APDCAT (Catalonia) - EXP202409570
From GDPRhub
| APDCAT - EXP202409570 | |
|---|---|
 | |
| Authority: | APDCAT (Catalonia) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 7 GDPR Law 39/2015 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 19.11.2024 |
| Decided: | 28.02.2026 |
| Published: | 28.02.2025 |
| Fine: | 600 EUR |
| Parties: | Club Esportiu |
| National Case Number/Name: | EXP202409570 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | cwa |
The DPA fined a junior football club €600 as the consent collected from parents for the taking of photographs of their child was not freely given, thus violating Article 7 GDPR.
English Summary
Facts
Parents registered their son to play in junior football Summer Camp with Club Esportiu (controller). At the time of registration, the parents indicated on the form that they did not wish to consent for photographs to be taken of their son.
The club followed up with the parents, urging them to consent to the photographs being taken in order for the registration to continue. The club noted that in any event, they could not guarantee that their child would not appear in photographs taken.
The parents filed a complaint with the Catalan DPA (APDCAT) on June 19th 2024.
During the proceedings, the controller argued that they did not have facial recognition technology and could thus not guarantee that specific children did not appear in group photos taken during the camp. They also claimed that the photos taken were only for use in club publications and their social network pages, and that the complaint should be dismissed.
Holding
The DPA began their investigation on 19th November 2024.
The DPA highlighted the fact that the parents were informed that without consenting to the photographs of their child being taken, they could not proceed with registration, and held that the consent given would not have been “free”, as required in Article 7 GDPR. The DPA according found that the controller infringed Article 7 GDPR.
The DPA also noted that the absence of anonymisation software on the part of the controller was not an excuse for not offering the parents a genuine choice in consenting to the processing.
The DPA initially set the fine at €1,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €600.
The controller was also ordered to bring their processing in line with the requirements of Article 7 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/14 File No.: EXP202409570 RESOLUTION TO TERMINATE THE PROCEDURE BY RECOGNITION OF RESPONSIBILITY AND VOLUNTARY PAYMENT Of the procedure instructed by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On November 19, 2024, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against CLUB ESPORTIU VILA OLÍMPICA (hereinafter, CLUB ESPORTIU), through the agreement that is transcribed: << File No.: EXP202409570 AGREEMENT TO START SANCTIONING PROCEDURE Of the actions carried out by the Spanish Data Protection Agency and based on the following, FACTS FIRST: On June 19, 2024, a complaint was filed with the Spanish Data Protection Agency for a possible infringement attributable to CLUB ESPORTIU VILA OLIMPICA (hereinafter CLUB ESPORTIU) with NIF G63607022. The facts brought to the attention of this authority are: That when registering his minor son for sports activities offered by CLUB ESPORTIU, he marked on the registration form his refusal to have images of his son collected by CLUB ESPORTIU, after which said club contacted him via email, urging him to accept the collection of images in order to continue with the registration; the club indicated that they could not guarantee that the minor would not appear in any of the snapshots they collect, which the parent understands to be a procedure contrary to data protection regulations. Along with the complaint, the following must be provided: - Copy of the registration form. - Communications exchanged by email with the ESPORTIU CLUB. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 2/14 - Original complaint to the Catalan Data Protection Authority. SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), said complaint was forwarded to the ESPORTIU CLUB, so that it could proceed to analyze it and inform this Agency within a period of one month of the actions taken to comply with the requirements provided for in the data protection regulations. The notification of the transfer of the claim, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP) by electronic notification, was not collected by the respondent party, within the period of availability, and is understood to have been rejected in accordance with the provisions of art. 43.2 of the LPACAP on 07/13/2024, as stated in the certificate in the file. Although the notification was carried out by electronic means, for information purposes a copy was sent by postal mail that was duly notified on 08/30/2024. In this notification, the respondent party was reminded of its obligation to interact electronically with the Administration, and was informed of the means of access to said notifications, reiterating that, from now on, it would be notified exclusively by electronic means. On 09/30/2024, the ESPORTIU CLUB submitted a response letter in which it states that it does not know who made the claim, since this information has not been transferred to it by this Agency. It is reported that the interested party can obtain a copy