AEPD (Spain) - PS/00102/2021
From GDPRhub
| AEPD - PS/00102/2021 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 23.04.2021 |
| Fine: | 5000 EUR |
| Parties: | ASOCIACIÓN HAZTEOIR.ORG Asociación Arcopoli |
| National Case Number/Name: | PS/00102/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD decision (in ES) |
| Initial Contributor: | n/a |
The Spanish DPA fined a political association €5000 (reduced to €4000) for sharing a leaflet containing the names and pictures of three data subjects without their consent.
English Summary
Facts
The political activist association Hazte Oir shared a leaflet containing the names, surnames and images of three individuals that were giving sexual education lectures in schools, without their consent.
Subsequently, a LGBT-rights association lodged a complaint with the Spanish DPA, which launched an investigation. During this investigation, Hazte Oir withdrew the leaflets and distributed new ones without the names and pictures.
Holding
The Spanish DPA held that sharing the names, surnames and pictures of the individuals without their consent was a violation of Article 6 GDPR.
Because of that, they fined Hazte Oir €5000, with a possibility of a reduced fine of €3000 if the association made an early payment and recognized their responsibility. The association chose to make the early payment, but refused to recognize their responsibility. Therefore, the fine was only reduced to €4000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/8
Procedure No.: PS / 00102/2021
RESOLUTION OF TERMINATION OF THE PROCEDURE BY PAYMENT
VOLUNTARY
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following:
BACKGROUND
FIRST: On March 22, 2021, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure against the association
HAZTEOIR.ORG with NIF G83068403 which is transcribed below:
<<
Procedure number: PS / 00102/2021
926-240120
Of the procedure instructed by the Spanish Agency for Data Protection and
based on the following:
BACKGROUND
FIRST: The Arcopoli association (hereinafter, Arcopoli) dated November 11
of 2019 filed a claim with the Spanish Agency for Data Protection. The
The claim is directed against the HazteOir.Org association with NIF G83068403 (as
successive, Make yourself heard).
Arcopoli states that it is an association that defends people's rights
LGTB, files a claim against HazteOír because it has published a brochure against
of sexual education actions in schools, which on the second page
includes pictures and the names of three people, which they understand to be contrary to
the regulations on data protection.
Together with the claim they provide:
Brochure with the photos and names of the three people.
SECOND: In view of the facts denounced in the claim and the
documents provided by the claimant of the facts and documents of which he has
this Agency, the Subdirectorate General for Data Inspection, has come to know
proceeded to carry out preliminary investigation actions for the
clarification of the facts in question, by virtue of the powers of investigation
granted to the control authorities in article 57.1 of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter RGPD), and of
in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (hereinafter LOPDGDD).
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/8
As a result of the investigative actions carried out, it is verified that the
Responsible for the treatment is HazteOír.
Likewise, the following points are found:
The antecedents that appear are the following:
Admission file E / 11775/2019.
On December 13, 2019, the claim was transferred to Hazte Oír
requesting information on the facts.
On January 10, 2020, it is received at this Agency, with registration number,
001034/2020 brief of allegations sent by HazteOír stating that after
know the facts, the immediate withdrawal from circulation of the
brochures that are the subject of the complaint and the edition and re-publication of the same
editing the image and removing the reference to the names of the people whose
information is highlighted in the complaint, always as a sign of good faith on the part
of HazteOír and in the spirit of not bothering them.
Therefore, the data relating to the image (the photograph in question) and the data
identification (name and surname) related to the three people participating in
Sex education talks in schools have been modified in the
new brochure published by HazteOír.
Requested by this Agency a copy of the modified brochure referred to in the brief of
allegations to the transfer of the claim, dated July 20, 2020 received
at this Agency, with registration number 025514/2020, answering brief
stating that for the new brochure they have adopted the measure of eliminating
completely the photographs and names that have motivated this claim.
Attached to the letter, a copy of the new brochure in which the ends are checked
stated in their reply.
FOUNDATIONS OF LAW
I
By virtue of the powers that article 58.2 of the RGPD recognizes to each
control authority, and as established in articles 47 and 48 of the LOPDGDD,
the Director of the Spanish Data Protection Agency is competent to initiate
and to solve this procedure.
II
The defendant is charged with committing an offense for violation of the
Article 6 of the RGPD, "Legality of the treatment", which indicates in its section 1 the
cases in which the processing of third party data is considered lawful:
"1. The treatment will only be lawful if at least one of the following is met
terms:
a) the interested party gave their consent for the processing of their data
personal for one or more specific purposes;
b) the treatment is necessary for the performance of a contract in which the
interested is part or for the application at the request of this of measures
pre-contractual;
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/8
(…) "
III
Sections b), d) and i) of article 58.2 of the RGPD provide the following:
“2 Each supervisory authority shall have all the following powers
corrective measures listed below:
(…)
b) punish any person responsible or in charge of the treatment with
warning when the processing operations have infringed the provisions of
this Regulation; "
(...)
