AEPD - PS/00464/2020
|AEPD - PS/00464/2020|
|Relevant Law:||Article 32(1) GDPR|
|National Case Number/Name:||PS/00464/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD decision (in ES)|
The AEPD fined a controller €3000 for abandoning documentation containing personal data next to a building, which was considered a data breach and therefore a violation of Article 32(1) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
The Police Force of Navarra (Spain) reported to the AEPD the fact that they had found documentation held by controller next to a garbage container in a building. The documents included personal data of clients and suppliers. The police officers tried to locate the controller, but the business activity had ceased the activity at their premises. However, the person responsible for the company responded to a communication from the police informing that they had ceased their activity and that they had disposed of the "files that they could".
Dispute[edit | edit source]
Did the controller appropriately process the personal data under its responsibility by adopting the necessary technical and organizational measures?
Holding[edit | edit source]
The AEPD concluded that the facts constitute a personal data breach and that the controller had not adopted the necessary technical and organizational measures to prevent it. The AEPD reminds that the GDPR does not require the adoption of specific measures, but that controller must assess in each case what measures are necessary according to a risk assessment.
The AEPD found that there was therefore a violation of Article 32(1) GDPR.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/10 Procedure No.: PS / 00464/2020 RESOLUTION OF SANCTIONING PROCEDURE Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: The POLICIA FORAL DE NAVARRA (hereinafter, the claimant) dated 08/07/2020 sent a complaint bulletin to the Spanish Agency for the Protection of Data. The claim is directed against KUKIMBIA S.L., with NIF B99352023 (in ahead, the claimed one). The reasons on which you base the claim are that you have found abandoned documentation containing personal data, from a company that abandoned a warehouse adjacent to the area where said documentation has been found abandoned. Photographs are provided with the abandoned material. SECOND: Upon receipt of the claim, the General Sub-Directorate of Data Inspection proceeded to carry out the following actions: On 09/28/2020, the claim submitted for analysis was transferred to the respondent. and communication to the claimant of the decision adopted in this regard. Likewise, he is required so that within a month it sent to the determined Agency information: - Copy of the communications, of the adopted decision that has been sent to the claimant regarding the transfer of this claim, and accreditation that the claimant has received the communication of that decision. - Report on the causes that have motivated the incidence that has originated the claim. - Report on the measures adopted to prevent the occurrence of similar incidents. - Any other that you consider relevant. There is no response from the complainant to the request for information from the AEPD. THIRD: On 12/09/2020, in accordance with article 65 of the LOPDGDD, the Director of the Spanish Agency for Data Protection agreed to admit for processing the claim filed by the claimant against the defendant. FOURTH: On 02/12/20210, the Director of the Spanish Protection Agency of Data agreed to initiate a sanctioning procedure for the claimed party, for the alleged infringement of article 32.1 of the RGPD, typified in article 83.4.a) of the aforementioned Regulation, and considered for the purposes of prescription as a serious offense in the article 73.g) of the LOPDGDD, a penalty of 3,000 euros. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/10 FIFTH: Notified the initiation agreement, the one claimed at the time of the present resolution has not submitted a brief of allegations, so it is applicable indicated in article 64 of Law 39/2015, of October 1, on the Procedure Common Administrative of Public Administrations, which in its section f) establishes that in case of not making allegations within the term provided on the content of the initiation agreement, it may be considered a proposal for resolution when it contains a precise statement about the responsibility imputed, for which a Resolution is issued. SIXTH: Of the actions carried out in this proceeding, there have been accredited the following: PROVEN FACTS FIRST: The 08/07/2020 has an entry in the AEPD police report bulletin FORAL DE NAVARRA (hereinafter, the claimant), stating the abandonment of documentation of clients and suppliers of the claimed, containing data from personal character, next to a garbage container and third party access. SECOND: The defendant is a company incorporated in Zaragoza on 08/03/2012 and its corporate purpose is the storage, distribution and transportation throughout the national territory and foreigner of all kinds of merchandise. THIRD: Report No. 01132421 of the Navarra Foral Police has been provided, matter of documentation spilled in the Ezkarbarte de Arre industrial estate, pointing out that their passage through the aforementioned polygon they observed the existence of documentation abandoned containing personal data of carriers and customers (name and surnames, DNI number, telephone number) from the company *** COMPANY.1 located in the transport city at *** LOCALIDAD.1, *** ADDRESS.1; who went to the company, although they verified that they no longer operated in the area, having ceased their activity in the ship they had rented; however, they tried to contact the cited company; On 06/16/2020 they received the following response from it: Good Morning, In response to the photos received On XX / YY / 2020 we vacated the facilities of *** COMPANY. 2. Removing the merchandise and office supplies and "files that we could." At that time we did not have access or keys to the facilities again. FOURTH: Photographs of abandoned documentation are provided: letters, delivery notes, etc., containing personal data. