AEPD - E/03379/2021
|AEPD - E/03379/2021|
|Relevant Law:||Article 13 GDPR|
Article 22 Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y Comercio Electrónico (LSSI)
|National Case Number/Name:||E/03379/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish Data Protection Authority (AEPD) considers that the websites that are not a "service provider" of an information society service do not fall under the obligation to ask for consent to use analytics cookies under Spanish legislation.
A data subject made a complaint to the Spanish DPA that the website of an Spanish political party (Podemos) did not comply with the requirement of asking for consent of the user of their website before using analytics cookies.
Does a website that does not fall under the definition of a service provider of an information society service need to comply with the requirements of the electronic commerce and information society services legislation?
The Spanish DPA analyzed the provisions of the Spanish legislation related to electronic commerce and information society services and concluded that only the websites that fall under the definition of "service provider" (with an economic activity) have to comply with the requirements of said legislation. It also concluded that given that the website of the political party Podemos is not a "service provider" in the meaning of the legislation, the complaint cannot be upheld.
Share your comments here!
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 Procedure Nº: E / 03379/2021 RESOLUTION OF ACTION FILE Of the actions carried out by the Spanish Agency for Data Protection and based on the following, FACTS FIRST: On 11/02/20, a letter submitted by D. A.A.A., (hereinafter, “the claimant”), indicating, among others, the following: “As of November 2, 2020, when accessing the public website of the political party PODEMOS (https://podemos.info/), analytical cookies are downloaded, without having given consent in this regard. The cookie banner that appears when accessing the web does not report the existence of analytical cookies or the property of this- tas. The banner does not allow the user to individually manage consent by category. cookie category or reject all of them to continue browsing without being downloaded. guen ”. SECOND: In view of the facts presented in the claim and the documents provided by the claimant, the SG of Data Inspection proceeded to carry out actions for its clarification, under the protection of the powers of investigation granted to the control authorities in article 57.1 of Regulation (EU) 2016/679 (GDPR). Thus, dated 12/04/20, an information request is addressed to training policy, “PODEMOS, PARTIDO POLÍTICO”, (claimed entity). THIRD: Based on the preliminary information that is available and when it is appreciated Rational indications of a possible violation of the regulations on protection tion of data, dated 03/03/21, the Director of the Spanish Agency for the Protection of Data, In accordance with article 65 of the LOPDGDD, it agreed to admit the complaint for processing submitted by the claimant. FOUNDATIONS OF LAW I The Director of the Spanish Agency is competent to resolve this Procedure of Data Protection, in accordance with the provisions of art. 43.1, paragraph second, of Law 34/2002, of July 11, on Services of the Society of the Information and Electronic Commerce (LSSI). II Article 22.2 of the aforementioned LSSI Law establishes that: 2. Service providers will be able to use data storage and retrieval devices on computers terminals of the recipients, provided that they have given their consent after clear and complete information has been provided to them on its use, in particular, on the purposes of data processing, with in accordance with the provisions of Organic Law 15/1999, of December 13, on Protection of Personal Data. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/6 Article 2 of the same law establishes: 1. This Law shall apply to the service providers of the information society established in Spain and to the services provided by them. The LSSI Annex defines: a) "Information society services" or "Services": any service normally provided for consideration, remotely, by way of electronically and at the individual request of the recipient. The concept of service of the The information society also includes unpaid services for their recipients, insofar as they constitute an economic activity for the service provider. ... c) "Service provider" or "provider": natural or legal person that provides an information society service. The report 0083/2014 of the Legal Office of the Agency in response to a consultation on the subjective scope of application of the LSSI in relation to regulation of information storage and retrieval devices notes: "It is proposed what is the subjective scope of application of this article 22.2 LSSI, basically questioning whether it applies only to the service providers of the information society or in the field of any communication service electronic devices that install cookies; and specifically if the consulting University can be considered a service provider of the information society. For an adequate hermeneutic of the article and for a systematic exposition, We start from the general systems of interpretation of norms that our right establishes that they are none other than those referred to in article 3.1 of the Code Civil: “The rules will be interpreted according to the proper meaning of their words, in relation to the context, the historical and legislative antecedents, and the social reality of the time in that have to be applied, attending fundamentally to the spirit and purpose ”. Thus, the criteria of literal interpretation are established (the proper sense of the words, which when sufficient should prevail since in claris non fit interpretatio); the systematic (the situation of the precept in the law, title and chapter of the herself); historical interpretation, including not only historical background, but also related norms from which the study proceeds; interpretation according to social reality; and the teleological interpretation of the norm, the spirit and purpose. Taking into account such criteria, the literal tenor and the systematic position of the precept. Article 22.2 LSSI appears within Title III of said standard, on commercial communications electronically. The rubric of the precept is "Rights of recipients of services"; and literally art. 22.2 begins defining who will be obliged by the standard, who will be able to use devices storage and recovery of data, speaking of "the providers of services". C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/6 These are, therefore, concepts of the LSSI, which all have a definition established in the standard itself: on the one hand, both the heading of the article as the literal wording of the article speaks of the addressee, who according to section d) of the Annex of the LSSI is the “natural or legal person who uses, whether or not for reasons professionals, a service of the information society. That is, we are not speaking of all kinds of users, but of recipients in the legal sense. For another On the other hand, the Annex of the LSSI defines in its section c) the service provider as the “Natural or legal person that provides a service of the company of the information". And by service of the information society, section a) understands "Any service normally provided for consideration, remotely, electronically and at the individual request of the recipient. The concept of service of the society of the information also includes unpaid services by their recipients, insofar as they constitute an economic activity for the provider of services". And it is that art. 1 LSSI, when identifying the object of the standard, indicates that “it is the object of the this Law regulating the legal regime of the services of the society of the information and contracting by electronic means… ”. And that is why article 2 determines the scope of application of the LSSI, in terms of the services offered and borrowed from those established in Spain or offered through an establishment in Spain, but always talking about