Banner2.png

APDCAT (Catalonia) - EXP202409570

From GDPRhub
APDCAT - EXP202409570
Apdcat-logo.png
Authority: APDCAT (Catalonia)
Jurisdiction: Spain
Relevant Law: Article 7 GDPR
Law 39/2015
Type: Complaint
Outcome: Upheld
Started: 19.11.2024
Decided: 28.02.2026
Published: 28.02.2025
Fine: 600 EUR
Parties: Club Esportiu
National Case Number/Name: EXP202409570
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: cwa

The DPA fined a junior football club €600 as the consent collected from parents for the taking of photographs of their child was not freely given, thus violating Article 7 GDPR.

English Summary

Facts

Parents registered their son to play in junior football Summer Camp with Club Esportiu (controller). At the time of registration, the parents indicated on the form that they did not wish to consent for photographs to be taken of their son.

The club followed up with the parents, urging them to consent to the photographs being taken in order for the registration to continue. The club noted that in any event, they could not guarantee that their child would not appear in photographs taken.

The parents filed a complaint with the Catalan DPA (APDCAT) on June 19th 2024.

During the proceedings, the controller argued that they did not have facial recognition technology and could thus not guarantee that specific children did not appear in group photos taken during the camp. They also claimed that the photos taken were only for use in club publications and their social network pages, and that the complaint should be dismissed.

Holding

The DPA began their investigation on 19th November 2024.

The DPA highlighted the fact that the parents were informed that without consenting to the photographs of their child being taken, they could not proceed with registration, and held that the consent given would not have been “free”, as required in Article 7 GDPR. The DPA according found that the controller infringed Article 7 GDPR.

The DPA also noted that the absence of anonymisation software on the part of the controller was not an excuse for not offering the parents a genuine choice in consenting to the processing.

The DPA initially set the fine at €1,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €600.

The controller was also ordered to bring their processing in line with the requirements of Article 7 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/14

 File No.: EXP202409570

RESOLUTION TO TERMINATE THE PROCEDURE BY RECOGNITION
OF RESPONSIBILITY AND VOLUNTARY PAYMENT

Of the procedure instructed by the Spanish Data Protection Agency and based
on the following

BACKGROUND

FIRST: On November 19, 2024, the Director of the Spanish Data Protection Agency
agreed to initiate sanctioning proceedings against CLUB ESPORTIU
VILA OLÍMPICA (hereinafter, CLUB ESPORTIU), through the agreement that is
transcribed:

<<
File No.: EXP202409570

AGREEMENT TO START SANCTIONING PROCEDURE

Of the actions carried out by the Spanish Data Protection Agency and
based on the following,

FACTS

FIRST: On June 19, 2024, a complaint was filed with the Spanish Data Protection Agency for a possible infringement attributable to CLUB ESPORTIU VILA OLIMPICA (hereinafter CLUB ESPORTIU) with NIF G63607022.

The facts brought to the attention of this authority are:

That when registering his minor son for sports activities
offered by CLUB ESPORTIU, he marked on the registration form his refusal to
have images of his son collected by CLUB ESPORTIU, after which said club
contacted him via email, urging him to accept the collection of
images in order to continue with the registration; the club indicated that they could
not guarantee that the minor would not appear in any of the snapshots they collect, which the
parent understands to be a procedure contrary to data protection regulations.

Along with the complaint, the following must be provided:

- Copy of the registration form.

- Communications exchanged by email with the ESPORTIU CLUB.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/14

- Original complaint to the Catalan Data Protection Authority.

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the

Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), said complaint was forwarded to the ESPORTIU CLUB, so that it
could proceed to analyze it and inform this Agency within a period of one month of the actions
taken to comply with the requirements provided for in the data protection regulations.

The notification of the transfer of the claim, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP) by electronic notification, was not collected by the respondent party, within the period of availability, and is understood to have been rejected in accordance with the provisions of art. 43.2 of the LPACAP on 07/13/2024, as stated in the certificate in the file.

