AEPD (Spain) - PS/00065/2020

From GDPRhub
Revision as of 11:40, 27 January 2021 by Mh (talk | contribs)
AEPD - PS/00065/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 13 GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published: 20.01.2021
Fine: n/a
Parties: Ciegos Españoles Católicos Organizados (CECO)
National Case Number/Name: PS/00065/2020
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Spanish
Original Source: AEPD resolution (in ES)
Initial Contributor: Miguel Garrido de Vega

The Spanish Data Protection Agency (AEPD) imposed a warning on the blind catholic people association Ciegos Españoles Católicos Organizados (the defendant) for infringing Article 13 GDPR. The defendant used a form for the admission of new members that did not include all the relevant information required by the data protection legislation.

English Summary

Facts

The decision is the consequence of a complaint submitted by a Spanish citizen (the claimant), stating that the defendant used forms for the admission of new members that did not comply with the requirements by Article 13 GDPR; to that respect, the claimant attached a copy of such forms.

Dispute

The defendant answered to the first AEPD investigation requests stating that it had always made its best efforts to comply with the legislation, and it attached some information to such answer: the same forms already attached by the claimant, an enquiry to the legal team of the AEPD, internal communications on the irregularities detected regarding data protection, and a copy of the new form already signed by the claimant. The AEPD started the corresponding sanction procedure, and the defendant answered admitting that, although it is true that the last form did not include all the relevant points of Art. 13 GDPR, since the irregularities were detected, the defendant has made big efforts to solve the matter and comply with the legislation.

Holding

Thus, the AEPD understood that the defendant has infringed Article 13 of the GDPR, as its previous form did not provide new members with all the legal information. Consequently, after considering some circumstances [(i) the defendant had already amended the form to include all the necessary information; (ii), the defendant even admitted that such previous form was not compliant; and (iii) the new form includes a separate consent box for the data processing activity and the use of the image of the new members], the AEPD decided to impose a warning to the defendant.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.