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each control authority, and as established in articles 47 and 48 of the LOPDGDD, C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/10 the Director of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations, in its article 64 “Agreement of initiation in the procedures of a sanctioning nature ”, provides: "1. The initiation agreement will be communicated to the instructor of the procedure, with transfer of how many actions exist in this regard, and the interested parties will be notified, understanding in any case the accused as such. Likewise, the initiation will be communicated to the complainant when the regulatory norms of the procedure so foresee it. 2. The initiation agreement must contain at least: a) Identification of the person or persons allegedly responsible. b) The facts that motivate the initiation of the procedure, its possible qualification and the sanctions that may correspond, without prejudice to what result of the instruction. c) Identification of the instructor and, where appropriate, Secretary of the procedure, with express indication of the regime of challenge of the same. d) Competent body for the resolution of the procedure and regulation that attributes such competence, indicating the possibility that the alleged responsible can voluntarily acknowledge their responsibility, with the effects provided for in article 85. e) Provisional measures that have been agreed by the body competent to initiate the sanctioning procedure, without prejudice to those that can be adopted during the same in accordance with article 56. f) Indication of the right to make allegations and to the hearing in the procedure and the deadlines for its exercise, as well as an indication that, in case of not making allegations within the term provided on the content of the initiation agreement, this may be considered a resolution proposal when it contains a precise statement about liability charged. 3. Exceptionally, when at the time of issuing the initiation agreement there are not enough elements for the initial qualification of the facts that motivate the initiation of the procedure, the aforementioned qualification may be carried out in a phase later by preparing a Statement of Charges, which must be notified to the interested". In application of the previous precept and taking into account that they have not formulated allegations to the initiation agreement, it is necessary to resolve the procedure initiated. III Article 58 of the RGPD, Powers, states: "two. Each supervisory authority shall have all of the following powers corrective measures listed below: C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/10 (…) i) impose an administrative fine in accordance with article 83, in addition or in instead of the measures mentioned in this section, according to the circumstances of each particular case; (…) " Article 5 of the RGPD establishes the principles that must govern the treatment of personal data and mentions among them that of "integrity and confidentiality". The aforementioned article points out that: "1. The personal data will be: (…) f) treated in such a way as to guarantee adequate security of the personal data, including protection against unauthorized processing or illicit and against its loss, destruction or accidental damage, through the application appropriate technical or organizational measures ('integrity and confidentiality »)”. (…) " IV The denounced events materialize in the abandonment of documentation in the public thoroughfare in which personal data corresponding to the claimed person appears, violating the regulations on data protection. The security of personal data is regulated in articles 32, 33 and 34 of the GDPR. Article 32 of the RGPD "Security of treatment", establishes that: "1. Taking into account the state of the art, the application costs, and the nature, scope, context and purposes of the treatment, as well as risks of variable probability and severity for people's rights and freedoms physical, the person in charge and the person in charge of the treatment will apply technical measures and appropriate organizational arrangements to ensure a level of security appropriate to the risk, that in your case include, among others: a) pseudonymisation and encryption of personal data; b) the ability to guarantee confidentiality, integrity, availability and permanent resilience of treatment systems and services; c) the ability to restore availability and access to data personnel quickly in the event of a physical or technical incident; d) a process of regular verification, evaluation and assessment of effectiveness of the technical and organizational measures to guarantee the safety of the treatment. 2. When evaluating the adequacy of the security level, particularly the take into account the risks presented by the data processing, in particular as C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/10 consequence of accidental or illegal destruction, loss or alteration of data personal data transmitted, preserved or otherwise processed, or the communication or unauthorized access to such data. 3. Adherence to a code of conduct approved in accordance with article 40 or to a certification mechanism approved under article 42 may serve as an element to demonstrate compliance with the requirements established in section 1 of the this article. 4. The person in charge and the person in charge of the treatment will take measures to ensure that any person acting under the authority of the controller or the manager and have access to personal data can only process said data following the instructions of the person in charge, unless it is obliged to do so under the Law of the Union or of the Member States ”. The violation of article 32 is classified in article 83.4.a) of the cited GDPR in the following terms: "4. Violations of the following provisions will be sanctioned, in accordance with with paragraph 2, with administrative fines of maximum EUR 10 000 000 or, in the case of a company, an amount equivalent to a maximum of 2% of the total annual global business volume of the previous financial year, opting for the highest amount: a) the obligations of the controller and the processor pursuant to articles 8, 11, 25 to 39, 42 and 43. (…) " For its part, the LOPDGDD in its article 71, Infractions, states that: “The acts and conducts referred to in sections 4, constitute offenses. 