AEPD - PS/00194/2020
|AEPD - PS/00194/2020|
|Relevant Law:||Article 6 GDPR|
|Parties:||CABRERA & GIL ABOGADOS, S.L.P|
|National Case Number/Name:||PS/00194/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
An individual lodged a complaint with the Spanish DPA (AEPD) for considering the processing of his personal data by a law firm contrary to data protection regulations (Article 6 GDPR).
English Summary[edit | edit source]
Facts[edit | edit source]
A lawyer from the Cabrera y Gil law firm, sent a letter to a third company, providing the knowledge of the personal data and private address without the knowledge or consent of the data subject for that purpose, being that company totally unrelated to the applicant, without any corporate, labour or shareholder relationship or any other relation.
The law firm in question sent a reply to the AEPD's request for information, claiming that the procedure for security breach and/or leakage of confidential information and personal data of the company itself had been carried out.
They also justified that all processing of personal data was carried out for the purpose of providing legal defense and representation before the courts, as provided for in Article 24 of the Spanish Constitution. At the same time, they replied that the protection of information has been carried out in a correct manner, respecting the three basic principles: confidentiality. integrity and availability.
From the law firm, they defend that the processing of data serves a legitimate purpose as set out in Article 6 (1) (f) GDPR, since it is necessary to carry out their work of defence and legal representation.
Dispute[edit | edit source]
Is the processing of personal data for legal defense purposes a situation that complies with legitimate purposes, as stated in article 6 (1) (f) GDPR?
Holding[edit | edit source]
On 20/07/20, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the entity complained of for failing to comply with the provisions of the regulations in force and imposing on the entity complained of a sanction of EUR 2000 (two thousand euros) for the infringement of Article 6 of the RGPD.
Comment[edit | edit source]
On 29/07/20, the claimed entity has proceeded to pay the penalty in the amount of EUR 1600 (one thousand six hundred euros) using one of the two reductions (20%), as a voluntary payment option without recognition of liability.
Therefore, the company complained of desists from lodging any appeal against the sanction, but at the same time refuses to acknowledge its responsibility in the matter in question.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10 Procedure No.: PS / 00194/2020 938-0419 RESOLUTION OF TERMINATION OF THE PROCEDURE BY EARLY PAYMENT In the sanctioning procedure PS / 00194/2020, instructed by the Spanish Agency for Data Protection, to the entity, CABRERA & GIL ABOGADOS, S.L.P. with CIF .: B84220193, (hereinafter, “the claimed entity”), by virtue of the complaint filed by A.A.A., (hereinafter, “the claimant”) and based on the following: BACKGROUND FIRST: On 03/19/19, you entered this Agency, complaint filed by the claimant in which it indicated, among others, the following: “On January 11, 2019, a lawyer from the Cabera y Gil law firm sent the letter that accompanied the company *** COMPANY.1 and to whom he subscribes, putting in his I know my personal data and home address without my knowledge and consent to this, said company being totally unrelated to the appearing party, without corporate, labor, shareholding or any other relationship ”. A copy of the letter sent by the Firm is attached to the claim document. de Abogados Cabrera & Gil, addressed to the claimant, with a copy ("w / copy"), to the entity *** COMPANY.1, in which they contact him, on behalf of his client, *** COMPANY.2, in relation to the lawsuit presented. SECOND: In view of the facts set forth in the claim and the documents provided by the claimant, the Subdirectorate General for Data Inspection proceeded to carry out actions for its clarification, under the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (RGPD). Thus, dated 05/15/19, an informative request is addressed to the claimed entity. THIRD: On 06/06/19, the claimed entity sends this Agency in writing in which, among others, it indicates: “We present the facts that are inserted in the claim: -a lawyer from the firm- cho de abogados Cabrera & Gil Abogados, S.L.P. has sent a burofax to the company *** COMPANY.1 addressed to the claimant (your personal data is indicated at the top nales: name. surname and postal address) on behalf of your client, the company *** COMPANY.2, of which he claims he was a partner in the past. The claimant criticizes that your personal data is being disclosed to the aforementioned company *** COMPANY.1 with which it does not maintain any type of relationship (neither corporate, labor nor shareholder). The first decision taken regarding this claim was to activate the protocol colo of security breach and / or leak of confidential information and personal data implemented by Cabrera & Gil Abogados SLP, which is provided as (document no. mere 2). