier: | n/a |
| Appeal: | Appealed - Confirmed AEPD (Spain) EXP202206316 |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | n/a |
The DPA fined a medical institute €7,000 for a failure to implement appropriate security measures leading to the publication of a data subject’s personal data (including health data) in response to a review she left on Google, in violation of Articles 5(1)(f) and 32 GDPR.
English Summary
Facts
A data subject wrote a review on Google about a medical institute (the controller). The response from the controller revealed personal data of the data subject- this included first and last names, ID, phone number as well as health data and data related to previous criminal infractions of the data subject.
On 19 April 2022 the data subject filed a complaint by the Spanish DPA (AEPD). She argued that the controller was responsible for the data disclosed when responding to her review.
On the other hand, the controller argued that it did not have its own website, and did not have a direct relationship with the data subject. The controller stated that their business consisted of rental of medical services and property management, and could therefore not access the information. Finally, the controller argued that information such as the name and ID of the data subject were already freely available on the internet.
Holding
First, the DPA dismissed the arguments of the controller. Investigation by the DPA (e.g. a Google Maps search) showed that the controller had a website. The e-mail address provided in the controller’s documentation sent to the DPA was the same address used to contact the data subject. With this, the DPA concluded that the controller had in fact a direct relationship with the data subject.
The DPA found that the controller had infringed the principle of data security under Article 5(1)(f) GDPR. According to the DPA, the controller had not fulfilled its duty of confidentiality by openly publishing personal data of the data subject.
The fact that this data was published was also an infringement of Article 32 GDPR. Here the DPA reasoned that the controller had clearly not implemented adequate security measures. The implementation and correct use of security measures is as important as its design, which was supported by case law from the Spanish Supreme Court.
Furthermore, the sensitive nature of the data and the intentional disclosure of data were considered aggravating factors. Health data has a particularly protected status under Article 9 GDPR. This is also the case with data related to criminal offenses under Article 10 GDPR.
The DPA fined the controller €7,000 in total- €5,000 for the infringement of Article 5(1)(f) GDPR and €2,000 for the infringement of Article 32 GDPR.
Comment
The controller appealed the decision 3 December 2023. The DPA rejected the appeal on 10 April 2024, stating that the controller had not brought new facts or legal arguments.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/14
File No.: EXP202206316
- RESOLUTION OF SANCTIONING PROCEDURE
From the procedure initiated by the Spanish Data Protection Agency and based on the following
BACKGROUND
FIRST: On April 19, 2022, this Spanish Data Protection Agency (hereinafter, AEPD) received a complaint filed by A.A.A. (hereinafter, the complainant) against the OPHTHALMOLOGICAL INSTITUTE OF ***LOCALITY.1 B.B.B., S.L. with NIF ***NIF.1 (hereinafter, the respondent) for
an alleged violation of Articles 5.1.f), 6.1, and 9 of Regulation (EU) 2016/679
of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, GDPR).
Specifically, due to the following circumstances:
The complainant states that, after writing a review on Google, the respondent's response consisted of the publication of her personal data, specifically her name and surname, national identity card number, telephone number, as well as personal
health data and data relating to infringements committed due to document plagiarism.
The complainant provides, among other information, a copy of her ID valid until December 3, 2023, confirming the reported facts by taking a screenshot of the website and printing them.
SECOND: In accordance with the mechanism prior to admitting complaints filed with the AEPD, as provided for in Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD), which consists of forwarding the complaints to the data protection officers designated by the data controllers or processors, or to the latter when none have been designated, and for the purpose indicated in the aforementioned article, the complaint was forwarded to the INSTITUTO OFTALMOLÓGICO DE ***LOCALIDAD.1 B.B.B., S.L. (hereinafter, the respondent) to proceed with its analysis and respond within one month, which was verified by means of a letter received by this Agency on July 20, 2022.
THIRD: On September 2, 2022, after analyzing the documentation in the file, the Director of the Spanish Data Protection Agency issued a resolution ordering the filing of the complaint. The resolution was notified to the appellant on September 2, 2022, as evidenced in the file.
