AEPD - PS/00070/2020
|AEPD - PS/00070/2020|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 6(1)(f) GDPR
Article 58(2)(b) GDPR
|National Case Number/Name:||PS/00070/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) held that publishing an unredacted copy of a local court judgment on Facebook breached Article 5(1)(a) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
The respondent published on his personal Facebook page an unredacted copy of a judgment from a local court case in which he was a co-defendant in his capacity as Mayor. The claimant, an employee of the Mayor’s Municipality, was also a party in the case, and could be identified from the personal information featured in the judgment published.
Dispute[edit | edit source]
Did the publication of the judgment breach the GDPR?
Holding[edit | edit source]
The AEPD held that the respondent’s actions violated the GDPR Article 5(1)(a) requirement that processing must be lawful, fair and done in a transparent manner, because “no lawful basis was accredited to the processing”. They also stated that the claimant had a right for data associated with the development of his job to not to be used in a surprising manner nor on social networks. (Part III Fundamentos de Derecho).
The AEPD rejected the respondent’s claim that the processing was based on the lawful basis of legitimate interest under Article 6(1)(f), as the processing of the claimant’s data was unnecessary since it could have been redacted before publishing the judgment. For this reason the respondent also failed the legitimate interest balancing test, with the “lasting effect” of the processing on the claimant overriding the respondent’s entitlement to process the personal data. (Part IV Fundamentos de Derecho).
Finally, the AEPD issued the respondent with a reprimand, citing GDPR Recital 148, where it states that “if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.” (Part V Fundamentos de Derecho).
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/14 Procedure Nº: PS / 00070/2020 938-300320 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on the following BACKGROUND FIRST: A.A.A. (hereinafter, the claimant) on 09/19/2018 filed claim before the Spanish Data Protection Agency against B.B.B. (in forward, the claimed). The reasons on which the claim is based are that the claimed performs the functions of Mayor of *** LOCALIDAD.1, and in his condition of such, was co-defendant along with the City Council in a procedure in the Social Court. The defendant has exposed the *** DATE.1 on his page of FACEBOOK the sentence integrates with all personal data and the rest of the circumstances associated with the matter, being able to access it any person. Provides printing of the FACEBOOK page of the claimed in which Some comments stand out and the full sentence is attached. In the sentence the claimant is a plaintiff against the City Council and the defendant, as Mayor of the municipality. SECOND: After processing the claim to the CITY COUNCIL OF *** LOCALITY. 1 (Mayor) in the sanctioning procedure (PS / 00430/2018), on 02/04/2020, was issued resolution of the director of the AEPD, agreeing: “DECLARE, in accordance with the provisions of article 90.1 of the LPCAP the non-existence of liability for the CITY COUNCIL OF *** LOCALIDAD.1 (MAYOR) in the alleged infraction of the Article 6.1.f) of the RGPD. " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/14 In its foundation of law III it was indicated: “The making available through the FACEBOOK platform of the sentence cia integra containing personal data of the claimant, a colleague of this and the circumstances surrounding the case, visible to anyone, regardless of zeros, implies the imputation to the CITY COUNCIL OF *** LOCALIDAD.1 of an infraction tion of article 6.1, f) of the RGPD for data processing through an au- tomatizado, which through the social network allows adding or uploading documents, such as the judgment. It is observed that without the intermediation of the platform of the social network, no If it had been possible to access and know the data that appeared in the sentence Inc. The City Council is the owner of files that contain personal data among others those related to the development of labor relations. However, in this case, it does not appear that the City Council had intervened in any way in the setting of means or purposes of the treatment nor can it be said that The mayor will act officially as spokesperson or person in charge of the treatment of that but rather that the Mayor as the holder of the sentence document, in a private environment As was his FACEBOOK page, he fully exposed the sentence. Although it did to respond to the claims of the claimant, who did not mention ex- The name of the Mayor was expressly displayed on the B.B.B. website, and not on the of the townhall. The treatments carried out by the City Council and the natural persons who act within it according to the instructions imparted, of which even belonging to its structure they treat the same margin of the instructions given or for their own benefit. Although on the page of FACEBOOK in which the sentence was exposed indicated his status as Mayor, it is proper to the Mayor, not as such a condition, but in a private capacity. In this case, the responsibility for the use of the same is of said natural person as responsible for the treatment, not the City Council. Article 28 of Law 40/2015, of 1/10, on the legal regime of the public sector co states: "1. They can only be sanctioned for acts constituting an infringement administrative natural and legal persons, as well as, when a law Recognize the capacity