Editing AEPD - PS/00051/2020

From GDPRhub

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.

Latest revision Your text
Line 57: Line 57:
  
 
===Facts===
 
===Facts===
The complainant, a former affiliate to the political party, had fully unsubscribed from the political party and requested the erasure of all her personal data (even receiving a confirmation to that respect by the DPO of the controller). Notwithstanding that, she later received an email asking her about the possibility of acting as a party's representative in the Spanish general elections of November 2019. The complainant, therefore, assumes that her personal data had not been duly deleted. The controller answered to the first AEPD investigation stating that, as soon as the data subject sent the deletion request, her personal data were totally erased.
+
The complainant, a former affiliate to the political party, had fully unsubscribed from the political party and requested the erasure of all her personal data (even receiving a confirmation to that respect by the DPO of the controller). Notwithstanding that, she later received an email asking her about the possibility of acting as a party's representative in the Spanish general elections of November 2019. The complainant, therefore, assumes that her personal data had not been duly deleted.
 +
 
 +
The controller answered to the first AEPD investigation requests stating that, as soon as the former representative sent her deletion request, her personal data were totally erased (and it even attached a certificate by the president of VOX España declaring that the claimant was no longer a representative).
  
 
===Dispute===
 
===Dispute===
The Authority has to assess the lawfulness of the processing following the withdrawal of consent under Article 7(3) GDPR. The Authority also considers the existence of a deletion request under Article 17 GDPR.
+
According to the information available in the file, the controller has continued to process the complainant's personal data without her consent. The documentation provided to the file shows that the complainant hasArticle 6.1.a) of the RGPD has been violated, since it has carried out an illegal treatment ofthe data of the claimant when sending email 10/15/2019 without authorization orconsent to having previously requested their withdrawal from the party<br />
  
 
===Holding===
 
===Holding===
The AEPD concludes that VOX España has infringed the lawfulness principle as per Article 6(1)(a) GDPR.
+
Thus, the AEPD understood that VOX España has infringed the lawfulness principle included at Article 6(1)(a) GDPR, as it has processed the personal data of its former representative without her consent in order to send her a communication despite she had requested the full erasure of her data. Consequently, after considering some circumstances [(i) the local scope of the processing activity made by the defendant, (ii) only one person has been affected by the processing activity, (iii) there is no evidence that the defendant has adopted any measures in order to prevent such issues to happen again in the future, (iv) there is no evidence of wilful misconduct by the defendant, even being this issue a very serious breach of the law, (v) the link between the activity of the defendant and the processing of personal data, and (vi) the defendant is a national political party], the AEPD decided to impose a fine of 1,500 € to the defendant.
 
 
The controller has processed the personal data of its former representative without her consent and despite the fact that she had requested the full erasure of her data. Consequently, after considering some circumstances including, (1) the local scope of the processing activity made by the defendant, (2) only one person has been affected by the processing activity, (3) there is no evidence that the defendant has adopted any measures in order to prevent such issues to happen again in the future, (4) there is no evidence of wilful misconduct by the defendant, even being this issue a very serious breach of the law, (5) the link between the activity of the defendant and the processing of personal data, and (6) the defendant is a national political party, the AEPD decided to impose a fine of 1,500 € to the defendant.
 
  
 
==Comment==
 
==Comment==

Please note that all contributions to GDPRhub are considered to be released under the Creative Commons Attribution-NonCommercial-ShareAlike (see GDPRhub:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please answer the question that appears below (more info):

Cancel Editing help (opens in new window)

Template used on this page: