AEPD (Spain) - EXP202414144

AEPD - Expediente Nº: EXP202414144
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 22.2 LSSI Article 40 LSSI
Type:	Complaint
Outcome:	Upheld
Started:	03.09.2024
Decided:	30.06.2025
Published:	11.07.2025
Fine:	3000 EUR
Parties:	EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.
National Case Number/Name:	Expediente Nº: EXP202414144
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	English
Original Source:	AEPD (in EN)
Initial Contributor:	Eleonora

The DPA fined the operator of a website €5,000 for setting non-necessary cookies without users' consent, including when users refused or withdrew consent to said cookies.

English Summary

Facts

The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.

On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical and unnecessary cookies without the user's prior consent.

The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.

The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent.

Holding

The DPA found a breach of the national ePrivacy implementation law (LSSI). Article 22.2 LSSI on the installation of cookies before the user's consent. The exemptions under this Article apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents.

The DPA decided this infraction was minor based on Article 38(4)(g) LSSI. According to the criteria of Article 40 LSSI, the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence.

The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

1/17

 File No.: EXP202414144

RESOLUTION TERMINATING THE PROCEDURE FOR RECOGNITION OF LIABILITY AND VOLUNTARY PAYMENT

From the procedure initiated by the Spanish Data Protection Agency and based on the following

BACKGROUND

FIRST: On June 30, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. (hereinafter, EDICIONES CATÓLICOS),
through the agreement transcribed below:

<<
File No.: EXP202414144 (PS/00224/2025)

AGREEMENT TO INITIATE SANCTIONING PROCEDURE

Regarding the actions taken by the Spanish Data Protection Agency and based on the following:

FACTS

FIRST: On September 3, 2024, a complaint was filed with the

Spanish Data Protection Agency. The complaint is directed against the entity
EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. with NIF B04953758, owner of the website: ***WEB.1, (hereinafter, the defendant), for the alleged violation

of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (hereinafter LSSI).

The grounds for the claim relate to the use of non-technical and unnecessary cookies without the user's prior consent.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/17

SECOND: On October 14, 2024, this Agency consulted and

added to the file the "Cookie Policy" (***WEB.1.) and the cookie report
(Report obtained with the EDPB WEBSITE AUDITING TOOL.)

THIRD: On October 16, 2024, in accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), this claim was forwarded to the respondent so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the regulations. Data protection.

The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was received on October 16, 2024, as recorded in the acknowledgment of receipt included in the file.

FOURTH: On November 15, 2024, this Agency received a written response to the transfer in which, in summary, the respondent states:

- Having reviewed the claim and declares that it strictly complies with the current regulations on data protection and the use of cookies. It ensures that it does not install non-exempt cookies without express consent, that the configuration banner clearly informs and allows preferences to be managed, and that

only technical cookies, necessary for the operation of the portal, are used without the need for consent.

- It indicates that, after internally analyzing the facts, it has not detected any incidents that justify the claim, considering that the alleged facts do not reflect the actual functioning of the portal. The entity emphasizes that the cookie management system prevents the installation of non-essential cookies without express consent; the banner allows the user to accept, reject, or configure cookies clearly and freely; the cookie policy offers detailed and accessible information about each cookie, its purpose, duration, and the third parties involved, with links to their respective privacy policies; periodic reviews of the system are carried out to ensure its proper functioning.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/17

and therefore concludes that the system complies with current regulations.

- That website users are informed in a clear, accessible, and structured manner about the types of cookies used, both in the entry banner and in the Cookie Policy accessible from any section of the portal.

- That it informs users in detail about the specific purposes
of the data processing carried out through cookies, which can be freely managed through the banner enabled on the website.

- That it uses a cookie consent management system through the provider ***EMPRESA.1, in accordance with the GDPR and the IAB Europe Transparency and Consent Framework (TCF).