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/10 This protocol contains the following action parameters: 1.- Whoever has had knowledge of an incident. related to personal data- them. report the situation internally without delay, communicating it to the management team tive. 2.- An internal audit will be carried out within the first 6 hours 3.- An external audit will be carried out if deemed necessary 4.- An estimate of the impact will be made. 5.- In the event that we are faced with a leak of personal data significant and / or seriously jeopardizing the rights or freedoms of the person. In accordance with the RGPD, the security violation will be notified to the AEPD 6.- Taking measures to mitigate the leak or security breach. 7.- Evaluation of the result and the effectiveness of the actions taken. The corresponding act has been drawn up of the activation of the action protocol whose certificate is attached as [document number 3) dated May 20, 2019: The agreements and assessments taken as a result of the activation of the protocol Color of breach and / or information leak are the following: The communication has been made by the AEPD. on May 10, 2019; Denun- ciant: A.A.A .; Data Processing Registry. *** COMPANY. 2 filing of requests lla. Facts: "- A lawyer from the law firm Cabrera & Gil Abogados S.L.P. has sent a burofax to the company *** COMPANY.1 addressed to the claimant (in the upper part above, your personal data is indicated: name, surname and postal address) in the name of his client, the company *** EMPRESA.2, of which they affirm that he was a partner in the past. The claimant criticizes that their personal data is being disclosed to the aforementioned company *** COMPANY.1, with which it does not have any type of relationship (or corporate estuary. neither labor nor stock). After conducting the internal audit, within the first six hours, it is determined that no no information has been stolen. There is no leak. They are not affected entities or persons. There is no information leak for which there is no responsible party. A.A.A. has been the subject of a complaint by the company *** COMPANY. 2 cu- We defend interests. It is attached as (Doc. 4) acknowledgment of receipt before the jurisdiction penal. and as (Doc. 5) complaint presented before the criminal jurisdiction. The presentation of said claim in the AEPD against “Cabrera & Gil Abogados. SLP ”is in response to and in retaliation for the complaint filed on February 28, 2019 in defense of the rights and interests of our client. one month before claim before the AEPD. A.A.A. is a partner of *** EMPRESA.2 and has been represented legal entity of the company *** COMPANY.2 is attached as (Doc. 6) power of attorney tion and in direct relationship with *** COMPANY.1 of which it has been and is the representative of done. The complaint is filed among other reasons for this in direct relation to unfair competition. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/10 Action protocols related to confidentiality agreements are reviewed. quality and treatment of data transferred by the company *** COMPANY.2 as responsible of transferred data and Cabrera & Gil SLP as assignee and in charge of the treatment of data to defend your rights. As well as internal agreements and other protocols with the dispatch personnel and the person responsible and authorized to carry the proceedings. It is provided as (Doc. 7) confidentiality agreement and data transfer between client as responsible and office as data controller. Be it by- as (Doc. 8), confidentiality agreement and data processing by la- boral assigned to the office signed by B.B.B .. Provided as (Doc. 9) Record of Treatment activities for clients with *** COMPANY. 2. All requests made to A.A.A. has been in quality and related to its representation of legal persons either *** COMPANY.2 or *** COMPANY.1 Article 19 of the LOPD is applicable. As we have said since February 28, 2019, a complaint before the criminal courts against A.A.A. so the personal data object of treatment have been obtained in legitimate interest. The claim is dated March 19, 2019, so this is one month after the filing of the complaint. The provisions regarding the lawfulness of the data. both the consent of the interested party who is *** COMPANY.2 and responsible treatment, as in relation to A.A.A. because it is covered by a provision legal, as is established in the Criminal Procedure Law article 277 in relation to compliance with the provisions of the articles of the Criminal Code and legitimation in the interests of law determined in the effective judicial protection of article 24 of the EC, all of in accordance with the articles in article 6.1 RGPD and 8 of the LOPD. The protection of the information has been carried out correctly, respecting the three basic principles: confidentiality. integrity and availability. Confidentiality, the information is accessible only by authorized personnel. c: B.B.B. and by C.C.C .. The integrity of the information, the information is correct and is free of modifications nests and mistakes. The complaint is precisely to denounce their responsibility as de facto representative with the company *** COMPANY.1 Disponibility. The information is accessible to authorized persons or systems zed when necessary. The management team does not consider the audit necessary external depending on gravity. size, filtration level. The impact estimate is level 0. It has been taken into account first, if in the leakage of information, whether or not there is personal data and their level. Reputational damages.