AEPD - PS/00172/2020
|AEPD - PS/00172/2020|
|Relevant Law:||Article 6(1) GDPR|
Article 7 GDPR
|Parties:||POSADA LAS ANIMAS VIGO SPAIN, S.L.|
|National Case Number/Name:||PS/00172/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) issued a warning to a pub for recording and disseminating the image of its customers on their social networks without a legal basis.
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant turned to the AEPD to claim that the entity had recorded him, along with other people, during a public event without his permission. Subsequently, the respondent had disseminated the images on their social networks.
The complainant alleged that the dissemination of the images caused him serious harm, since he could be seen kissing a person who was not his couple.
The respondent alleged that they had placed at the entrance of the place a large informative sign specifying that the event was going to be recorded and uploaded to their social networks.
Dispute[edit | edit source]
Did the respondent process the claimant's personal data with sufficient legal basis? Is the sign posted at the entrance of the event an adequate measure to ensure fair data processing?
Holding[edit | edit source]
The AEPD concluded that the respondent needed the complainant's consent to capture his image and subsequently disseminate it on their social networks. For such consent to be valid, it had to be informed, unequivocal, specific and free. The fact that the respondent had provided an explanatory poster does not guarantee that the consent was unequivocal, since the data controller could not prove that each and every one of the attendees to the event had read the poster and agreed with its content.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/13 Procedure No.: PS / 00172/2020 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: A.A.A. (hereinafter, the claimant) dated October 28, 2019 filed a claim with the Spanish Data Protection Agency. The The claim is directed against POSADA LAS ANIMAS VIGO SPAIN, S.L. with NIF B27793926 (hereinafter, the defendant) for some facts that could be violating the legislation on protection of personal data. The main reasons in which based on the claim are as follows: “On 09/21/2019, they have released a video of me where it is displayed perfectly my face and that of other people in the premises of the ALLEGED RECLAIMED. This video is recorded inside the premises and published on the social network INSTAGRAM in the official profile of the establishment: "la_posada_vigo". I dispose of screenshots and witnesses that can corroborate this publication. In addition, the video has been edited with graphic elements according to the situation that it is being recorded, which is my person kissing another person. In the video, which It lasts approximately 20 seconds, you can see my face and the act. When they give me a transfer of this publication, which I did not know at the time It was recorded, because they had recognized me from the Internet, I try to get in touch with the ALLEGED COMPLAINT at the contact telephone number that appears in your profile of INSTAGRAM, indicating that it will immediately withdraw those contents, to which He replied "whoever enters his premises is exposed to being recorded". This telephone conversation has not been recorded. Consequently, I have suffered significant non-pecuniary damage, since the person with whom I kissing me was not my partner at that time. I request that the corresponding sanction provided for by law be applied, before an act of disclosure of sensitive personal images, without my consent, even if it is taken into account the editing of the contents counts as a tax on the diffused image […] » Along with the claim, it provides several frames of the supposed video recorded. SECOND: Prior to the admission for processing of this claim, a transferred the defendant, in accordance with the provisions of article 65.4 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/13 On 12/03/2019, a written reply from LA was entered in this Agency. POSADA DE LAS ÁNIMAS VIGO SPAIN S.L, in which it states the following: "one. In the access to the hospitality establishment there is an express communication from the fact that the premises take pictures and videos of the environment, made not from automated way but by a photographer. 2. It is also indicated that if you have any questions, contact the management. 3. As the complainant himself indicates, the removal of the video was not requested in a written, but by phone and without success. 4. That there are ways of communication by email or writing available in the premises, open from Monday to Friday from 20:30. In any case, the photographs and images of the environment are deleted and replaced by others on a weekly basis, with any client having the right to be informed in advance access to address the address. In the event that the photograph or video were made without being aware of it, there are mechanisms to request the withdrawal immediate of it. " Attach image of the poster that appears at the entrance of the establishment. THIRD: The claim was admitted for processing by resolution of June 2 2020. FOURTH: On July 17, 2020, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure to the claimed, by the alleged infringements of article 6.1 and 7 of Regulation (EU) 2016/679 (Regulation General Data Protection, hereinafter RGPD) typified in article 83.5 of the aforementioned rule, granting a period of ten days to present allegations. FIFTH: Once the aforementioned commencement agreement was notified, the defendant submitted a written allegations in which it stated that: “[…] The fact that environmental photographs and videos are those that are carried out as specified by the poster that occupies 25% of the upper frame of the only