- That it has implemented, through the ***EMPRESA.1 system, a clear and accessible procedure that allows users to accept or reject non-excepted cookies upon first accessing the website and that the consent granted by users through the system applies exclusively to the web domain,

as indicated in its Cookie Policy. Likewise, the user is informed, through the ***EMPRESA.1 partner management system, of the
identity of the third parties involved, the type of processing they perform, their

purposes, and whether the processing is conditional on the user's consent.

- That it provides users with a clear, accessible, and permanent mechanism to

revoke or modify the consent given for the use of cookies,
in accordance with the GDPR and the LSSI, and that the consent given by users
for the use of cookies can be revoked or modified at any time

through the cookie banner or browser settings.

- Regarding international data transfers, it states that it does not directly

transfer personal data internationally. However, it informs that its provider ***EMPRESA.1 uses the services of
***HERRAMIENTA.1, a subprocessor located in Israel. This

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/17

transfer is covered by the European Commission Decision
of 2011.

- Regarding the retention period for data obtained through cookies,

the company states that the retention period for data obtained through cookies varies depending on the purpose of the processing and that the Cookie Policy details this information.

- Regarding the implementation and effectiveness controls, the company states that it carried out an exhaustive technical review without identifying any incident related to the

installation of non-exempt cookies without prior consent, ensuring that non-essential cookies are only installed with informed, free, and unequivocal consent.

The following documentation is attached to the document:

- ANNEX 1 contains a table of cookies used according to its cookie policy and as stated. This table includes cookies, among others, from Google Analytics, for the purpose of counting page visits, Facebook cookies, for the purpose of tracking interactions, and a Twitter cookie for collecting behavioral and interaction data.

- ANNEX 2 shows the cookies used prior to the user's consent, as stated. This table includes, among others, cookies associated with Google Analytics.

FIFTH: On November 25, 2024, in accordance with Article 65 of the LOPDGDD (Spanish Data Protection Act), the complaint filed by the complainant was admitted for processing.

SIXTH: The Subdirectorate General of Data Inspection proceeded to carry out preliminary investigative actions to clarify the facts in question, pursuant to the functions assigned to supervisory authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VII, Chapter I, Section Two, of the LOPDGDD (Spanish Data Protection Act), having learned of the following:

On 01/08/2025, the following characteristics were verified regarding the website ***WEB.1:

- Cookies are installed, without interacting with the website: "_ga" associated with the cookie. to the
service of Google Analytics, as well as "VISITOR_INFO1_LIVE".

- That without interacting with the website, upon entering it, a notice appears that prevents you from reading the website, with the following text:

or "Privacy Notice: The content of ***DIARIO.1 is the result of the daily work of more than 100 journalists and professionals to ensure that the information offered is of high quality. You can access its website
through the following options: Accept cookies and access for free. Personalized digital advertising, based on the information

collected through cookies, allows us to finance our activity to
continue offering you content with high quality standards at no cost to you. By clicking the "Accept cookies" button, you can access the

website and accept the installation of cookies, whether ours or those of our partners, which allow us to track and analyze behavior on the website, in order to show you advertising and content.

Reject cookies and access through monthly payment without personalized advertising.
If you do not accept the installation of cookies, only those necessary to guarantee navigation on the website will be installed, but they will not be used to analyze behavior or

to display personalized advertising or content, although you may still view general non-personalized advertising. You can reject the
installation of cookies and access our website through this

€4 monthly subscription by clicking the "Reject and pay" button.

With your consent, we and our partners use cookies or

similar technologies to store, access, and process personal data such as your visit to this website. You can withdraw your
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/17

consent and object to the processing of data based on legitimate interests at any time by clicking

"Configure" or in our Cookie Policy on this website.

- There is an "Accept and Continue" button and a "Decline and Pay" button, and at the bottom of the web page there is a link with the text "PRIVACY POLICY" and another "COOKIE POLICY."