- There are no reputational damages. Level 0. Regulatory consequences that entail financial, administrative, criminal, civil, deontological. Level 0. Economic valuation - level 0. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/10 We are not in the case of data of a significant personal nature and / or that seriously jeopardizes the rights or freedoms of the person, in accordance with the Re- European Data Protection Regulation. Therefore, it is not necessary to notify the violation. lation of security to the AEPD or notify the interested party. Taking measures to mitigate the leak or security breach. All the me- decisions taken by the management team. The evaluation of the result and the effectiveness of the actions taken. The effectiveness of The actions taken have been positive and were within the valid legality people, however, the implementation of more rigorous measures to prevent deal with any damage as far as possible. Second.- It is not found in the cases of exercises of the regulated rights in articles 15 to 22 of the RGPD. Third.- The facts provided to the contrary, object of the claim dated 19 March 2019 are the following already mentioned: A lawyer from the law firm CABRERA & GIL ABOGADOS S.L.P. has in- Viado a burofax & the company *** COMPANY.1. addressed by the claimant (in the upper part above, your personal data is indicated: name, surname and postal address) in the name of his client, the company *** EMPRESA.2, of which they affirm that he was a partner in the past. - The claimant criticizes that their personal data is being disclosed to the mentioned company *** COMPANY.1 with which it does not maintain any type of relationship (neither corporate, labor nor shareholder). The facts are motivated in response to the complaint dated February 28, 2019 that this office has presented before the criminal jurisdiction: On February 28, In 2019, the company *** EMPRESA.2 (complainant), filed a complaint, in the form of ma and with the requirements indicated in article 277 and concordant of the Law of Criminal Prosecution, against A.A.A. (defendant). From the point of view of data protection and its legitimacy to initiate it is fully justified from the evidentiary point of view, by the various documents related in the point first. The legitimacy of “Cabrera & Gil Abogados, S.L.P for the possession of personal data sonal. and its treatment, is justified from two aspects, by a hand, from the effective judicial protection that our client *** COMPANY.2 has to defend deed from unlawful actions and omissions by A.A.A. and whose “consent express consent 'is included in the confidentiality and data transfer agreement as responsible for treatment; on the other hand, it would be justified according to the interest legitimate. included in article 6 of the RGPD and 8 of the LOPD, and that the law of prosecution- criminal procedure in relation to the penal code (articles 252, 253 and 248.1) gives ture to that possession and transfer of personal data to the Judicial Bodies and to the investigation investigation of the facts in which other entities or persons are related legal or physical activities, such as the case of *** COMPANY.1, especially when it is the pia public administration through the DGT (General Directorate of Traffic) which ' puts on the track 'that A.A.A., is using an account of which is the owner together with *** EMPRESA.1 so that, causing deception in the DGT, C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/10 gresen in it, money that corresponds to *** COMPANY. 2. It is provided as (Doc. 10) email from the D.G.T. The complaint is requested as diligence investigation of the account holders from the BBVA Bank. A.A.A. missing the truth when he 'hints' that he is not a member of *** COMPANY.2, causing an error in as far as the data may be inaccurate. This person has been and is a partner of *** COMPANY.2, and as we have said, he has been Legal representative of the company *** COMPANY. 