AEPD (Spain) - PS/00292/2019: Difference between revisions

From GDPRhub
No edit summary
 
(18 intermediate revisions by 4 users not shown)
Line 3: Line 3:
<!--Information about the DPA-->
<!--Information about the DPA-->
|Jurisdiction=Spain
|Jurisdiction=Spain
|DPA-BG-Color=
|DPA-BG-Color=#ffffff;
|DPAlogo=logoAT.png
|DPAlogo=logoES.jpg
|DPA_Abbrevation=AEPD
|DPA_Abbrevation=AEPD
|DPA_With_Country=AEPD (Spain)
|DPA_With_Country=AEPD (Spain)
Line 26: Line 26:
|Date_Decided=n/a
|Date_Decided=n/a
|Date_Published=10. 2.2020
|Date_Published=10. 2.2020
|Year=2018
|Year=2020
|Fine=None
|Fine=1.000
|Currency=
|Currency=


<!--Information about the applied law-->
<!--Information about the applied law-->
Line 72: Line 72:
|GDPR_Article_Link_20=
|GDPR_Article_Link_20=


|EU_Law_Name_1=Article 4 Directive 2002/58/EC
|Party_Name_1=Anoymous Vs. Anonymous
|EU_Law_Link_1=https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=DE
|EU_Law_Name_2=
|EU_Law_Link_2=
|EU_Law_Name_3=
|EU_Law_Link_3=
|EU_Law_Name_4=
|EU_Law_Link_4=
|EU_Law_Name_5=
|EU_Law_Link_5=
|EU_Law_Name_6=
|EU_Law_Link_6=
|EU_Law_Name_7=
|EU_Law_Link_7=
|EU_Law_Name_8=
|EU_Law_Link_8=
|EU_Law_Name_9=
|EU_Law_Link_9=
|EU_Law_Name_10=
|EU_Law_Link_10=
|EU_Law_Name_11=
|EU_Law_Link_11=
|EU_Law_Name_12=
|EU_Law_Link_12=
|EU_Law_Name_13=
|EU_Law_Link_13=
|EU_Law_Name_14=
|EU_Law_Link_14=
|EU_Law_Name_15=
|EU_Law_Link_15=
|EU_Law_Name_16=
|EU_Law_Link_16=
|EU_Law_Name_17=
|EU_Law_Link_17=
|EU_Law_Name_18=
|EU_Law_Link_18=
|EU_Law_Name_19=
|EU_Law_Link_19=
|EU_Law_Name_20=
|EU_Law_Link_20=
 
|National_Law_Name_1=§ 45 AVG
|National_Law_Link_1=https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&Artikel=&Paragraf=46&Anlage=&Uebergangsrecht=
|National_Law_Name_2=
|National_Law_Link_2=
|National_Law_Name_3=
|National_Law_Link_3=
|National_Law_Name_4=
|National_Law_Link_4=
|National_Law_Name_5=
|National_Law_Link_5=
|National_Law_Name_6=
|National_Law_Link_6=
|National_Law_Name_7=
|National_Law_Link_7=
|National_Law_Name_8=
|National_Law_Link_8=
|National_Law_Name_9=
|National_Law_Link_9=
|National_Law_Name_10=
|National_Law_Link_10=
|National_Law_Name_11=
|National_Law_Link_11=
|National_Law_Name_12=
|National_Law_Link_12=
|National_Law_Name_13=
|National_Law_Link_13=
|National_Law_Name_14=
|National_Law_Link_14=
|National_Law_Name_15=
|National_Law_Link_15=
|National_Law_Name_16=
|National_Law_Link_16=
|National_Law_Name_17=
|National_Law_Link_17=
|National_Law_Name_18=
|National_Law_Link_18=
|National_Law_Name_19=
|National_Law_Link_19=
|National_Law_Name_20=
|National_Law_Link_20=
 
|Party_Name_1=Anoymous
|Party_Link_1=
|Party_Link_1=
|Party_Name_2=
|Party_Name_2=
Line 164: Line 82:
|Party_Name_5=
|Party_Name_5=
|Party_Link_5=
|Party_Link_5=
<!--Information about a possible appeal-->
|Appeal_To_Body=BVwG (Austria)
|Appeal_To_Case_Number_Name=PS/00292/2019
|Appeal_To_Status=Rejected
|Appeal_To_Link=
|
}}
}}


The AEPD imposed a 1.000 € fine for a fake ad containing personal data in a website site aimed at offering services for adults, without the consent of the data subject.  
The AEPD imposed a 1.000 € fine for a false advertisement containing personal data in a website aimed at offering services for adults, without the consent of the data subject.  