Although the notification was carried out by electronic means, for information purposes a copy was sent by postal mail that was duly notified on 08/30/2024.

In this notification, the respondent party was reminded of its obligation to
interact electronically with the Administration, and was informed of the means of access
to said notifications, reiterating that, from now on, it would be notified
exclusively by electronic means. On 09/30/2024, the ESPORTIU CLUB
submitted a response letter in which it states that it does not know who made the

claim, since this information has not been transferred to it by this Agency. It is
reported that the interested party can obtain a copy of the administrative file.

In this letter, reference is made to the report issued by the club's Data Protection Delegate, dated 09/30/2024, in which it states that for the Summer 2024 Campus, there are several communications from parents who, at the time of

registration, indicated that they wanted to check the NO box regarding authorization to
take photos of their children. In view of this, the Delegate informs that the association does not have
facial recognition technology to guarantee that children do not appear in
any group photo taken during sporting events and that the photos that are
taken are only for the entity and for the sole purpose of having an archive of the teams

and of the different sporting events and obtaining prizes, and some of them may
be published in the club's publications.
For all these reasons, she requests that this file be archived.

THIRD: On September 19, 2024, in accordance with article 65 of

the LOPDGDD, the claim was admitted for processing.

FOURTH: According to the report dated 10/23/2024 collected from the
AXESOR tool, the entity CLUB ESPORTIU is an Association established in 2007,
and with a sales volume of (…) euros as of the date of the report.

FUNDAMENTALS OF LAW

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/14

I
Competence

In accordance with the powers granted to each supervisory authority by article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Data Protection Agency is competent to

initiate and resolve this procedure.

II
Procedure

Likewise, article 63.2 of the LOPDGDD determines that: “The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
of Regulation (EU) 2016/679, in this organic law, by the regulatory
provisions issued in its development and, insofar as they do not contradict them,
on a subsidiary basis, by the general rules on administrative procedures”.

In accordance with article 64 of the LOPDGDD, and taking into account the
characteristics of the alleged infringement committed, a sanctioning procedure is
initiated.

The procedure will have a maximum duration of twelve months from the date
of the start agreement. After this period, it will expire and, consequently, the proceedings will be filed, in accordance with the provisions of
article 64 of the LOPDGDD.

If you do not make any objections to this initiation agreement within the stipulated period, it may be considered a resolution proposal, as established in article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP).

III

Preliminary questions

In the present case, in accordance with the provisions of article 4.1 and 4.2 of the GDPR,
there is evidence of the processing of personal data, since the CLUB

ESPORTIU carries out, among other treatments, the collection and storage of data of natural persons such as names, surnames, date of birth, postal address,
email address, telephone number, health card number, medical certificate and type of illnesses/allergies, if applicable.

CLUB ESPORTIU carries out this activity in its capacity as data controller,

since it is the party that determines the purposes and means of such activity, pursuant to
article 4.7 of the GDPR.

IV

Obligation not fulfilled. Conditions for consent
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/14

Regarding the conditions for consent, Article 7 of the GDPR
provides:

"1. Where processing is based on the data subject's consent, the controller
should be able to demonstrate that the data subject has consented to the processing of his or her personal
data.

2. Where the data subject's consent is given in the context of a written declaration
which also concerns other matters, the request for consent shall be presented in

a way that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, and using clear and plain language. No part of
the declaration that infringes this Regulation shall be binding.

3. The data subject shall have the right to withdraw consent at any time. The

withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. Before giving consent, the data subject
will be informed of this. It will be as easy to withdraw consent as it is to give it.

4. When assessing whether consent has been freely given, account will be taken to the greatest extent possible of whether, among other things, the execution of a contract,

including the provision of a service, is subject to consent to the processing of personal data that are not necessary for the execution of said contract."