- The cookie policy provides information about what cookies are, what types of cookies are used, their purpose, and their duration. There is also a link to change consents, which checks that you can access a banner with the following information:

or "Welcome to ***DIARIO.1 Consent Management. We and our partners place cookies, access, and use non-sensitive information from your device to improve our products and personalize ads and other content on this website. You can accept all or part of these operations. For more information about cookies, partners, and how we use your data, to review your options, or to review these operations for each partner, please visit our privacy policy and our cookie policy."

- There is a "Reject all" button, an "Accept all" button, and a "Save" button. However, after revoking consent (previously granted) to the processing and cookies listed in the banner above, the following cookies remain installed: "_ga", "_fbp", and "VISITOR_INFO1_LIVE".

As of January 9, 2025, it was verified that the website contains the following:

- It is possible to accept or reject processing for each individual member, but after accepting all cookies and processing and following the revocation or rejection of all consents, the following cookies remain installed in the browser: "_ga", "_fbp", and "VISITOR_INFO1_LIVE".

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/17

As of April 1, 2025, the following was verified: Information regarding cookies

detected on the website:

- The “_ga” cookie is used in the context of Google Analytics and its functionality

is analytical.

- The “VISITOR_INFO1_LIVE” cookie has a “functionality” function since

“[…]it is also used to detect and resolve problems with the service
[…]”, security, analytics, and advertising.

LEGAL BASIS

I

Jurisdiction

In accordance with the provisions of Article 43.1 of the LSSI and as established in
Articles 47, 48.1, 64.2, and 68.1 of the LOPDGDD, the President of the Spanish Data Protection Agency is competent to initiate and

resolve this procedure.

Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions

of Regulation (EU) 2016/679, in this Organic Law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, in a subsidiary capacity, by the general rules on administrative procedures."

Finally, the fourth Additional Provision "Procedure in relation to the powers conferred on the Spanish Data Protection Agency by other laws" establishes that: "The

provisions of Title VIII and its implementing regulations shall apply to the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/17

procedures that the Spanish Data Protection Agency may have to process in the exercise of the powers conferred on it by other laws."

II

Deficiencies detected in the Cookie Policy

a).- Installation of cookies on the terminal equipment prior to the user's consent:

Article 22.2 of the LSSI establishes that users must be provided with Clear and complete information on the use of data storage and retrieval devices and, in particular, on the purposes of data processing.
This information must be provided in accordance with the provisions of the GDPR.

However, it should be noted that cookies necessary for the intercommunication of terminals and the network, as well as those that provide a service expressly requested by the user, would be exempt from compliance with the obligations established in Article 22.2 of the LSSI.

In this regard, the WP29, in its Opinion 4/2012, interpreted that among the exempted cookies would be user input cookies (those used to fill out forms or manage a shopping cart); user authentication or identification cookies (session cookies); user security cookies (those used to detect repeated failed attempts to connect to a website); multimedia player session cookies; session cookies for load balancing; user interface customization cookies; and some plug-ins for sharing social content.

These cookies would be excluded from the scope of Article 22.2 of the LSSI, and therefore, it would not be necessary to inform or obtain consent regarding their use. On the contrary, it will be necessary to inform and obtain the user's prior consent before using any other type of cookies, whether first-party or third-party, session or persistent.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/17

In the present case, the check carried out on the website in question detected that upon accessing the website for the first time, after clearing the terminal equipment of its browsing history and cookies, without accepting new cookies or performing any action on the website, the following non-technical cookies were used.

These cookies continued to be used even after the user rejected the cookie. or did not give consent for the use of non-technical or unnecessary cookies:

- The "_ga" cookie, whose provider is "Google Analytics," and whose purpose is to distinguish users and collect data about their browsing behavior on the website.

- The "VISITOR_INFO1_LIVE" cookie, associated with "YouTube" (Google LLC), is installed when a YouTube video is embedded on a web page and may collect user preference data related to video viewing. This cookie could only be exempt if it is used exclusively to technically adapt the video to the user's connection (for example, screen resolutions or network speed). However, the respondent's website indicates that it is for advertising purposes.

