AEPD (Spain) - PS/00173/2020

From GDPRhub
Revision as of 14:08, 19 October 2020 by Miguel Garrido de Vega (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS/00...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
AEPD - PS/00173/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(d) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published: 09.10.2020
Fine: 3000 EUR
Parties: Spanish citizen
National Case Number/Name: PS/00173/2020
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Spanish
Original Source: AEPD decision (in ES)
Initial Contributor: Miguel Garrido de Vega

9 October 2020 - The Spanish Data Protection Agency (AEPD) decided to impose a fine up to 3,000 € on a Spanish citizen (the defendant) for the infringement of the accuracy principle, as per Article 5(1)(d) of the GDPR.

English Summary

Facts

The decision is the consequence of a complaint submitted by another Spanish citizen (the claimant) stating that its former company and the agency advising such had infringed the data protection legislation, as they improperly identified him as the author of a traffic offense; the claimant attached several evidences that its labour relationship ended nine days before the traffic offense took place (working life report, letter of dismissal and penalty).

Dispute

The Spanish company Estevez y Maeso (the advising agency) answered to the first AEPD investigation requests stating that: (i) it maintained a contract relationship with the defendant, who required to process personal data, (ii) the defendant came to the agency with the notice of a traffic offense due to an improper parking of a professional car that, in that moment, was being driven by an employee of him (the claimant), and required the agency to issue the documentation identifying the claimant as driver before the public administration. The AEPD started the corresponding sanction procedure.

Holding

Thus, the AEPD understood that the defendant has infringed the accuracy principle included at Article 5(1)(d) GDPR. Consequently, after considering some circumstances [(i) the local scope of the processing activity made by the defendant, (ii) the number of persons affected by the processing activity, (iii) the damage to the claimant, who, not being an employee of the agency anymore, has needed to issue this claim, (iv) there is no evidence that the defendant has adopted any measures in order to prevent such issues to happen again in the future, (v) there has been no collaboration of the defendant with the AEPD, (vi) there is no evidence of wilful misconduct by the defendant, even being this issue a very serious breach of the law, (vii) the link between the activity of the defendant and the processing of personal data, and (viii) the defendant is a physical person], the AEPD decided to impose a fine of 3,000 € to the defendant.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.