AEPD - PS/00320/2020
|AEPD - PS/00320/2020|
|Relevant Law:||Article 4(11) GDPR|
Article 6(1) GDPR
Article 58(2)(i) GDPR
Article 83(2)(f) GDPR
Article 83(2)(g) GDPR
Article 83(5) GDPR
|National Case Number/Name:||PS/00320/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA (AEPD) fined an accommodation services company €6000 for signing a contract on behalf of the claimant without their consent.
English Summary[edit | edit source]
Facts[edit | edit source]
An action for breach of contract was filed against the claimant. The claimant stated that they only became aware of the contract when the lawsuit was filed, because the respondent (the accommodation company) had signed the contract on the claimant’s behalf without the claimant knowing.
Dispute[edit | edit source]
Were the actions of the respondent a violation of the GDPR?
Holding[edit | edit source]
The AEPD held that the actions of the company violated Article 6 GDPR. According to the decision, acting as the claimant’s personal representative and signing a contract on their behalf without their consent, meant that the company had processed the claimant’s personal data without a lawful ground for doing so.
The AEPD fined the company €6000. They considered the respondent’s lack of cooperation with the AEPD during the investigation of the complaint, and the respondent’s use of the claimant’s basic personal identifiers (name, address and ID number) during the processing, to be aggravating factors in determining the amount of the fine.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/6 Procedure No.: PS / 00320/2020 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following: BACKGROUND FIRST: D. A.A.A., in the name and on behalf of D. B.B.B. (hereinafter, the claimant) on April 16, 2020 he filed a claim with the Agency Spanish Data Protection. The claim is directed against Servicio de Responsible Accommodations, S.L. with NIF B19517911 (hereinafter, the claimed one). The claimant states that, in March 2019, he had knowledge of the existence of a lawsuit filed against him for breach of contract deposit supposedly held on July 10, 2018, in which the entity denounced claimed the status of her legal representative and signed the contract in your name, without authorization or representation for it. The treatment of the claimant's personal data without legal basis. Provides the deposit contract dated July 10, 2018. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5 December, Protection of Personal Data and guarantee of digital rights (LOPDGDD), which has provided a mechanism, prior to the admission for processing of the claims made before the Spanish Agency for Data Protection, consisting of transferring them to the Data Protection Delegates designated by those responsible or in charge of the treatment, for the purposes provided in article 37 of the aforementioned norm, or to them when they have not been designated, the claim presented by the claimant to the defendant, to proceed with his analysis and respond to this Agency within a month. Within the framework of file E / 03725/2020, by means of a document signed on June 5 2020, the claim was transferred to the defendant requesting that, in the within a month, send the following information: 1. The decision adopted to purpose of this claim. 2. In the event of exercise of rights regulated in articles 15 to 22 of the RGPD, accreditation of the response provided to the claimant. Thus, the defendant was notified electronically on June 9, 2020, as evidenced by the certificate issued by the FNMT that works in the proceedings. After the period granted to the claimed person without having responded to the request for information, in accordance with the provisions of article 65.2 of the LOPDGDD, the agreement for admission for processing is signed on September 16 of this year of this claim. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/6 THIRD: On October 8, 2020, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure to the claimed, by the alleged violation of Article 6.1 of the RGPD, typified in Article 83.5.a) of the RGPD. Said agreement was notified electronically on October 20, 2020 at reclaimed. FOURTH: Formally notified of the initiation agreement, the one claimed at the time of the This resolution has not submitted a brief of allegations, so it is application of the provisions of article 64 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations, which in its Section f) establishes that in case of not making allegations within the established period on the content of the initiation agreement, it may be considered a proposal for resolution when it contains a precise pronouncement about the responsibility imputed, for which a Resolution is issued. In view of all the actions, by the Spanish Agency for Data Protection In this proceeding, the following are considered proven facts, ACTS FIRST: That the defendant claimed the status of legal representative of the claimant and signed a deposit contract on July 10, 2018 in his name and consigning the personal data of the claimant, without authorization or representation for it. SECOND: It is stated in the deposit contract signed on July 10, 2018, that the claimed acts as the legal representative of the claimant, acted on behalf of and representation of the claimant, signing on their behalf and providing the data claimant's personal. THIRD: On October 8, 2020, this sanctioning procedure was initiated by the alleged violation of article 6.1) of the RGPD, being notified on October 20, 2020. Not having made any allegations, the claimed one, to the initiation agreement. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, in its article 4.11 defines the consent of the interested as “any manifestation of free will, specific, informed and C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/6 unequivocal by which the interested party accepts, either through a declaration or a clear affirmative action, the processing of personal data that concerns you ”. Article 6.1 of the RGPD establishes the following: 1. The treatment will only be lawful if at least one of the following is met terms: a) the interested party gave their consent for the processing of their data personal for one or more specific purposes; b) the treatment is necessary for the performance of a contract in which the interested is part or for the application at the request of this of measures pre-contractual; c) the treatment is necessary for the fulfillment of a legal obligation applicable to the person responsible for the treatment; d) the treatment is necessary to protect vital interests of the interested party or of another natural person; e) the treatment is necessary for the fulfillment of a mission carried out in public interest or in the exercise of public powers conferred on the person responsible for treatment; f) the treatment is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party, provided that on said interests do not prevail the interests or the rights and freedoms fundamental data of the interested party that require the protection of personal data, in particular when the interested party is a child. The provisions of letter f) of the first paragraph