“D) order the person in charge of the treatment that the operations of
treatment comply with the provisions of this Regulation, where appropriate,
in a certain way and within a specified period; "
“I) impose an administrative fine in accordance with article 83, in addition or in
place of the measures mentioned in this section, depending on the circumstances
of each particular case; "
The offense is classified in Article 83.5 of the RGPD, which considers as such:
"5. Violations of the following provisions will be sanctioned, in accordance with
with section 2, with administrative fines of a maximum of EUR 20,000,000 or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for
the highest amount:
a) The basic principles for the treatment, including the conditions for the
consent in accordance with articles 5,6,7 and 9. "
Organic Law 3/2018, on Protection of Personal Data and Guarantee of
Digital Rights (LOPDGDD) in its article 72, under the heading "Infractions
considered very serious ”provides:
"1. Based on what is established in article 83.5 of the Regulation (E.U.)
2016/679 are considered very serious and will prescribe after three years the infractions that
suppose a substantial violation of the articles mentioned in that one and, in
in particular, the following:
(…)
a) The processing of personal data without the concurrence of any of the
conditions of legality of the treatment established in article 6 of the
Regulation (EU) 2016/679. "
IV
The documentation in the file provides evidence that the
HazteOír association, violated article 6.1 of the RGPD, since of the
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/8
actions carried out, it is clear that he processed the data without legitimacy to do so by
publish photos and names of three people from the Arcopoli association.
In this sense, HazteOír recognizes the facts and has proceeded in the new
brochure to completely remove the photographs and names that have motivated this
sanctioning procedure.
V
In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In this case, it is considered that the sanction to be imposed should be adjusted according to
with the following criteria established in article 83.2 of the RGPD:
As aggravating criteria:
- Basic personal identifiers are affected (names and
photographs of three people) (article 83.2 g).
As mitigating criteria:
- The degree of cooperation with the supervisory authority in order to remedy
to the infraction and mitigate the possible adverse effects of the infraction, (83.2 f).
The balance of the circumstances contemplated in article 83.2 of the RGPD,
with regard to the offense committed by violating the provisions of its article 6
allows setting a penalty of 5,000 euros, (five thousand euros).
Therefore, based on the foregoing, by the Director of the
Spanish Agency for Data Protection.
HE REMEMBERS:
START: SANCTIONING PROCEDURE for the HAZTEOIR.ORG ASSOCIATION
with NIF G83068403, for Infringement of article 6 of the RGPD regarding the treatment
of personal data, punishable in accordance with the provisions of art. 83.5 of the aforementioned
Regulation.
APPOINT: as Instructor to D. R.R.R., and secretary to Dª S.S.S., indicating that any-
Any of them may be challenged, where appropriate, in accordance with the provisions of art 23
and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LR-
JSP).
INCORPORATE: to the sanctioning file, for evidentiary purposes, the inter-
put by the claimant and its documentation, the documents obtained and generated
by the Subdirectorate General for Data Inspection during the investigation phase.
nes, all of them part of the present administrative file.
WHAT: for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1, on
Common Administrative Procedure of Public Administrations, the sanction that
that could correspond would be 5,000 euros (five thousand euros), without prejudice to what
Sulte of the instruction of the present file.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/8
NOTIFY: this agreement to initiate a sanctioning file to ASOCIACIÓN
HAZTEOIR.ORG with NIF G83068403, granting a hearing period of ten days
able to formulate the allegations and present the evidence that it considers
convenient.
If within the stipulated period it does not make allegations to this initiation agreement, the same
It may be considered a resolution proposal, as established in article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
the Public Administrations (hereinafter, LPACAP).
In accordance with the provisions of article 85 of the LPACAP, in the event that the
penalty to be imposed would be a fine, you may recognize your responsibility within the
term granted for the formulation of allegations to the present initiation agreement; it
which will entail a reduction of 20% of the penalty to be imposed in
the present procedure, equivalent in this case to 1,000 euros. With the app
of this reduction, the penalty would be set at 4,000 euros, resolving the
procedure with the imposition of this sanction.
In the same way, you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which
will mean a reduction of 20% of the amount thereof, equivalent in this case
to 1,000 euros. With the application of this reduction, the sanction would be established in
4,000 euros and its payment will imply the termination of the procedure.
The reduction for the voluntary payment of the penalty is cumulative to the corresponding
apply for the acknowledgment of responsibility, provided that this acknowledgment
of the responsibility is made manifest within the period granted to formulate
allegations at the opening of the procedure. The voluntary payment of the referred amount
in the preceding paragraph, it may be done at any time prior to the resolution. On
In this case, if both reductions should be applied, the amount of the penalty would be
established at 3,000 euros (three thousand euros).