5 and 6 of article 83 of Regulation (EU) 2016/679, as well as those resulting contrary to the present organic law ”. And in its article 73, for the purposes of prescription, it qualifies as "Infractions considered serious ”: "Based on the provisions of article 83.4 of Regulation (EU) 2016/679 are considered serious and will prescribe after two years the infractions that suppose a substantial violation of the articles mentioned therein and, in particular, the following: (…) g) The breach, as a consequence of the lack of due diligence, of the technical and organizational measures that have been implemented in accordance with as required by article 32.1 of Regulation (EU) 2016/679 ”. (…) The facts revealed in this claim are specified in the existence of a security incident in the complainant's systems, making it possible to its vulnerability by allowing documentation containing data from C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/10 personal character, were abandoned, allowing access to the data contained in them. V The GDPR defines personal data security breaches as “All those security violations that cause the destruction, loss or accidental or illegal alteration of personal data transmitted, stored or processed otherwise, or unauthorized communication or access to said data ”. From the documentation in the file there are evident indications of that the complainant has violated article 32.1 of the RGPD, due to a breach of security in their systems allowing access to personal data contained in documents that were abandoned by the defendant with possible violation of security measures. It should be noted that the RGPD in the aforementioned precept does not establish a list of the security measures that are applicable according to the data that are object of treatment, but establishes that the controller and the person in charge of the treatment will apply technical and organizational measures that are appropriate to the risk involved in the treatment, taking into account the state of the art, the costs of application, the nature, scope, context and purposes of the treatment, the risks of probability and seriousness for the rights and freedoms of the persons concerned. Likewise, the security measures must be adequate and proportionate to the risk detected, noting that the determination of the technical measures and organizational must be carried out taking into account: pseudonymisation and encryption, ability to guarantee confidentiality, integrity, availability and resilience, the ability to restore availability and access to data after an incident, process verification (not audit), evaluation and assessment of the effectiveness of measures. In any case, when evaluating the adequacy of the security level, the particularly take into account the risks presented by data processing, such as consequence of accidental or illegal destruction, loss or alteration of data personal data transmitted, preserved or otherwise processed, or the communication or unauthorized access to said data and that could cause damages physical, material or immaterial. In this same sense, recital 83 of the RGPD states that: “(83) In order to maintain security and prevent the treatment from infringing the provided in this Regulation, the person in charge or the person in charge must evaluate the risks inherent to the treatment and apply measures to mitigate them, such as the encryption. These measures must guarantee an adequate level of security, including the confidentiality, taking into account the state of the art and the cost of its application with respect to the risks and the nature of the personal data that must protect yourself. When assessing risk in relation to data security, you should take into account the risks arising from the processing of personal data, such as accidental or illegal destruction, loss or alteration of personal data transmitted, preserved or otherwise processed, or communication or access does not C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/10 authorized to said data, susceptible in particular to cause damages physical, material or immaterial ”. In the present case, as stated in the facts and in the framework of the investigation file E / 07635/2020, the AEPD transferred to the complainant the 09/28/2020 the written claim submitted for analysis requesting the provision of information related to the incident claimed, without having received in this body any response. Responsibility of the claimed person is determined by the incident / bankruptcy of security revealed by the Navarra Provincial Police, since it is responsible for making decisions aimed at effectively implementing the appropriate technical and organizational measures to ensure a level of security appropriate to the risk to ensure the confidentiality of the data, restoring its availability and prevent access to them in the event of a physical or technical incident. However, the documentation provided shows that the entity has not only breached this obligation, but also the adoption of measures is unknown respect, despite having given notice of the claim presented. In accordance with the foregoing, it is estimated that the claimed would be allegedly responsible for the violation of the RGPD: the violation of article 32.1, offense typified in its article 83.4.a). SAW In order to establish the administrative fine to be imposed, they must observe the provisions contained in articles 83.1 and 83.2 of the RGPD, which they point out: "1. Each supervisory authority will guarantee that the imposition of fines administrative under this article for the infractions of this Regulations indicated in paragraphs 4, 5 and 6 are in each individual case effective, proportionate and dissuasive. 