of the administrative file. In this letter, reference is made to the report issued by the club's Data Protection Delegate, dated 09/30/2024, in which it states that for the Summer 2024 Campus, there are several communications from parents who, at the time of registration, indicated that they wanted to check the NO box regarding authorization to take photos of their children. In view of this, the Delegate informs that the association does not have facial recognition technology to guarantee that children do not appear in any group photo taken during sporting events and that the photos that are taken are only for the entity and for the sole purpose of having an archive of the teams and of the different sporting events and obtaining prizes, and some of them may be published in the club's publications. For all these reasons, she requests that this file be archived. THIRD: On September 19, 2024, in accordance with article 65 of the LOPDGDD, the claim was admitted for processing. FOURTH: According to the report dated 10/23/2024 collected from the AXESOR tool, the entity CLUB ESPORTIU is an Association established in 2007, and with a sales volume of (…) euros as of the date of the report. FUNDAMENTALS OF LAW C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 3/14 I Competence In accordance with the powers granted to each supervisory authority by article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. II Procedure Likewise, article 63.2 of the LOPDGDD determines that: “The procedures processed by the Spanish Data Protection Agency will be governed by the provisions of Regulation (EU) 2016/679, in this organic law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures”. In accordance with article 64 of the LOPDGDD, and taking into account the characteristics of the alleged infringement committed, a sanctioning procedure is initiated. The procedure will have a maximum duration of twelve months from the date of the start agreement. After this period, it will expire and, consequently, the proceedings will be filed, in accordance with the provisions of article 64 of the LOPDGDD. If you do not make any objections to this initiation agreement within the stipulated period, it may be considered a resolution proposal, as established in article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). III Preliminary questions In the present case, in accordance with the provisions of article 4.1 and 4.2 of the GDPR, there is evidence of the processing of personal data, since the CLUB ESPORTIU carries out, among other treatments, the collection and storage of data of natural persons such as names, surnames, date of birth, postal address, email address, telephone number, health card number, medical certificate and type of illnesses/allergies, if applicable. CLUB ESPORTIU carries out this activity in its capacity as data controller, since it is the party that determines the purposes and means of such activity, pursuant to article 4.7 of the GDPR. IV Obligation not fulfilled. Conditions for consent C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 4/14 Regarding the conditions for consent, Article 7 of the GDPR provides: "1. Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has consented to the processing of his or her personal data. 2. Where the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a way that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, and using clear and plain language. No part of the declaration that infringes this Regulation shall be binding. 3. The data subject shall have the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. Before giving consent, the data subject will be informed of this. It will be as easy to withdraw consent as it is to give it. 4. When assessing whether consent has been freely given, account will be taken to the greatest extent possible of whether, among other things, the execution of a contract, including the provision of a service, is subject to consent to the processing of personal data that are not necessary for the execution of said contract." In the present case, the intention was to register a minor in sports activities offered by the CLUB ESPORTIU, marking on the registration form the refusal to collect images of the minor while he was doing sports at said club. More specifically, the registration form, provided by both parties, states the following: “I give my consent for my image to appear clearly identifiable on the Club's website and its social networks in the form of a recording or images captured during the Club's events and activities YES NO” “I give my consent for my image to appear clearly identifiable on the club's website and its social networks in the form of a recording or images captured during the club's events and activities." (unofficial translation) The file contains the original registration form of the minor, to whom this claim refers, in which it is clearly seen that for this consent, the NO box has been crossed out. After receiving the aforementioned form and other documentation from the minor by email, the CLUB ESPORTIU contacted the minor's parent by email, urging him/her to accept the collection of images in order to continue with the registration. Proof of this are the emails in the file: 1. From the email account ***EMAIL.1 to the claimant's email account, with a copy ***EMAIL.2, which states: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 