FOURTH: On September 24, 2022, the complainant filed an appeal for reconsideration through the AEPD Electronic Registry against the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/14
resolution issued in file EXP202206316, in which it expresses its disagreement with the contested resolution, arguing that:
The respondent calls itself online both the Instituto Oftalmológico de
***LOCALIDAD.1 and Centro Oftalmológico B.B.B., with both clinics having the same postal address.
The mobile phone number from which a WhatsApp message requesting the removal of the comment posted on Google was sent is the same one provided to contact the reported clinic.
The response to the review does not currently appear on Google; however, Google has registered it and notified the appellant via email.
The respondent considers the respondent responsible for the willful disclosure of their personal data and is therefore subject to the sanctioning regime.
A fine should be imposed against the responsible party and compensation for damages should be established.
A copy of the bank statement is provided, which proves that the Ophthalmological Institute of ***TOWN.1 was the party that charged the medical services provided.
Finally, the respondent requests that their personal data be deleted.
FIFTH: On December 20, 2022, the appeal was forwarded to the respondent pursuant to Article 118.1 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, for the purpose of formulating arguments and submitting the documents and supporting documents it deemed relevant within ten business days. This was verified by a response dated January 5, 2023.
SIXTH: Having found reasonable indications of a possible violation of the regulations within the scope of the powers of the Spanish Data Protection Agency, on February 1, 2023, the Director of the Spanish Data Protection Agency resolved to ALLOW the appeal for reconsideration filed by A.A.A. against the resolution of this Agency issued on September 2, 2022, in order to continue processing the complaint.
SEVENTH: On June 8, 2023, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent, in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 5.1.f) of the GDPR and Article 32 of the GDPR, as defined in Article 83.5 of the GDPR and Article 83.4 of the GDPR.
EIGHTH: After notification of the aforementioned initiation agreement in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), the respondent submitted a written statement of allegations in which, in summary, it stated the following:
“1. Instituto oftalmológico is a company with a Tax Identification Number (NIF) ***NIF.1 with partners and an administrator that DOES NOT OWN its own website, nor is it, nor has it ever been, the owner of the website reported by the complainant, and in NO CASE HAS ITS OWNERSHIP BEEN PROVEN, NOR CAN IT BE PROVEN, NOR THEREFORE DOES IT HAVE ACCESS to the passwords for the website, and THEREFORE, NO POSSIBILITY OF BE RESPONSIBLE FOR TAKING ANY ACTION.
2. An ophthalmological institute that does NOT have its own medical staff and is dedicated to leasing medical services and property management of premises, with no direct relationship with patients, and therefore has NEVER HAD A DIRECT RELATIONSHIP WITH THE COMPLAINANT.
3. The OPHTHALMOLOGY CENTER is a clinic registered with the Ministry of Health of the Community of ***LOCATION.1 with its own legal personality, separate from the falsely accused institute, with a specific doctor, B.B.B., who leases the facilities to the institute. This is the only relationship between the two independent entities: the rental of facilities and technology. IT IS NOT THE INSTITUTE—B.B.B. is not among its partners. -: therefore, the taxpayer has no standing to incriminate this company in the complainant's personal conflict with her doctor. Citing the coincidental postal address as an argument is absurd, given the existence of a tenant-landlord relationship, and the institute has been carrying out its activity elsewhere for many years, ***ADDRESS.1 at the Avanza clinic, where its facilities are rented. We will provide the contract in a few days once we have collected the documentation.
