| AEPD - PS/00473/2019 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5 GDPR Article 32 GDPR Art. 22 Ley de Servicios de la Sociedad de la Información y Comercio Electrónico (LSSI) |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 02.04.2020 |
| Published: | |
| Fine: | 1500 EUR |
| Parties: | n/a |
| National Case Number/Name: | PS/00473/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AgenciaEspañola de Protección de Datos (in ES) |
| Initial Contributor: | n/a |
The AEPD fined a controller for not providing its users with complete information regarding the use of cookies.
English Summary
Facts
The complainant highlights general non-compliance regarding processing. Just to take a couple of examples, in order to access the workstation, employees are not requested to use login credentials nor password are needed to unlock the screen. Employee can access all type of personal data regardless of their concrete tasks.
Moreover, the company's website does not provide an appropriate information regarding the use of cookies. The first pop-up banner does not inform about the existence of tracking cookies. The full cookie policy is also vague and does not provide a tool to uninstall cookies easily.
Dispute
The AEPD must assess whether or not the statements from the complainant are true. In particular if the processing is safeguarded with appropriate technical and organisational measures.
The Authority must also verify if the controller has respected the Spanish implementation of ePrivacy Directive (Ley 34/2002, Servicios de la Sociedad de la Información y ComercioElectrónico - LSSI). In particular if, under Article 22 LSSI, the controller has provided a clear and complete information on the use of cookies.
Holding
After thorough investigation, the AEPD considers that some statements in the complaint are not - or no longer - accurate.
For example, the controller has convincingly demonstrated that its personnel can now only access those data and resources required to carry out their tasks. Printed manuals and personal data are stored into locked filing cabinets and access to the office is only allowed to authorized personnel. Because of that, the AEPD decided to dismiss this part of the complaint.
The Authority then addresses the second point of the complaint.
According to the analysis, the pop-up notification (first layer) does not allow users to understand the use of cookies, as it happens, for instance, for phrases like “improve our services”. The Cookie Policy (second layer) does not describe which type of cookies is used or provide information regarding their sources (first or third-party). Also, it does not include any tool to manage cookies in a granular way. For these reasons, the Authority found a violation of Article 22(2) LSSI.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Page 1 1/12 936-031219 Procedure No.: PS / 00473/2019 RESOLUTION R / 00258/2020 OF TERMINATION OF THE PAYMENT PROCEDURE VOLUNTARY In the sanctioning procedure PS / 00473/2019, instructed by the Agency Spanish Data Protection to HAPPY FRIDAY, SL , given the complaint presented by AAA , and based on the following, BACKGROUND FIRST: On April 2, 2020, the Director of the Spanish Agency for Data Protection agreed to initiate sanctioning procedure to HAPPY FRIDAY, SL (hereinafter, the claimed), through the Agreement that is transcribed: << Procedure Nº: PS / 00473/2019 935-240719 PENALTY PROCEDURE STARTING AGREEMENT Of the actions carried out by the Spanish Agency for Data Protection before the entity, HAPPY FRIDAY, SL, with CIF: B54660980, owner of the website https://happvfridavhome.com , (hereinafter “the claimed entity”), by virtue of- nuncia presented by DAAA , (hereinafter “the claimant”) and based on the following: ACTS FIRST: On 05/10/19, you have entered this Agency, complaint filed by the claimant indicating, among others, the following: "In the company Happy Friday, SL, everything is being done wrong, regarding the treatment of personal data and others: -Works with personal folders shared on the server where all the files that each Save your daily work in your own personal folder. Folders accessible by any other user regardless of the department to which it corresponds, without no type of server authentication, no password or type of permissions. Anyone can access any document from another worker regardless of their profile, department or the sensitivity of the information from which concerned. No login credentials required, no password to lock screen etc. In addition, all computers use illegal software both at the level of operating system and applications, with the risk that this implies. And without the security of updates typically provided by software manufacturers. Processing thousands of customer data accessible to any of the 25 workers without any control. Well, in the management application (Eneboo) the start of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 2 12/12 session, but everyone can access any part of the application regardless of their role and department without any authentication or log of who has performed each action. I also consider that they are not acting according to current legislation regarding the processing of personal data: When entering the web https://happvfridavhome.com a pop-up opens requesting the subscription to the newsletter with an "I accept the Terms and Conditions", but it is not noticed Nor does it inform about the cookies they use and the tracking they carry out since accessing the Web. Nor is any consent requested for the collection of this