access door to the premises. It is therefore unfailingly necessary that every client who has access to the local have the poster in your field of vision C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/13 1. In the access to the hospitality establishment there is an express communication from the fact that the premises take pictures and videos of the environment, made not from automated way but by a photographer. Apart from this fact, as also indicated in the answer, the photographs and small clips (videos) are made manually by a photographer. Being possible at any time, as it is a digital camera, request its removal or even asking that his image not be captured. According to article 4 of the RGPD, it must be a "manifestation of will free, specific, informed and unequivocal by which the interested party accepts, either by means of a declaration, or a clear affirmative action, the treatment of the data people who concern you » The fact that the informational poster occupies a prominent place in the only route of access, along with the fact that the person who captures the images is accessible in all moment in the opinion of the mercantile "La posada de las animas" respond to the need for a clear affirmative action, through access to the establishment and the not communicate any impediment to the person taking the photographs. Regarding the responsibility to remove the image, it is clear that corresponds to the interested party, disproportionately, in what corresponds this qualification is considered from the mercantile that does not correspond to reality, since not only could he have told the photographer to delete the video clip, but as soon as he wanted, he could contact the establishment by phone, It could also have been done by email, in any case the Images and video clips are deleted by default on a weekly basis. That is why it is requested that this writing be considered presented and proceed to close the file opened against POSADA LAS ANIMAS VIGO SPAIN SL. " SIXTH: On September 3, 2020, the instructor of the procedure agreed to the opening of a period of practice of tests, being considered reproduced, for the purpose of evidence the claim filed by the claimant and its documentation, the documents obtained and generated by the General Sub-Directorate of Inspection of Data and allegations presented by the claimed. SEVENTH: On October 13, 2020, a resolution proposal was formulated, proposing that a penalty of warning be imposed on the defendant, for respective infractions of articles 6.1 and 7 of the RGPD, typified in article 83.5 of the same rule. In this proposal, a period of 10 days was established for the claimed could allege whatever he considered in his defense as well as present the documents and information deemed pertinent, in accordance with article 89.2 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). On October 30, the defendant submitted a brief of allegations in which stated the following: "[...] C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/13 1- The proposed resolution is based on “The fact that the mere existence of a informational poster does not guarantee that all customers who access the premises are aware of the possible capture of their physical image ”this as indicated to them prevents compliance with the provisions of article 7.1 of the RGPD "When the treatment is Based on the consent of the interested party, the person in charge must be able to demonstrate that he consented to the processing of his personal data " 2- There is no specific regulation on signaling regarding data protection should extrapolate this regulation from the only two regulations existing in the matter and from which the entire legal basis of other types of signals not included in them. the Royal Legislative Decree 339/1990 of 2 March by which the articulated text of the law on traffic, circulation of Motor vehicles and road signs and the other RD 485 on road signs. security and health. In both cases, a signaling system is established by means of warning panels. different nature (Prohibition, warning obligation, etc.) where All users of the roads that are the object of this Law are obliged to obey the traffic signs that establish an obligation or a prohibition and adapt their behavior to the message of the rest of the regulatory signals that are found on the roads on which they circulate (art 53.1 of the Regulations) This paragraph together with the extensive and abundant jurisprudence is what leads to the fact that that if an informative sign from a panel in a private company (RD485 / 97) or on a public (RD 339/1990) indicates that the maximum speed is 20 KM and I access the road I am accepting that said maximum speed is 20 km per hour. Having no effect liberating the fact that the signal was seen or not (as long as it exists). This principle extrapolated to all types of signage is that it creates signals so shoot like Some wear the blue color of obligation, others the red emergency, however None is standardized since it is not to regulate road traffic or traffic conditions of access and safety at work. Neither the warning sign of the mercantile, the posada de las animas Vigo Spain It is, however it makes clear the warning “Environmental photographs are taken that they get on social networks ”. This signage, being placed on the only access door, complies with perfectly meet the requirements of a warning sign. Being able the person that you do not want to consent not to access. The fact that the reading of the warning sign cannot be guaranteed does not invalid nor the fulfillment of the requirements that extrapolating from the abundant jurisprudence in panel signs could only be for one of these reasons. - That the sign is not covered or hidden in such a way as to prevent its visualization. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/13 - Make it legible - That precedes the obligation, danger zone, etc. - That in concurrence with other signals is contradictory. None of these reasons is given and therefore the claimant accesses the interior of the premises may or may not be informed, but at no time has he been denied the right to the information and therefore your consent when expressly accessing the establishment is free and conscious. Imposing a warning for this issue removes the validity of warning signs. information panel in any field since in all it is based on the same reference rules. Regarding the ease (Symmetry) art 7.3, to oppose being recorded or photographed I return to art 7.1 already commented on the express consent shown to access the premises, being able to be duly informed and as which accepting of expressly and voluntarily the possibility of being recorded or photographed. " In view of all the actions, by the Spanish Agency for Data Protection In the present proceeding, the following are considered proven facts, FACTS FIRST: The claimant submitted a brief on October 28, 2019 to the Data Protection Agency that the one that shows that on the 21st of September 2019 the establishment POSADA DE LAS ÁNIMAS VIGO published in the social network Instagram a video of him while he was inside said establishment, video that would have been recorded without their consent (and allegedly edited). Provide screenshots in this regard. SECOND: The hotel establishment takes photographs and videos of the environment of some of your clients. These photos and videos are taken by a photographer and published in the profile of the establishment in a social network during a period temporary one week. THIRD: The defendant has placed a sign at the entrance of the establishment in the one that warns that inside photographs and videos of the environment are taken to its publication on the official website and that upon entering the establishment it is presumed the consent of the client. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in arts. 47 and 48.1 of the LOPDGDD, the Director of C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/13 The Spanish Data Protection Agency is competent to resolve this process. II The defendant is charged with committing an offense for violation of article 6.1 of the GDPR, which states that: "one. The treatment will only be lawful if it complies with at least one of the following terms: a) the interested party gave their consent for the processing of their personal data for one or more specific purposes; b) the treatment is necessary for the execution of a contract in which the interested party is part of or for the application at his request of pre-contractual measures; c) the treatment is necessary for the fulfillment of a legal obligation applicable to the responsible for the treatment; d) the treatment is necessary to protect vital interests of the interested party or another Physical person. e) the treatment is necessary for the fulfillment of a mission carried out in the interest public or in the exercise of public powers conferred on the data controller; f) the treatment is necessary for the satisfaction of legitimate interests pursued by the person responsible for the treatment or by a third party, provided that on said interests do not override the interests or fundamental rights and freedoms of the interested party who require the protection of personal data, in particular when the interested is a child. The provisions of letter f) of the first paragraph will not apply to the treatment carried out by public authorities in the exercise of their functions. " Likewise, an infringement of article 7 of the same legal text, which provides that: "one. When the treatment is based on the consent of the interested party, the person in charge must be able to demonstrate that he consented to the processing of his data personal. 2. If the consent of the interested party is given in the context of a written statement that also refers to other matters, the request for consent will be submitted in such a way that it is clearly distinguished from other matters, in an intelligible and easily accessible and using clear and simple language. It will not be binding any part of the declaration that constitutes an infringement of this Regulation. 3. The interested party will have the right to withdraw their consent at any time. The Withdrawal of consent will not affect the legality of the treatment based on the consent prior to its withdrawal. Before giving consent, the interested party you will be informed of it. It will be as easy to withdraw consent as it is to give it. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/13 4. When evaluating whether consent has been freely given, it will be taken into account in the as much as possible the fact whether, among other things, the performance of a contract, including the provision of a service, is subject to data consent personnel that are not necessary for the execution of said contract. " Violations are classified in article 83.5 of the RGPD: "Violations of the following provisions will be sanctioned, in accordance with the paragraph 2, with administrative fines of a maximum of EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global business volume of the previous financial year, opting for the highest amount: a) the basic principles for the treatment, including the conditions for the treatment consent in accordance with articles 5, 6, 7 and 9; […] " For the purposes of the statute of limitations for infractions, those indicated in paragraph above are considered very serious and prescribe after three years, in accordance with article 72.1 of the LOPDGDD, which establishes that: "Based on what is established in article 83.5 of Regulation (EU) 2016/679, considered