4. It is FALSE that no one from the institute has sent a WhatsApp request to delete a comment to the complainant, in violation of the data protection law, from any of the institute's phones. FURTHERMORE, said WhatsApp does NOT violate the Data Protection Act. Therefore, linking the WhatsApp as evidence is perverse, given that the possible violation would be, if it existed, on the Ophthalmology Center's own website and NOT on WhatsApp. Furthermore, we are NOT enclosed a copy of said evidence, which we doubt was presented with notarized or similar authenticity. What was the WhatsApp number from which it was sent and whose is it? Whose WhatsApp it was sent to? Is there evidence of these claims and certificates of ownership? THEY DO NOT PROVIDE US WITH THIS REQUEST WITH SUCH DATA SO THAT WE CAN PROVE THE COMPLETE FALSEHOOD OF THE STATEMENTS WITHOUT ANY PROOF. TAKING SCREENSHOTS and manipulating images is something that the complainant should remember. We have already attached a complaint from B.B.B. for falsification of a private document and identity theft, which is being processed in Investigative Court No. 4 of ***TOWN.1
5. IT IS STATED THAT THE REVIEW - care at B.B.B. ophthalmological center. -Not from the institute. IT DOES NOT APPEAR ON GOOGLE, and it's true, and Google states on that same page that REVIEWS ARE NOT VERIFIED!!! If Google claims they are not verified, as can be seen on the website itself...? THE COMPLAINANT SAYS THAT GOOGLE INFORMED THE COMPLAINANT, BUT THEY DO NOT ATTACH ANY GOOGLE CERTIFICATE TO THE PRESENT, THEREFORE THIS IS A NEW FALSE CLAIM.
WHERE IS THE GOOGLE CERTIFICATE certifying these facts? The complainant's repeated behavior without proving any facts is unacceptable, and it seems that the AEPD gives credibility to a photo or photocopy of a screenshot that could have been perfectly manipulated by a person who is now the complainant but who had been reported by B.B.B. for identity theft and falsification of a private document BEFORE the AEPD initiated this procedure. NOR has the AEPD attached the false evidence alleged by the current complainant.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/14
6. The Ophthalmological Institute has never had any information about the complainant, given that it has never had a direct relationship with her. This company only rents technology to medical professionals, never to patients.
7. THE COMPLAINANT IS SIMULTANEOUSLY FILING A COMPLAINT against professional B.-
B.B. to the medical association for the same reason: EVERYONE CANNOT BE COMPLAINED. IF THERE IS ONE RESPONSIBLE PARTY, IT WILL BE A SPECIFIC LEGAL ENTITY.
Not everyone. The fact of filing multiple complaints against different companies and legal entities demonstrates a lack of legitimacy: THERE IS A SERIOUS AND PERSONAL MEDIA-PATIENT CONFLICT HERE THAT THEY CANNOT INVOLVE THIRD PARTIES. The complaints appear to be personal exchanges between two people.
The complainant's comments on Google are about B.B.B. AND NOT about the institute. B.B.B.'s criminal complaint is filed against her. It is for identity theft and threats from the apparently military to the civilian doctor demanding false reports under threat of not doing so.
With this type of actions and having hacked access to the doctor's websites, based on their military knowledge.
8. Of the 400 reviews that appear on the website, no one mentions the institute, not even the complainant in her alleged...
9. How can anyone besides the complainant herself know that this
***USER.1 is the complainant? If the complainant appears on Google as ***USER.1 among more than 400 reviews on this Google website, which, once again, we insist, is NOT owned by the Ophthalmological Institute, only the complainant can know. The falsehood falls flat. Furthermore, the supposedly private data, such as ID, etc., appear freely accessible on multiple websites. And the phone number is fake, as it doesn't match the one the complainant submitted to the medical association.
10. It is stated, but a bank account statement is NOT attached to the file. IS A BANK ACCOUNT STATEMENT PROVIDED? Has this statement been authenticated, or is a photocopy sufficient? Is this proof not attached because, if it is provided, it would be false - falsification of a private document.
In addition to the false complaint, where is the invoice, which would demonstrate that the business relationship was with the Ophthalmology Center and not with this Institute, different entities, we repeat ad nauseam? NOR has the AEPD attached the false evidence alleged by the now complainant.