5/14 “I have indicated that we are NOT authorized to take photos or recordings for the club's social networks. The Club does not have facial recognition and cannot guarantee that they will be included in any photo. Do I want to continue with the registration? I must accept this option.” “You have marked that you do NOT authorize us to take photos or recordings for the club's social networks. The club does not have facial recognition and it cannot be guaranteed that you will not appear in any photos. Do you want to continue with the registration? (…).” (Unofficial translation) 1. The parent/guardian responds to the previous email, in the following terms: “Good morning, Aleshores had to change the form and explain that I cannot comply with both the data protection/confidentiality, right? Yes, we want to continue the registration.” “Then I should change the form and explain that I cannot comply with the data protection/confidentiality, right? (Unofficial translation) 2. The club reiterates to the parent, from the email accounts mentioned above: “I must accept the option of consent for photos in the registration and send it again” “(…) of photos in the registration and send it again”. (Unofficial translation) Specifically, consent is requested to “appear clearly identifiable on the club website and its social networks in the form of a recording or images”, that is, the processing of the image of the minor (personal data), would consist of the minor appearing clearly identifiable. From the transcribed emails it would be deduced that the complainant did not consent to such processing of data of his minor son and that in the event of having given it, he would not be free. And this is because the emails sent by the club would force the minor to accept the option of consent for photos in order to register the minor, said consent would be vitiated from the beginning and could be null and void by law. Furthermore, the fact of not having image anonymization software, which the Club claims, is not an obstacle to not respecting the wish of the claimant not to appear in photographs and/or videos. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 6/14 Therefore, in accordance with the evidence available at this time in the agreement to initiate sanctioning proceedings, and without prejudice to the outcome of the investigation, it is considered that the known facts could constitute an infringement, attributable to CLUB ESPORTIU, for violation of the article transcribed above. V Classification of infringement of Article 7 of the GDPR and classification for the purposes of prescription Article 83.5 of the GDPR classifies as an administrative infringement the infringement of the following articles, which shall be punishable, in accordance with paragraph 2, by administrative fines of a maximum of EUR 20,000,000 or, in the case of an undertaking, of a maximum of 4% of the total annual turnover of the previous financial year, whichever is higher: "a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9; b) the rights of data subjects pursuant to Articles 12 to 22; c) transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; d) any obligation in by virtue of the law of the Member States adopted pursuant to Chapter IX; e) failure to comply with a resolution or a temporary or definitive limitation of the processing or suspension of data flows by the supervisory authority in accordance with Article 58, paragraph 2, or failure to provide access in breach of Article 58, paragraph 1." For its part, the LOPDGDD in its Article 71, Infringements, states that: "The acts and conduct referred to in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this organic law, constitute infringements." For the sole purposes of the limitation period, Article 72.1 of the LOPDGDD establishes the following: "In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that are considered very serious and will be subject to a three-year statute of limitations shall be imposed on infringements constitute a substantial violation of the articles mentioned therein and, in particular, the following: c) Failure to comply with the requirements set out in Article 7 of Regulation (EU) 2016/679 for the validity of consent." VI Proposed sanction In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed, which state: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 7/14 “1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 are in each individual case effective, proportionate and dissuasive. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or instead of the measures referred to in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due account shall be taken of: (a) the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing operation in question as well as the number of data subjects affected and the level of damage suffered by them; (b) the intent or negligence of the infringement; (c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor, taking into account any technical or organisational measures implemented by them pursuant to Articles 25 and 32; (e) any previous infringement committed by the controller or processor; (f) the extent of cooperation with the supervisory authority in order to remedy the infringement and mitigate any adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the supervisory authority became aware of the infringement, in particular whether the controller or processor notified the infringement and, if so, to what extent; (i) where measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” For its part, Article 76 “Penalties and corrective measures” of the LOPDGDD provides: “1. The sanctions provided for in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the grading criteria established in paragraph 2 of the aforementioned article. 