AEPD (Spain) - EXP202303215
From GDPRhub
| AEPD - EXP202303215 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 03.03.2023 |
| Decided: | 05.09.2024 |
| Published: | 05.09.2024 |
| Fine: | 3,000 EUR |
| Parties: | PLAY FUL KIDS, S.L. |
| National Case Number/Name: | EXP202303215 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | Mgrd |
AEPD fined a children's party venue after it disseminated CCTV footage in social media as part of an intimidation and online criticism againts data subjects, in violation of Article 6(1) GDPR.
English Summary
Facts
A children's birthday party was held at the premises of PLAY FUL KIDS, S.L., a recreational venue located in Sant Adrià de Besòs, Barcelona. During the party, a confrontation occurred between several guests and staff members, including the manager of the venue and her partner. The situation escalated into a physical and verbal altercation involving shouting, grabbing of clothes, pushing, and accusations exchanged between the parties.
The following day, various attendees posted negative reviews on Google, criticising the staff’s unprofessional behaviour and the lack of safety and decorum at a venue that is supposed to cater to children.
In apparent retaliation, three data subjects received a WhatsApp message from a number attributed to the manager of venue, which contained a video clip recorded by the venue's CCTV video surveillance system. The message included a warning: if the complainants did not remove their negative reviews, the footage would be used against them.
The video in question showed the confusion event, as well as numerous adults and children in attendance. It was filmed from a high angle in a corner of the premises and captured a panoramic view of the interior. The data subjects later provided screenshots of the threatening messages and the video to the authorities.
The matter escalated when the footage was uploaded to, at the time, Twitter, and linked to a public campaign against gender-based violence. The post, which was not published by an official account, but with visual elements related to PLAY FUL KIDS, accused the one of the data subjects as being a "male abuser.” The video included in the post was the same as the one sent by WhatsApp: same angle, same content, and same identifiable individuals. The post invited viewers to stop gender violence in Sant Adrià, misrepresenting the nature of the incident and weaponising the footage to shame the individual.
On 17 April 2023, the Catalan Data Protection Authority forwarded to the AEPD a police report filed by the data subjects. The report included allegations of threats and the unauthorised dissemination of CCTV footage via WhatsApp and social media (Twitter, Facebook, and Instagram). In these proceedings, the police confirmed that the WhatsApp messages were real and came from a phone number registered to the manager of PLAY FUL KIDS. The footage in question was found to clearly show the data subjects, the staff and several minors. An online search conducted by the AEPD confirmed that the video was still publicly accessible on Twitter as of 9 March 2023.
In her defence, the manager of PLAY FUL KIDS admitted to having reviewed the video footage the day after the event and sending it to individuals involved, allegedly in an effort to clarify the facts and obtain an apology. However, she denied publishing the footage online and stated that the footage had not been shared publicly by her or her partner.
In parallel criminal proceedings, the Court acquitted her of criminal liability for coercion and threats, concluding that although she had indeed sent the video via WhatsApp and used language perceived as threatening, the burden of proof regarding the authorship of the Twitter post had not been met.
Holding
AEPD found that PLAY FUL KIDS, S.L., through its manager, had extracted and disseminated personal data, including images of identifiable adults and minors, for purposes incompatible with the original purpose of the CCTV system, namely ensuring security.
The footage had been used as a means of reprisal and intimidation in response to online criticism. The unauthorised sharing of this footage with at least two individuals, and possibly broader dissemination via social media, constituted unlawful processing, violating Article 6(1) GDPR.
The video surveillance system, while lawfully installed and accompanied by a privacy notice indicating its security purpose, was misused to exert pressure and damage the reputations of individuals. As the controller of the CCTV system, the venue bore full responsibility for ensuring that personal data was processed lawfully, fairly, and for legitimate purposes.
The Spanish DPA concluded that the company had violated these principles and imposed a fine of €3,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/21
File No.: EXP202303215
Contents
BACKGROUND.......................................................................................................1
FIRST: Entry of complaints and supporting documentation.............................1
SECOND: SGI verification actions.................................................................3
THIRD: Transfer of the complaint..............................................................................4
FOURTH: Admission for processing......................................................................................5
FIFTH: Written report with police report on the facts of the complaint........................................................................................................5
SIXTH: Written report from the respondent.................................................................................6
SEVENTH: Agreement to initiate sanctioning proceedings......................................................7
EIGHTH: Proposed resolution of 06/18/2024 and allegations...................................................7
NINTH: Facts proven........................................................................................9
PROVEN FACTS........................................................................................................10
LEGAL GROUNDS.................................................................................................12
I. Jurisdiction........................................................................................................12
II. Breached Obligation........................................................................................13
III. Classification and Qualification of the Infraction............................................................16
IV. Proposed Sanction...................................................................................................17
RESOLVES:...................................................................................................................19
SANCTIONING PROCEDURE RESOLUTION
From the procedure initiated by the Spanish Data Protection Agency and based on the following
BACKGROUND
FIRST: Entry of claims and documentation provided.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/21
Between March 3 and March 17, 2023, SIX COMPLAINTS were received from attendees of a birthday party at a venue for minors on ***DATE.5, which are listed in the GENERAL ANNEX.
The complaints are directed against PLAY FUL KIDS, S.L., located at c Ricart 9, Sant Adrià de Besòs, Barcelona, with NIF B10790327 (hereinafter, the defendant). The grounds for the claim are as follows:
The complainants agree that, due to an altercation (...) in front of two attendees, the following day several attendees, including complainants 1 and 2, posted negative reviews on Google. "A few hours later," explains complainant 1, ***PARENTESCO.1, complainant 2, received a WhatsApp message from the establishment's
***PUESTO.1, containing a video indicating that if I (complainant 2) did not "delete" the written reviews, they would use the video.