information. Cookies that are already started on the cover without accepting them, nor have shown us their information. As you can see they don't indicate anything on the next page https://happvfridavhome.com/en/cookies You can navigate with full functionality on the web without having accepted any cookie policy, Privacy". SECOND: In view of the facts set forth in the claim and the documents contributed by the claimant, the General Sub-Directorate for Data Inspection proceeded to carry out actions for its clarification, under the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD). So, dated 07/12/19, an informative request is addressed to the claimed entity. THIRD: On 08/08/19, the requested entity sends this Agency written in who, among others, reports the following: “On the measures and regulations related to the identification and authentication of personnel authorized to access personal data. a) .- All users of the system are assigned an identifier and a password. The authentication system is based on a password environment under one system operating Microsoft Windows 10. The user enters his identifier (which identifies him as an authorized user to access) and your password (which authenticates you as the user river identified), which are verified on the computer itself, which recognizes it as system user, allowing access to directories, files and databases for the performance of their work. b) .- Passwords are one of the basic components of the security of the data, and must therefore be specially protected. As access keys to system, passwords must be strictly confidential and personal, and Any incident that compromises your confidentiality must be immediately communicated to the administrator and corrected in the shortest possible time. - The password file must be protected (in computerized format) they would be intelligible through the encryption system used by the system operational issue) and under the responsibility of the system administrator. - Passwords will be 13 alphanumeric characters, modified by the responsible for the file every 12 months. - The File Manager, or on his behalf the System Administrator in charge of the treatment, it will eliminate the passwords of the users that have unsubscribed from the organization. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 3 12/3 c) .- The staff will only access those data and resources that they need for the development. he of his functions. The person responsible for the file will establish mechanisms to avoid that a user can access resources other than those authorized in the following shape: - Different user profiles will be created in which they will be authorized / They will deny the different accesses to the allowed functions. - The staff will be informed of the applications, tools and documentation at which has access to perform its functions. - Only the person responsible for the file is authorized to grant, alter or cancel authorized access to data and resources. d) .- Annex II includes the updated users list with authorized access. do to each information system. Also, the type of authorized access is included for each of them. This list will be updated when necessary by modification. tions on the staff, by the person responsible for the file. - If there are personnel outside the person responsible for the file with access to the resources must be subject to the same conditions and security obligations than own staff. - Manual documents are located in locked cabinets at each station. work of authorized users. e) .- About the criteria for filing and storing information in ma- manual or non-automated. The archiving of the supports or documents will be carried out in accordance with the established criteria. blecidos by the person in charge of the file: The office has a work area made up of desks with computers and some locked metal filing cabinets, in those that manual documentation is kept, its content correctly identified and access only by authorized personnel. As long as the documents with personal data are not filed in the devices mentioned above, by working with them, people who are in charge of them must guard them and prevent in any way ment that it can be accessed by unauthorized persons. The office is located in an industrial warehouse. To access it you must call a external bell, enter with prior authorization, cross the nave and the bottom, going up some stairs, access to the second floor of the warehouse, where the management is located administrative office of the company. The security of the personal data of the Files not only supposes the confidentiality of them but also entails the integrity and availability of those data. To guarantee these two fundamental aspects of security, it is necessary to ary that there are backup and recovery processes that, in case of failure of the computer system, allow to recover and, where appropriate, reconstruct the data of the Fi- chero. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 4 4/12 - The person responsible for the File will be responsible for periodically obtaining a backup, for backup and recovery purposes in case of failure. - A backup is made daily on the Storage Device. (NAS) located in the company, as well as another parallel copy in another Device positive storage (NAS) located in a Ship used as warehouse- cen, inside a locked cabinet where only the Res- File manager and authorized person. With this current method that we have, the company guarantees an adequate level of security when in the processing of personal data. f) .