In the present case, the intention was to register a minor in
sports activities offered by the CLUB ESPORTIU, marking on the registration

form the refusal to collect images of the minor while he was
doing sports at said club. More specifically, the registration form, provided by both parties, states the following:

“I give my consent for my image to appear clearly identifiable on

the Club's website and its social networks in the form of a recording or images captured
during the Club's events and activities YES NO”

“I give my consent for my image to appear clearly identifiable on
the club's website and its social networks in the form of a recording or images captured
during the club's events and activities." (unofficial translation)

The file contains the original registration form of the minor, to whom this claim refers, in which it is clearly seen that for this
consent, the NO box has been crossed out.

After receiving the aforementioned form and other documentation from the minor by email, the CLUB ESPORTIU contacted the minor's parent by email, urging him/her to accept the collection of images in order to continue with the registration.
Proof of this are the emails in the file:

1. From the email account ***EMAIL.1 to the claimant's email account,
with a copy ***EMAIL.2, which states:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/14

“I have indicated that we are NOT authorized to take photos or recordings for the club's social networks.
The Club does not have facial recognition and cannot guarantee that they will be included in any photo.
Do I want to continue with the registration?
I must accept this option.”

“You have marked that you do NOT authorize us to take photos or recordings for the club's social networks.

The club does not have facial recognition and it cannot be guaranteed that you will not

appear in any photos. Do you want to continue with the registration?

(…).” (Unofficial translation)

1. The parent/guardian responds to the previous email, in the following terms:

“Good morning,

Aleshores had to change the form and explain that I cannot comply with both the

data protection/confidentiality, right?

Yes, we want to continue the registration.”

“Then I should change the form and explain that I cannot comply with the

data protection/confidentiality, right? (Unofficial translation)

2. The club reiterates to the parent, from the email accounts mentioned above:

“I must accept the option of consent for photos in the registration and send it again”

“(…) of photos in the registration and send it again”. (Unofficial translation)

Specifically, consent is requested to “appear clearly identifiable on the club website and its social networks in the form of a recording or images”, that is, the
processing of the image of the minor (personal data), would consist of the minor

appearing clearly identifiable. From the transcribed emails it would be deduced that the
complainant did not consent to such processing of data of his minor son and that in the
event of having given it, he would not be free. And this is because the emails sent by the club would force the minor to accept the option of consent for photos in order to

register the minor, said consent would be vitiated from the beginning and could be null and void
by law. Furthermore, the fact of not having image anonymization software, which the Club claims, is not an obstacle to not respecting the
wish of the claimant not to appear in photographs and/or videos.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/14

Therefore, in accordance with the evidence available at this time
in the agreement to initiate sanctioning proceedings, and without prejudice to the outcome of the
investigation, it is considered that the known facts could constitute an

infringement, attributable to CLUB ESPORTIU, for violation of the article transcribed
above.

V
Classification of infringement of Article 7 of the GDPR and classification for the purposes of

prescription

Article 83.5 of the GDPR classifies as an administrative infringement the infringement of the
following articles, which shall be punishable, in accordance with paragraph 2, by administrative fines of
a maximum of EUR 20,000,000 or, in the case of an undertaking, of
a maximum of 4% of the total annual turnover of the previous financial year, whichever is higher:

"a) the basic principles for processing, including the conditions for
consent pursuant to Articles 5, 6, 7 and 9;

b) the rights of data subjects pursuant to Articles 12 to 22;
c) transfers of personal data to a recipient in a third country or an
international organisation pursuant to Articles 44 to 49;
d) any obligation in by virtue of the law of the Member States adopted pursuant to Chapter IX;

e) failure to comply with a resolution or a temporary or definitive limitation of the
processing or suspension of data flows by the supervisory authority
in accordance with Article 58, paragraph 2, or failure to provide access in breach of
Article 58, paragraph 1."

For its part, the LOPDGDD in its Article 71, Infringements, states that:

"The acts and conduct referred to in paragraphs 4,
5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are
contrary to this organic law, constitute infringements."

For the sole purposes of the limitation period, Article 72.1 of the LOPDGDD
establishes the following:

"In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that are
considered very serious and will be subject to a three-year statute of limitations shall be imposed on infringements constitute

a substantial violation of the articles mentioned therein and, in particular, the
following:
c) Failure to comply with the requirements set out in Article 7 of Regulation (EU)
2016/679 for the validity of consent."