Complainant 2 makes the same point in their claim.
The complainants state that, as part of a campaign launched by the
Sant Adrià de Besòs City Council on Twitter against gender-based violence,
***PUESTO.1 and ***PUESTO.2 of the establishment in question posted the video on
***DATE.1. They indicate
***URL.1, which posts the comment about Complainant 1 as "a sexist abuser and revealing my position as ***POST.3."
Complainant 3 states that she attended the children's birthday party as a guest and
due to the incident that arose between several people, she also received several messages from
***RELATED.2 and a partner of the defendant company asking her
friends to delete the comments or use the video.
Complainant 6 indicates that she attended the children's birthday party as a guest and
learned that the video had been shared by ***POST.1 and ***POST.2 via WhatsApp and social media. She and her daughter appear in the video. "The video has already been deleted from Facebook and Instagram, but it still appears on Twitter," "in addition, the video was sent via WhatsApp to one of the attendees."
The following is provided:
a) Complainant 2 provides a copy of a mobile phone screenshot showing "ds,
***DATE.2.", and the number ***PHONE.1 in the header, along with a video with the verbatim text of the messages:
"I have this video of your ***RELATED.2 about to hit my
***RELATED.3. (A video is shown from inside a closed establishment, which
could be the interior of the premises with the attendees, duration 10:48).
Do you want me to go and file a complaint, or are you leaving everything as it is without further ado?
C.C.C. has created a problem for which you are not to blame.
I'm very sorry that this happened on your daughter's day.
But if we're honest, everything was wrong.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/21
I'm trying to do my job. The best you can in your very difficult financial situation, so that because of this person, there are things that this person has done and things that she has done that I'm not going to talk about. She will have her version.
She's your friend and I'm not going to go into details. I have my own. The fact is, I'm sorry for what happened.
It's clear it was wrong, but I only asked not to dirty the beds. It wasn't that bad.
It triggered everything. I have the whole video of everything that happened, and you don't look good.
So I ask you to leave things alone, and I'll leave the videos saved here."
In the screenshot of the video, the first thing you see of the message, saying "I have
this video of your ***PARENTESCO.2," is the interior of what may be the play center, a general image taken from a high angle on a corner.
a) Another screenshot, showing the same interior of the aforementioned establishment with people, including minors, under the caption "San Adrián City Council,
help us stop gender-based violence, watch the video" with the text: "(...)
A.A.A. to Twitter twitter.com” and including a copy of the URL: ***URL.1
It can be seen that the image captured in the video matches the one in the WhatsApp message sent to Claimant 2, in terms of angle, focus, and location where it was taken.
b) This same video appears on March 9, 2023, according to the printout submitted by Claimant 3, which also includes two Google reviews, with a printout dated March 9, 2023, “two weeks ago.” One of them, as “response from ***POST.2,” states:
“I have video surveillance cameras that clearly show what happened. A man who says ***RELATED.1 is ***POST.3 trying to attack an elderly woman from behind. A guest pushes an older woman who tries to mediate
when this same guest tries to hook up with "***POST.1" without a child in her arms.
A guest raising her hand to "***POST.1" and everything that happened that day was recorded.
The company reserves the right to exercise any legal action that may be appropriate in the case of defamatory comments and/or reviews."
SECOND: Verification actions by the SGI.
As a fact-finding action, the Subdirectorate General of Data Inspection:
-On March 8, 2023, the Commercial Registry website was accessed and information was obtained on PLAY FUL KIDS SL, an entity registered since July 15, 2022, with the following corporate purpose: "recreational, leisure, and entertainment activities for children, as well as any other activity that may arise from or is framed within the scope of the described activities, etc.," with subscribed and paid-up capital of €3,000. Both A.A.A. and B.B.B. are listed as joint and several directors.
-Printed on March 9, 2023, 10:40, on a page containing the logo of the campaign against gender-based violence, with the text of the Sant Adrià de Besòs City Council dated March 21, 2020
"Against gender-based violence, let confinement not stop us. If you are experiencing it or know someone who may be a victim of gender-based violence, please call." Below, a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/21
message (…) In response to ÅjSantAdria (…)" along with a video of the interior of an establishment in which people can be seen, lasting 0:44 and 2:03 p.m.
***DATE.1. In the footer of the printout, you can see: ***URL.2.
- A "Twitter video" that, when opened, reveals images of the establishment mentioned in the previous point, including minors. It is evident that the video is edited, as around the 16-second mark, some images are shown that are not continuous with those that were being developed. At the beginning, a conversation can be seen between a customer wearing jeans pushing a stroller and a person who appears to be ***STAND.1 (who then stands behind the counter). ***STAND.1 and the customer appear to be talking, and a third person approaches them. As ***STAND.1 leaves behind the counter, she and the girl in jeans lightly struggle with each other, and the third person separates them.
Next, a man wearing dark clothing enters the establishment through the entrance door. He appears to be familiar or acquainted with the girl wearing jeans. After a brief conversation, he takes her to the back of the establishment. After the cutout, the image begins with the man dressed in dark clothing talking to the aforementioned third person. When she leaves, the man appears to challenge her with a gesture (his hands raised). They continue talking, and the third person moves toward the counter. When the man approaches her, another man intervenes, separating him from the third person and
pulling him back. The video ends with another cut, at the 36-second mark, in which the empty establishment and its interior images are seen. The image of the gaming space may coincide with the one featured in the A.A.A. logo on the A.A.A. Twitter profile.