III

Breached Obligation

Title VII of the LSSI, under the heading "Infractions and Sanctions," contains the sanctioning regime applicable in the event of any of the infractions listed in the table of infractions. It is included therein. Specifically, Article 37 specifies that "information society service providers are subject to the sanctioning regime established in this Title when this Law applies to them."

The definition of service provider is contained in section c) of the Annex to the aforementioned regulation, which defines the service provider as the "natural or legal person who provides an information society service."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/17

Article 22.2 of the LSSI establishes that:

"Service providers may use data storage and retrieval devices on recipients' terminal equipment, provided that the recipients have given their consent after being provided with clear and complete information about their use, in particular, about the purposes of data processing, in accordance with the provisions of Organic Law 15/1999, of December 13, on the protection of personal data.

When technically possible and effective, the recipient's consent
to data processing may be facilitated by using the appropriate settings in the browser or other applications.

The foregoing will not prevent possible storage or access of a technical nature
for the sole purpose of transmitting a communication over an electronic communications network or, to the extent strictly
necessary, for the provision of an information society service
expressly requested by the recipient."

In the present case, the following deficiencies have been detected in the website's Cookie Policy:

- The use of cookies that are not of a technical nature without the user's prior consent and the impossibility of rejecting them, as they do not disappear after the revocation or rejection of all consents.

All of this could constitute a violation of Article 22.2 of the LSSI by the respondent.

IV

Classification of the violation

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/17

This violation is classified as "minor" in Article 38.4 g) of the aforementioned Law, which

considers as such:

“Using data storage and retrieval devices when the information has not been provided or the consent of the recipient of the service has not been obtained in accordance with the terms required by Article 22.2.”, which may be

sanctioned with a fine of up to €30,000, in accordance with Article 39 of the aforementioned LSSI.

V

Proposed Sanction

Furthermore, in accordance with the evidence available at this time, the decision to initiate the sanctioning procedure, and without prejudice to the outcome of the investigation, is considered appropriate to grade the sanction to be imposed according to the following criteria established in Article 40 of the LSSI:

“The amount of the fines imposed will be graded according to the following criteria: a) The existence of intentionality. b) Period of time during which the violation has been committed. c) Repeat offenses due to the commission of violations of the same nature, when so declared by a final decision. d) The nature and amount of the damages caused. e) The profits obtained from the violation. f) The turnover affected by the violation committed. g) Adherence to a code of conduct or advertising self-regulation system applicable to the violation committed, which complies with the provisions of Article 18 or the eighth final provision and which has been favorably reported by the competent body or bodies. Based on the evidence obtained, and without prejudice to the results of the investigation, it is considered appropriate to grade the sanction to be imposed according to the following criteria, established in Article 40 of the LSSI:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/17

- The existence of intentionality (section a). This expression must be interpreted as equivalent to the degree of culpability. The defendant entity should have exercised extreme due diligence, which corresponds to the determination of a system for obtaining informed consent that complies with the mandate of the LSSI.

In accordance with these criteria, and without prejudice to the results of the investigation of this case, it is considered appropriate to impose, for the violation of Article 22.2 of the LSSI, with respect to the cookie policy implemented on the website of its owner, a Initial fine of 5,000 euros (five thousand euros).

Therefore, in accordance with the foregoing, the Director of the Spanish Data Protection Agency, HEREBY AGREES:

FIRST: TO INITIATE SANCTIONING PROCEEDINGS against EDICIONES

CATÓLICOS Y VIDA PÚBLICA, S.L.U. with Tax Identification Number (NIF) B04953758, owner of the website
***WEB.1, for the violation of Article 22.2 of the LSSI, classified as "minor" in

Article 38.4 g) of the aforementioned law.

SECOND: TO APPOINT A.A.A. as Instructor, and B.B.B. as Secretary, indicating

that either of them may be challenged, if appropriate, in accordance with the provisions of
Articles 23 and 24 of Law 40/2015, of 1 October, of the Legal Regime of the Public Sector (LRJSP).

THIRD: TO INCORPORATE into the sanctioning file, for evidentiary purposes, the complaint filed and its documentation, the documents obtained and generated by the Subdirectorate General of Data Inspection in the actions prior to the initiation of this sanctioning procedure, all of which are part of this administrative file.

FOURTH: THAT for the purposes provided for in Article 64.2 b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the sanction that may be imposed would be, without prejudice to the results of the investigation of this file, 5,000 euros (five thousand euros).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/17

FIFTH: NOTIFY this agreement to initiate sanctioning proceedings to

EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U., with Tax ID No. B04953758, owner of the website ***WEB.1, granting it a hearing period of ten business days to formulate any allegations and present any evidence it deems appropriate.
In its written statement, it must provide its Tax ID No. and the file number that appears in the heading of this document.

If it does not submit any allegations to this initiation agreement within the stipulated period, it may be considered a proposed resolution, as established in Article

64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP).

In accordance with the provisions of Article 85 of the LPACAP, in the event that the sanction to be imposed If the fine is imposed, the party may acknowledge liability within the

period granted for submitting allegations to this initiation agreement; this will entail a 20% reduction in the sanction to be imposed in this procedure, equivalent in this case to €1,000. With the application of this reduction, the sanction would be set at €4,000, and the procedure would be resolved with the imposition of this sanction.

Likewise, the party may, at any time prior to the resolution of this procedure, voluntarily pay the proposed sanction, which will entail a 20% reduction in the amount of the sanction, equivalent in this case to €1,000. With the application of this reduction, the sanction would be set at €4,000, and its payment will imply the termination of the procedure.

The reduction for voluntary payment of the sanction is cumulative with the reduction that must be applied for acknowledgment of liability, provided that this acknowledgment Liability is established within the period granted for submitting allegations at the opening of the procedure. Voluntary payment of the amount referred to in the previous paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the penalty would be set at €3,000 (three thousand euros).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/17

In any case, the effectiveness of either of the two aforementioned reductions will be conditioned upon the withdrawal or waiver of any administrative action or appeal against the penalty.

If the decision is made to voluntarily pay either of the amounts indicated above (€4,000 or €3,000), this must be made by depositing it into account No. ES00 0000 0000 0000 0000 0000 opened in the name of the

Spanish Data Protection Agency at Banco CAIXABANK, S.A., indicating
in the concept the reference number of the procedure listed in the
heading of this document and the reason for the reduction in the amount you are

receiving. You must also send proof of payment to the Subdirectorate General of
Inspection to continue the procedure in accordance with the amount

paid.

The procedure will last a maximum of nine months from the

date of the initiation agreement. After this period has elapsed without a resolution being issued and
notified, it will expire and, consequently, the proceedings will be closed; in accordance with the provisions of Article 43.2 of the LSSI.

Finally, please note that, in accordance with the provisions of Article 112.1 of the LPACAP,
there is no administrative appeal against this decision.

Lorenzo Cotino Hueso

President of the Spanish Data Protection Agency

>

SECOND: On July 9, 2025, EDICIONES CATÓLICOS proceeded to pay the fine in the amount of €3,000.00, using the two reductions provided for in the initiation agreement transcribed above, which implies acknowledgment of liability in relation to the events referred to in the initiation agreement and their legal classification.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/17

LEGAL BASIS

I
Jurisdiction

In accordance with the provisions of Article 43.1 of Law 34/2002, of July 11, on information society services and electronic commerce (hereinafter LSSI) and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure.

Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development, and, insofar as they do not contradict them, in a subsidiary manner, by the general rules on administrative procedures."

Finally, the Fourth Additional Provision "Procedure in relation to the powers conferred on the Spanish Data Protection Agency by other laws" establishes that: "The provisions of Title VIII and its implementing regulations shall apply to the procedures that the Spanish Data Protection Agency may process in the exercise of the powers conferred on it by other laws."