VI

Proposed sanction

In order to determine the administrative fine to be imposed, the provisions of
Articles 83.1 and 83.2 of the GDPR must be observed, which state:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/14

“1. Each supervisory authority shall ensure that the imposition of administrative
fines pursuant to this Article for infringements of this Regulation referred to in
paragraphs 4, 9 and 6 are in each individual case

effective, proportionate and dissuasive.

2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or instead of the measures referred to in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due account shall be taken of:

(a) the nature, gravity and duration of the infringement, taking into account the
nature, scope or purpose of the processing operation in question as well as the number of data subjects affected and the level of damage suffered by them;

(b) the intent or negligence of the infringement;

(c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects;
(d) the degree of responsibility of the controller or processor, taking into account any technical or organisational measures implemented by them pursuant to Articles 25 and 32; (e) any previous infringement committed by the controller or processor;

(f) the extent of cooperation with the supervisory authority in order to remedy the infringement and
mitigate any adverse effects of the infringement;
(g) the categories of personal data affected by the infringement;
(h) the manner in which the supervisory authority became aware of the infringement, in
particular whether the controller or processor notified the infringement and, if so, to what

extent;
(i) where measures referred to in Article 58(2) have been previously ordered against the
controller or processor concerned in relation to the same matter, compliance with those measures;
(j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and
(k) any other aggravating or mitigating factor applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or
indirectly, through the infringement.”

For its part, Article 76 “Penalties and corrective measures” of the LOPDGDD

provides:

“1. The sanctions provided for in paragraphs 4, 5 and 6 of Article 83 of Regulation
(EU) 2016/679 shall be applied taking into account the grading criteria
established in paragraph 2 of the aforementioned article.

2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679
the following may also be taken into account:
a) The continued nature of the infringement. b) The connection between the offender's activity and the processing of personal

data.
c) The benefits obtained as a result of committing the infringement.
d) The possibility that the affected party's conduct could have led to the commission of the infringement.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/14

e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the absorbing entity.
f) The impact on the rights of minors.

g) Having, when not mandatory, a data protection officer.
h) The submission by the controller or person in charge, on a voluntary basis, to
alternative dispute resolution mechanisms, in those cases in which
there are disputes between them and any interested party.

In this case, a fine would be imposed in addition to the adoption of

measures, if appropriate.

The fine imposed must be, in each individual case, effective, proportionate
and dissuasive, in accordance with the provisions of article 83.1 of the GDPR. In order to
guarantee these principles, the turnover of CLUB ESPORTIU with sales of (…) as of the date of the AXEXOR report is considered as a priori.

For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the evidence available at the time of the agreement to initiate sanctioning proceedings, and without prejudice to the outcome of the investigation, it is considered that the balance of the circumstances contemplated in Article 83.2 of the GDPR and 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 7 of the GDPR, allows for an initial administrative fine of 1,000.00 euros to be set.

VII

Corrective measures

If the infringement is confirmed, the resolution issued may establish the corrective measures that the offending entity must adopt to put an end to the breach of personal data protection legislation, in this case Article 7 of the

RGPD, in accordance with the provisions of the aforementioned article 58.2.d) of the RGPD, according to which each supervisory authority may "order the controller or processor to comply with the provisions of this Regulation, where appropriate, in a certain manner and within a specified period..."

Thus, the responsible entity may be required to adapt its actions to personal data protection regulations, with the scope expressed in the previous Legal Grounds.

This act establishes the alleged infringement committed and the facts
that could lead to this possible violation of the data protection regulations, from which it is clearly inferred what measures to be adopted are, without prejudice to the type of procedures, mechanisms or specific instruments to
implement them corresponding to the sanctioned party, since it is the person responsible for the
treatment who fully knows its organization and must decide, based on

proactive responsibility and a risk approach, how to comply with the RGPD and the
LOPDGDD.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/14

However, in this case, regardless of the above, in accordance with the evidence available at the moment of the agreement to initiate
the sanctioning procedure, in the resolution that is adopted, CLUB

ESPORTIU may be required to adopt the following measures within 2 months from the date of enforcement of the
resolution finalizing this procedure:

That in the photographs/videos taken by the club at its sporting events, the necessary
measures are guaranteed to respect the right to data protection of those

who freely choose not to give consent.