-Printed Google reviews of the business in question as of March 9, 2023.
The following appears to be the criticism of the establishment by the people who run it: "two weeks ago."
In another, it says, "We've been to several birthday parties and I've never felt comfortable. ***STAND.1, who never leaves the bar, forgives you for asking for a coffee. But yesterday was the last straw, when we suddenly found her and her
***RELATED.3 confronting a guest, pulling her sweater and raising her hand when the guest was holding a little girl. I myself had to pull the woman away and remind her there were children. Zero professionalism and security in a place that's supposed to be for children. I don't plan on returning and will let families who invite us know from now on." With the response from "***STAND.2":
"I have video surveillance cameras that clearly show what happened. A
man who says ***RELATED.1 is ***STAND.3 tries to attack an older woman from behind. A guest pushes an older woman who tries to mediate
when this same guest attempts to hook up with "***POST.1" without a child in her arms. A guest raising her hand to "***POST.1" and everything that happened that day was recorded. The company reserves the right to take any legal action that may be appropriate in the case of defamatory comments and/or reviews. Regards.
In another, it refers to another criticism, coinciding with the name of complainant 2, referring to the response: "Your ***RELATED.2 had to be detained so he wouldn't hit an elderly woman."
There are also other negative criticisms that are unrelated to the subject of the complaint.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/21
THIRD: Transfer of the complaint.
In accordance with Article 65.4 of Organic Law 3/2018, of 5/12, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), this complaint was forwarded to the respondent so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the data protection regulations.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP) via electronic notification, was not received by the controller within the deadline for making it available, and was deemed rejected in accordance with the provisions of Article 43.2 of the LPACAP on March 24, 2023, as recorded in the certificate in the file.
Although the notification was validly made electronically, and the procedure was deemed to have been carried out in accordance with the provisions of Article 41.5 of the LPACAP, for informational purposes, a copy was sent by post to the address of the registered office as registered in the Commercial Registry: c/ Josep Royo 25, local 1, 08930 Sant Adrià de Besòs, Barcelona. which was notified as "absent" on the first attempt on March 31, 2023, and "returned to origin as unknown on April 3, 2023."
FOURTH: Admission for processing.
On April 18, 2023, in accordance with Article 65 of the LOPDGDD (Spanish Data Protection Act), the claim filed by the complainant was admitted for processing.
FIFTH: Written statement with police record regarding the facts of the claim.
The filing date of April 17, 2023, record 18, from the Catalan Data Protection Authority, includes the transfer of various documentation related to the facts.
1) From the Department of the Interior of the Generalitat de Catalunya, General of ***POST.3, the following is attached: the transfer of the police proceedings of ***DATE.3
***REFERENCE.1 AT USC SANT ADRIÀ. These proceedings contain:
a) Start date ***DATE.3, end date ***DATE.6, complainants, claimants
1 and 3, reported: ***POST.1 of the establishment: PLAY FUL, A.A.A., who
report:
-threats, mistreatment without injury, threats and damages (claimant 3), and threats to upload to social media (WhatsApp, Instagram, Facebook, and Twitter) the videos
recorded by the security cameras of the PLAY FUL establishment if they did not remove the negative reviews of the establishment and disseminate the images.
The proceedings also include claimant 2 (...) and her statement as victim/complainant.
-Dissemination of images taken from a security camera at the children's center, PLAY FUL.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/21
b) Complainant 3 provides a response from ***POST.2 of the establishment to a comment, stating:
"I have security cameras that clearly show what happened, evidence that
they call you defaming my business without any proof other than a profile created
to write this. After what you did to a man who says
***PARENTESCO.1 is ***POST.3 trying to hit a woman who didn't do it because
one of the guests stopped him, you should be careful what you say because it's your word against a security video showing what happened, and this is reportable... You have the right not to return, and I have the right to use the videos I have to
report whoever defames us..." And you tell your friend that I have everything recorded, that if
she wants to play this, she'll be the same sexist That's a bad move for him."
Complainant 3 testified on ***DATE.3 about the events that gave rise to the complaint and that he received a WhatsApp message from ***POST.1 that same day. He indicated that on Saturday ***DATE.2, he learned that the video had been shared via WhatsApp and that several people had written negative reviews of the establishment.
"This video was also published on the Twitter page in a post by the Sant Adrià City Council, and that his complaint relates to the misuse of images from a security camera." He provided screenshots of the conversations, published posts, and the security camera video that appears in the caption "Help us stop gender-based violence in Sant Adria, watch the video (...).
c) Complainant 1 states the events that gave rise to the complaint and that ***PUESTO.1 made a statement at the venue, stating that she knew it was ***PUESTO.3.
He acknowledges that he and ***PARENTESCO.1, also the complainant, posted negative reviews on Google, with ***PUESTO.1 responding to ***PARENTESCO.1 asking him to delete the reviews or make the videos public. He states that ***PUESTO.1, the venue, made the videos of the party public in various conversations on WhatsApp, Facebook, Twitter, and Instagram, mentioning his status as ***PUESTO.3 and calling him the aggressor, and reporting it as violence. Sexist. She provides images shared on social media, screenshots of conversations on her cell phone with her conversations with
***POST.1 and a copy of the reviews from the Google page.
d) Statement from A.A.A., in which she describes the events that occurred, according to her, on
***DATE.5, as ***POST.1 of the PLAY FUL KIDS establishment, and that the next day she saw the negative reviews about her business. She states that she and her partner (D.D.D.) proceeded to watch the security camera videos and "her partner sent the video" to
***PARENTESCO.2 of claimant 3 (the declarant states that D.D.D. was a friend of
***PARENTESCO.2 of C.C.C.) "so they could see what happened and hoping for an apology from them." Instead, instead of apologizing, her establishment began to receive more negative reviews. The video and the negative reviews were provided.