11. THIS COMPANY CANNOT DELETE DATA FROM THE COMPLAINT PARTY, AS IT DOES NOT HAVE, AND NEVER HAD, ANY DATA.
12. THIS CASE CHANGES THE CRITERION FROM FILING TO PENALTY WITHOUT ATTACHING A SINGLE ONE OF THE EVIDENCE THE COMPLAINANT CLAIMS TO PROVIDE. AND ALTHOUGH WE HAVE ALREADY ARGUED THE LACK OF VERIFICATION OF THE EVIDENCE PROVIDED, GUARANTEEING ITS FALSEHOOD, IT WOULD BE SERIOUSLY DEFENSELESS TO NOT PROVIDE US WITH THE EVIDENCE THE COMPLAINANT CLAIMS TO PROVIDE, WHICH SURPRISINGLY CHANGES THE AEPD'S CRITERIA: it is mandatory that the AEPD facilitate access to the new evidence so that the accused party can refute it, certify its falsity, and initiate appropriate action. C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/14
13. ATTEMPTING TO SANCTION THIS COMPANY—which is not the ophthalmology center that owns the GOOGLE website—would violate the principle of the presumption of innocence. In this regard, the Constitutional Court, in Ruling 76/1990, considers that
the right to the presumption of innocence entails "that the sanction be based on acts or evidence that incriminate or incriminate the alleged conduct; that the burden of proof falls on the accuser, without anyone being obliged to prove their own innocence; and that any insufficiency in the results of the evidence presented, freely assessed by the sanctioning body, must result in an acquittal." This principle is expressly established for administrative sanctioning procedures in Article 53.2.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, which recognizes the interested party's right "to the presumption of non-existence of administrative liability until proven otherwise." Ultimately, the application of the principle of presumption of innocence prevents the imputation of an administrative offense when no evidence has been obtained indicating the existence of an offense. 14. THE PROCEDURE HAS EXPIRED AS IT HAS FAR EXCEEDED THE LEGAL DEADLINES, HAVING PASSED MORE THAN 9 MONTHS SINCE THE LAST ACTION.
15. This is the second time the AEPD has confused the Institute with B.B.B.. See procedure TD/00124/2021 where a certain C.C.C., who happens to be a military officer like the current complainant, sued the B.B.B. for similar acts—refusing to file false sick leave reports—and the AEPD unjustifiably attacked the institute. Please analyze the repeated situation of legal defenselessness to which such confusion leads us.
16. We are waiting for the AEPD to send us the documents provided by the complainant in a second claim so we can verify that they are NOT original NOR authenticated by any accrediting entity. We request that we be given additional time to respond in more detail, given that they state this in the letter but have NOT provided them. 1
17. This company is initiating legal proceedings for false accusations and identity theft against the complainant.
NINTH: On July 3, 2023, the investigating judge agreed to conduct the following tests:
1. The claim filed by A.A.A. and its documentation, the documents obtained and generated during the claim admission phase, and the report on the preliminary investigation procedures that are part of procedure RR/00592/2022 are hereby reproduced for evidentiary purposes.
2. Likewise, the allegations to the agreement to initiate the referenced sanctioning procedure, presented by the OPHTHALMOLOGICAL INSTITUTE OF ***LOCALITY.1 B.B.B., S.L., and the accompanying documentation, are hereby reproduced for evidentiary purposes.
TENTH: On July 20, 2023, a resolution proposal was signed for the Director of the Spanish Data Protection Agency to sanction INSTITUTE
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/14
OPHTHALMOLOGICAL INSTITUTE OF ***LOCALITY.1 B.B.B., S.L., with Tax Identification Number ***NIF.1, for the violation of Article 5.1 f) and 2,000 euros (two thousand euros) for the violation of Article 32 of the GDPR, making a total of 7,000 euros (seven thousand euros).
ELEVENTH: On July 31, 2023, the respondent entity, in response to said proposed resolution, reiterates the allegations previously indicated, where it states that the complainant has falsely linked the respondent, since the website of the Doctor B.B.B. Ophthalmological Center with NIF ***NIF.2 has nothing to do with the OPHTHALMOLOGICAL INSTITUTE OF
***TOWN.1 with NIF ***NIF.1.
He also attaches the complaint filed by Dr. B.B.B. against the claimant for identity theft.
From the actions taken in this proceeding and the documentation in the file, the following have been established:
PROVEN FACTS
FIRST: Publication of the claimant's personal data (name and surname, ID number, telephone number, as well as personal health data and data related to violations committed due to document plagiarism). He provides a printout of the publication.
