AEPD (Spain) - ps-0035-2025

AEPD - ps-0035-2025
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5(1)(f) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	24.05.2026
Decided:
Published:	28.09.2026
Fine:	160.0 EUR
Parties:	n/a
National Case Number/Name:	ps-0035-2025
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	bms

The DPA held that a landlord violated Article 5(1)(f) GDPR by disclosing a tenant’s personal data and alleged debts to the tenant’s workplace.

English Summary

Facts

The controller owned an apartment rented by the data subject, who had lived in the property since late 2021. Following a dispute concerning the tenancy and an alleged outstanding debt, the controller contacted the data subject about vacating the property.

On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct.

On 4 October 2023, the controller sent an email to several addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone numbers, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues.

On 6 October 2023, the controller sent another email to the workplace stating that it would cease further communications. The data subject lodged a complaint with the AEPD. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller.

Holding

The DPA held that the controller infringed Article 5(1)(f) GDPR.

The DPA considered that the information disclosed by the controller constituted personal data and that its communication to the data subject’s workplace amounted to processing under the GDPR. The controller determined the purposes and means of that processing and therefore acted as the controller.

The DPA found that the controller disclosed the data subject’s personal data to unauthorised third parties. In particular, information relating to the data subject’s identity, contact details, employment and alleged debts was communicated to colleagues at the data subject’s workplace. Such disclosure breached the principle of integrity and confidentiality under Article 5(1)(f) GDPR.

Taking into account the circumstances of the case, including the consequences for the data subject and the controller’s subsequent commitment to cease such communications, the DPA imposed a €200 administrative fine.

Before the final decision was issued, the controller voluntarily paid the proposed fine and benefited from the 20% reduction available under Spanish Administrative Law (39/2015). The amount payable was therefore reduced to €160. The DPA nevertheless formally declared the infringement and confirmed the €200 sanction before terminating the proceedings following the voluntary payment.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Case No.: EXP202403237


DECISION TO TERMINATE THE PROCEEDINGS DUE TO VOLUNTARY PAYMENT


Regarding the proceedings conducted by the Spanish Data Protection Agency and based
on the following

 BACKGROUND


FIRST: On November 23, 2025, the Presidency of the
Spanish Data Protection Agency agreed to initiate disciplinary proceedings against A.A.A.
(hereinafter, A.A.A.). Following notification of the decision to initiate proceedings, on April 30, 2026,

the proposed resolution set forth below was issued:

<<



Case No.: EXP202403237


       PROPOSED RESOLUTION IN DISCIPLINARY PROCEEDINGS


Regarding the proceedings conducted by the Spanish Data Protection Agency and based
on the following:

 BACKGROUND



FIRST: On May 24, 2024, a complaint was filed with the
Spanish Data Protection Agency regarding a possible violation attributable to A.A.A., with
Tax ID No. ***NIF.1 (hereinafter, A.A.A. or the respondent).


The facts brought to the attention of this authority are as follows:

The complainant states that they rented a residence owned by the
respondent and that, following disagreements, they chose to terminate the lease agreement.


The respondent is making a complaint and is demanding payment of a debt related to the rent and states that
it has disclosed information regarding this alleged delinquency to third parties,
having contacted the complainant via a third party’s WhatsApp account to demand
payment of the amount allegedly owed and receiving threats that the
situation would be disclosed in the claimant’s workplace.


Thus, on October 4, 2023, the defendant sent an email
addressed to ***POSITION.1, given that the plaintiff is (…), explaining the situation


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/13








of alleged delinquency and accusing them of criminal conduct, which was brought to their
attention by the institutional relations department at their workplace.


He notes that, subsequently, on October 6, 2023, the respondent sent
another email to his workplace, retracting its statements
regarding the complainant’s alleged criminal conduct.

Attached to his complaint are:


- A copy of the WhatsApp message received, which states, among other things, the following:
“(…).

(…) (…)”.


- Copies of the emails:

a. Email dated October 1, 2023, at 3:52 a.m.

“ (…)


(…).

(…)”.

b. Email dated October 4, 2023, at 2:26 a.m.


“(…)
(…)

(…),


(…) (…)

(…)

(…),


(…).

(…).