shall not apply to the treatment carried out by public authorities in the exercise of their functions. In this sense, Article 6.1 of the RGPD establishes that “in accordance with the provisions of article 4.11 of Regulation (EU) 2016/679, is understood as consent of the affected party any manifestation of free will, specific, informed and unequivocal by which it accepts, either through a statement or a clear affirmative action, the treatment of personal data that concerns him ”. III According to the available evidence, it is considered that the facts denounced, that is, that the defendant acted as the legal representative of the claimant, intervened on behalf and on behalf of the claimant, signing in his name and consigning the personal data of the claimant, without any legitimation on the part of the claimed party, constitutes an infringement of the principle of legitimation in the data processing. This action assumes that he processed the personal data of the claimant (name, surnames and D.N.I.), without having legitimacy for the treatment of the data of the claimant, thereby violating art. 6 of the RGPD. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/6 Well, with regard to the facts that are the subject of this claim, We must emphasize that the defendant, despite the repeated requests he received from the AEPD to explain the facts about which it relates, never answered or provided any evidence that would allow estimating that the treatment of the data of the claimant had been legitimate. We refer on the matter to the request for information that the AEPD addressed the defendant within the framework of E / 03725/2020. Request whose reception by him It is proven (certificate issued by the FNMT) that it happened on June 9, 2020. However, no response was received and on September 16, this year the claim was agreed to be admitted for processing. Reminder that, limited to the violation of article 6.1. of the RGPD, its purpose is to put it is clear that the respondent has had ample opportunities to provide evidence or documents that certify that, contrary to the statements and evidence documents provided by the claimant, the data processing that is the subject of The assessment in this case was adjusted to the Law. Likewise, the notification of the Agreement to initiate this procedure, which was notified electronically on October 20, 2020, without stating allegations the same. The lack of diligence displayed by the entity in complying with the Obligations imposed by the regulations for the protection of personal data It is thus obvious. A diligent compliance with the principle of legality in the treatment of third-party data requires that the person responsible for the treatment is in conditions to prove it (principle of proactive responsibility) In short, there is evidence in the file that the defendant treated the personal data of the claimant without standing for it. The behavior described violates article 6.1. of the RGPD and is subsumable in the sanctioning type of the article 83.5.a, of the RGPD. IV Article 72.1.b) of the LOPDGDD states that “depending on what it establishes Article 83.5 of Regulation (EU) 2016/679 are considered very serious and The infractions that suppose a substantial violation will prescribe after three years of the articles mentioned therein and, in particular, the following: c) The processing of personal data without any of the conditions of legality of the treatment in article 6 of Regulation (EU) 2016/679. " V Article 58.2 of the RGPD provides the following: “Each control authority will have all of the following corrective powers listed below: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/6 b) sanction any person responsible or in charge of the treatment with warning when the processing operations have violated the provisions of these Regulations; d) order the person in charge of the treatment that the operations of treatment are in accordance with the provisions of this Regulation, where appropriate, in a certain way and within a specified time; i) impose an administrative fine in accordance with article 83, in addition or in place of the measures mentioned in this section, depending on the circumstances of each particular case; SAW This offense can be sanctioned with a fine of € 20,000,000 maximum or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global business volume of the previous financial year, opting for the higher amount, in accordance with article 83.5 of the RGPD. Likewise, it is considered that the sanction to be imposed should be adjusted according to with the following criteria established in article 83.2 of the RGPD: As aggravating factors the following: - The null cooperation with the AEPD in order to remedy the infraction and mitigate its effects (article 83.2.f, of the RGPD) -Basic personal identifiers (name, surname, address, D.N.I.) (article 83.2 g). Therefore, in accordance with the applicable legislation and the criteria of graduation of the sanctions whose existence has been accredited, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: IMPOSE SERVICIO DE ALOJAMIENTOS RESPONSABLES, S.L., with NIF B19517911, for a violation of Article 6.1 of the RGPD, typified in Article 83.5 of the RGPD, a fine of 6,000 euros (six thousand euros). SECOND: NOTIFY this resolution to the ACCOMMODATION SERVICE RESPONSIBLES, S.L. THIRD: Warn the sanctioned person that the sanction imposed by a Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number of procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/6 Spanish Data Protection in the bank CAIXABANK, S.A .. In case Otherwise, it will be collected in the executive period. Notification received and once executive, if the execution date is found Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment volunteer will be until the 20th day of the following or immediately subsequent business month, and if between the 16th and the last day of each month, both inclusive, the payment term It will be until the 5th of the second following or immediate business month. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may file, optionally, an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to count from the day after notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, may provisionally suspend the final resolution through administrative channels if the interested party expresses his intention to file contentious-administrative appeal. If this is the case, the interested party must formally communicate this fact through writing addressed to the Spanish Agency for Data Protection, presenting it through of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica- web /], or through any of the other records provided for in art. 16.4 of the cited Law 39/2015, of October 1. You must also transfer to the Agency the documentation proving the effective filing of the contentious appeal- administrative. If the Agency was not aware of the filing of the appeal contentious-administrative within a period of two months from the day following the notification of this resolution would terminate the precautionary suspension. 938-300320 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es