SECOND: The respondent indicates that it does not have its own website, nor has it ever been the owner of the website complained about by the complainant, and that it does not have its own medical staff, as it is dedicated to leasing medical services and property management of premises, with no direct relationship with patients. Therefore, it has never had a direct relationship with the complainant.
LEGAL BASIS
I
In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (the General Data Protection Regulation, hereinafter GDPR), and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.
Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures
processed by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, in a subsidiary manner, by the general rules on administrative procedures."
II
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/14
The principles relating to the processing of personal data are regulated in
Article 5 of the GDPR, which establishes that "personal data shall be:
"a) processed lawfully, fairly, and transparently with respect to the data subject ("lawfulness, fairness, and transparency");
b) collected for specified, explicit, and legitimate purposes and will not be further processed in a manner incompatible with those purposes; in accordance with Article 89(1), further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes will not be considered incompatible with the initial purposes ("purpose limitation");
c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization");
d) accurate and, where necessary, up-to-date; all reasonable steps will be taken to ensure that personal data that are inaccurate with respect to the purposes for which they are processed are erased or rectified without delay ("accuracy");
e) maintained in a manner that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; Personal data may be retained for longer periods provided that they are processed exclusively for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with Article 89(1), without prejudice to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject ("retention period limitation");
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by applying appropriate technical or organizational measures ("integrity and confidentiality").
The data controller shall be responsible for compliance with the provisions of paragraph 1 and be able to demonstrate this ("proactive accountability").
Violations of Article 5.1 f) of the GDPR may be punished with a fine of up to €20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the previous financial year, whichever is higher, in accordance with Article 83.5 a) of the GDPR, which establishes "non-compliance with the basic principles for processing,
including the conditions for consent pursuant to Articles 5, 6, 7, and 9."
Article 72.1 a) of the LOPDGDD states that for the purposes of statute of limitations, "based on the provisions of Article 83.5 of Regulation (EU) 2016/679, violations that constitute a substantial violation of the articles mentioned therein, and in particular the following, are considered very serious and will be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and guarantees established in Article 5 of Regulation (EU) 2016/679.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/14
III
Security in the processing of personal data is regulated in Article 32 of the GDPR, which establishes the following:
“1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which, where appropriate, may include, among others:
a) the pseudonymization and encryption of personal data; b) the ability to guarantee the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
c) the ability to restore the availability of and access to personal data promptly in the event of a physical or technical incident;
d) a process for regularly verifying, evaluating, and assessing the effectiveness of the technical and organizational measures to ensure the security of processing.
2. When assessing the adequacy of the level of security, particular account shall be taken of the risks posed by data processing, in particular as a result of the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal data transmitted, stored, or otherwise processed.
3. Adherence to a code of conduct approved pursuant to Article 40 or to a certification mechanism approved pursuant to Article 42 may serve as an element to demonstrate compliance with the requirements set out in paragraph 1 of this Article.
4. The controller and the processor shall take measures to ensure that any person acting under the authority of the controller or the processor who has access to personal data only processes those data on instructions from the controller, unless required to do so by Union or Member State law.
Article 83.4 of the GDPR establishes that administrative fines of up to
€10,000,000 or, in the case of a company, up to 2% of the total annual global turnover of the previous financial year will be imposed, whichever is higher, when the following are violated:
a) the obligations of the controller and the processor under Articles 8, 11, 25 to 39, 42, and 43;
Article 73.f) of the LOPDGDD, under the heading "Infringements considered serious" provides:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/14
"In accordance with Article 83.4 of Regulation (EU) 2016/679, the following shall be considered serious: and
infractions that constitute a substantial violation of the articles mentioned therein, and in particular the following, will expire after two years:
f) Failure to adopt appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing, in accordance with the terms required by Article 32.1 of Regulation (EU) 2016/679.
IV
In this case, a claim is filed for the use of personal data, specifically because after leaving a review on the ophthalmology center's Google My Business profile, the owner responded by publishing a large amount of personal data, specifically the following:
"(…)".