The establishment's ***POST.1 line also appears as identifying information: ***TELEPHONE.1.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/21
SIXTH: Letter from the respondent.
On May 2, 2023, a letter was received from the respondent stating that they had received
notification of the admission of the claim dated April 18, 2023. This letter addresses the notification of the claim's admission for processing, which also informs them that it concerns
the publication on Twitter of a video whose images have been extracted, presumably,
from the respondent's video surveillance system and have been disseminated. In his letter, he states:
1- "The fact that the images were posted on Twitter is unfounded because there is no
evidence." He states that he provides a copy of "the Twitter account of which I am ***POST.1,
verifying that no images of personal data" of the complainants have been published. In the copy he provides, a screenshot from 2/05/23, (...).
2- She indicates that there is a pending legal proceeding regarding the matter. She provides a copy of the
"summons" for oral trial, minor offense proceedings ***REFERENCE.2 for
***DATE.4, for events that occurred on ***DATE.5, as the "defendant."
She also provides a copy of the police proceedings already referenced in the FIFTH incident.
3- She states that the video surveillance installation at PLAY FUL KIDS, where the events took place, has an informational sign, and she provides a copy of a photograph of it, which states that PLAY FUL will process the data for the purpose of "preserving the security of the facilities and people," posted on the door of the premises.
SEVENTH: Agreement to initiate sanctioning proceedings
On September 15, 2023, the Director of the AEPD (Spanish Agency for Data Protection) agreed:
"TO INITIATE SANCTIONING PROCEEDINGS against PLAY FUL KIDS, S.L., with Tax Identification Number (NIF) B10790327, for the alleged violation of Article 6.1 of the GDPR, as defined in Article 83.5.a) of the GDPR, and for the purposes of the statute of limitations for the violation in Article 72.1.b) of the LOPDGDD.
"Without prejudice to the results of the investigation, for the purposes provided for in Art. 64.2 b) of Law 39/2015, of 1/10, on the Common Administrative Procedure of Public Administrations, the sanction that may apply for the facts that led to the initiation of the procedure and its possible classification would be an administrative fine of 3,000 euros. The postal mailing was sent to the establishment's physical location, c/ Ricart 9, in Sant Adriá de Besós, Barcelona. The result was "returned to origin as unknown" on 10/2/2023. Therefore, the submission was forwarded to the Official State Gazette, appearing on 10/6/2023, in accordance with Article 44 of the LPACAP.
No objections to the initiation agreement were received.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/21
EIGHTH: Proposed resolution of 06/18/2024 and objections.
On 06/18/2024, the investigator issued a proposed resolution to the Director of the AEPD proposing a sanction against PLAY FUL KIDS, S.L., with NIF (Tax ID Number). B10790327, for
a violation of Article 6.1 of the GDPR, classified in Article 83.5 a) of the GDPR,
classified as very serious in Article 72.1.b) of the LOPDGDD, for the purposes of
statute of limitations, with a fine of 3,000 euros, and "that pursuant to Article 58.2.d) of the GDPR,
within 30 days, it must prove that it has complied with the measures
provided for in legal ground V." It stated:
"In this case, it is unknown whether the respondent removed the video from the Twitter page of the aforementioned City Council, which it must prove, as well as delete the sending of the aforementioned video to complainant 2.
The proposal was sent to the respondent, and it appeared to have expired in the electronic notification.
A.A.A. filed a letter with this AEPD on June 24, 2024, stating that on June 18, they received an electronic notification without being able to view it, "since it is not addressed to my name," "it is a company that no longer exists," and requested that it be sent through other channels.
On June 28, 2024, a letter was sent to this person, enclosing a copy of the proposed resolution, which was received on the same day.
On July 15, 2024, PLAY FUL KIDS SL received a written statement of allegations, stating:
-After the complaint was filed with the Investigating Court number (...) of Badalona, the claim was filed, without any legal basis or evidence.
It also reiterates the numerous negative reviews about its premises.
It states that "the complainant has not proven at any time that the
alleged images captured by the respondent's surveillance system were
published on any social media."
As annex, it provides a copy of the ruling from the Investigating Court number (...) of Badalona, stating that she has been acquitted, and that, in said proceedings, "the IP address or the device from which the images that are the subject of this complaint were published was not proven." Reading the ruling, it is number
***REFERENCE.1, dated ***DATE.7, highlighting:
- As complainants, complainants 1 and 2, as complainant/defendant, complainant 3, all against A.A.A. (complainant/defendant) for minor offenses of physical abuse, minor offenses of threats, and minor offenses of coercion/threats. Source: Mossos d'Esquadra report dated ***DATE.3.
-In the PROVEN FACTS section, it means that in response to the negative reviews posted on GOOGLE by Complainant 2, days after ***DATE.5, in the afternoon when the argument occurred, "A.A.A. sent" Complainant 2 "a message via WhatsApp in which he sent him the video recorded by the premises' cameras and said, "I have this video of your ***RELATIVE.2 about to hit him... I ask you to
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/21
leave things alone and I'll leave the videos saved. Nothing happened here. I apologize for my mistake and for not restraining myself... I ask that you remove what you wrote."
In the third proven fact, it is stated, "Days later, from the Twitter profile
"***USER.1", whose origin and Ownership is unknown, the video recorded by the premises' security cameras was published."