- About Cookies. Regarding the measures adopted to provide clear and complete information on the use of Cookies, the purposes of the treatment of the data collected by them, and the procedure to obtain the consent of users about their installation In the browser, we inform you that since the launch of our WEB Yes, there is a notice to users at the bottom of the page, appearing I give an information and authorization sign for the use of Cookies framed in black on white letters that could accept or obtain more information, I am thus complying with our obligation. After having received this notification and after a Management meeting with the Computer department we have seen fit to improve our website by doing more Visible the section on Cookies, in order to have greater transparency for users who use our website. You can check it out at: https: //happyfridayhome.- com / ”. FOURTH: On 09/10/19, In view of the facts set forth in the information provided by the claimed entity, the General Sub-Directorate for Data Inspection proceeded to request additional information about, Security policies or in its to the following procedures: User authentication procedure; Procedures Access Control method; List of users with access to home information system training (Annex II) and Storage procedure and backup copies. FIFTH: On 10/10/19, the claimed entity remits to this Agency, written in which, among others, reports the following: a) .- All users are assigned an identifier and a password. The system Authentication is based on Microsoft Windows 10 operating system. The user enters his identifier (which identifies him as an authorized user) and his password (which authenticates you as the user), which are verified in the computer itself nador, which recognizes you as a user, allowing you to access directories, files, you and databases for the performance of your work. Passwords are 12 characters Alphanumeric racteres, modifying by the person in charge of the file every 12 months. The staff only access those data and resources that they need for the development of its functions. The person responsible for the File establishes mechanisms to prevent a user can access resources other than those authorized in the following way: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 5 12/5 - The different user profiles in which authorization is authorized have been drawn up. They will / deny the different accesses to the allowed functions. - The staff have been informed of the applications, tools and documents tion to which it has access to perform its functions. Exclusively the person in charge of the file is authorized to grant, alter or void authorized access to data and resources. Manual documents They are located in 2 locked cabinets, and are only accessed by authorized users. two. b) .- Storage of information in manual or non-automated files: The office has a work area made up of desks with a computer. res and some locked metal filing cabinets, in which the documentation is kept manual, correctly identified its content and access only by staff authorized for it. As long as the documents with personal data are not filed in the devices mentioned above, by working with them, people who are in charge of them must guard them and prevent in any way ment that it can be accessed by unauthorized persons. The office is located in an industrial warehouse. To access it you must call a external bell, enter with prior authorization, cross the nave and the bottom, going up some stairs, access to the second floor of the warehouse, where the management is located administrative office of the company. c) .- Storage of information in computer files. All files are located on the company server (SERVER 2019). Users are assigned an identifier and password. Access is through the PC of each user in Windows 10 environment with username and password and have access only to the files they use and for which they are duly authorized. d) .- Backups: The person responsible for the File is responsible for periodically obtaining a copy of file security. A daily backup is made to the Storage Device (NAS), located in the company, as well as another parallel copy in another device of storage (NAS) located in a Warehouse used as a warehouse, inside an Mario locked with a key where only the File Manager and person have access. authorized end. SIXTH: In view of the facts denounced, in accordance with the evidence of that is available, the Data Inspection of this Spanish Agency for the Protection of Data considers that the cookie policy that is made by the claimed entity, not C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 6 6/12 complies with the conditions imposed by current regulations, for which reason the opening ra of the present sanctioning procedure. FUNDAMENTALS OF LAW I Competition - About security measures: By virtue of the powers that art 58.2 of Regulation (EU) 2016/679, of European Parliament and of the Council, of 04/27/16, relative to the Protection of Individuals with regard to the Processing of Personal and Free Data Circulation of these Data (RGPD) recognizes each Control Authority and, according to the established in arts. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), The Director of the Spanish Agency for Data Protection is competent to initiate this procedure. Sections 1) and 2) of article 58 of the RGPD, list, respectively, the investigative and corrective powers that the supervisory authority may dispose to effect, mentioning in point 1.d), that of: “notify the person in charge or commission of the treatment of the alleged infractions of these Regulations ”and in 2.i), that of: “Impose an administrative fine pursuant to article 83, in addition to or instead of measures mentioned in this section, according to the circumstances of each case.". - About the Cookies Policy: In accordance with the provisions of art. 43.1, second paragraph, of the Law 34/2002, of July 11, on Services of the Information Society and Commerce Electronic (LSSI), is competent to initiate and resolve this Procedure Sanctioner, the Director of the Spanish Agency for Data Protection. II A) .- About security measures in computer systems: In the present case, the claimant denounces the lack of security measures, in the management of the existing computer system in the claimed company. However, from the information and documentation provided by the company, Several aspects emerge that must be taken into account: a) .- There is a work area made up of desks with computers and some locked metal filing cabinets, in which manual documentation is kept, correctly identified. b) .- Access is only allowed to authorized personnel. While the documents with personal data are not stored on the devices C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 7 12/7 mentioned above, by working with them, the people who are in charge of them are responsible for guarding them and preventing can be used by other unauthorized persons. c) .- The office is located in an industrial warehouse. To access it you must call an external bell, enter with authorization, cross the ship and access the second plant where the administrative management area of the company is located. d) .- About the storage of information in computer files: all Files are located on the company's server (SERVER 2019). The Users are assigned an identifier and password. Access is through the PC of each user in Windows 10 environment, with username and password. You only have access to files that are used and for which they are duly authorized. e) .- About backup copies: the person responsible for the file is in charge of periodically obtain a backup copy of the file. A copy of daily security on the storage device (NAS), located in the company, as well as another parallel copy on another storage device (NAS), located in another warehouse, inside a locked cabinet where you only have access the person responsible for the file and the authorized personnel. f) .- According to the person in charge, the company has made the adaptation to the new Regulation which includes a Security Document on Measures, Norms, Procedures, Rules and Security Standards, in which they are made explicit the measures and standards related to the identification and authentication of personnel with access to personal data based on a password system environment Windows 10. g) .- Regarding Access Control, the personnel only access those data and resources required for the development of its functions for which the responsible will establish mechanisms to prevent a user from accessing resources for those who do not have privileges based on the creation of different user profiles in which access to authorized functions will be authorized / denied. Talk about that staff will be informed of the applications, tools and documentation to the who has access to perform their functions. Annex II, sent to that Agency, includes an updated list of users, with access allowed to each system of information, as well as the type of access. Regarding the security of the entity's computer systems, indicate that the RGPD establishes a new data protection system based on the proactive responsibility. This means that they must be responsible for treatment which will establish the appropriate technical and organizational measures to guarantee an adequate level of security based on the risks detected in the Previous analysis. Therefore, the information and documentation provided by the entity claimed is not it follows that the security policy, implemented in their computer systems, contravene the guidelines set by the GDPR in this regard. III C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 8 12/8 B) .- About the Cookies Policy, and following the recommendations of the "Guide on Cookies ”published by the Spanish Agency for Data Protection, in November 2019, when entering the website https://happvfridavhome.com , the following features: a) On the initial page (first layer), there is a banner with the following legend: "We use our own and third party cookies to improve our services and show you advertising related to your preferences, by analyzing your browsing habits. You can get more information, or know how to change the settings, in our Cookies Policy. Press ACCEPT to confirm that you have read and accepted the information presented. After accepting, we will not show you this message again ” a) In the second layer, "Cookies Policy". If you access the "Policy of Cookies ”, information is provided on some aspects of cookies, such as what they are, the types of cookies that exist but are not given information on cookies, both own and third party, that are loaded when you browse the web or the time they will remain installed on the computer terminal. Nor is it possible, in this second layer, a mechanism that allow you to manage the installation of cookies in granular form and / or to reject all cookies. IV Thus, in the banner on cookies of the first layer, the information on the Cookies provided do not allow users to understand their purposes and the use that is it will give them since an unclear language is used, with phrases like “ (…) improve