AEPD (Spain) - PS/00438/2019

From GDPRhub
AEPD - PS/00438/2019
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 6(1)(a) GDPR
Article 8(1) GDPR
Article 13 GDPR
Article 7 LOPDGDD
Type: Investigation
Outcome: Violation Found
Published: 14.12.2020
Fine: 10000 EUR
Parties: n/a
National Case Number/Name: PS/00438/2019
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: n/a

The Spanish DPA (AEPD) imposed a fine of €10000 on the web page for a violation of Articles 13, 6(1)(a) and 8 GDPR as well as Article 7 of the Spanish Law on Personal Data Protection (LOPDGDD).

English Summary


The Spanish controller of the web page, informs on its website that a minimum age of 13 is required to subscribe to the company newsletter and, at the same time, also informs that the legal basis for the processing of personal data is consent (Article 6(1)(a) GDPR) given while registering to the newsletter. Article 8(1) GDPR establishes the age at which a minor can legally give consent at 16 and provides that Member States can set a lower age as long as it is not less than 13 years. Based on this article, the Spanish law on the protection of personal data (LOPDGDD), in its article 7, sets the age at 14 years.


Does providing incorrect information on the legal basis of the processing activity constitute a violation of Article 13 GDPR?


The Spanish DPA found that wrongly informing on the age required for a child's consent to be lawful, was a violation of article 13 GDPR in relation to articles 6(1)(a) and 8 GDPR and article 7 of Spanish Law LOPDGDD. For this reason, with the power conferred by article 58(2) GDPR, the Spanish DPA imposed a fine of €10000 aggravated by article 83(2)(b) GDPR (intentional or negligent character of the infringement) and article 83(2)(k) GDPR in relation with article 76(f) of Spanish Law LOPDGDD which refers to the affectation of the rights of minors. The Spanish DPA, with the power conferred by article 58(2)(d), also ordered the controller to delete the wrongful privacy policy from the website.


Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.