==English Summary==
==English Summary==


===Facts===
===Facts===
A website containing aimed at offering services for adults published the picture, name, telephone number and a sexual related description of a citizen – the complainant -  as a contact person for the performance of those services without her consent. Followings the publication of her personal data on the website, the complainant received unsolicited phone calls from people who wanted to have sex with her. The complainant pointed it out that the pictures published had been obtained from her work intranet with an external IP address. Thus, she filed a complaint with the AEPD against the IP address owner which added her personal data on the website. Therefore, she complained that the advertiser who added the ad unlawfully processed her personal data and did not sue the service provider which removed the publication immediately.  
A website aimed at offering services for adults published the picture, name, telephone number and a sexual related description of a citizen – the complainant -  as a contact person for the performance of these services without her consent. Following the publication of her personal data on the website, the complainant received unsolicited phone calls from people who wished to have sex with her. The complainant pointed out that the pictures published had been obtained from her work intranet with an external IP address. Thus, she filed a complaint with the AEPD against the IP address' owner which added her personal data to the website. Therefore, she complained that the advertiser who created the false ad unlawfully processed her personal data and did not sue the service provider which removed the publication immediately.  


===Dispute===
===Dispute===
The AEPD had to pronounce itself on the legal basis of the processing of personal data – consent or performance of a contract – and had to decide which circumstances should be take into account for the administrative fine.  
The AEPD had to pronounce itself on the legal basis of the processing of personal data – the consent or the performance of a contract – and had to decide which circumstances should be taken into account for the administrative fine.  


===Holding===
===Holding===
The AEPD stated that it was clear from the procedure that the advertiser added a fake ad on the web portal, containing the personal data of the complainant without her consent. Thus, it considered that the personal data published on the website were not necessary for the performance of the contract between the advertiser and the website. Therefore, it concluded that the advertiser violated Article 5(1)(a) and 6(1)(b) GDPR.
The AEPD stated that it was clear from the procedure that the advertiser added a false ad on the web portal, containing the personal data of the complainant without her consent. Thus, the AEPD ruled that the personal data published on the website were not necessary for the performance of the contract between the advertiser and the website. Therefore, it has been concluded that the advertiser violated Articles 5(1)(a) and 6(1)(b) GDPR.   
In addition, the AEPD decided to impose a fine of 1.000 € in accordance with Article 83(5)(a) by taking into consideration that the action is intentional (Article 83(2)(b) GDPR), and that the personal data are sensitive (Article 83(2)(g) GDPR).   
 


In addition, the AEPD decided to impose a fine of 1.000 € in accordance with Article 83(5)(a) GDPR by taking into consideration that the action was intentional (Article 83(2)(b) GDPR), and that the personal data are sensitive (Article 83(2)(g) GDPR). 
==Comment==
==Comment==
''Share your comments here!''
''Share your comments here!''

Latest revision as of 14:26, 13 December 2023

AEPD - PS/00292/2019
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(a) GDPR
Article 6(1)(b) GDPR
Article 83(2)(b) GDPR
Article 83(2)(g) GDPR
Article 83(5)(a) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: n/a
Published: 10. 2.2020
Fine: 1.000 €
Parties: Anoymous Vs. Anonymous
National Case Number/Name: PS/00292/2019
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in es)
Initial Contributor: n/a

The AEPD imposed a 1.000 € fine for a false advertisement containing personal data in a website aimed at offering services for adults, without the consent of the data subject.

English Summary

Facts

A website aimed at offering services for adults published the picture, name, telephone number and a sexual related description of a citizen – the complainant - as a contact person for the performance of these services without her consent. Following the publication of her personal data on the website, the complainant received unsolicited phone calls from people who wished to have sex with her. The complainant pointed out that the pictures published had been obtained from her work intranet with an external IP address. Thus, she filed a complaint with the AEPD against the IP address' owner which added her personal data to the website. Therefore, she complained that the advertiser who created the false ad unlawfully processed her personal data and did not sue the service provider which removed the publication immediately.

Dispute

The AEPD had to pronounce itself on the legal basis of the processing of personal data – the consent or the performance of a contract – and had to decide which circumstances should be taken into account for the administrative fine.

Holding

The AEPD stated that it was clear from the procedure that the advertiser added a false ad on the web portal, containing the personal data of the complainant without her consent. Thus, the AEPD ruled that the personal data published on the website were not necessary for the performance of the contract between the advertiser and the website. Therefore, it has been concluded that the advertiser violated Articles 5(1)(a) and 6(1)(b) GDPR.

In addition, the AEPD decided to impose a fine of 1.000 € in accordance with Article 83(5)(a) GDPR by taking into consideration that the action was intentional (Article 83(2)(b) GDPR), and that the personal data are sensitive (Article 83(2)(g) GDPR).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the **Spanish** original. Please refer to the **Spanish** original for more details.

to be completed