to act, the affected groups, the unions and entities without legal personality and independent or autonomous patrimonies, which are responsible for them by way of fraud or fault. " The conduct that consists of referring, in a social network, web page created and fed by B.B.B., personal data should be considered treatment of data, which according to technical and computer procedures involve performing the operations necessary to make your content accessible to people that are connected to the Internet, through the FACEBOOK platform, these being operations carried out, in an automated way. Since the principles of the field of criminal law are applicable, with certain tices, in the administrative sanctioning field, and according to the proven facts, leaving further admitted by B.B.B. who presented the sentence as a defense to the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/14 attacks that contained the claims of the claimant, it is not possible to impute the infraction to the City Council and declare that it has committed the same. Given that the events that gave rise to the claim take place on 09/12/2018, and due to their seriousness, they are not prescribed, so we will proceed to initiate lie against the person of B.B.B .. " THIRD: As actions within the claim that motivated the PS / 00430/2018 that are incorporated herein, included: “In view of the facts and the documents provided by the claimant, when claimed, a copy of the claim is sent through the AEPD, so that send: 1. Copy of the communications and the adopted decision that has been sent to the claimant regarding the transfer of this claim. 2 Report on the causes that have motivated the incidence that has originated the claim. 3. Report on the measures adopted to prevent incidents from occurring Similar. On 11/23/2018, the CITY COUNCIL states in its response with signature of the Mayor, B.B.B., the claimed one, indicating: 1) The claimant provides services for the City Council and has filed a decision sends before the Social Court requesting the termination of his employment contract under derived from article 50 of the Workers' Statute, due to workplace harassment, and repeated breaches of the City Council, requesting a compensation of € 50,000 for moral damages. The content of the sentence reveals the vicissitudes in the claimant's relationships with a partner and other personal circumstances of the claimant in the provision of services such as moving to another plant and reassigning tasks between employees. The defendant states that the day after the sentence is notified, 09/12/2018, the claimant on his FACEBOOK wall published a message from that a copy is provided in which it begins “it is sad to have to go to trial to that two days before it, the defendant does what he should have done- five months earlier, which has largely led to the demand being dismissed. I already knew when I filed the claim the difficulty of proving a situation of harassment at work, especially in a public administration but if I had not gone to court, possibly this matter would be involved in an unresolved drawer, and my personal and professional dignity questioned by written, which in no way can he admit ... It has been made clear that my behavior as an employee and co-worker has been correct ”. He is grateful for the neighborhood support and ends by stating that he is going to present himself at the next elections. In view of these comments, the respondent states: to. He presented the sentence before the claimant's intention to misrepresent the content and failure of the same that was unfavorable. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/14 In the same social network FACEBOOK made a statement in which begins by stating that “a person linked to the City Council is trying to manipulate local public opinion with falsehoods and half truths with relation to a labor matter. Said person filed a labor lawsuit against the City Council and against me on 06/22 ”, refers to the name and surname two, which are contained in the ruling of the sentence, and points out that because it is illustrative goes and “to prove the facts more than the malicious manifestations without any proof ”“ I accompany in this message the sentence integrates ”by understanding der that it indicates that there is no indication of professional injury or attack on your dignity. Together with these comments, the sentence ex- put, of which provides a full copy. It states in it that there is legitimacy for it derived from the ar- Section 6.1. c) and 6.1.e) and at the individual level 6.1.f) of the RGPD due to the serious sations that it poured in its demand and of the 69 and 70 bis 3 of the LBRL. b. It adds that the publicity of personal data, such as the situation The claimant's occupational and health status have been disclosed by the claimant himself complaining to many residents of the Council considering that it rules out the event tual illegality of the treatment object of the claim. c. In addition, there was a clear public interest as shown by the fact that submitted signatures of citizens in support or in the interests of the claimant (Provide copies of them). 