(…).

(…):
    -  (…).
    -  (…).

 -  (…).
    -  (…).

(…).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/13









(…)”.


c. Email dated October 6, 2023

“(…)

(…):
(…)”.


SECOND: Pursuant to Article 65.4 of Organic Law 3/2018, of December 5,
on data protection and the Guarantee of Digital Rights (hereinafter
hereinafter LOPDGDD), said complaint was forwarded to A.A.A. so that
it could analyze it and inform this Agency, within one month, of the

actions taken to comply with the requirements set forth in the
data protection regulations.

The forwarding of the complaint, which was carried out in accordance with the rules established in
Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter LPACAP), was not acknowledged by the data controller.


The first attempt to deliver the complaint was made on March 1, 2024, resulting in
“returned to sender due to missing address” on April 24, 2024, as certified by the
notice of non-delivery included in the case file.


The second attempt was made on April 26, 2024, resulting in “Returned to
Origin due to Incorrect Address on May 7, 2024,” according to the certification of
failure to deliver included in the file.

THIRD: On May 10, 2024, in accordance with Article 65 of the

LOPDGDD, the complaint was dismissed.

FOURTH: On May 24, 2024, the claimant filed an appeal
for reconsideration against the refusal to accept the complaint for processing, on the grounds that it seriously violated their
fundamental rights.


FIFTH: On September 10, 2024, a notice was sent to A.A.A.,
granting him a hearing regarding the appeal for reconsideration.

The first attempt to deliver the notice was made on October 7, 2024, resulting in
“returned to sender due to recipient not present” on October 10, 2024, as certified by

the notice of non-delivery on file.
No communication has been received from the respondent in this regard.

SIXTH: On January 29, 2025, the Director of the Spanish Data Protection Agency
upheld the appeal for reconsideration filed by the

complainant.

SEVENTH: On November 23, 2025, the Presidency of the
Spanish Data Protection Agency decided to initiate disciplinary proceedings against the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/13




complaint, in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1,
October, on the Common Administrative Procedure of Public Administrations
(hereinafter, LPACAP), for the alleged violation of Article 5.1.f) of the GDPR,

as defined in Article 83.5.a) of the GDPR.

EIGHTH: The notification of the decision to initiate proceedings was issued in accordance with the rules
set forth in the LPACAP; it was not accepted by the respondent and was returned to
the sender on December 29, 2025, with the acknowledgment of receipt noting “incorrect
address.”


Finally, the notice was published in the Official State Gazette (BOE) on January 7,
2026.

NINTH: A list of the documents on file in the

proceedings is attached as an appendix.

                                ESTABLISHED FACTS

FIRST: The plaintiff had a lease agreement with the
defendant, such that the plaintiff had been living in a property owned by

A.A.A. since late 2021.

SECOND: On October 1, 2023, from the email address ***EMAIL.1, the
plaintiff sent an email to the defendant and to (…) (corresponding to the
plaintiff’s workplace) setting a deadline for the defendant to vacate the

property and hand over the keys. In that email, the claimant stated that, if the defendant failed
to do so, the claimant would provide “a complete report of your fraudulent actions and criminal
conduct” to ***POSITION.1.

THIRD PARTY: On October 4, 2023, the defendant, from the

email address ***EMAIL.1, sent an email to the addresses (…), (…);
(…), corresponding to the defendant’s workplace, in which he referred
to an alleged situation of delinquency on the defendant’s part, identifying her by her
first and last names, as well as her identification number and job title. Furthermore,
the aforementioned email disclosed the defendant’s phone numbers, email address,
and information regarding her alleged debts to the claimant.


FOURTH: The email described in the preceding fact was read by coworkers
of the defendant, who forwarded its contents to the defendant on October 4,
2023.


FIFTH: On October 6, 2023, at 6:00 p.m., the respondent, from the
email address ***EMAIL.1, sent an email to the
addresses (…), (…) and (…) in which they undertook to “cease all
communications regarding this matter with you and with them.”