2. On October 20, 2005, Power of attorney was granted to the defendant today, by the company *** EMPRESA.2, with full powers to manage its assets, by virtue of a deed power of attorney granted on said date, authorized before the Madrid Notary. The power of attorney was revoked due to the company's detection of improper use and for their own benefit, and their employment relationship was terminated, the object of which nuncia in the complaint. The data is treated in a lawful, loyal and transparent manner in relationship with the interested party. They have been collected for specific purposes. explicit and le- to defend the rights of our client by filing a complaint with date prior to filing the claim with the AEPD and they have not been treated subsequently inconsistently. In addition, the data as we have seen are adequate, pertinent and limited. to what is necessary in relation to the purposes for which they have been treated in accordance with the principle of data minimization; They are exact and updated data. The claimant criticizes that their personal data is being disclosed to the aforementioned company *** COMPANY.1 with which it does not have any type of relationship or corporate neither labor nor stock. Precisely the complaint also deals with conduct of unfair competition 248.1 of the Penal Code by A.A.A. regarding *** EM- PRESA.2 and in direct relationship with *** COMPANY.1 of which it has been and is representing you actually. The company *** EMPRESA.2, detected that the defendant, carried out work for companies sas of the competition, during the period in which he was as agent, and He was the de facto administrator of the entity *** COMPANY. 2. The defendant today, while he was the agent of the company *** COMPANY.2, created a shell company, *** COMPANY.1, through a single partner and administrator, D.D.D. being the object so- cial and commercial activity of this company, the same as that of my sponsored one. For This, he made use of reserved information that as a partner and attorney of *** EMPRE- SA.2, had in the sector. Specifically, and as noted before, *** COMPANY.2, received on the 2nd of March 2016. email from the DGT (General Traffic Directorate), in which It was indicated that after checking the bank details of *** COMPANY.2, these differed of the usual that consisted in said client. Later. my client found that the account was owned by A.A.A. and *** EM- DAM. 1. That is, the account provided by the defendant today to the client of my sponsor- The purpose of this was to benefit from the amount that would be received from the DGT. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/10 On this occasion, the defendant tried, through deception and confusion of a third party, in this case the DGT, to appropriate certain amounts that were directed to my sponsored by the provision of services in the scope of its activity, facilitating for this, an account number of which he was the owner, apparently, together with the company *** COMPANY.1, to charge for such services, without it being achieved since by part From the DGT a certificate was requested for my client to prove the alleged change of ownership of the account you used regularly. In the face of unfair competition conducts and under article 6 of the RGPD and 8 of the LOPD mentioned above. my client has the right to defend himself and to find out until where fraudulent business practices have come. Data transfers have been otherwise. those strictly necessary and directly related to their representation data: name. surname and address not using other data such as your D.N.I or other data related to your natural person. Being within the norm therefore by article 19 of the LOPD as business data. We consider relevant the legal basis by which, according to the article Article 65 of the LOPD there is no place for the opening of any sanctioning file because the claim is manifestly unfounded and in accordance with the article the 74 of the LOPD not to have caused damage to the affected by being protected our legitimacy for the treatment and transfer of data. in article 6 of the RGPD and 8 of the LOPD, falls within the established legitimate interest. The behavior before- described above, carried out by the defendant, is included in the crime of fraud of the Article 248.1 of the current CP. Crime with the aggravation of article 250.1.6º of the CP. What has been seen so far determines that, if such facts exist. after checking timely by the consultant, the action of the consultant consisting of communicating to the prosecutor or judges a possible criminal act would not only be protected by the legislation protection of data, but would be imposed by procedural legislation. The requested data transfer would be covered by a law: "(...) if the law contemplates the birth of an obligation between the parties the necessary corollary is that the law also It must also consider the need to know the circumstances necessary to der exercise the subjective rights that arise from said obligation. In consecuense my client, before the commission of a crime on his person, property or property committed by a third party, he must be able to know the circumstances necessary to exercise his rights, and if article 24 of the Constitution recognizes the right to judicial protection effective, developed, among other rules by the Civil Procedure Law, or the Law of Criminal Procedure will have to go to these, art. 399 of the LEC or 277 of the Criminal Procedure Law, to see the circumstances that a decision must have judicial order. or in this case a complaint and among them, there is, that they have to state "the data and circumstances of the plaintiff and the defendant, or in this case, that and the domicile or residence in which they may be located ", so it is conclude that the transfer of the requested data is covered by the exception tion