2) From the reading of the judgment of 09/11/2018, it is clear, among others elements: - Lawsuit is filed against the City Council and D. B.B.B. as defendant, in the sentence they also refer to this as Mayor. - In proven facts, a colleague from the rector's work is identified clamoring and details the situation of conflict and tension between the two, the harassment and harassment that the employee claims to suffer and the request for measures to sell the situation that the claimant made to the City Council. The actions of the Mayor bringing together complaints from both employees, the reassignment of tasks and relocation to the second floor of the plaintiff, and the interviews. The status of the applicant in IT situation is mentioned from 03/23/2018 "due to anxiety disorder, which continues". It contains the Mayor's agreement of 04/12/2018 for the reassignment of tasks. - On the basis of law, the judge indicates that the plaintiff intends to of the termination of the contract based on workplace harassment. Enter to assess happiness question. - On legal grounds it is indicated that “there is no existence of any decisive indication of any situation of harassment, persecution degradation or attack on the personal and labor dignity of the plaintiff ”” or “The Mayor here sued as the author of the persecution that the plaintiff denounces, after the briefs presented by the parties on 25 and C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/14 01/30 met with them ... it is indicated that the Mayor intended to try solve the confrontation ”. The claim is dismissed. 3) Provide a copy of the document delivered to the claimant on 11/22/2018 in the which details explanations of the reasons for which the judgment is dismissed. I send the request that he makes to the AEPD. " Likewise, in PROVEN FACTS of PS / 00430/2018, there were: 1) “The claimant, labor employee, administrative assistant of the City Council of *** LOCALIDAD.1 filed on 06/25/2018 a lawsuit before the Social Court against D. B.B.B. and the City Council of *** LOCALIDAD.1 requesting the termination of the labor relationship for violation of their rights and compensation of 50 thousand euros for damages. The lawsuit ended with a ruling dated 09/11/2018. In the sentence reference is made to D. B.B.B. as Mayor, Chief of Staff and his resolutions dictated. The lawsuit “dismisses the one presented by the claimant, acquitting the defendants of the claims made against them ”. 2) The sentence assesses the alleged workplace harassment by the claimant, the bad relations with a partner of the claimant, who is identified by names and surname two, writings presented by her to the Mayor referring to the work environment with the claimant, the claimant's change of plant as a result of a meeting of the Mayor with the parties on 02/02/2018. The judgment determines that there is no evidence of any decisive indication of any situation of harassment, persecution, Damage or attack on the personal and labor dignity of the plaintiff "To the Mayor, here defendant as the author of the persecution that the plaintiff denounces… .meet with them ... and that the plaintiff stated that he did not want to be on the ground floor, so much does not explain what type of retaliation that is when you are acceding to what the actor himself requested “there is not the slightest indication that there has been a Mayor's conduct aimed at persecuting or harming the complainant, rather everything contrary." In the ninth proven fact, it is indicated that the plaintiff “went to the situation tion of TI due to anxiety disorder on 03/23/2018, in which it continues ”. 3) The claimant exhibited on his FACEBOOK page, associated with his name and surnames a message on 09/12/2018 at 18:21 indicated "Today is a great day" in which states that “It is sad to go to trial so that two days before the trial the defendant do what you should have done 5 months earlier, which has largely motivated that the claim be dismissed ”, without explaining what it refers to, it continues by stating that “he knew that when he filed the lawsuit it would be difficult for him to prove the harassment in the work ", which" is clear that his behavior as an employee and colleague has been correct ”, that“ he has been working as a public employee for 18 months ”, thanks the neighborhood support received and announces that he is going to enter politics ”. 4) After seeing the complainant, Mayor of *** LOCALIDAD.1, the announcement of the complainant on the same social network FACEBOOK, on a page with the name B.B.B., without any reference to the City Council, he presented a written reply entitled “CO- OFFICIAL MUNICATE ”stating that“ some people linked to the City Council They are trying to manipulate public opinion with falsehoods and half truths. lime in relation to a labor issue that should never have left the walls of the consistory ”. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/14 He indicates that said person filed his claim on 06/22/2018 against him and the City Hall, accusing him of workplace harassment and asking for compensation. Appoint the verbatim of the judgment with the name of the claimant. He states that in the face of the demonstrations malicious intent, exposes the entire sentence. Add to your writing with your name and surnames, the position of Mayor of *** LOCALIDAD.1 4) The defendant states that he removed the sentence during the processing of the This procedure, upon receipt of the initiation agreement. " FOURTH: On 03/9/2020, the director of the AEPD agreed: "INITIATE SANCTIONING PROCEDURE of APERCIBIMENTO to B.B.B., for the alleged violation of article 5.1.a) of the RGPD, in accordance with article 83.5.a) and 58.2.b) and d) of the aforementioned RGPD. " FIFTH: On 06/12/2020, the defendant presents the following allegations: -The exposure occurred due to the serious accusations of workplace harassment, non-compliance- repeated coughs of the City Council, violation of fundamental rights contained in the lawsuit and also in view of the misrepresentation of the content of the The claim that the complainant stated in his letter on the social network