AEPD - PS/00200/2020
|AEPD - PS/00200/2020|
|Relevant Law:||Article 6(1) GDPR|
Article 83(2)(b) GDPR
Article 83(2)(g) GDPR
Ley Procedimiento Administrativo Común de las Administraciones Públicas
|Parties:||FEDERACIÓN DE BALONCESTO DE CASTILLA Y LEÓN|
|National Case Number/Name:||PS/00200/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
The AEPD imposed a fine of 3000 euros on the FEDERACIÓN de BALONCESTO de CASTILLA y LEÓN for disseminating personal data without consent.
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant sent a complaint to the FEDERACIÓN DE BALONCESTO DE CASTILLA Y LEÓN and this organization shared his personal data without his consent.
On 30 August 2017, the complainant filed a complaint with the AEPD against the SPANISH FEDERATION OF BALONCESTO DE CASTILLA Y LEÓN for the disclosure without consent of his personal data via the Internet and a newspaper.
It was demonstrated that the FEDERACION de BALONCESTO de CASTILLA Y LEÓN sent the document with the personal data of the claimant, and therefore it is responsible for the violation of confidentiality when sending this document with the personal data of the claimant to a newspaper.
Dispute[edit | edit source]
Does sharing a complainant's personal data without their consent a breach of Article 6 (1) (f) GDPR?
Holding[edit | edit source]
The AEPD considered that the conduct of the defendant's employees - sending personal data from a complaint - infringes Article 6 (1) GDPR, by unlawfully processing the complainant's personal data, in relation to Article 5 (1) (f) GDPR, which governs the principles of integrity and confidentiality of personal data, as well as the proactive responsibility of the data controller to demonstrate compliance. This is an infringement punishable under Article 83 (4) (a) GDPR.
Assessing the circumstances that modify the responsibility contemplated in Article 83 (2) GDPR, in this case, the aggravating circumstances for being a non-intentional but significant negligent action (Article 83 (2) (b) GDPR), and for being data known as basic personal identifiers such as name and address (83 (2) (g) GDPR.
The AEPD set the amount of the administrative fine at 3000€ (three thousand euros).
Comment[edit | edit source]
In the first place, the AEPD did not admit the complaint about processing, stating that the processing of the complainant's data relating to his status as a representative of a sports organization is outside the scope of application of the LOPD and, therefore, outside the scope of action of the AEPD. The complainant filed an administrative appeal with the Audiencia Nacional, a court that declared the previous resolutions of the AEPD null and void, and therefore the AEPD agreed to initiate preliminary investigation proceedings.
The defendant/sanctioned benefited from the reduction provided for in Article 85 of Law 39/2015, of 1 October, on the Common Procedure of Public Administrations. In fact, two reductions of 20% were applied to it: one for acknowledging his responsibility and the other for the voluntary payment prior to the resolution of the procedure.
Therefore, the initial penalty corresponded to EUR 5,000 and was reduced by 40%, resulting in a final figure of EUR 3,000.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.