- In the SECOND legal argument, the facts established by the evidence presented are reviewed, referring to the documents in the case file and statements. It is
stated, among others:
"Fifth, according to all the statements made and the
documentary evidence in the case file, the video recorded by the establishment's security cameras was published from the "***USER.1" Twitter profile.
Beyond the foregoing, the evidence presented in court does not confirm that, as the private prosecution points out, the accused was the author of the publication
on said social network—and others—of the videos recorded by the security cameras of the establishment she runs.
To this end, it should be noted that since the accused denies ownership of the aforementioned profile and the authorship of the message posted therein, and since we are not dealing with a profile verified by the technology company, the private prosecution, which bears the burden of proof, has not proposed producing any evidence—not even comparing the screenshots provided with the complaint—that would prove that the IP address and the device associated with it from which the tweet was published belong to the accused, and that it was she—and not another person—who actually made said post."
(...)
"In the present case, the evidence presented in court allows us to verify that the written messages sent by the accused to the complainant were not only a consequence of the public comment previously made by the latter, but also included, in several sentences, apologies for her own behavior on the day of the initial confrontation. Therefore, given that the complainant did not even withdraw the comment after receiving the accused's messages, it is difficult to understand that the comment caused any limitation on the complainants' freedom—a limitation required for the criminal offense of coercion to be consummated."
-In the third legal ground, it is stated that A.A.A. "She cannot be declared the perpetrator of the minor offense of coercion or, alternatively, threats, since the evidence presented has not confirmed the direct, material, and voluntary participation of the accused in any of the aforementioned offenses," as reproduced in the ruling.
-The defendant states that the personal data captured through the establishment's video surveillance system has been processed lawfully, fairly, and transparently, without violating Article 5.1.b) and f) of the GDPR, and that the security of the processing has been guaranteed, maintaining the confidentiality of the personal data captured by the video surveillance cameras.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/21
NINTH: Proven Facts
From the actions taken in this proceeding and from the documentation
in the file, the following have been proven:
PROVEN FACTS
1. It is proven that Claimant 1 and ***PARENTESCO.1, Claimant 2, held a birthday party for their minor daughter on Friday ***DATE.5 at PLAY
FUL KIDS, SL (with subscribed and paid-up capital of 3,000 euros, registered since 15/07/2022, corporate purpose according to the Commercial Registry: recreational leisure and entertainment activities for children, as well as any other activity that may arise from or is framed within the scope of the activities described, etc.). Services are provided at the aforementioned premises. A.A.A., ***POST.1, and ***POST.4, jointly and severally, of the venue mentioned along with B.B.B., according to the Commercial Registry.
2-During the aforementioned event, there was an altercation between several attendees
(claimants 1 and 2, claimant 3, a friend and guest of the aforementioned) with
***POST.1 of the venue and her ***RELATED.3, as acknowledged by all of the aforementioned
both in the complaint and in the police report. The remaining claimants
stated in their complaints that they attended the event as guests.
3-The following day, several event attendees, including claimants 1 and 2,
acknowledged that they posted negative reviews on Google, giving their opinions about the venue.
This is confirmed by screenshots presented by the
claimants and also included in a police report that will be referred to.
4- Complainants 1 and 2, ***RELATED.4, as stated and as stated in the police report, also prove with the printed copy of the screenshots they provide that on the WhatsApp application of the mobile phone provided by Complainant 2, as shown on the device, they receive a video of the interior of the celebration establishment, focusing in panoramic mode from an upper part of a birthday celebration venue on virtually the entire establishment, allowing everyone to be seen, including minors. It contains the following: "I have this video of your
***RELATED PARTNER 2 about to hit my ***RELATED PARTNER 3. Do you want me to come over and file a complaint, or will you leave everything as it is without further ado?" The following text continues:
Referring to the name of "Complainant 3," "He has created a problem that is not your fault," "I have the entire video of everything that happened, and you are not in a good light," "I ask you to leave things alone, and I will save the videos here." Above the video header, there is the line ***PHONE 1, which, according to the police records in the file, corresponds to ***POST 1 of the PLAY FUL KIDS establishment,
A.A.A., ***POST 4 of the aforementioned defendant. It's also clear that the video he sent was from the following day, ds (dissabte, in Catalan, Saturday***DATE.2, seen on screen).
5- Furthermore, claimants 1 and 2 also indicate in their claim that the video was posted on ***DATE.1 on the Sant Adrià de Besòs Twitter account (which had been posted since 03/21/2020, as a means of reporting gender-based violence), accrediting this with a screenshot of the interior of the venue and the address: C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/21
***URL.1 with the caption "AjSantAdria. Help us stop gender-based violence in Sant
Adrià (...)", claimant 2 indicating that the person accused of sexism is claimant 1, and their
***RELATEDNESS.2. The images and the space visible at first glance in the screenshot, the angle of view, and the content are the same as those of claimant 2. Received on WhatsApp.
6- On March 9, 2023, the General Subdirectorate of Data Inspection accessed the Sant Adrià de Besòs City Council's website. On that date, the following message appeared: "***USER.1 In response to ÅjSantAdria Help us stop gender-based violence in Sant Adrià (...)" along with a video of the interior of a children's birthday party in which people can be seen, lasting from 0:44 a.m. to 2:03 p.m. ***DATE.1. The following can be seen in the footer:
***URL.1.
Also included as evidence is the copy obtained on March 9, 2023, which is a
"Twitter video," in which the people inside the children's birthday party can be seen. It is clear that the images were obtained from the camera inside the establishment. The incidents that occurred are shown. When opened, the images of the establishment mentioned in the previous point, including minors, are revealed. It is evident that the video is edited, as starting at the 16-second mark, non-continuous images of what was taking place are shown, and it ends with images of the establishment's interior without anyone inside.