II
Termination of the Procedure

Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading "Termination of Sanctioning Procedures," provides the following:

"1. Once a sanctioning procedure has been initiated, if the offender acknowledges responsibility, the procedure may be terminated with the imposition of the appropriate sanction.

2. When the sanction is solely monetary in nature, or when one monetary sanction and another non-monetary sanction may be imposed, but the inadmissibility of the latter has been justified, voluntary payment by the alleged responsible party, at any time prior to the resolution, will entail the termination of the procedure, except with regard to restoring the altered situation or determining compensation for damages caused by the commission of the offense. Infraction.

3. In both cases, when the penalty is solely monetary in nature, the

body competent to resolve the procedure will apply reductions of at least 20% on the amount of the proposed penalty, which may be combined.
These reductions must be specified in the notification of initiation of the procedure, and their effectiveness will be conditional on the withdrawal or waiver of any administrative action or appeal against the penalty.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/17

The percentage reduction provided for in this section may be increased by regulation.

III
Voluntary Payment and Acknowledgment of Responsibility

In accordance with the provisions of the aforementioned Article 85 of the LPACAP (Spanish Civil Procedure Act), the notified initiation agreement provided information on the possibility of acknowledging responsibility and voluntarily paying the proposed penalty, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the penalty would be set at €3,000.00, and its payment would imply the termination of the procedure, without prejudice to the imposition of the corresponding measures.

Following notification of the aforementioned initiation agreement, EDICIONES CATÓLICOS has proceeded to acknowledge responsibility and voluntarily pay the penalty, availing itself of the two proposed reductions. In accordance with section 3 of Article 85 of the LPACAP (Spanish Civil Procedure Act), the effectiveness of the aforementioned reductions will be conditional on the withdrawal or waiver of any administrative action or appeal against the penalty.

It should be noted that, in accordance with the provisions of the LPACAP, as well as the Supreme Court's jurisprudence on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of their form of initiation. Similarly, Article 88 of the aforementioned law establishes that the resolution that concludes the procedure will decide all issues raised by the interested parties and any other issues arising from it.

Therefore, in accordance with applicable legislation and having assessed the criteria for graduating sanctions, the Presidency of the Spanish Data Protection Agency RESOLVES:

FIRST: TO DECLARE the commission of the violations and CONFIRM the sanctions determined in the operative section of the initiation agreement transcribed in this resolution.

The sum of the aforementioned amounts results in a total of €5,000.00.

After EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. has made prompt payment and acknowledged liability, pursuant to Article 85 of the LPACAP, the aforementioned total is reduced by 40%, resulting in the final amount of €3,000.00.

The effectiveness of the aforementioned reductions is subject, in all cases, to the withdrawal or waiver of any administrative action or appeal.

SECOND: DECLARE the termination of procedure EXP202414144, in accordance with the provisions of Article 85 of the LPACAP.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/17

THIRD: NOTIFY this resolution to EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.

FOURTH: In accordance with the provisions of Article 85 of the LPACAP (Spanish Civil Code), which conditions the reduction for voluntary payment and acknowledgment of liability on the withdrawal or waiver of any action or appeal in administrative proceedings, this resolution will become final in administrative proceedings and fully enforceable upon notification.

In accordance with the provisions of Article 50 of the LOPDGDD (Spanish Civil Code), this resolution will be made public once it becomes final in administrative proceedings.

Against this resolution, which ends the administrative proceedings as provided for in art. 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law.

However, pursuant to the provisions of Article 90.3.a) of the LPACAP, a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeaeps.gob.es/sede-electronica-web/], or through one of the other registries provided for in Article 16.4 of the aforementioned Law 39/2015, of October 1. They must also forward to the Agency the documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension. 936-080725
Lorenzo Cotino Hueso

President of the Spanish Data Protection Agency

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es