Facebook on 09/12. It considers that there is a legitimate interest of the Mayor to publish the sentence that the non-existence of such allegations. -The total and complete exposition of the sentence is also justified, in terms of the data storage by: - article 6.1. c) of the RGPD since it is a legal competence and obligation to inform the neighbors by local Corporations, which is provided for in the law on the basis of the moan local. -Article 6.1 f) of the RGPD, when the legitimate interest of the person in charge concur. Indicates that The claims of the claimant affected his honor and his own image and rights. fundamental reasons and that in view of the very serious allegations, the disclosure of the judgment must prevail over the claimant's right to data protection. -It states that once the electoral process held in May 2019 was concluded, it did not persist aunt and the public interest in the publication of the judicial decision in question, reason whereby when the requirement of the agreement that the 06/06/2019, the copy of the aforementioned sentence was removed from the Mayor's Facebook wall. SIXTH: The resolution proposal was issued on 08/07/2020 with the literal: “That for the Director of the Spanish Agency for Data Protection is sanctioned with warning to B.B.B., with NIF *** NIF.1, for a violation of article 5.1.a) of the RGPD, in accordance with article 83.5 a) of the RGPD. " No allegations are received against it. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/14 PROVEN FACTS 1) The claimant, worked as labor personnel, administrative assistant in the Town Hall- location of *** LOCALIDAD.1, and filed on 06/25/2018 a lawsuit before the the social against D. B.B.B. and the City Council of *** LOCALIDAD.1 requesting the extinction employment relationship for violation of their rights and compensation of 50 thousand euros for damages. The lawsuit ended with a ruling dated 09/11/2018. In the sentence refers to D. B.B.B. as Mayor, Chief of Staff and their resolutions passed. The lawsuit “dismisses the one presented by the claimant, absolving seeing the defendants of the claims made against them ”. The sentence assesses the alleged workplace harassment by the claimant, his bad response relationships with a partner, who is identified with names and surnames, written presented by her to the Mayor regarding the work environment with the claimant, the change of plant of the claimant as a result of a meeting of the Mayor with the parties on 02/02/2018. The judgment determines that there is no evidence any determinant of any situation of harassment, persecution, degradation or attention to the personal and labor dignity of the plaintiff "To the Mayor, here defendant as the author of the persecution that the plaintiff denounces… .meet with them… and that the plaintiff stated that he did not want to be on the ground floor, therefore explains what kind of retaliation this is when you are acceding to what the ac- tor requested “there is not the slightest indication that there has been a conduct of the Mayor aimed at persecuting or harming the plaintiff, rather the opposite. " In the ninth proven fact, it is indicated that the plaintiff “went to the IT situation by anxiety disorder on 03/23/2018, in which it continues ”. 2) The claimant exhibited on his FACEBOOK page, associated with his name and surnames a message on 09/12/2018 at 18:21 indicated "Today is a great day" "It's sad go to trial so that two days before the trial the defendant does what he had to have done 5 months before, which has largely motivated the demand to be dismissed ”, without explaining what he refers to, he continues by stating that“ he knew that when filed the lawsuit, it would be difficult for him to prove the harassment at work ”, which“ is clarified Your behavior as an employee and co-worker has been correct. to ”, who“ has been working as a public employee for 18 months ”, appreciates the support of the neighbors nal received and announces "that he is going to enter politics." After viewing the claimed ad of the claimant in the same social network FACEBOOK, on a page that contains with his name, B.B.B., without any reference to the City Council, presented a letter of response entitled "OFFICIAL COMMUNICATION" noting that "by some people linked to the City Council is trying to manipulate with falsehoods and means local public opinion regarding a labor issue that should not have been never left the walls of the consistory ”. He indicates that said person filed his claim on 06/22/2018 against him and the City Hall, accusing him of workplace harassment and asking for compensation. Appoint the verbatim of the judgment with the name of the claimant. He states that in the face of the demonstrations malicious intent, exposes the entire sentence. Add to your writing with your name and surnames, the position of Mayor of *** LOCALIDAD.1. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/14 3) The defendant states that he / she removed the sentence, during the processing of the You procedure, "upon receipt of the initiation agreement." FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to resolve this procedure. II First of all, the jurisprudential doctrine of the Constitutional Court in this matter that configures the right to the protection of data as an autonomous fundamental right, differentiated from the fundamental right to privacy. It thus states in its Judgment 292/2000 the following: “In this way, the object of protection of the fundamental right to protection data is not reduced only to the intimate data of the person, but to any type of personal data, whether or not intimate, whose knowledge or use by third parties may affect their rights, whether or not they are fundamental, because its object is not only the individual privacy, for this is the protection that art. 18.1 CE grants, but personal data. Therefore, it also reaches those data public personnel, that by the fact of being, of being accessible to the knowledge of anyone, they do not escape the power of disposition of the affected person because it is guaranteed by right to data protection. Also for this reason, the fact that the data is of a Personal does not mean that only those related to private or intimate life have protection of the person, but the data covered are all those that identify or allow the identification of the person, being able to serve for the preparation of their profile ideological, racial, sexual, economic or of any other nature, or that serve to any other utility that in certain circumstances constitutes a threat for the individual. " The aforementioned Judgment 292/2000 also determines the content of the right to the protection of personal data, indicating in its legal basis 7: “From all that has been said, it follows that the content of the fundamental right to data protection consists of a power of disposition and control over data personal data that empowers the person to decide which of these data to provide to a third party, be it the State or an individual, or which third parties can collect, and that it also allows the individual to know who owns this personal data and for what, being able to oppose that possession or use. These powers of disposition and control on personal data, which constitute part of the content of the right fundamental to data protection are legally specified in the power of consent to the collection, obtaining and access to personal data, its subsequent C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/14 storage and treatment, as well as its use or possible uses, by a third party, be it the State or an individual. And that right to consent to knowledge and treatment, computer or not, of personal data, requires as complements indispensable, on the one hand, the ability to know at all times who has the these personal data and what use is being submitted, and, on the other hand, the power object to that possession and uses. In short, they are characteristic elements of the constitutional definition of law. fundamental to the protection of personal data the rights of the data subject to consent about the collection and use of your personal data and knowing about them. And they result essential to make this content effective the recognition of the right to be informed of who owns your personal data and for what purpose, and the right to be able oppose such possession and use by requiring whoever corresponds to put an end to the possession and use of data. That is, demanding from the owner of the file that report what data you have about yourself, accessing your appropriate records and seats, and what destination they have had, which also reaches possible assignees; and, where appropriate, require you to rectify or cancel them. " III The RGPD defines in its article 4: 1) "personal data": any information about an identified natural person or identifiable ("the interested party"); an identifiable natural person shall be considered any person whose identity can be determined, directly or indirectly, in particular by means of an identifier, such as a name, an identification number, data from location, an online identifier or one or more elements of the identity physical, physiological, genetic, psychic, economic, cultural or social of said person; " 2) "treatment": any operation or set of operations carried out on personal data or sets of personal data, whether by procedures automated or not, such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, broadcast or any other form of authorization of access, collation or interconnection, limitation, deletion or destruction; 4) "file": any structured set of personal data, accessible in accordance with to certain criteria, whether centralized, decentralized or distributed in a functional or geographic; 7) "data controller" or "controller": the natural or legal person, public authority, service or other body that, alone or together with others, determines the purposes and means of treatment; whether the law of the Union or of the Member States determines the purposes and means of the treatment, the person responsible for the treatment or Specific criteria for their appointment may be established by Union law or from the Member States; The defendant exposes a sentence integrated with the data of an employee of the Town Hall on the social network FACEBOOK. It does not follow that in the provision of the data and its disclosure to third parties through the social network has intervened other will than that of the claimed on a particular page, when in the sentence the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/14 claimed his position accommodated that of the procedural party in the trial (co-claimed next to the Town Hall). The post exposed by the claimed in said social network supposes a treatment automated, which using the FACEBOOK infrastructure reveals some facts and data that allow the claimant to be identified through the integra sentence set forth, together with the various circumstances that are relate, among others, the development of their employment, or the allusion to third parties to the that is identified as happening in the story of it. The claimed, in a private capacity, with his name and surname on FACEBOOK expresses not only their opinions, but also adds the claimant's data