                           LEGAL GROUNDS



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/13








                                            I
 Jurisdiction


In accordance with the powers granted by Article 58(2) of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter GDPR) grants to each
supervisory authority, and as established in Articles 47, 48.1, 64.2, and 68.1 of
Organic Law 3/2018 of December 5 on the Protection of Personal Data and
the Guarantee of Digital Rights (hereinafter, LOPDGDD), the Presidency of the Spanish Data Protection Agency

has jurisdiction to initiate and resolve this proceeding.

Likewise, Article 63.2 of the LOPDGDD provides that: “The proceedings
handled by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, this Organic Law, the

adopted to implement it, and, to the extent they do not contradict them, on a
subsidiary basis, by the general rules on administrative proceedings.”

                                           II
 Preliminary Issues


Article 4(1) of the GDPR defines “personal data” as: “any information relating to an
identified or identifiable natural person (‘the data subject’); an identifiable natural person
shall mean any person whose identity can be determined, directly or
indirectly, in particular by reference to an identifier such as a name,
an identification number, location data, an online identifier, or one or

more factors specific to that person’s physical, physiological, genetic, mental,
economic, cultural, or social identity.” 

Article 4(2) of the GDPR defines “processing” as: “any operation or set
of operations performed on personal data or sets of personal data, whether

whether or not by automated means, such as collection, recording, organization,
structuring, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure, or destruction.”

Article 4(7) of the GDPR defines the “controller” or “data controller”

as: “the natural or legal person, public authority, agency, or other body which,
alone or jointly with others, determines the purposes and means of the processing; if Union law
Union or of the Member States determines the purposes and means of the processing, the
controller or the specific criteria for its appointment may be
established by Union or Member State law.” In turn, article

4.8) of the GDPR defines the “processor” or “data processor” as the
natural or legal person, public authority, agency, or other body that performs personal data
processing on behalf of the controller.

In the present case, in accordance with the provisions of Articles 4.1 and 4.2 of the GDPR,

it is established that personal data processing has taken place, since A.A.A.
carries out, among other processing activities, the collection and storage of the
complainant’s personal data, such as first and last name, date of birth, phone number, and
email address, among others.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/13









A.A.A. carries out this activity in its capacity as the controller, since
it is the entity that determines the purposes and means of such activity, pursuant to Article 4.7 of the

GDPR.

                                           III
 Breach of Obligation. Integrity and Confidentiality

Article 5.1(f) of the GDPR states:


“1. Personal data shall be:
(…)
(f) processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorized or unlawful processing and against

their accidental loss, destruction, or damage, through the implementation of appropriate technical
or organizational measures (“integrity and confidentiality”).”

In the present case, the complainant had a lease agreement with the
respondent, and as a result of some disagreements, the respondent
sent an email to the complainant on October 1, 2023,

informing it of its intention to report to ***POSITION.1 regarding alleged debts
of the claimant, since the respondent is (…).

On October 4, 2024, the respondent sent an email to the
addresses (…), (…); (…), (corresponding to the defendant’s

workplace) with the subject line “(…)”, in which it referred to the claimant’s alleged
delinquency, identifying the claimant by first and last name, as well as
ID number and job title. Furthermore, the aforementioned email disclosed the defendant’s
phone numbers, email address, and information regarding her
alleged debts to the claimant.


The email described in the preceding fact was read by coworkers
of the defendant, who forwarded its contents to her on October 4, 2023.

This action, in which certain data was disclosed to unauthorized third parties,
constitutes a breach by the respondent of the obligation to ensure the confidentiality of the

data.

Therefore, based on the evidence currently available
in this proposed resolution of the disciplinary proceeding, it is considered that the
known facts constitute a violation, attributable to A.A.A., for

violation of Article 5.1.f) of the GDPR, as transcribed above.

 IV
   Classification of the violation of Article 5.1.f) of the GDPR and determination for purposes of
 the statute of limitations


Article 83.5 of the GDPR defines a violation of the
following article as an administrative violation, which shall be punishable, in accordance with paragraph 2, by administrative fines
of up to 20,000,000 EUR or, in the case of an enterprise, of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/13








an amount equivalent to a maximum of 4% of the total annual
global turnover for the previous fiscal year, whichever is higher:


“a) the basic principles for processing, including the conditions for
consent pursuant to Articles 5, 6, 7, and 9;”

For its part, Article 71 of the LOPDGDD, titled “Infractions,” states that:

“Acts and conduct referred to in paragraphs 4,

5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are
contrary to this Organic Law, constitute violations.”