our services (…) ” without further information on this matter. In the second layer, which is accessed through the link, "Cookies Policy", there is no informs about the type of cookies used, whether they are their own or from third parties or the period of keeping them on the computer; whether or not it exists is not reported international data transfer or if there is profiling. I do not know includes a panel to manage cookies in a granular way or another that allows, in its case, reject all cookies. The page is only limited to offering information about tools that disable cookies and refer to the configuration of the browser for it. The exposed facts could suppose on the part of the entity demanded the commission of the violation of article 22.2 of the LSSI, according to which: “The providers of services may use data storage and recovery devices in terminal equipment of the recipients, provided that they have given their consent after clear and complete information has been provided to them on its use, in particular, for the purposes of data processing, with C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 9 12/9 pursuant to the provisions of Organic Law 15/1999, of December 13, on protection of personal data. When technically possible and effective, the recipient's consent to Accepting the data processing may be facilitated by using the parameters browser or other applications. The above will not prevent the possible storage or access of a technical nature for the sole purpose of transmitting a communication by an electronic communications network or, to the extent that it is strictly necessary, for the provision of a service of the company of the information expressly requested by the recipient ”. This Infringement is classified as mild in article 38.4 g) of the aforementioned Law, which considers as such: “Use data storage and recovery devices when the information had not been provided or the consent of the recipient of the service in the terms required by article 22.2. ", and may be sanctioned with a fine of up to € 30,000, in accordance with article 39 of the aforementioned LSSI. V After the evidence obtained in the preliminary investigation phase, and without prejudice to whatever results from the instruction, it is considered appropriate to graduate the sanction to impose in accordance with the following criteria established by art. 40 of the LSSI: - The existence of intentionality, an expression to be interpreted as equivalent to degree of guilt according to the Judgment of the National Hearing of 11/12/07 relapse in Resource no. 351/2006, corresponding to the entity denounced the determination of a system of Obtaining informed consent that is appropriate to the LSSI mandate. - Period of time during which the offense has been committed, as it is the claim May 2019, (section b). In accordance with these criteria, it is considered appropriate to impose on the entity claimed a penalty of 2,500 euros (two thousand five hundred euros), for the violation of the article 22.2 of the LSSI. Therefore, in accordance with the foregoing, by the Director of the Spanish Data Protection Agency, HE REMEMBERS: START: SANCTIONING PROCEDURE to the entity HAPPY FRIDAY, SL, with CIF: B54660980, owner of the website https://happvfridavhome.com , for Infringement of article 22.2) of the LSSI, punishable in accordance with the provisions of art. 39.1.c) and 40) of the aforementioned Law, regarding its Cookies Policy. NAME: as Instructor to DRRR, and Secretary, where appropriate, to Ms SSS , indi- Whereas any of them may be challenged, if applicable, in accordance with the provisions of cited in articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP). INCORPORATE: to the sanctioning file, for evidentiary purposes, the inter- put by the claimant and its documentation, the documents obtained and generated C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 10 12/10 by the General Sub-Directorate for Data Inspection during the investigation phase tions, all of them part of this administrative file. WHAT: for the purposes provided in art. 64.2 b) of law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations, the sanction that could correspond would be a fine of 2,500 euros for the violation of article 22.2 of the LSSI, without prejudice to what results from the instruction. REQUIRE: the entity HAPPY FRIDAY, SL, to take the appropriate measures to include in the web pages of your ownership, information about the cookies that are They install and a mechanism that enables or disables all cookies and another that enable granular cookies to manage preferences of the user. NOTIFY: this agreement to initiate sanctioning proceedings against the entity HAPPY FRIDAY, SL, granting you a hearing period of ten business days so that formulate the allegations and present the evidence that you consider appropriate. If, within the stipulated period, no allegations are made to this initial agreement, the same may be considered a resolution proposal, as established in the article 64.2.f) of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). In accordance with the provisions of article 85 of the LPACAP, in the event that the sanction to impose were a fine, you can recognize your responsibility within the zo granted for the formulation of allegations to this initial agreement; what will entail a reduction of 20% of the sanction to be imposed in the this procedure, equivalent in this case to 500 euros. With the application of this reduction, the sanction would be established at 2000 euros, resolving the