provided for in the LOPD and does not require the consent of the interested party. In the present case. Obligations arise between the parties, according to art. 1089 of the Code civil (Cc), art.1092 Cc. And art. 1093 Cc. Thus. both the crime and the res- extra-contractual liability obligations arise between the parties. In the LEC art. 399 establishes the circumstances that the claim must contain: and among them we find is that the application must state "the data and circumstances of the actor and C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/10 of the defendant and the domicile or residence in which they may be located. " LECr the exercise of the action is exercised by complaint. according to art. 277 LECr. that requires that the name be recorded in it. surnames and neighborhood the defendant, that is, the law establishes the need to provide personal data of the person against whom the complaint is filed in order to be properly identified (either the name, surname, or other circumstances, photography, tattoos. characteristics personal cas etc.-). Although in our case in particular, it has only been provided name, surname and address. Basic data. The transfer of data has a legitimate interest: A second possibility that excepts the need for the consent of the interested party is constituted by the existence of an interest legitimate interest, provided that in a balancing exercise between said legitimate interest and the fundamental rights of those affected, the former prevail over the latter. So. the Judgment of the Court of Justice expressly declared the direct effect of the Title 7 f) 'of Directive 95/46 / EC. according to which: “Member States shall provide that the processing of personal data can only be carried out if (...) it is necessary for the satisfaction of the legitimate interest pursued by the data controller or by the third party or third parties to whom the data is communicated, provided that it does not prevail read the interest or the fundamental rights and freedoms of the interested party that requires They are protected under Article 1 (1) of this Directive ". The RGPD. considers as a legitimate cause for the processing of data the interest legitimate according to its article 6.1.f). So. to determine if the application would proceed of the aforementioned provision, the weighting rule provided therein shall be applied; that is, it is necessary to assess whether in the specific case under analysis, there will be a legitimate interest pursued by the data controller or by the third party or third parties to whom the data is communicated. that prevails over the interest or rights and fundamental freedoms of the interested party that require protection in accordance with the provisions put in article 1 of the RGPD. or if, on the contrary, fundamental rights or Interests of the interested parties to whom the data processing refers must prevail over the legitimate interest in which the person responsible or the third party intends to Mention the treatment or transfer of personal data. Before the commission of a crime, it is clear that the interests of my client prevail and not the other way around. Your- effective judicial fabric: In the present case. the legitimate interest invoked refers specifically to cially to the fundamental right to effective judicial protection (art. 24 CE). as far in which the illegal actions and omissions carried out by the "interested" and included in the supporting documentation are necessary to file the complaint. The scope of right to judicial protection in relation to the evidence has been addressed. among other. in STC 212/2013, of December 16. The scope of the right to judicial protection in relation to relationship with the test has been addressed. among other. in STC 21212013. of December 16 Cement. in which reference is made, citing STC 88/2014. May 28 at " intimate relationships of the right to evidence with other rights guaranteed in art. 24 CE. The relationship between the rights to protection of personal data and guardianship judicial has been. Likewise, analyzed in the Infamous of this AEPD 469/2011 of December 30, December 2011. in which the following is indicated: "In this point. It should be remembered that the AEPD has already had the opportunity to analyze the possible concurrence in a certain case of data processing of the rights Chos fundamental to the protection of personal data and judicial protection effective data controller. Thus, it has been considered, for example, that the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/10 treatment by a lawyer of the data of the opposing party of his client finds its protection in the recognition of the latter by article 24.1 of the Constitution of their right to effective judicial protection. which implies, according to section 2, the defense lawyer and the use of the pertinent means of proof for the defense of their right. The enforceability of the opponent's consent, in this case, A.A.A., for trafficking of your data, or by your lawyer would mean leaving the warehouse at the disposal of storage of the necessary information so that your client can