For the sole purpose of the statute of limitations, article 72.1 of the LOPDGDD
provides as follows:


“Pursuant to the provisions of Recital 83(5) of Regulation (EU) 2016/679,
infractions that constitute a substantial violation of the articles mentioned therein—and, in particular, the
following—are considered very serious and shall be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and safeguards

established in Article 5 of Regulation (EU) 2016/679.”

 VI
 Proposed Penalty


In order to determine the administrative fine to be imposed, the
provisions of Articles 83(1) and 83(2) of the GDPR must be observed, which state:

“1. Each supervisory authority shall ensure that the imposition of administrative fines
pursuant to this article for the infringements of this

Regulation referred to in paragraphs 4, 9, and 6 is, in each individual case,
effective, proportionate, and dissuasive.

2. Administrative fines shall be imposed, depending on the circumstances of each
individual case, in addition to or in lieu of the measures referred to in
Article 58(2)(a) through (h) and (j). When deciding whether to impose an administrative fine

and determining its amount in each individual case, due consideration shall be given to:
(a) the nature, gravity, and duration of the violation, taking into account the
nature, scope, or purpose of the processing operation in question, as well
as the number of data subjects affected and the extent of the damage they
have suffered;

(b) whether the infringement was intentional or due to negligence;
c) any measures taken by the controller or processor to
mitigate the harm suffered by the data subjects;
d) the degree of responsibility of the controller or processor,
taking into account the technical or organizational measures they have implemented pursuant to

Articles 25 and 32;
e) any prior infringements committed by the controller or processor;
f) the extent of cooperation with the supervisory authority to remedy the
infringement and mitigate its potential adverse effects;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/13








g) the categories of personal data affected by the violation;
h) how the supervisory authority became aware of the violation, in
particular whether the controller or processor reported the violation and, if so, to what

extent;
i) where the measures referred to in Article 58(2) have previously been ordered
against the controller or processor concerned in relation to the
same matter, compliance with those measures;
j) adherence to codes of conduct pursuant to Article 40 or to certification
mechanisms approved in accordance with Article 42; and

k) any other aggravating or mitigating factors applicable to the circumstances of the case,
such as the financial benefits obtained or the losses avoided, directly or
indirectly, through the violation.”

For its part, article 76 “Sanctions and Corrective Measures” of the LOPDGDD

provides:

“1. The sanctions provided for in Articles 83(4), (5), and (6) of Regulation
(EU) 2016/679 shall be applied taking into account the criteria for determining the level of the sanction
set forth in paragraph 2 of that article.


 2. In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679,
the following may also be taken into account:
 a) The ongoing nature of the violation.
b) The connection between the infringer’s activity and the processing of
personal data.

c) The profits obtained as a result of the commission of the infringement.
 d) The possibility that the data subject’s conduct may have contributed to the commission
of the infringement.
e) The existence of a merger by absorption occurring after the commission of the
infringement, which cannot be attributed to the absorbing entity.

f) The impact on the rights of minors.
 g) Appointing a data protection officer, even when not mandatory.
h) The voluntary submission by the controller or processor to
alternative dispute resolution mechanisms in cases where
disputes arise between them and any data subject.” 


In the present case, considering the seriousness of the possible violation, with
particular regard to the consequences it has had on the
complainant, a fine should be imposed, in addition to the adoption of
measures, if appropriate.


The fine imposed must be, in each individual case, effective, proportionate,
and dissuasive, in accordance with the provisions of Article 83(1) of the GDPR.

For the purposes of deciding on the imposition of an administrative fine and its amount, based
on the evidence currently available, it is

considered that the balance of the circumstances set forth in Article 83(2) of the
GDPR and Article 76.2 of the LOPDGDD (including the respondent’s commitment to cease
such communications, as stated in its email dated October 6, 2023), with


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/13




regarding the violation committed by breaching the provisions of Article 5(1)(f) of the
GDPR, allows for the imposition of an administrative fine of 200.00 euros.