7- Complainant 3, among other complainants, also provided a screenshot of the Sant Adrià de Besòs City Council's campaign against gender-based violence, including a screenshot of the video showing the interior of the establishment. The image matches the one mentioned in the previous section of the video.
Twitter.
8- On April 17, 2023, the Catalan Data Protection Authority sent to the AEPD a copy of the police proceedings of a criminal complaint filed by ***DATE.3, filed by complainants 1 and 2, with the addition of an alleged violation of the LOPDGDD (Spanish Data Protection Act) due to the dissemination on various social media platforms (WhatsApp, Instagram, Facebook, and Twitter) of the images recorded by the security cameras of the PLAY FUL establishment, c Ricart 9, Sant Adrià de Besòs, on ***DATE.5, at 5:00 p.m., which is run by the accused, A.A.A.
9- In a statement of these police proceedings, ***REFERENCE.1 AT
USCSADRIAB of ***DATE.3, A.A.A., stated that, the following day, ***DATE.2 saw the negative reviews about his business and that after seeing the videos from the security camera at the premises where the events took place, "her partner sent the video to ***PARENTESCO.2 of complainant 3, so they can see what happened and is hoping for an apology from them."
10- In the police report, there is a printout of the screenshot of reviews on GOOGLE
about PLAY FUL KIDS that mention the PLAY FUL KIDS - PLAY FUL kids
(***PUESTO.2) project and allude to the altercation and that "we have security cameras that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/21
support what happened." Another indicates that "you are defaming my business" and that a
***PUESTO.3 tries to hit a woman, who is in the security video.
11- The respondent acknowledged in its statements to this AEPD dated 04/18/2023 that PLAY FUL KIDS SL has a video surveillance system inside the premises that captures personal data, providing a photograph of an informational sign placed on the establishment's door stating that PLAY FUL "will process the personal data obtained through the video surveillance systems installed in order to preserve the security of the facilities and individuals."
12- The respondent submitted, in its submissions to the proposed resolution, a copy of the ruling of the Investigating Court number (...) of Badalona, dated ***DATE.7, which was issued in response to the police complaint filed against ***POST.4 of the respondent, A.A.A., for the events that occurred on ***DATE.5 at its premises. The sentence
acquits the aforementioned ***POST.4 of the minor offenses of misuse of construction, minor offense of threat, and minor offense of coercion/threats. The proven facts include:
-In response to the negative reviews posted on Google by Complainant 2, days later
on ***DATE.5, in the afternoon when the argument occurred, "A.A.A. sent "Complainant 2" a message via WhatsApp in which he forwarded the video recorded
by the establishment's cameras and said, "I have this video of your ***RELATED.2 about to hit him... I ask you to leave things alone and I'll save the videos here.
Nothing happened. I apologize for my mistake and for not restraining myself... I ask that you remove what you wrote."
13- It can be seen that the logo of the profile image of the advertisement on Twitter for the
Sant Adrià City Council is a photo-image of the establishment's interior
(compare with video) associated with "***USER.1," which is repeated in the URL.
The logo of the Twitter image provided by A.A.A. after the claim was admitted for processing, dated 05/02/23, is different, (…).
The judgment provided by the complainant, from the Investigative Court number (…) of Badalona, dated ***DATE.7, states in the third proven fact, “Days later, from the Twitter profile “***USER.1”, whose origin and ownership are unknown, the video recorded by the premises' security cameras was published.”
LEGAL BASIS
I. Jurisdiction
In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of 5/12, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.
Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development, and, insofar as they do not contradict them, in a subsidiary capacity, by the general rules on administrative procedures."
II. Unfulfilled Obligation
The purpose of the GDPR is to guarantee the right to data protection of natural persons. Article 4.1 of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Article 4.2 of the GDPR defines “processing” as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.”
Article 4.7 of the GDPR defines: "controller" or "controller": the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing; if Union or Member State law determines the purposes and means of processing, the controller or the specific criteria for its nomination may be laid down by Union or Member State law.
Images of people that are part of a video are personal data, as recognized by, among others, the Constitutional Court ruling 14/2003 of 30/01.
Article 22 of the LOPDGDD states that:
"1. Natural or legal persons, public or private, may carry out the
processing of images through camera or video camera systems for the
purpose of preserving the security of persons and property, as well as their facilities."
(…)
"3. The data will be deleted within a maximum period of one month from its capture,
except when it must be retained to prove the commission of acts that threaten the integrity of persons, property, or facilities. In such cases, the
images must be made available to the competent authority within a maximum period of seventy-two hours from the moment they became aware of the existence of the recording."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/21
For its part, Article 6.1 of the GDPR establishes the circumstances under which the processing of personal data may be considered lawful:
"1. Processing will only be lawful if at least one of the following conditions is met:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
a) the processing is necessary for the performance of a contract to which the data subject is party or for the implementation, at the request of the data subject, of pre-contractual measures;
b) the processing is necessary for compliance with a legal obligation to which the controller is subject;
c) the processing is necessary to protect the vital interests of the data subject or of another natural person.
d) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(e) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The provisions of point (f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their tasks.
The physical image of a person, in this case contained in images pursuant to Article 4.1 of the GDPR, is personal data, and its protection is therefore subject to this Regulation. Article 4.2 of the GDPR defines the concept of "processing" of personal data, which has a broad meaning.