2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679 the following may also be taken into account: a) The continued nature of the infringement. b) The connection between the offender's activity and the processing of personal data. c) The benefits obtained as a result of committing the infringement. d) The possibility that the affected party's conduct could have led to the commission of the infringement. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 8/14 e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having, when not mandatory, a data protection officer. h) The submission by the controller or person in charge, on a voluntary basis, to alternative dispute resolution mechanisms, in those cases in which there are disputes between them and any interested party. In this case, a fine would be imposed in addition to the adoption of measures, if appropriate. The fine imposed must be, in each individual case, effective, proportionate and dissuasive, in accordance with the provisions of article 83.1 of the GDPR. In order to guarantee these principles, the turnover of CLUB ESPORTIU with sales of (…) as of the date of the AXEXOR report is considered as a priori. For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the evidence available at the time of the agreement to initiate sanctioning proceedings, and without prejudice to the outcome of the investigation, it is considered that the balance of the circumstances contemplated in Article 83.2 of the GDPR and 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 7 of the GDPR, allows for an initial administrative fine of 1,000.00 euros to be set. VII Corrective measures If the infringement is confirmed, the resolution issued may establish the corrective measures that the offending entity must adopt to put an end to the breach of personal data protection legislation, in this case Article 7 of the RGPD, in accordance with the provisions of the aforementioned article 58.2.d) of the RGPD, according to which each supervisory authority may "order the controller or processor to comply with the provisions of this Regulation, where appropriate, in a certain manner and within a specified period..." Thus, the responsible entity may be required to adapt its actions to personal data protection regulations, with the scope expressed in the previous Legal Grounds. This act establishes the alleged infringement committed and the facts that could lead to this possible violation of the data protection regulations, from which it is clearly inferred what measures to be adopted are, without prejudice to the type of procedures, mechanisms or specific instruments to implement them corresponding to the sanctioned party, since it is the person responsible for the treatment who fully knows its organization and must decide, based on proactive responsibility and a risk approach, how to comply with the RGPD and the LOPDGDD. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 9/14 However, in this case, regardless of the above, in accordance with the evidence available at the moment of the agreement to initiate the sanctioning procedure, in the resolution that is adopted, CLUB ESPORTIU may be required to adopt the following measures within 2 months from the date of enforcement of the resolution finalizing this procedure: That in the photographs/videos taken by the club at its sporting events, the necessary measures are guaranteed to respect the right to data protection of those who freely choose not to give consent. And all this in order to guarantee compliance with the provisions of article 7 of the RGPD. The imposition of this measure is compatible with the sanction consisting of an administrative fine, as provided for in art. 83.2 of the GDPR. Please note that failure to comply with the possible order to adopt measures imposed by this body in the resolution of this sanctioning procedure may be considered an administrative infringement in accordance with the provisions of the GDPR, classified as an infringement in its article 83.5 and 83.6, and such conduct may motivate the opening of a subsequent administrative sanctioning procedure. Likewise, it is recalled that neither the recognition of the infringement committed nor, where appropriate, the voluntary payment of the proposed amounts, exempts from the obligation to adopt the pertinent measures to cease the conduct or correct the effects of the infringement committed and from the obligation to prove to this AEPD compliance with this obligation. Therefore, in accordance with the above, the Director of the Spanish Data Protection Agency REGUES: FIRST: TO START SANCTIONING PROCEDURE against CLUB ESPORTIU VILA OLIMPICA, with NIF G63607022, for the alleged infringement of Article 7 of the RGPD, as defined in article 83.5 of the RGPD. SECOND: TO APPOINT A.A.A. as instructor and B.B.B. as secretary, indicating that they may be challenged, if applicable, in accordance with the provisions of articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP). THIRD: INCLUDE into the file, for evidentiary purposes, the claim filed by the claimant and its documentation, as well as the documents obtained and generated by the General Subdirectorate of Data Inspection in the actions prior to the start of this sanctioning procedure. FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 10/14 penalty that may apply would be an administrative fine of 1,000.00 euros, without prejudice to what results from the investigation. FIFTH: NOTIFY this agreement to CLUB ESPORTIU VILA OLIMPICA, with NIF G63607022, granting it a hearing period of ten working days to formulate the allegations and present the evidence it considers appropriate. In its written allegations it must provide its NIF and the procedure number that appears in the heading of this document. In accordance with the provisions of article 85 of the LPACAP, it may acknowledge its responsibility within the period granted for the formulation of allegations to this initiation agreement; which will entail a 20% reduction of the sanction that must be imposed in this procedure. With the application of this reduction, the sanction would be set at 800.00 euros, the procedure being resolved with the imposition of this sanction. Likewise, the applicant may, at any time prior to the resolution of this procedure, make voluntary payment of the proposed fine, which will entail a 20% reduction of its amount. With the application of this reduction, the fine would be set at 800.00 euros and its payment will imply the termination of the procedure, without prejudice to the imposition of the corresponding measures. The reduction for voluntary payment of the fine is cumulative with that which must be applied for the recognition of responsibility, provided that this recognition of responsibility is made clear within the period granted to formulate allegations at the opening of the procedure. The voluntary payment of the amount referred to in the previous paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the amount of the fine would be established at 600.00 euros. In any case, the effectiveness of any of the two reductions mentioned will be conditioned to the express withdrawal or waiver of any action or appeal through administrative channels against the sanction. For these purposes, if you accept any of them, you must send to the General Subdirectorate of Data Inspection an express communication of the withdrawal or waiver of any action or appeal through administrative channels against the sanction indicating which of the two reductions you accept or if it is both. If you choose to make a voluntary payment of any of the amounts indicated above (800.00 euros or 600.00 euros), you must make the payment by depositing it into the account number IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT code: CAIXESBBXXX) opened in the name of the Spanish Data Protection Agency at the bank CAIXABANK, S.A., indicating in the concept the reference number of the procedure that appears in the heading of this document and the reason for the reduction of the amount to which you are entitled. Likewise, proof of payment must be sent to the Subdirectorate General of Inspection along with the express communication of withdrawal or waiver of any C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 11/14 action or appeal through administrative channels against the sanction in order to continue with the procedure in accordance with the amount paid. Finally, it is noted that in accordance with the provisions of article 112.1 of the LPACAP, there is no administrative appeal against this act. 1479-141024 Mar España Martí Director of the Spanish Data Protection Agency >> SECOND: On December 31, 2024, CLUB ESPORTIU has proceeded to pay the fine in the amount of 600.00 euros using the two reductions provided for in the initiation agreement transcribed above, which implies the recognition of responsibility in relation to the facts referred to in the initiation agreement and its legal qualification. THIRD: CLUB ESPORTIU has expressly renounced any action or appeal through administrative channels against the sanction. FOURTH: The initiation agreement transcribed above indicated that, if the infringement is confirmed, it could be agreed to impose on the person responsible the adoption of appropriate measures to adjust its performance to the regulations mentioned in this act, in accordance with the provisions of the cited article 58.2 d) of the RGPD, according to which each supervisory authority may “order the person responsible or in charge of the treatment that the treatment operations comply with the provisions of this Regulation, where appropriate, in a certain manner and within a specified period…”. Having recognized the responsibility for the infringement, the imposition of the measures included in the initiation agreement is appropriate. FUNDAMENTALS OF LAW I Competence C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 12/14 In accordance with the powers granted to each supervisory authority by article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures processed by the Spanish Data Protection Agency will be governed by the provisions of Regulation (EU) 2016/679, in this organic law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures." II Termination of the procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading "Termination of sanctioning procedures" provides the following: "1. Once a sanctioning procedure has been initiated, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is of a purely monetary nature or when it is possible to impose a monetary sanction and another of a non-monetary nature but the inappropriateness of the second has been justified, the voluntary payment by the presumed responsible party, at any time prior to the resolution, will imply the termination of the procedure, except in relation to the restoration of the altered situation or the determination of compensation for the damages and losses caused by the commission of the infringement. 