In any case, the effectiveness of either of the two mentioned reductions will be
conditioned to the withdrawal or resignation of any action or remedy in
administrative against the sanction.
If you choose to proceed to the voluntary payment of any of the amounts
indicated above, you must make it effective by entering account no.
ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for
Data Protection at Banco CAIXABANK, S.A., indicating in the concept the
procedure reference number in the heading of this
document and the cause of reduction of the amount to which it is accepted.
Likewise, you must send the proof of admission to the Subdirectorate General of
Inspection to continue the procedure according to the quantity
entered.
The procedure will have a maximum duration of nine months from the date of
date of the initiation agreement or, where appropriate, the draft initiation agreement.
After this period, its expiration will occur and, consequently, the file of
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/8
performances; in accordance with the provisions of article 64 of the LOPDGDD. For
Lastly, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP,
There is no administrative appeal against this act.
Mar Spain Martí
Director of the Spanish Agency for Data Protection. >>
THIRD: The Initiation Agreement was notified on April 6, 2021. On April 15
of 2021, HazteOír has proceeded to pay the sanction in the amount of 4,000 euros
making use of the reduction provided in the Initiation Agreement, stating: “We have
applied the reduction for payment in voluntary period, but not the recognition of
guilt (because we don't recognize it) "
FOURTH: The payment made entails the waiver of any action or recourse in progress
against the sanction, in relation to the facts referred to in the
Initiation Agreement.
In view of all the actions, by the Spanish Agency for Data Protection
In this proceeding, the following are considered proven facts:
FACTS
FIRST: It appears that HazteOír has published a brochure against actions of
sex education in schools, which on the second page includes images and
the names of three people.
SECOND: HazteOír has proceeded to the immediate withdrawal of circulation of the brochures
object of claim and therefore, the data related to the image (the photograph in
question) and the identification data (name and surname) related to the three
people participating in sex education talks in schools have
have been modified in the new brochure published by HazteOír.
THIRD: It is noted in the new brochure that they have adopted the measure of eliminating
completely the photographs and names that have motivated this claim.
FOURTH: It is clear that the Initiation Agreement was notified on April 6, 2021, they proceeded
on April 15, 2021 to the payment of the sanction in the amount of 4,000 euros using
of the reduction foreseen in the Initiation Agreement, stating: “We have applied the
reduction for payment in voluntary period, but not the recognition of
guilt (because we don't recognize it) "
FIFTH: The payment made entails the waiver of any action or recourse in progress.
against the sanction, in relation to the facts referred to in the
Initiation Agreement.
FOUNDATIONS OF LAW
I
By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/8
The Spanish Data Protection Agency is competent to resolve this
process.
II
Article 85 of Law 39/2015, of October 1, on the Procedure
Common Administrative of Public Administrations (hereinafter LPACAP), under
The heading "Termination of sanctioning procedures" provides the following:
"1. Initiated a sanctioning procedure, if the offender acknowledges his
responsibility, the procedure may be resolved with the imposition of the sanction
that proceeds.
2. When the sanction is solely of a pecuniary nature or it fits
impose a pecuniary and a non-pecuniary sanction but it has been justified
the inadmissibility of the second, the voluntary payment by the presumed responsible, in
any time prior to the resolution, will imply the termination of the procedure,
except in relation to the replacement of the altered situation or to the determination of the
compensation for damages caused by the commission of the offense.
3. In both cases, when the penalty is solely of a pecuniary nature,
the competent body to resolve the procedure will apply reductions of, at
less, 20% on the amount of the proposed sanction, these being cumulative
each. The aforementioned reductions must be determined in the notification of
initiation of the procedure and its effectiveness will be conditional on the withdrawal or
waiver of any action or appeal in administrative proceedings against the sanction.
The percentage of reduction foreseen in this section may be increased
regulations. "
In accordance with the above, the Director of the Spanish Agency for the Protection of
Data RESOLVES:
FIRST: DECLARE the termination of procedure PS / 00102/2021, of
in accordance with the provisions of article 85 of the LPACAP.
SECOND: NOTIFY this resolution to ASOCIACIÓN HAZTEOIR.ORG with
NIF G83068403.
In accordance with the provisions of article 50 of the LOPDGDD, the
This Resolution will be made public once it has been notified to the interested parties.
Against this resolution, which puts an end to the administrative procedure according to
prescribed by art. 114.1.c) of Law 39/2015, of October 1, on the Procedure
Common Administrative of Public Administrations, interested parties may
file an administrative contentious appeal before the Contentious Chamber-
administrative authority of the National Court, in accordance with the provisions of article 25 and
in section 5 of the fourth additional provision of Law 29/1998, of July 13,
regulator of the Contentious-Administrative Jurisdiction, within a period of two months to
count from the day following the notification of this act, as provided in the
Article 46.1 of the aforementioned Law.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/8
Mar Spain Martí
Director of the Spanish Agency for Data Protection
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es