On July 3, 2023, this Agency received a letter from the respondent responding to the initiation of this sanctioning procedure, indicating, among other things, that it does not have its own website, nor has it ever owned the website complained about by the complainant, and that it does not have its own medical staff, as it is dedicated to the rental of medical services and property management of premises, with no direct relationship with patients. Therefore, it has never had a direct relationship with the complainant. Therefore, accusing it of such acts violates the principle of the presumption of innocence.
Despite these statements, the preliminary investigation carried out by this Agency confirms that the respondent has been processing the following personal data of the complainant: name and surname, ID number, telephone number, as well as personal health data and data related to violations committed by document plagiarism.
As already indicated in the appeal against the decision issued in
file EXP202206316, a Google Maps search for the B.B.B. Ophthalmological Center yielded a link to the website:
“***URL.1”.
After accessing said page, the information published suggests a presumed
link between the Ophthalmological Center, the B.B.B., and the Ophthalmological Institute of
***LOCALITY.1.
Furthermore, after conducting a search in the Commercial Registry for the “OPHTHALMOLOGICAL INSTITUTE OF ***LOCALITY.1”, it was found that the
result was the legal entity “OPHTHALMOLOGICAL INSTITUTE OF ***LOCALITY.1 B.B.B. LIMITED COMPANY”.
Likewise, according to the data in the State Tax Administration Agency (AEAT) Database, in response to the AEPD request requesting the NIF (Tax Identification Number) and tax address of ***COMPANY.1 (Professor B.B.B.), the AEAT
reports the following information: OPHTHALMOLOGICAL INSTITUTE OF ***TOWN.1
B.B.B., ***NIF.1 ***ADDRESS.1”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/14
Furthermore, it should be noted that the claimant provides email correspondence with the doctor who operated on her, and the email address with which the doctor replies is exactly the same as that shown in the documentation submitted electronically by the respondent. That is, when submitting his allegations, the respondent includes The contact email address is exactly the same address used to communicate with the complainant.
These facts would mean that the respondent is violating Article 5.1 f) of the GDPR, indicated in legal ground II, by breaching the duty of confidentiality of the personal data it processes, having verified the open publication of the complainant's personal data, such as her first and last name, ID number, telephone number, as well as personal health data and data related to violations committed by document plagiarism.
Furthermore, it is considered that the respondent entity has violated Article 32 of the GDPR, indicated in legal grounds III, because the fact that the personal data subject to this claim has been published implies a lack of security measures in the processing or a breach thereof, since the respondent chose to publish it without taking into account basic aspects such as the necessary confidentiality that must be maintained in relation to the identification and health data of the patients it treats. This demonstrates that adequate security measures were not applied. As stated by the Supreme Court in its Ruling of February 15, 2022 (STS 543/2022), the design of the necessary technical and organizational means is not sufficient; their correct implementation and use in an appropriate manner is also necessary, so the data controller will also be liable for the lack of due diligence in their use and application.
... V
Article 58.2 of the GDPR provides as follows: "Each supervisory authority shall have all of the following corrective powers:
d) to order the controller or processor to bring the processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;
i) to impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each individual case;
VI
The fine imposed must be, in each individual case, effective, proportionate, and dissuasive, in accordance with Article 83.1 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/14
Therefore, the sanction to be imposed should be graded according to the criteria established in Article 83.2 of the GDPR, and with the provisions of Article 76 of the LOPDGDD, with respect to section k) of the aforementioned Article 83.2 GDPR.
Article 83.2 of the GDPR establishes that:
"Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures provided for in Article 58(2)(a) to (h) and (j).
When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of:
a) the nature, gravity, and duration of the infringement, taking into account the
nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;
b) the intentionality or negligence involved in the infringement;
c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects;
d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32;
e) any previous breach committed by the controller or processor;
f) the degree of cooperation with the supervisory authority to remedy the breach and mitigate the potential adverse effects of the breach;
g) the categories of personal data affected by the breach;
h) how the supervisory authority became aware of the breach, in particular whether the controller or processor notified the breach and, if so, to what extent;
i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;
j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/14
k) any other aggravating or mitigating factors applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.”