that voluntarily and consciously selects to upload to said network knowing the effects multipliers that can have their visibility, and also holding a public position so that you can undoubtedly be qualified as the person responsible for the treatment at decide the purpose and the means of data collection and processing personal data used in the reference framework it represents and above. East The preceding frame does not cite personal data. The defendant who is part of a public institution, even if he spills his opinions on a private and particular network where you appear as a particular user, could have fought freedom of expression in another way, without the need for exposure integrates of a sentence. In front of the claimant's quote on FACEBOOK, it is deducted that does not expressly mention the respondent and the response regarding the protection of data that affects those of the claimant, must be proportional, considering in addition to that the defendant has an institutional relationship with the City Council. Not being in In no way provided the full and integrated exposition of the sentence with the vision of fully identifiable personal data, not only of the affected but of third parties that appear in it. This claimed, interested party in the judicial process, as public office that shares his condition, openly exposed in his user network of FACEBOOK the sentence that it uploads and maintains a not short period of time, even after the claimant's request that reaches him in the form of transfer of the claim by this Agency. In the use of the data of the affected party, there must be a legitimate basis provided for in article 6.1 of the RGPD, there are several. The fundamental right of claimant, so that their data is not used in a surprising way, or in networks associated with the development of their task, when it comes to countering the defendant the declarations of the defendant suppose an illegal use of said data, not adequate, necessary, or justified. It does not justify the presentation of the sentence integrated into the social network FACEBOK that integrates the imputation of article 5.1.a) of the RGPD that indicates: 1. The personal data will be: a) treated in a lawful, loyal and transparent manner in relation to the interested party ("lawfulness, loyalty and transparency ”); The use of the claimant's data on FACEBOOK is a use that has not been consented by its owner, and no legitimate basis is accredited in the treatment of said C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/14 data in relation to the response to the complainant's comment that the complainant should have offered. IV When the claimed act says to act on behalf of the City Council that holds competences in matters of information to citizens, seeking to give a official statement, it should be noted that he used an account on FACEBOOK from his ownership, in which your data appeared, without any reference to the City Council. Even if the defendant went to the judicial procedure as Mayor, the bases legal entities that legitimize data processing vary from being a public entity and pursue general interests that a private individual may have. For this purpose, recital 47 of the RGPD on the legitimate interest, which indicates: "The legitimate interest of a data controller, including that of a person in charge to whom personal data may be communicated, or of a third, it may constitute a legal basis for the treatment, provided that no the interests or rights and freedoms of the interested party prevail, taking into account for the reasonable expectations of data subjects based on their relationship with the responsable. Such a legitimate interest could occur, for example, when there is a relationship relevant and appropriate between the data subject and the controller, such as in situations those that the interested party is a client or is at the service of the person in charge. In any case, the existence of a legitimate interest would require a careful assessment, even if a data subject can reasonably foresee, at the time and in the context of the collection of personal data, which may be processed for this purpose. In In particular, the interests and fundamental rights of the interested party could prevail over the interests of the data controller when proceeding to the processing of personal data in circumstances in which the interested party does not reasonably expect further treatment to take place. Since it corresponds the legislator establish by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to the treatment carried out by public authorities in the exercise of their functions ”. Although referring to the legitimate interest of the previous regulations, for having a doctrinal fixation in various judgments, paragraph 95 of the judgment of 07/29/2019, of the Court of Justice of the European Union (“CJEU”), matter "Fashion ID" that on the legitimate interest of article 7, letter f) of the directive 95/46, establishes three cumulative requirements for a data processing personal data is lawful, namely, in the first place, that the person responsible for the treatment or the third party or third parties to whom the data is communicated pursue a legitimate interest; in second, the need to process personal data for the satisfaction of the legitimate interest pursued, and, thirdly, the requirement that they not prevail the fundamental rights and freedoms of the interested party (judgment of 05/04/2017, Rīgas satiksme, C-13/16, EU: C: 2017: 336, paragraph 28). The protection regime of the interested party in the RGPD against the person responsible for the treatment that intends to use your