2. Administrative fines will be imposed, depending on the circumstances of each individual case, as an additional or substitute title for the measures contemplated in Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine administrative and its amount in each individual case will be duly taken into account: a) the nature, severity and duration of the offense, taking into account the nature, scope or purpose of the processing operation in question as well as the number of affected stakeholders and the level of damage and damages they have suffered; b) intentionality or negligence in the infringement; c) any measure taken by the person in charge or in charge of the treatment to alleviate the damages suffered by the interested parties; d) the degree of responsibility of the person in charge of the treatment, taking into account the technical or organizational measures that have applied by virtue of articles 25 and 32; C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 8/10 e) any previous infringement committed by the person in charge or the person in charge of the treatment; f) the degree of cooperation with the supervisory authority in order to establish remedy the violation and mitigate the possible adverse effects of the violation; g) the categories of personal data affected by the infringement; h) the way in which the supervisory authority learned of the infringement, in particular if the person in charge or the person in charge notified the infraction and, in such case, what extent; i) when the measures indicated in article 58, paragraph 2, have been previously ordered against the person responsible or the person in charge in relation to the same matter, compliance with said measures; j) adherence to codes of conduct under article 40 or to mechanisms certification approved in accordance with Article 42, and k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, direct or indirectly, through the infringement. In relation to letter k) of article 83.2 of the RGPD, the LOPDGDD, in its Article 76, “Sanctions and corrective measures”, establishes that: "two. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679 may also be taken into account: a) The continuing nature of the offense. b) The linking of the activity of the offender with the performance of treatments of personal data. c) The benefits obtained as a result of the commission of the offense. d) The possibility that the affected person's conduct could have led to the commission of the offense. e) The existence of a merger process by absorption after the commission of the infringement, which cannot be attributed to the absorbing entity. f) Affecting the rights of minors. g) Have, when not mandatory, a delegate for the protection of data. h) The submission by the person in charge or in charge, with character voluntary, to alternative dispute resolution mechanisms, in those cases in which there are controversies between those and any interested." - In accordance with the transcribed precepts, in order to establish the amount of the sanction of a fine to be imposed in the present case for the offense typified in the Article 83.4.a) of the RGPD for which the claimed person is responsible, they are considered concurrent the following factors: The merely local scope of the treatment carried out by the claimed person. The nature and severity of the offending conduct as the documentation Abandoned affects the personal data of many people. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/10 The claimed entity does not record that it has adopted measures to prevent produce similar incidents; It has not responded to the request either informative from the Agency which affects the absence of cooperation with the supervisory authority in order to remedy the infringement and mitigate the possible adverse effects of it. Although there is no evidence that the defendant had acted maliciously, the conduct observed is deeply negligent. The linking of the offender's activity with the performance of treatment of Personal data. The claimed is a small business. Therefore, in accordance with the applicable legislation and assessed the criteria of graduation of sanctions whose existence has been proven, The Director of the Spanish Data Protection Agency RESOLVES: FIRST: IMPOSE KUKIMBIA S.L., with NIF B99352023, for an infraction of the Article 32.1 of the RGPD, typified in article 83.4.a) of the RGPD and considered to Prescription effects as a serious offense, a fine of € 3,000 (three thousand euros). SECOND: NOTIFY this resolution to KUKIMBIA S.L. with NIF B99352023. THIRD: Warn the sanctioned person that the sanction imposed by a Once this resolution is enforceable, in accordance with the provisions of the art. 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter LPACAP), within the payment period voluntary established in art. 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number procedure that appears in the heading of this document, in the account restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case Otherwise, it will be collected in the executive period. Once the notification has been received and once it is executed, if the date of execution is finds between the 1st and the 15th of each month, both inclusive, the deadline to carry out the Voluntary payment will be until the 20th of the following or immediately subsequent business month, and if is between the 16th and last days of each month, both inclusive, the term of the payment will be up to the 5th of the second following or immediate business month. In accordance with the provisions of article 50 of the LOPDGDD, the This Resolution will be made public once it has been notified to the interested parties. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/10 Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the interested parties may file, optionally, an appeal for reversal before the Director of the Spanish Agency for Data Protection within a period of month from the day following notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within two months from the day following notification of this act, as provided in article 46.1 of the referred Law. Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of the LPACAP, the firm resolution may be suspended in an administrative way If the interested party expresses his intention to file a contentious appeal- administrative. If this is the case, the interested party must formally communicate this made by writing to the Spanish Data Protection Agency, Presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through any of the rest records provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. Also must forward to the Agency the documentation that proves the effective filing of the contentious-administrative appeal. If the Agency is not aware of the filing of the contentious-administrative appeal within a period of two months from the day after the notification of this resolution, I would terminate the precautionary suspension. Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es