In light of the foregoing, the following is hereby issued:

 PROPOSED RESOLUTION


That the Presidency of the Spanish Data Protection Agency impose a sanction on
A.A.A., with Tax ID No. ***NIF.1, for an infringement of Article 5.1.f) of the GDPR, as defined in
Article 83.5.a) of the GDPR, with a fine of 200 € (two hundred euros).

Furthermore, in accordance with the provisions of Article 85.2 of the LPACAP, the individual is

is hereby informed that he may, at any time prior to the resolution of this
proceeding, voluntarily pay the proposed penalty, which
will result in a 20% reduction of the amount thereof. With the application of this
reduction, the penalty would be set at 160 euros, and payment thereof will result in the
termination of the proceedings, without prejudice to the imposition of the

corresponding measures.   The   effectiveness   of this reduction is conditional upon     the
withdrawal or waiver of any administrative action or appeal against the
penalty.

To this end, if you choose to avail yourself of this reduction, you must submit to the

Subdirectorate General of Inspection a written notice of withdrawal
or waiver of any administrative action or appeal against the penalty.

If you choose to voluntarily pay the amount specified
above, in accordance with the provisions of the aforementioned Article 85.2, you must make the

by depositing it into the restricted account with IBAN: ES00-0000-0000-0000-
0001-0000 (BIC/SWIFT Code: CAIXESBBXXX) held in the name of the
Spanish Data Protection Agency at the bank CAIXABANK, S.A., indicating
in the payment description the reference number of the proceeding that appears in the
header of this document and the reason—voluntary payment—for the reduction of the

amount of the penalty. You must also send proof of payment to the
Subdirectorate General for Inspection para close the case.

Accordingly, you are hereby notified of the foregoing, and the procedure is set forth
so that, within TEN DAYS, you may present any arguments you deem appropriate in your defense and

submit any documents and information you deem relevant, in accordance with
Article 89.2 of the LPACAP.

 926-250625
B.B.B.
INSPECTOR/INVESTIGATOR




C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/13










                                       APPENDIX
Table of Contents for File EXP202403237

02/13/2024 Complaint
03/01/2024 Complaint forwarded to A.A.A.
04/26/2024 Complaint forwarded to A.A.A.
05/10/2024 Letter to A.A.A.
05/10/2024 Decision

05/24/2024 Motion for reconsideration
09/04/2024 Hearing with A.A.A.
09/10/2024 Second hearing with A.A.A.
09/10/2024 Third hearing with A.A.A.
January 21, 2025 Brief from (…)
January 29, 2025 Decision

November 25, 2025 Notice of Initiation to A.A.A.
01/07/2026 Notice of Commencement to STATE AGENCY OFFICIAL STATE GAZETTE
SINGLE NOTICE BOARD
01/08/2026 Brief


>>

SECOND: On May 19, 2026, A.A.A. paid the penalty
in the amount of 160.00 euros, taking advantage of the reduction provided for in the proposed
resolution transcribed above.



                           LEGAL GROUNDS

 I

 Jurisdiction

In accordance with the powers granted to each supervisory authority under Article 58(2) of Regulation (EU) 2016/679

(General Data Protection Regulation, hereinafter GDPR) grants to each
supervisory authority, and in accordance with Articles 47, 48.1, 64.2, and 68.1 of
Organic Law 3/2018, of December 5, on the Protection of Personal Data and
the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency
has jurisdiction to
resolve this proceeding.


Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings
handled by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, this Organic Law, the
adopted to implement it, and, to the extent they do not contradict them, on a

subsidiary basis, by the general rules on administrative proceedings.”

                                          II
 Conclusion of the proceeding



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/13








Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure
of Public Administrations (hereinafter “LPACAP”), under the heading
“Termination of Disciplinary Proceedings,” provides as follows:


“1. Once a disciplinary proceeding has been initiated, if the offender acknowledges liability,
the proceeding may be resolved by imposing the appropriate penalty.

2. When the penalty is solely of a pecuniary nature, or when it is appropriate to impose a
pecuniary penalty and another of a non-pecuniary nature but the

inappropriateness of the latter has been demonstrated, voluntary payment by the alleged offender, at
any time prior to the final decision, shall result in the termination of the proceedings,
except with respect to the restoration of the altered situation or the determination of
compensation for damages caused by the commission of the violation.