personal data based on a legitimate interest is more intense in the RGPD than in the LOPD, since if in the latter, to allow the legitimate interest, it was enough that "their rights or freedoms were not violated", in the RGPD regime, it is enough that your interests, rights or freedoms prevail about said legitimate interest. Note that the word interests is added, in front of the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/14 violation of the rights or freedoms previously necessary in the LOPD and that no violation is necessary, but it is enough that your interests, rights or freedoms are affected, even slightly, provided that said interest prevails over the alleged legitimate interest. The sole argument of the claimed for maintaining the legitimate interest is that he answered the accusations, not nominative, but if it was understood against the city council, understanding they were serious and false. Regarding the concurrence of legitimate interest, it is considered that it could be that the defendant had an interest in answering denying the news, but could have it done through the City Council. The particular interest of the natural person was not with which the defendant went to the court. His actions were not aired. sonal but the mediated actions in the exercise of their position. On whether the treatment is necessary for the purpose or purposes, it is repeated that the facts could have been made known by anonymizing all the ca- personal character and data that would make any person identifiable, therefore no it was neither necessary nor proportional. On the element that "rights and freedoms do not prevail fundamental of the interested party ”. The right to data protection may assign to other rights, however, the fact of the criticism that “every public power must assume, whether true or not, you should not respond in this case through a social network particular of the claimed person that fully exposes their data and makes known clearly circumstances of your daily work life. The right cannot prevail of the defendant because in the face of the opinion of the claimant the exposition of data is a surprising treatment, not balanced and that produces some effects durable in proportion to the use that the data has been kept in a social network, in this case if he even cautiously withdrew them when he received the letter from the AEPD when he receives the transfer as Mayor of the AEPD. In this case, the existence of any legitimate interest on the part of neither of the claimant, nor is it considered as an official way of making known information by a City Council. This allegation is therefore rejected V Article 83.5 a) of the RGPD, considers that the infringement of “the basic principles costs for the treatment, including the conditions for consent under the Articles 5, 6, 7 and 9 ”is punishable, in accordance with section 5 of the aforementioned article. Article 83 of the aforementioned Regulation, with administrative fines of € 20,000,000 as maximum or, in the case of a company, an amount equivalent to a maximum of 4% total annual turnover of the previous financial year, opting- I know for the highest amount. " Article 58.2 of the RGPD indicates: "Each control authority will have all the following corrective powers listed below: b) punish any person in charge or in charge of the treatment with warning when the processing operations have infringed the provisions of this Regulation; C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 13/14 Regarding the statute of limitations for infractions, the LOPDGDG establishes a period of three years in article 72.1: "1. Based on what is established in article 83.5 of Regulation (EU) 2016/679, considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned therein and, in particular, the following: a) The processing of personal data violating the principles and guarantees established in Article 5 of Regulation (EU) 2016/679. " Recital 148 of the RGPD indicates that in order to impose the common measure appropriate corrective action, particular attention should be paid to the nature, severity and duration offense, or any relevant prior offense, and any other circumstances aggravating or mitigating circumstance. For natural persons, instead of sanction me- A fine may be imposed. Therefore, in accordance with the applicable legislation the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: IMPOSE a penalty of warning to B.B.B., with NIF *** NIF.1, for an infringement of article 5.1.a) of the RGPD, as determined by articles 83.5 a) and 58.2.b) of the RGPD. SECOND: NOTIFY this resolution to B.B.B. THIRD: Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the interested parties may optionally file an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of month from the day after notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final resolution may be suspended in an administrative way If the interested party expresses his intention to file a contentious appeal- administrative. If this is the case, the interested party must formally communicate this made by writing to the Spanish Agency for Data Protection, Presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. As well must forward to the Agency the documentation that proves the effective filing C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 14/14 of the contentious-administrative appeal. If the Agency is not aware of the filing of the contentious-administrative appeal within a period of two months from the day after the notification of this resolution, would terminate the precautionary suspension. Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es