very serious and will prescribe after three years the infractions that suppose a substantial violation of the articles mentioned therein and, in particular, the following: […] B) The processing of personal data without any of the conditions concurring of legality of the treatment established in article 6 of Regulation (EU) 2016/679. c) Failure to comply with the requirements of article 7 of Regulation (EU) 2016/679 for the validity of the consent […] " III This procedure has its origin in the consideration as an infringer of the current policy of recording images and videos of clients of the establishment of hospitality and leisure POSADA LAS ÁNIMAS VIGO for further dissemination in networks social or website. The defendant bases the legitimate basis of the treatment in the consent of the interested parties. The RGPD regulates the different legitimate bases for the processing of personal data in its article 6.1, and on this question of the legality of the treatment, also affects the Recital 40 of the aforementioned RGPD, when it states that “For the treatment is lawful, personal data must be processed with consent of the interested party or on any other legitimate basis established in accordance with Law, and either in this Regulation or by virtue of other Union law or of the Member States covered by this Regulation, including the need to comply with the legal obligation applicable to the person responsible for the treatment or the need to execute a contract with which the interested party is a party or in order to take measures at the request of the interested party prior to the conclusion of a contract. " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/13 According to what was stated by the complainant, he has based the treatment of data object of the procedure in the consent of the interested parties and to this In this regard, it is necessary that it be linked to the specific purposes of the treatment of your data. In relation to the definition of consent, article 4.11 of the RGPD represents a paradigm shift with respect to the current scheme with prior to the aforementioned rule, inasmuch as it makes the legal reality disappear called “presumed consent”. Thus, this definition indicates that it is considered consent of the interested party that “manifestation of free will, specific, informed and unequivocal by which the interested party accepts, either through a declaration, or a clear affirmative action, the treatment of the personal data that concern ». Regarding the form of consent, according to Recital 32 «The consent must be given by means of a clear affirmative act that reflects a manifestation of free, specific, informed and unequivocal will of the interested party to accept the processing of personal data that you agree, such as a statement by written, including by electronic means, or an oral statement. This could include check a box on a website on the internet, choose technical parameters for the use of information society services, or any other statement or conduct that clearly indicates in this context that the interested party accepts the Proposal for the processing of your personal data. Therefore, the silence, the boxes already marked or inaction should not constitute consent. Consent must be given for all treatment activities carried out with the same or the same purposes. When the treatment has several purposes, consent must be given to all of them. If the consent of the interested party has to be given as a result of a request for electronic means, the request must be clear, concise and not disturb unnecessarily the use of the service for which it is provided. " And abounding in this need for a clear and unequivocal statement, Recital 42 establishes that: “When the treatment is carried out with the consent of the interested party, the data controller must be able to demonstrate that he has given your consent to the processing operation. In particular in the context of a written statement made on another matter, there must be assurances that the interested party is aware of the fact that he gives his consent and of the extent to which that makes. In accordance with Council Directive 93/13 / EEC [of April 5, 1993, on abusive clauses in contracts concluded with consumers], an elaborate model declaration of consent must be provided previously by the person responsible for the treatment with an intelligible formulation and easy access that uses clear and simple language, and does not contain clauses abusive. For the consent to be informed, the interested party must know at least the identity of the person responsible for the treatment and the purposes of the treatment which are intended for personal data. Consent must not be considered freely provided when the interested party does not enjoy true or free choice or cannot deny or withdraw their consent without suffering any harm ”. Likewise, article 7 of the RGPD lists the conditions that must be met for the granting of consent and in our ordinance, the LOPDGDD indicates in its article 6, which has as a rubric “Treatment based on the consent of the affected ”the following: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/13 "one. In accordance with the provisions of article 4.11 of Regulation (EU) 2016/679, The consent of the affected party is understood to be any manifestation of free will, specific, informed and unequivocal by which it accepts, and cleans through a declaration or a clear affirmative action, the processing of personal data that concern. 