The images generated by the video surveillance system are personal data, so their processing is subject to data protection regulations. The respondent company is responsible for processing the video surveillance data of the PLAY FUL establishment, in which the people appearing in the video extracted from the video surveillance system can be recognized with the images of the altercation on ***DATE.5 in which the complainants were involved.
The facts that are the subject of the complaint, the conduct of which gives rise to the attribution of the respondent, are those related to:
1. The aforementioned video was sent via WhatsApp to the complainant. 2, ("I have this video of your
***RELATED.2 about to hit my ***RELATED.3"), which also appears in the proven facts of the ruling of ***DATE.7 and which Claimant 2 submitted with his claim. According to the screenshot, it was sent on Saturday ***DATE.2,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/21
and this was stated by the recipient in her claim. This means that the video, dedicated to certain purposes and collecting data for those purposes, was extracted from the defendant's video surveillance operating system by his ***POST.4, who participated in the altercation, and for purposes that have nothing to do with the security of the premises and the people involved.
Considering that the concept of data processing is broad, the data controller is responsible for lawful processing, which originally pursues its purposes in the safety of the venue and its employees, not in the use of the venue for the private purposes and interests of ***POST.1. This also constitutes processing insofar as it is communicated, disseminated, and used for other purposes, without a legitimate basis, in pursuit of a personal interest that, in response to negative reviews, can never justify the use of attendee data in this manner.
2- A declaration before ***POST.3 of the A.A.A. In which she stated that she saw the video
along with her ***PARENTESCO.2: "they proceed to view the videos from the security camera" and expressly indicates that the "video is sent to F.F.F., ***PARENTESCO.2
of claimant 3," for which the system must be entered and used, and, in addition, an express will to extract it and again, share it with a third party.
3- An exhibition of a video recorded inside the defendant's establishment (data collection) since the images are the same as those on WhatsApp, with a specific purpose such as "preserving the security of the facilities and people." This was then posted on a medium such as the social network,
via the Twitter account of the Sant Adrià de Besòs City Council two days later, whose authorship could not be accredited, despite the fact that the origin of the video is that of the claimant's establishment.
Clearly, in the first two actions mentioned, it is proven that the aforementioned video about the disputed events was sent to at least two people, belonging to the system installed by the defendant. The video depicts the altercation and shows complainants 1, 2, and 3, as well as staff members, some of whom are also complainants and children. All of them are third parties unrelated to the data controller, and each of the transmissions constitutes data processing.
Thus, the video was viewed by ***POST.1 of the establishment that is the subject of the complaint, and, at its convenience, used to disseminate it as a means to attempt to
refute the statements of those attending the event regarding the altercation and pressure them to file a complaint.
This implies that the defendant is charged with the aforementioned violation of Article 6.1 of the GDPR, as it has carried out at least two processing operations, extracting the video or part of it and sending it to different destinations, for which the aforementioned violation of Article 6.1 of the GDPR is charged.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/21
The sending of the video, whether via mobile devices, to WhatsApp, in this case to Claimant 2, wife of the aforementioned Claimant 1, ***POST.3, and to ***PARENTESCO.2 of Claimant 3, as she voluntarily declares before the
***POST.3 (they extract the video and send it to her in order to receive negative reviews), without being questioned in this regard, constitutes processing of personal data.
This data was collected and stored in the video surveillance system of the respondent's establishment for the purpose of protecting the facility and its personnel.
(among other things, containing data on minors, as it is a playroom) and was extracted by ***POST.4 and ***POST.1 of the respondent's establishment in an accredited manner. The data is processed, including this dissemination, to private attendees, forming at least two communications per transmission, as defined in Article 4.2 of the GDPR.
This processing is considered distinct from the original and legitimate processing that may be carried out for the purpose of protecting the establishment and its personnel, which is reported on the video surveillance sign provided by the respondent and which is not disputed.
The video sent to Claimant 2's WhatsApp and to another person constitutes specific processing that required extracting the video or part of it and uploading and/or sending it for the purpose of disseminating it for the purposes that arise from the proven facts, including obtaining the removal of the Google reviews of the aforementioned establishment, using it to achieve those ends, and not for the purposes contemplated by said system.
Thus, the defendant's unilateral use of the video to allegedly defend the negative reviews leveled against her or her business, or the issues that may arise from the altercation, would not cover the processing of the establishment's images in the manner described in the proven facts.
The defendant does not prove that she had the legal authority to process the images resulting from the aforementioned dissemination, thus proving the alleged infringement.
The evidence, all rational and coherent, presented in the claims and in the judgment provided by the defendant's ***POST.4,
together with the actions included in the police proceedings, do not call into question the video, its content, its origin, or the aforementioned disseminations. Thus, the defendant's presumption of innocence regarding the origin of the data, as well as the authorship of the two transmissions, must be overturned in the face of evidence of such facts.
III. Classification and Qualification of the Infringement
The infringement attributed to the respondent is classified in Article 83.5.a) of the GDPR, which provides: "Infringements of the following provisions shall be sanctioned in accordance with paragraph 2, with administrative fines of up to €20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total global annual turnover of the preceding financial year, whichever is higher:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/21
a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9;
For the purposes of the limitation period for infringements, the alleged infringement expires within three years, in accordance with Article 72.1.b) of the LOPDGDD, which classifies the following conduct as very serious:
(…)
a) The processing of personal data without meeting any of the conditions for the lawfulness of processing established in Article 6 of Regulation (EU) 2016/679. (…)”
FOURTH Proposed Sanction
The corrective powers available to the Spanish Data Protection Agency, as a supervisory authority, are established in Article 58.2 of the GDPR. These include the power to impose an administrative fine pursuant to Article 83 of the GDPR (Article 58.2 i), or the power to order the controller or processor to ensure that processing operations comply with the provisions of the GDPR, where appropriate, in a specified manner and within a specified period (Article 58.2 d).