fully exercise their right to effective judicial protection. Thus the lack of these data may logically imply camente, a reduction in the possibility of contribution by the interested party of "the media relevant evidence for his defense ”, violating another of the guarantees derived of the aforementioned right to effective protection and restricting the possibility of obtaining the full development of this right. For all of it. Although no provision with the force of Law expressly establishes the possibility of the treatment by lawyers and solicitors of the data referred to the opposition of his client within a certain judicial process, it is evident that he cha possibility brings direct cause of a norm of constitutional rank. regulatory in addition to one of the fundamental rights and public freedoms enshrined by the Constitution. and developed by the regulatory laws of each of the Orders Jurisdictional. in the precepts referring to the representation and defense of the tes. For all of it. it exists, from our point of view. a legal qualification for the data processing, which is covered by article 24 of the Constitution. tion and its implementing rules. FOURTH: On 07/20/20, the Director of the Spanish Agency for the Protection of Data agreed to initiate a sanctioning procedure against the claimed entity, by virtue of the powers established, for failing to comply with the provisions of current regulations and giving the claimed entity a penalty of 2,000 euros (two thousand euros) for the fraction of article 6 of the RGPD. FIFTH: On 07/29/20, the claimed entity has proceeded to pay the sanction in the amount of 1600 euros (one thousand six hundred euros) making use of one of the two reductions provided for in the Initiation Agreement transcribed above, submitting in this Agency writing in which, among others, it is indicated: “Voluntary payment option without acknowledgment of responsibility: That in accordance with the provisions of article 85 of the LPACAP, in the case of that the sanction to be imposed was a fine, may, at any time prior to the resolution of this procedure, carry out the voluntary payment of the penalty proposal, which will mean a reduction of 20% of the amount thereof, equivalent in this case to € 400. With the application of this reduction, the sanction it would be set at € 1,600 and its payment would imply the termination of the procedure. The effectiveness will be conditioned to the withdrawal or resignation of any action or administrative appeal against the penalty. (…) With the application of this reduction, the penalty would be set at € 1,600, no recognizes the responsibility on the part of “Cabrera & Gil Abogados and desists C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/10 expressly, of any action or appeal in the administrative channel against the sanction". FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation- ment. II Article 85 of Law 39/2015, of October 1, on the Administrative Procedure Co- of the Public Administrations (hereinafter LPACAP), under the heading “Termi- nation in sanctioning procedures ”provides the following: "1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is solely of a pecuniary nature or it is possible to impose a pecuniary sanction and another of a non-pecuniary nature, but the improper dence of the second, the voluntary payment by the presumed responsible, in any moment prior to the resolution, will imply the termination of the procedure, except in Regarding the replacement of the altered situation or the determination of the compensation tion for damages caused by the commission of the offense. 3. In both cases, when the sanction is solely of a pecuniary nature, the I win competent to resolve the procedure will apply reductions of, at least, the 20% on the amount of the proposed penalty, these being cumulative among themselves. The said reductions must be determined in the notification of initiation of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of any action or appeal in administrative proceedings against the sanction. The reduction percentage provided for in this section may be increased by regulation. mentally. " In accordance with the above, the Director of the Spanish Agency for the Protection of Data RESOLVES: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/10 FIRST: DECLARE the termination of the procedure, PS / 194/2020, in accordance with with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to the entity, CABRERA & GIL ABOGADOS, S.L.P. In accordance with the provisions of article 50 of the LOPDGDD, this Re- solution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, interested parties may file an appeal contentious administrative before the Contentious-administrative Chamber of the Audien- National company, in accordance with the provisions of article 25 and section 5 of the Additional fourth section of Law 29/1998, of July 13, regulating the Jurisdiction Contentious-Administrative, within two months from the next day upon notification of this act, as provided in article 46.1 of the aforementioned Law. Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es