AEPD - TD/00164/2020
|AEPD - TD/00164/2020|
|Relevant Law:||Article 12 GDPR|
Article 17 GDPR
|Parties:||Associació Catalana per la Participació Política|
|National Case Number/Name:||TD/00164/2020|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Francesc Julve Falcó|
The Spanish DPA (AEDP) accepted a complaint against 'Associació Catalana per la Participació Política' as the organisation failed to respond to a citizen's request for suppression (Article 17 GDPR).
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant exercised a right of deletion against the respondent, but his request has not received the legally established response.
The AEPD admitted the complaint for processing and granted the respondent entity the option to present allegations within fifteen days.
The respondent did not reply to the AEPD and did not prove that it had responded to the claimant's request for deletion.
Dispute[edit | edit source]
Is the lack of response an infringement of the data subject's right to erasure (Article 17 GDPR)?
Holding[edit | edit source]
The AEPD upheld the complaint and urged the respondent to reply to the complainant within ten working days, stating whether it had complied with the right of erasure or whether it had refused the request for erasure, stating its reasons.
In the event of non-compliance, the AEPD considers that this could lead to a sanction, in accordance with article 58(2) GDPR.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/5 File No.: TD / 00164/2020 RESOLUTION NO: R / 00011/2021 Considering the claim made on March 7, 2020 before this Agency by A.A.A. ,(to from now on the complaining party), against ASSOCIACIÓ PER LA PARTICIPACIÓ POLICY TO CATALUNYA, (from now on the claimed part), for not having been duly attended to your right of deletion. The procedural actions provided for in Title VIII of the Law have been carried out. Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD), the following have been verified ACTS FIRST: The complaining party exercised the right of deletion against the complained party, without that your request has received the legally established reply. It contributes diverse documentation related to the claim filed with this Agency and about the exercise of the right exercised. SECOND: Once the procedure provided for in article 65.4 of the LOPDGDD has been completed, The claim was admitted for processing and the claimed entity was granted hearing, so that within fifteen business days the allegations that deemed convenient. The claimed entity has not replied to this Agency nor has it proven that there is responded to the request for the exercise of rights that was presented by the complaining party. FOUNDATIONS OF LAW FIRST: The Director of the Spanish Agency for Data Protection, in accordance with the provisions of section 2 of article 56 in in relation to paragraph 1 f) of article 57, both of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, RGPD); and in article 47 of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). SECOND: Article 64.1 of the LOPDGDD, provides that: "one. When the procedure refers exclusively to the lack of attention of a request to exercise the rights established in articles 15 to 22 of the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/5 Regulation (EU) 2016/679, will start by agreement of admission for processing, which is adopt in accordance with the provisions of the following article. In this case, the period to resolve the procedure will be six months from From the date the claimant was notified of the agreement to admission for processing. After this period, the interested party may consider estimated your claim. " THIRD: Article 12 of Regulation (EU) 2016/679, of April 27, 2016, General Data Protection (RGPD), provides the following: "one. The person in charge of the treatment will take the appropriate measures to facilitate the interested party all information indicated in articles 13 and 14, as well as any communication pursuant to articles 15 to 22 and 34 regarding the treatment, in concise, transparent, intelligible and easily accessible form, with clear language and straightforward, particularly any information specifically directed at a child. The Information will be provided in writing or by other means, including, if applicable, by electronic means. When requested by the interested party, the information may provided verbally provided that the identity of the interested party is proven by other media. 2. The person in charge of the treatment will facilitate the interested party the exercise of their rights under Articles 15 to 22. In the cases referred to in the Article 11, paragraph 2, the controller shall not refuse to act at the request of the interested party in order to exercise their rights under articles 15 to 22, unless you can show that you are unable to identify the interested. 3. The person responsible for the treatment will provide the interested party with information regarding their proceedings on the basis of a request pursuant to Articles 15 to 22, and, in any case, within one month from receipt of the request. This period may be extended for another two months if necessary, taking into account count the complexity and number of requests. The person in charge will inform the interested party of any of said extensions within a period of one month from the receipt of the request, indicating the reasons for the delay. When the interested party submit the request by electronic means, the information is will facilitate by electronic means when possible, unless the interested party request that it be provided in another way. 4. If the person responsible for the treatment does not comply with the request of the interested party, will inform without delay, and no later than one month after receiving the request, the reasons for not acting and the possibility of submitting a claim before a control authority and to exercise legal actions. 5. The information provided by virtue of articles 13 and 14 as well as all communication and any action carried out pursuant to articles 15 to 22 and 34 will be free. When the requests are manifestly unfounded or excessive, especially due to its repetitive nature, the person responsible for the treatment may: a) charge a reasonable fee based on the administrative costs incurred to facilitate information or communication or carry out the requested action, or b) refuse to act on the request. The data controller will bear the burden of proving the character manifestly unfounded or excessive of the request. 6. Without prejudice to the provisions of article 11, when the person responsible for the treatment has reasonable doubts regarding the identity of the person C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/5 physicist making the request referred to in articles 15 to 21, may request that the additional information necessary to confirm the identity of the interested. 7. The information that must be provided to the interested parties by virtue of articles 13 and 14 may be transmitted in combination with standard icons that allow provide easily visible, intelligible and clearly legible a adequate overview of the planned treatment. The icons that are submitted in electronic format will be machine readable. 