3. In both cases, when the penalty is solely financial in nature, the
body competent to resolve the proceeding shall apply reductions of at least
20% of the amount of the proposed penalty, which may be cumulative.
The aforementioned reductions must be specified in the notice of initiation
of the proceedings, and their effectiveness shall be conditional upon the withdrawal or waiver of
any administrative action or appeal against the penalty.


The reduction percentage provided for in this section may be increased
by regulation.”

                                           III

 Voluntary Payment

In accordance with the provisions of the aforementioned Article 85 of the LPACAP, the
notified proposed resolution allowed you to make a voluntary payment of the
proposed penalty, which would result in a 20% reduction of its amount. With the

application of this reduction, the penalty would be set at 160.00 euros, and its
payment would result in the termination of the proceedings, without prejudice to the imposition of the
corresponding measures.

Following the aforementioned proposed resolution, and before a decision was issued by
this authority, A.A.A., on May 19, 2026, proceeded to make the

voluntarily, taking advantage of the 20% reduction. In accordance with paragraph 3 of
article 85 of the LPACAP, the applicability of the aforementioned reduction is conditional upon
the withdrawal or waiver of any administrative action or appeal against the
penalty.


It should be noted that, in accordance with the provisions of the LPACAP, as well as
the case law of the Supreme Court on this matter, the voluntary payment
by the alleged offender does not exempt the administration from the obligation to
resolve and notify all proceedings, regardless of how they were
initiated. Similarly, Article 88 of the aforementioned law establishes that the decision

that brings the proceeding to a close shall rule on all issues raised by the
data subjects and any other issues arising therefrom.



C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/13




Therefore, in accordance with applicable law and after evaluating the criteria for
determining the severity of penalties, the Presidency of the Spanish Data Protection Agency
RESOLVES:


FIRST: TO DECLARE that the violations have been committed and TO CONFIRM the penalties
set forth in the operative part of the proposed resolution transcribed in the
present resolution.

The sum of the aforementioned amounts totals 200.00 euros.


Since A.A.A. has made a voluntary payment, albeit without acknowledging
liability, pursuant to Article 85 of the LPACAP, the total amount is reduced by
20%, resulting in a final amount of 160.00 euros. 


The effectiveness of the aforementioned reduction is contingent, in any case, upon the withdrawal
or waiver of any administrative action or appeal.

SECOND: TO DECLARE the termination of proceeding EXP202403237, in
accordance with the provisions of Article 85 of the LPACAP.


THIRD: TO NOTIFY A.A.A. of this decision.

FOURTH: In accordance with the provisions of Article 85 of the LPACAP, which makes
the reduction for voluntary payment conditional upon the withdrawal or waiver of any action or
administrative appeal, this resolution shall be final in administrative proceedings and

fully enforceable as of the date of its notification.

In accordance with the provisions of Article 50 of the LOPDGDD, this
resolution shall be made public. Publication shall take place once the resolution has been
notified to the data subjects.


This resolution, which brings the administrative proceedings to a close as provided for in
Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure
of Public Administrations, data subjects may file a
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National Court, in accordance with the provisions of Article 25 and paragraph 5 of

the fourth additional provision of Law 29/1998, of July 13, regulating the
Administrative Litigation Jurisdiction, within two months from the
day following notification of this decision, as provided in Article 46.1 of the
aforementioned Law.


However, in accordance with the provisions of Article 90.3(a) of the LPACAP, the
final administrative decision may be provisionally suspended if the data subject
expresses their intention to file a contentious-administrative appeal. If this is
the case, the data subject must formally notify the Agency of this fact in writing
to the Spanish Data Protection Agency, submitting it through the

Agency’s Electronic Registry [https://sedeaepd.gob.es/sede-electronica-web/], or
through any of the other registries provided for in Art 16.4 of the aforementioned Law
39/2015, of October 1. The data subject must also provide the Agency with documentation
proving that the contentious-administrative appeal has been effectively filed. If the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/13










Agency is not notified of the filing of the contentious-

administrative appeal within two months from the day following notification of
this decision, it will consider the precautionary suspension to have ended.

                                                                                          968-101025

Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency






























































C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es