2. When it is intended to base the treatment of the data on the consent of the affected for a plurality of purposes, it will be necessary to record in a specific and unequivocal that said consent is granted for all of them. 3. The execution of the contract may not be subject to the consent of the affected party processing of personal data for purposes that are not related to the maintenance, development or control of the contractual relationship. " In accordance, therefore, with the provisions of article 6.1 of the RGPD, in relation to Considering paragraphs 32 and 42, when the treatment is based on the consent of the affected, to consider such consent valid, it must be informed, refer specifically to specific purposes, lend themselves freely and be unequivocal. On this issue, Guidelines 5/2020, adopted by the Committee European Data Protection, offer mechanisms to help the interpretation of these criteria and their compliance by those responsible for the treatments. In relation to the need for informed consent, it will be necessary to Go to article 13 of the RGPD, article that determines the information that will be be provided when the data is obtained from the interested party. To achieve this end, the article 11 of the LOPDGDD articulates the way to offer the information of article 13 of the RGPD, establishing what basic information must be provided, at least in a direct, and without prejudice to the due indication of the medium or place where it may be access the complete information to be offered by virtue of the aforementioned Article 13 of the RGPD. The elements that make up the information to be provided in the assumption that consent is established as the legitimizing basis of the treatment must reach: the identity of the person in charge, the purposes of the treatment or treatments, what type of data is collected, the existence of the right to withdraw the consent, information on whether the data will be the subject of automated decisions and the possible risks in the event that a transfer is planned international data in the absence of an adequacy decision and the corresponding safeguards. The requirement of specificity is closely linked to the requirement of the informed consent and refers to the fact that consent is given only for the purpose for which it is established and in the event that they are various purposes, consent must be differentiated for each of the they. This consent requirement must, logically, be based on the information specific previously provided. A consent freely given means that the interested party must have a real option not to grant it. Consequently, the consent freely when the subject cannot deny its granting without suffering C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/13 some type of negative consequence, extreme that the person responsible for the treatment.. Finally, with respect to non-equivocation, this requirement would be manifested in that the interested party accepts in an undisputed way the processing of their data through a deliberately affirmative action and prior to the start of treatment of the data. The RGPD does not prescribe a specific way to record the consent given and therefore, it will be the responsibility of the person responsible to determine that, in line with the principle of proactive responsibility established by article 4.2 of the RGPD, in such a way that can prove that the interested party has validly provided the aforementioned consent, that is, that it is informed, free, specific, and provided unequivocal way. In relation to the foregoing and in accordance with the proven facts highlighted In this procedure, the complained party carries out data processing consisting of taking pictures of the clients of the establishment for their subsequent dissemination on social networks based on consent, which is not in accordance with the data protection regulations for the following reasons. Thus, in those cases in which the captured photographs affect people identifiable and unaware of when these photographs are being taken, the consent obtained cannot be considered to be valid since that: 1. It is not possible to prove that the persons object of the images have been duly informed. The fact, by itself, of having a poster of adequate dimensions at the entrance of the premises (occupies more than 25% of the entrance to the premises), even if it collects at least the basic information provided in the Article 11 of the LOPDGDD and indicate an address where to go to know the rest of the information that must be provided to the interested parties is not enough to those data processing whose legitimating basis is consent since does not allow to prove that each and every one of the people whose data is going to be treated, have read the poster and have been informed. A different question would result, for For example, data processing carried out for security reasons through a video surveillance camera, data processing whose legitimating basis is the public interest and not consent, and where the requirement of the duty of information It is understood that the provision of a poster that meets the minimum requirements has been fulfilled. 2. It cannot be considered that people who are captured without being aware of their recording have undoubtedly consented to the taking of a photograph or video of their physical image because they may not even know that they are being subjected of that treatment. As noted above, the presumed consent has ceased to be valid within the framework of the data protection regulations that have arisen From the approval of the RGPD, it must be express. On the other hand, in those photographs in which the client appears looking directly and intentionally to the camera, it would be possible to conclude, unlike the assumption above, that the consent is unequivocal. Now, it is important to note that C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/13 In these cases, all the requirements that have been mentioned above as necessary for the provision of consent valid, which implies, therefore, the need for consent to also be reported