In the present case, without prejudice to the outcome of the investigation, the intentionality and negligence of the defendant entity have been taken into account as an aggravating factor, in accordance with Article 83.2 b) of the GDPR, because the intentionality of the unauthorized processing is clear, as it has consciously and deliberately published the complainant's data.
Furthermore, we can consider the category of data processed as an aggravating factor (Article 83.2 g), since, in addition to name, surname, ID number, and telephone number, other specially protected data are processed, such as health data, in accordance with Article 9 of the GDPR, and data on criminal offenses, in accordance with Article 10 of the GDPR.
Therefore, it is considered that the appropriate penalty would be €5,000 for the violation of Article 5.1 f) of the GDPR and €2,000 for the violation of Article 32 of the GDPR, making a total of €1,000. 7,000 euros.
VII
Article 58.2 d) of the GDPR states that each supervisory authority may "order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period."
In the present case, the respondent party must be ordered to provide proof to the Spanish Data Protection Agency, within one month of notification of this decision, of the definitive cessation of the publication of the personal data of A.A.A. which are included in paragraph IV of this resolution.
Please note that failure to comply with the order to adopt measures imposed by this body in the sanctioning resolution may be considered an administrative infraction under the provisions of the GDPR, classified as an infraction in its
Articles 83.5 and 83.6, and such conduct may lead to the opening of a subsequent administrative sanctioning procedure.
Therefore, in accordance with applicable legislation and having assessed the criteria for graduating the sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: TO IMPOSE two fines on INSTITUTO OFTALMOLÓGICO DE ***LOCALIDAD.1 B.B.B., S.L., with Tax Identification Number ***NIF.1, for a violation of Article 5.1.f) of the GDPR and Article 32 of the GDPR, as defined in Article 83.5 of the GDPR and Article 83.4 of the GDPR: a fine of €5,000 (five thousand euros) and €2,000 (two thousand euros), respectively, for a total of €7,000 (seven thousand euros).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/14
SECOND: TO MAKE THE PROVISIONAL MEASURE agreed upon in the agreement opening this sanctioning procedure definitive. Consequently, INSTITUTO OFTALMOLÓGICO DE ***LOCALIDAD.1 B.B.B., S.L. with NIF
***NIF.1 is hereby required to, within one month of notification of this resolution, certify to the Spanish Data Protection Agency that it has definitively ceased publishing the personal data of A.A.A., as set forth in paragraph IV of this resolution.
THIRD: TO NOTIFY INSTITUTO OFTALMOLÓGICO DE
***LOCALIDAD.1 B.B.B., S.L. of this resolution.
FOURTH: ORDER INSTITUTO OFTALMOLÓGICO DE ***LOCALIDAD.1 B.B.B., S.L., with NIF ***NIF.1, that pursuant to Article 58.2.d) of the GDPR, and as a result of the high risk posed by continued publication, as it violates the complainant's fundamental right to data protection and the guarantees and freedoms of the affected party, the respondent is ordered to immediately cease such actions.
FIFTH: Warn the sanctioned party that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Article 58.2.d). 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in conjunction with Article 62 of Law 58/2003, of December 17, by depositing the fine, indicating the sanctioned party's Tax Identification Number (NIF) and the procedure number shown in the heading of this document, into the restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at CAIXABANK, S.A. Otherwise, the fine will be collected during the enforcement period.
Once the notification has been received and enforced, if the enforcement date is between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day after, and if it is between the 16th and last day of each month, inclusive, the payment deadline will be until the 5th of the second following month or the next business day after.
In accordance with the provisions of Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data), this Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which terminates the administrative process pursuant to Art. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and Section 5 of the Fourth Additional Provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1. of the aforementioned Law.
Finally, it is noted that, in accordance with the provisions of Article 90.3 a) of the LPACAP, a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal.
If this is the case, the interested party must formally notify this fact by means of a written notice addressed to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in Article 16.4 of the aforementioned Law 39/2015, of October 1. They must also submit to the Agency the documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension.
938-010623
Mar España Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