Pursuant to Article 83.2 of the GDPR, the measure provided for in Article 58.2 d) of the aforementioned Regulation is compatible with the sanction of an administrative fine.
In the present case, based on the facts presented and proven, it is considered that the appropriate sanction to be imposed is an administrative fine. The fine that Any penalty imposed must be, in each individual case, effective, proportionate, and dissuasive, in accordance with Article 83.1 of the GDPR. In order to determine the administrative fine to be imposed, the provisions of Article 83.2 of the GDPR must be observed, which states:
“2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures provided for in Article 58(2)(a) to (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of:
a) the nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;
b) the intentionality or negligence involved in the infringement;
c) any measures taken by the controller or processor to mitigate the damage suffered by the data subjects;
d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/21
e) any previous breach committed by the controller or processor;
f) the degree of cooperation with the supervisory authority to remedy the breach and mitigate any adverse effects of the breach;
g) the categories of personal data affected by the breach;
h) the manner in which the supervisory authority became aware of the breach, in particular whether the controller or processor notified the breach and, if so, to what extent;
i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;
(j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42;
(k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.
In relation to Article 83.2(k) of the GDPR, the LOPDGDD, in its Article 76, "Sanctions and corrective measures," provides:
"1. The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the grading criteria established in paragraph 2 of the aforementioned article.
2. Pursuant to Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account:
a) The ongoing nature of the infringement.
b) The connection between the infringer's activity and the processing of personal data.
c) The benefits obtained as a result of committing the infringement.
d) The possibility that the affected party's conduct could have included the commission of the infringement.
e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.
f) The impact on the rights of minors.
g) The availability of a data protection officer, where not mandatory.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/21
h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where there are disputes between them and any interested party."
The following are aggravating circumstances:
- The defendant's conduct reflects that the violation was committed intentionally, in accordance with the context of the literal content, along with its data, the reviews whose impressions appear in the file, and the convenient use made of the images extracted from the video to pressure the removal of the reviews, which reflect this nature and should not be used as a negotiation tool because what is contained and processed in said video surveillance system violates individuals' rights (Article 83.2.b) GDPR).
- The category of personal data affected, with the dissemination of the image among minors, the location being a playroom where such individuals congregate. In the words of the CJEU in its judgment of 8/12/2022,
"A person's image is, in fact, one of the main attributes of their personality, insofar as it manifests their individuality and allows them to be distinguished from their peers. Thus, a person's right to the protection of their image constitutes one of the essential conditions of their personal fulfillment and presupposes, in particular, control by the person over their own image, which includes the possibility of preventing its dissemination. The protection of the right to privacy is of particular importance in this context, given the capacity of photographs to convey particularly personal, if not intimate, information about a person or their family (see, in this regard, Eur. Ct. H.R., 7/02/2012, Von Hannover v. Germany, ECHR:2012:0207JUD004066008, paragraphs 95, 96, and 103). cited case law).”
(83.2.g) GDPR).
On the other hand, as a mitigating factor, it is taken into account that the defendant is a company
whose activity is not, in fact, related to the regular processing of personal data, and Article 76.2.b) of the LOPDGDD may be applied.
The balance of the circumstances considered allows for a fine of €3,000 (three thousand euros) to be assessed for the violation of Article 6.1 of the GDPR.
Therefore, in accordance with applicable legislation and having assessed the criteria for graduating sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency
RESOLVES:
FIRST: TO IMPOSE on PLAY FUL KIDS, S.L., with Tax Identification Number (NIF) B10790327, for a
violation of Article 6.1 of the GDPR, classified in Article 83.5 a) of the GDPR, a
fine of 3,000 EUROS, classified as very serious for the purposes of the statute of limitations for the
violation in Article 72.1 b) of the LOPDGDD.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/21
SECOND: TO NOTIFY PLAY FUL KIDS, S.L. of this resolution by sending
the GENERAL ANNEX.
THIRD: This resolution will become enforceable once the deadline for filing an optional appeal for reconsideration expires (one month from the day following notification of this resolution) without the interested party having exercised this right.
The sanctioned party is hereby notified that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Article 98.1.b) of the LPACAP (Spanish Tax Administration Act), within the voluntary payment period established in Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to Article 10 of the LPACAP (Spanish Tax Administration Act). 62 of Law 58/2003, of December 17, by depositing the fine, indicating the sanctioned party's tax identification number and the procedure number shown in the heading of this document, into the restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at the banking institution CAIXABANK, S.A.
Otherwise, collection will be carried out during the enforcement period.
Once the notification has been received and enforced, if the enforcement date is between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be the 20th of the following month or the next business day after, and if it is between the 16th and last day of each month, inclusive, the payment deadline will be the 5th of the second following month or the next business day after.
In accordance with the provisions of Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data), this
Resolution will be made public once it has been notified to the interested parties.
Any action against this resolution, which terminates the administrative process pursuant to Art. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and Section 5 of the Fourth Additional Provision of Law 29/1998, of 13707, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law.
Finally, it is noted that pursuant to the provisions of Art. 90.3 a) of the LPACAP, a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in article 16.4 of the aforementioned LPACAP. They must also submit to the Agency the documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension.
938-16012024
Mar España Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