8. The Commission shall be empowered to adopt delegated acts of conformity with Article 92 in order to specify the information to be submitted to through icons and the procedures for providing standard icons. " FOURTH: Article 12 of the LOPDGDD determines the following: 1. The rights recognized in articles 15 to 22 of the Regulation (EU) 2016/679, may be exercised directly or through a legal representative or voluntary. 2. The person responsible for the treatment will be obliged to inform the affected party about the means at your disposal to exercise the rights that correspond to you. The means must be easily accessible to the affected person. The exercise of Right may not be denied for the sole reason of choosing the affected by another medium. 3. The person in charge may process, on behalf of the person in charge, requests for exercise made by those affected of their rights if so established in the contract or legal act that binds them. 4. Proof of compliance with the duty to respond to the request to exercise Your rights formulated by the affected party will fall on the person responsible. 5. When the laws applicable to certain treatments establish a special regime that affects the exercise of the rights provided for in Chapter III of Regulation (EU) 2016/679, the provisions of those will be followed. 6. In any case, the holders of parental authority may exercise on behalf of and representation of minors under fourteen the rights of access, rectification, cancellation, opposition or any other that could correspond to them in the context of this organic law. 7. The actions carried out by the person in charge of the treatment to meet requests for the exercise of these rights, without prejudice to the provisions of articles 12.5 and 15.3 of the Regulation (EU) 2016/679 and in sections 3 and 4 of article 13 of this organic law. " FIFTH: Article 17 of the RGPD provides that: "one. The interested party shall have the right to obtain without undue delay from the person responsible of the treatment the deletion of the personal data that concerns him, which will be obliged to delete without undue delay the personal data when any of the following circumstances concur: a) the personal data is no longer necessary in relation to the purposes for which that were collected or otherwise treated; b) the interested party withdraws the consent on which the treatment of in accordance with Article 6 (1) point (a) or Article 9 (2) point a), and it is not based on another legal basis; C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/5 c) the interested party objects to the processing in accordance with article 21, paragraph 1, and no other legitimate reasons for the treatment prevail, or the interested party object to the processing pursuant to Article 21 (2); d) the personal data has been unlawfully processed; e) personal data must be deleted to fulfill an obligation legal established in the Law of the Union or of the Member States that apply to the person responsible for the treatment; f) the personal data have been obtained in relation to the offer of services of the information society mentioned in article 8, paragraph 1. 2. When you have made the personal data public and are obliged, by virtue of the provisions of section 1, to delete said data, the person responsible for the treatment, taking into account the available technology and the cost of your implementation, adopt reasonable measures, including technical measures, with a view to inform those responsible who are treating the personal data of the request of the interested party to delete any link to these personal data, or any copy or replica thereof. 3. Sections 1 and 2 will not apply when the treatment is necessary: a) to exercise the right to freedom of expression and information; b) for the fulfillment of a legal obligation that requires the treatment of data imposed by the law of the Union or the Member States that applies to the person responsible for the treatment, or for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the responsable; c) for reasons of public interest in the field of public health in accordance with article 9, paragraph 2, letters h) and i), and paragraph 3; d) for archival purposes in the public interest, scientific research purposes or historical or statistical purposes, in accordance with article 89, paragraph 1, in the To the extent that the right indicated in paragraph 1 could make it impossible to seriously impede the achievement of the objectives of such treatment, or e) for the formulation, exercise or defense of claims. " SIXTH: In the case analyzed here, the complaining party exercised its right to deletion and after the period established in accordance with the aforementioned regulations, your request did not obtain the legally required response. The aforementioned standards do not allow the request to be ignored as if it were not had raised, leaving it without the answer that must be issued by the responsible, even in the event that there is no data of the interested party in the files of the entity or even in those cases in which it does not meet the stipulated requirements, in which case the recipient of said request also comes obliged to request the correction of the deficiencies observed or, where appropriate, deny the request with reasons indicating the reasons why it is not applicable consider the right in question. Therefore, the request that is formulated obliges the person in charge to give an express response, in In any case, using any means that justifies the receipt of the reply. Given that a copy of the necessary communication that must be addressed to the claimant informing him of the decision he has taken regarding the request to exercise rights, the claim that originated the C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/5 present procedure. Considering the cited precepts and others of general application, the Director of the Spanish Agency for Data Protection RESOLVES: FIRST: ESTIMATE the claim made by A.A.A. and urge ASSOCIACIÓ FOR POLITICAL PARTICIPATION IN CATALUNYA with NIF G67207472, so that, in within the ten business days following notification of this resolution, Send the complaining party a certification stating that you have attended the right of deletion exercised by the latter or is reasonedly denied indicating the causes for which the requested deletion does not proceed. The actions carried out As a consequence of this Resolution, they must be communicated to this Agency in the same period. Failure to comply with this resolution could lead to commission of the offense typified in article 72.1.m) of the LOPDGDD, which is sanction, in accordance with art. 58.2 of the RGPD. SECOND: NOTIFY this resolution to A.A.A. and ASSOCIACIÓ PER LA POLITICAL PARTICIPATION IN CATALUNYA. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the Interested parties may file, optionally, an appeal for reconsideration before the Director of the Spanish Agency for Data Protection within a month to count from the day after notification of this resolution or directly contentious-administrative appeal before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-administrative jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 1034-080719 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es