service providers. That is, the LSSI is subjectively applied to service providers of the company of the information, not to any other subject. The concepts used by art. 22.2 LSSI, We reiterate, they are legal concepts, as they are “services of the society of the information "," service provider "and" recipient ", which are defined in the rule. Therefore, the criteria to determine whether a service or website is included within of the scope of application of the Law on Information Society Services is whether whether or not it constitutes an economic activity for its provider. All services that are offered in exchange for a price or consideration are, therefore, subject to the Law. However, the free nature of a service does not determine by itself that it is not is subject to the Law. There are many free services offered through Internet that represent an economic activity for their provider (such as sponsors' income) and, therefore, would be included within their scope of app. On the other hand, the activities that are not incardinable in the concept studied for not constituting an economic activity for the provider. Thus, article 22.2 has been integrated into the LSSI using concepts of said rule; and it is about legal concepts, not vulgar, that have a definition established in the law itself, which delimits them. Furthermore, the Explanatory Memorandum itself of the LSSI - already in its initial drafting, of course - it stated in section II that welcomes in said law “a broad concept of services of the information society, that includes, in addition to the contracting of goods and services electronically, the provision of information through said medium (such as that made by newspapers or magazines that can be found on the net), the intermediation activities related to to the provision of access to the network, to the transmission of data over networks of telecommunications, to the realization of temporary copy of the Internet pages requested by users, to the accommodation on the information servers themselves, C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/6 services or applications provided by others or the provision of instruments of search or links to other Internet sites, as well as any other service that is provided at the individual request of users (downloading of video files or audio ...), provided that it represents an economic activity for the provider. These services are offered by telecommunications operators, providers of access to the Internet, portals, search engines or any other subject that have an Internet site through which you can carry out any of the activities indicated, including electronic commerce ”. As we can see, the LSSI does not apply to all types of electronic communications, but only to the services of the information society; though your need arises from the extraordinary expansion of the Internet, its purpose is not to regulate communications but only the services of the information society (Titles II, III and VI) and especially electronic contracting (Title IV), together with the actions of cessation of protection of consumer interests (Title V). And it is that the subjective and objective scope of law 34/2002 coincides with that of the Directive that transposes: as stated in the Statement of Motives of the LSSI in its section I, the purpose of the LSSI is none other than "incorporation into the legal system Spanish law of Directive 2000/31 / EC ”(together with the partial incorporation of the Directive 98/27 / CE which is alien to the problem at hand). " The subjective scope of application of the LSSI has been delimited, it should be noted, regarding the nature of political parties, which are configured as an instrument of formation of the popular will, as established in article 6 of the Constitution Española, which establishes the following: “Political parties express political pluralism, attend the formation and manifestation of the popular will and are a fundamental instrument for political participation. Its creation and the exercise of its activity are free within the respect for the Constitution and the law. Its internal structure and operation must be democratic. " To which must be added what the Constitutional Court has indicated, in the Legal Basis of its Judgment 48/2003, which considers that the parties politicians are empowered to exercise the right to freedom of information, In order to configure said public opinion, said sentence being of the following tenor: (On the political parties) “These are, therefore, associations qualified by the constitutional relevance of its functions; functions that are summarized in his vocation to integrate, mediate or immediately, the titular bodies of public power through electoral processes. (…) The parties are thus legal institutions. policies, an element of communication between the social and the legal that makes the integration between rulers and ruled, ideal of the democratic system. By shaping and expressing the popular will, the parties contribute to reality of the political participation of citizens in public affairs (art. 23 CE) ... " And he continues by saying: “Their functional qualification does not detract from the associative nature which is at the base of the parties, but raises an institutional reality above it diverse and autonomous that, as an instrument for political participation in C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/6 processes of shaping the will of the State, justifies the existence of a normative regime that is also its own, taking into account the specificity of these functions. The constitutional relevance of the parties is given by claiming a qualified purpose of public interest and whose aspiration the State uses to provide the integration of the procedures for the formation of the general will ... " III Of the actions carried out by the inspection services of this Agency, it has been verified that the claimed web page constitutes the institutional portal of a party political and that its content is related to the exercise of the functions that are its own and that have already been described in the previous paragraphs, which can be concluded that the activity of the denounced portal does not qualify the political party in question as an information society service provider. Additionally, this criterion coincides with that established by the Secretary of State for Telecommunications and for the Information Society as the competent body in the application of the provisions of the LSSI, with the due exceptions, such as establishes article 43 of the same law From the foregoing, it is not possible to incardinate the political parties, with respect to the activity developed through its institutional website, as Providers of Information Society Services and, therefore, these organizations are not They are under the scope of the aforementioned standard. Therefore, in accordance with the foregoing, by the Director of the Spanish Agency ñola of Data Protection. HE REMEMBERS: FIRST: PROCEED WITH THE FILING of these actions. SECOND: NOTIFY this resolution to PODEMOS, POLITICAL PARTY and to D.A.A.A .. In accordance with the provisions of article 50 of the LOPDGDD, this Re- solution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, and in accordance with the provisions of the arts. 112 and 123 of the aforementioned Law 39/2015, of October 1, interested parties may inter- place, optionally, an appeal for reconsideration before the Director of the Spanish Agency Data Protection Policy within a month from the day after the notification of this resolution or directly administrative contentious appeal before the Contentious-Administrative Chamber of the National Court, in accordance with set out in article 25 and in section 5 of the fourth additional provision of the Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, in the period of two months from the day following notification of this act, according to the provisions of article 46.1 of the aforementioned Law. Mar Spain Martí Director of the Spanish Agency for Data Protection. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/6 C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es