3. In both cases, when the sanction is of a purely monetary nature, the body competent to resolve the procedure will apply reductions of at least 20% on the amount of the proposed sanction, these being cumulative with each other. The aforementioned reductions must be determined in the notification of the initiation of the procedure and their effectiveness will be conditional on the withdrawal or waiver of any action or appeal in administrative proceedings against the sanction. The percentage of reduction provided for in this section may be increased by regulation.” III Voluntary payment and recognition of responsibility In accordance with the provisions of the aforementioned article 85 of the LPACAP, the notified initiation agreement reported on the possibility of recognizing responsibility and of making voluntary payment of the proposed fine, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the fine would be set at 600.00 euros and its payment would imply the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 13/14 termination of the procedure, without prejudice to the imposition of the corresponding measures. Following notification of the aforementioned initiation agreement, CLUB ESPORTIU has proceeded to acknowledge responsibility and to voluntarily pay the fine, accepting the two reductions provided for and expressly renouncing any action or appeal through administrative channels. It should be noted that, in accordance with the provisions of the LPACAP, as well as the jurisprudence of the Supreme Court in this matter, the exercise of voluntary payment by the alleged responsible party does not exempt the administration from the obligation to resolve and notify all procedures, whatever their form of initiation. Likewise, article 88 of the aforementioned rule establishes that the resolution that ends the procedure will decide all the issues raised by the interested parties and any other issues arising from it. Therefore, in accordance with the applicable legislation and having assessed the criteria for grading the sanctions whose existence has been proven, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO DECLARE the commission of the infringements and CONFIRM the sanctions determined in the operative part of the initiation agreement transcribed in this resolution. The sum of the aforementioned amounts gives a total amount of 1,000.00 euros. After CLUB ESPORTIU VILA OLÍMPICA has proceeded to prompt payment and recognition of liability, pursuant to article 85 of the LPACAP, a 40% reduction of the total mentioned is carried out, which represents the final amount of 600.00 euros. SECOND: DECLARE the termination of procedure EXP202409570, in accordance with the provisions of article 85 of the LPACAP. THIRD: ORDER CLUB ESPORTIU VILA OLÍMPICA to notify the Agency within a period of 2 months from the date this resolution becomes final and enforceable, of the adoption of the measures described in the legal grounds of the initiation agreement transcribed in this resolution. FOURTH: NOTIFY this resolution to CLUB ESPORTIU VILA OLÍMPICA. FIFTH: In accordance with the provisions of article 85 of the LPACAP, which makes voluntary payment reduction and recognition of liability conditional on the withdrawal or waiver of any action or appeal through administrative channels, the present authority accepts the waiver expressly stated by CLUB ESPORTIU VILA OLÍMPICA, and consequently no optional appeal may be filed against this resolution, all without prejudice to the possibility of resorting to the contentious-administrative court. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es 14/14 Consequently, taking into account the provisions of article 90 of the LPACAP, since no appeal through administrative channels may be filed as the waiver has been expressly stated, this resolution will be firm and fully enforceable from the moment it is notified. However, in accordance with the provisions of article 90.3.a) of the LPACAP, the final decision may be provisionally suspended by administrative means if the interested party states his intention to lodge an administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a letter addressed to the Spanish Data Protection Agency, presenting it through the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in art. 16.4 of the aforementioned Law 39/2015, of October 1. He must also transfer to the Agency the documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. 1259-180225 Olga Pérez Sanjuán The Deputy Director General of Data Inspection, in accordance with art. 48.2 LOPDGDD, due to vacancy in the position of President and Deputy C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd.gob.es