transfer with the imposition of this sanction. In the same way, you may, at any time prior to the resolution of this procedure, carry out the voluntary payment of the proposed sanction, which means will give a reduction of 20% of the amount thereof, equivalent in this case to 500 euros. With the application of this reduction, the sanction would be established in 2000 euros and their payment will imply the termination of the procedure. The reduction for the voluntary payment of the sanction is cumulative to the one that corresponds apply for the acknowledgment of responsibility, provided that this acknowledgment of the responsibility is revealed within the term granted to formulate allegations to the opening of the procedure. Voluntary payment of the referred amount in the previous paragraph it may be done at any time prior to the resolution. In In this case, if both reductions were to apply, the amount of the sanction would be established at 1,500 euros (one thousand five hundred euros). In any case, the effectiveness of any of the two mentioned reductions will be conditioned to the withdrawal or resignation of any action or recourse through administrative against the sanction. If you choose to proceed to the voluntary payment of any of the amounts indicated C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 11 12/11 previously, you must make it effective by entering the account number ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for the Protection of Data in Banco CAIXABANK, SA, indicating in the concept the reference number cia of the procedure that appears in the heading of this document and the cause reduction of the amount to which it avails. Likewise, you must send the proof of income to the General Subdirectorate of Ins- request to continue with the procedure in accordance with the amount entered gives. The procedure will have a maximum duration of nine months from the date cha of the initiation agreement or, where appropriate, the draft initiation agreement. Elapsed this period will expire and, consequently, the filing of proceedings; of in accordance with the provisions of article 64 of the LOPDGDD. Finally, it was pointed out which in accordance with the provisions of article 112.1 of the LPACAP, against this act there is no administrative appeal. Sea Spain Martí Director of the Spanish Agency for Data Protection. >> SECOND : On June 15, 2020, the requested party has paid the sanction in the amount of 1500 euros making use of the two planned reductions in the Initiation Agreement transcribed above, which implies the recognition of the responsibility. THIRD : The payment made, within the period granted to make allegations to the opening of the procedure, implies the waiver of any action or recourse administrative against the sanction and the recognition of responsibility in relation to the facts referred to in the Home Agreement. FUNDAMENTALS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 of December, on Personal Data Protection and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation; infractions of article 48 of Law 9/2014, of May 9, General Telecommunications (hereinafter LGT), in accordance with the provisions of the article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the information and electronic commerce (hereinafter LSSI), as provided in the article 43.1 of said Law. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es Page 12 12/12 II Article 85 of Law 39/2015, of October 1, of the Administrative Procedure Common of Public Administrations (hereinafter, LPACAP), under the heading " Termination in sanctioning procedures " provides as follows: "one. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the sanction that proceed. 2. When the sanction is solely pecuniary or fits impose a pecuniary and a non-pecuniary sanction but it has been justified the inadmissibility of the second, the voluntary payment by the alleged responsible, in any time prior to the resolution, will imply the termination of the procedure, except with regard to the replacement of the altered situation or the determination of the compensation for the damages caused by the commission of the offense. 3. In both cases, when the sanction is solely pecuniary in nature, the competent body to resolve the procedure will apply reductions of, to less, 20% on the amount of the proposed sanction, these being cumulative each. The aforementioned reductions must be determined in the notification of initiation of the procedure and its effectiveness will be conditioned to the withdrawal or waiver of any action or administrative remedy against the sanction. The reduction percentage provided in this section may be increased by regulation. According to what was stated, the Director of the Spanish Agency for Data Protection RESOLVES : FIRST: DECLARE the termination of the procedure PS / 00473/2019 , of in accordance with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to HAPPY FRIDAY, SL . In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once the interested parties have been notified. Against this resolution, which ends the administrative route as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, of the Administrative Procedure Common of Public Administrations, interested parties may file an appeal administrative litigation before the Contentious-administrative Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within two months from day after notification of this act, as provided in article 46.1 of the referred Law. Sea Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es
