AEPD - PS/00291/2020
|AEPD - PS/00291/2020|
|Relevant Law:||Article 5(1)(f) GDPR|
Article 6(1) GDPR
Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico (LSSI)
|National Case Number/Name:||PS/00291/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||E Rodriguez Montes|
The Spanish DPA sent requests for information to the controller (events' organizer) regarding the complaint of the data subject and did not receive an answer. In the course of the investigation of the complaint, the Spanish DPA checked the website of the events' organizer and decided to issue a written warning for using cookies in the website when enough information had not been provided to the user of the site. The Spanish DPA decided to issue a written warning instead of a economic fine because the website belonged to a natural person and not a legal person.
A data subject made a complaint to the Spanish DPA because she submitted anonymous comments via Instagram to an events' organizer related to the wedding of her cousin that she had attended and the events' organizer forwarded this comments together with identifying data of the data subject to the groom and bride without informing the data subject first.
The Spanish DPA held that it was a violation of the Spanish Law of services of the information society and electronic commerce (LSSI) when a website does not inform clearly about the cookies it use and does not allow the user to reject them all.
Surprisingly, the Spanish DPA does not analyze the actual complaint of the data subject which is that the company forwarded her comments and other identifying personal data to the bride and groom (relatives of the data subject) without having properly informing her about it. In my personal view, this would be a violation of Article 13 (1)(c) and (e) GDPR. Furthermore, it is unclear from the decision of the Spanish DPA what is the link the failure of providing appropriate information about cookies in the website of the company and actual complaint that was about forwarding comments and personal data of users of social media to third parties without properly informing the data subjects.
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.