for each and every one of the purposes (in this case, the capture of the image and its subsequent dissemination through social networks) and free, the responsible must be in a position to prove that these points have been fulfilled in all cases. Taking into account the foregoing, therefore, the allegations of the claimed since these are settled on the basis that the claimed provides information clearly visible at the entrance of the establishment and that would fall on the sphere of responsibility of the clients whether to read it or not; how has it indicated, the framework that configures the RGPD for the processing of personal data whose legitimating basis is the consent of the interested parties requires a clear affirmative action in the provision of said consent that must comply with all and each of the conditions referred to above, eliminating from this form the so-called tacit or presumed consent. Therefore, to fulfill with the data protection regulations when the legitimizing basis of the treatment is constitutes the consent of the interested party, the sole making available to him of information —whose reading in this case cannot even be credited— is set up as a necessary but not sufficient budget. On the other hand, it is indicated that, in the face of the affirmation of the absence of signage regarding data protection, although it is true that there are no provisions on the type of informational signs, articles 13 and 14 of the RGPD collect the information that the controller is obliged to supply depending on whether The data is obtained or not from the interested party and article 11 of the LOPDGDD offers a means of fulfilling this obligation through the so-called layer system (in which a distinction is made between basic information that must be provided immediately and the complementary information that can be offered in a second moment). The way to fulfill this duty of information will depend, logically, on the type of treatment in particular, being the responsibility responsible for the design and offering of that information. IV Without prejudice to the provisions of article 83.5, sections a) and b), of the RGPD, its art. 58.2 b) provides the possibility of sanctioning with warning, in relation to the indicated in Recital 148: "In the event of a minor offense, or if the fine that is likely to be imposed would constitute a disproportionate burden for an individual, rather than sanction by fine may be imposed a warning. It must however pay special attention to the nature, severity and duration of the offense, to its intentional nature, to the measures taken to alleviate the damages suffered, the degree of responsibility or any relevant prior infringement, the way in which that the supervisory authority has had knowledge of the infringement, to the fulfillment of measures ordered against the person in charge or in charge, to the adherence to codes of conduct and any other aggravating or mitigating circumstance. " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/13 In the present case, when deciding the sanction to impose, they have taken into account counts the following elements: That it is a company whose main activity is not related to the processing of personal data. That there is no recidivism or repetition, as the commission of previous infringements regarding data protection. Therefore, it is considered that the sanction that would correspond to impose is warning, in accordance with the provisions of article 58.2 b) of the RGPD, in relation to what is stated in Considering 148, cited above. On the other hand, in accordance with the provisions of the aforementioned article 58.2 d) of the RGPD, according to which each supervisory authority may 'order the person in charge or manager of the treatment that the treatment operations conform to the provisions of the this Regulation, where appropriate, in a certain way and within a specified term […] ”, the person in charge must adopt the necessary measures to prove that the consent given by the interested parties is informed, specific, free and undoubted. Therefore, in accordance with the applicable legislation and assessed the criteria of graduation of the sanctions whose existence has been accredited, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: IMPOSE POSADA LAS ANIMAS VIGO SPAIN, S.L., with NIF B27793926, for individual infractions of articles 6.1 and 7 of the RGPD, typified in Article 83.5 of the aforementioned rule, a sanction of APPEARANCE. SECOND: ORDER POSADA LAS ANIMAS VIGO SPAIN, S.L so that accredits, within a maximum period of ONE MONTH from the notification of this resolution, the adoption of the necessary measures to prove that the consent given by the interested parties is informed, specific, free and undisputed. THIRD: NOTIFY this resolution to POSADA LAS ANIMAS VIGO SPAIN, S.L. and inform the claimant. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to counting from the day after the notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 13/13 National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the final resolution through administrative channels if the interested party expresses his intention to file contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through writing addressed to the Spanish Agency for Data Protection, presenting it through of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web /], or through any of the other records provided for in art. 16.4 of the cited Law 39/2015, of October 1. You must also transfer to the Agency the documentation that proves the effective filing of the contentious appeal- administrative. If the Agency was not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would terminate the precautionary suspension. 938-131120 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es