And all this in order to guarantee compliance with the provisions of article 7 of the

RGPD.

The imposition of this measure is compatible with the sanction consisting of an administrative
fine, as provided for in art. 83.2 of the GDPR.

Please note that failure to comply with the possible order to adopt measures imposed by
this body in the resolution of this sanctioning procedure may be
considered an administrative infringement in accordance with the provisions of the GDPR,
classified as an infringement in its article 83.5 and 83.6, and such conduct may motivate the
opening of a subsequent administrative sanctioning procedure.

Likewise, it is recalled that neither the recognition of the infringement committed nor, where appropriate, the voluntary payment of the proposed amounts, exempts from the obligation to
adopt the pertinent measures to cease the conduct or correct the effects of
the infringement committed and from the obligation to prove to this AEPD compliance with this
obligation.

Therefore, in accordance with the above, the Director of the Spanish Data Protection Agency
REGUES:

FIRST: TO START SANCTIONING PROCEDURE against CLUB ESPORTIU VILA
OLIMPICA, with NIF G63607022, for the alleged infringement of Article 7 of the RGPD,
as defined in article 83.5 of the RGPD.

SECOND: TO APPOINT A.A.A. as instructor and B.B.B. as secretary,

indicating that they may be challenged, if applicable, in accordance with the provisions of
articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector
(LRJSP).

THIRD: INCLUDE into the file, for evidentiary purposes, the claim filed by the claimant and its documentation, as well as the documents obtained and generated by the General Subdirectorate of Data Inspection in the actions prior to the start of this sanctioning procedure.

FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/14

penalty that may apply would be an administrative fine of 1,000.00 euros, without prejudice to what results from the investigation.

FIFTH: NOTIFY this agreement to CLUB ESPORTIU VILA OLIMPICA, with
NIF G63607022, granting it a hearing period of ten working days to
formulate the allegations and present the evidence it considers appropriate. In its
written allegations it must provide its NIF and the procedure number that appears
in the heading of this document.

In accordance with the provisions of article 85 of the LPACAP, it may acknowledge its
responsibility within the period granted for the formulation of allegations to
this initiation agreement; which will entail a 20% reduction of the
sanction that must be imposed in this procedure. With the application of this
reduction, the sanction would be set at 800.00 euros, the procedure being
resolved with the imposition of this sanction.

Likewise, the applicant may, at any time prior to the resolution of this procedure, make voluntary payment of the proposed fine, which
will entail a 20% reduction of its amount. With the application of this reduction,
the fine would be set at 800.00 euros and its payment will imply the termination of the

procedure, without prejudice to the imposition of the corresponding measures.

The reduction for voluntary payment of the fine is cumulative with that which must be applied
for the recognition of responsibility, provided that this recognition
of responsibility is made clear within the period granted to formulate

allegations at the opening of the procedure. The voluntary payment of the amount referred to
in the previous paragraph may be made at any time prior to the resolution. In
this case, if both reductions were to be applied, the amount of the fine would be
established at 600.00 euros.

In any case, the effectiveness of any of the two reductions mentioned will be
conditioned to the express withdrawal or waiver of any action or appeal through administrative channels
against the sanction.

For these purposes, if you accept any of them, you must send to the
General Subdirectorate of Data Inspection an express communication of the withdrawal

or waiver of any action or appeal through administrative channels against the sanction
indicating which of the two reductions you accept or if it is both.

If you choose to make a voluntary payment of any of the amounts indicated above (800.00 euros or 600.00 euros), you must make the payment

by depositing it into the account number IBAN: ES00-0000-0000-0000-0000-0000
(BIC/SWIFT code: CAIXESBBXXX) opened in the name of the Spanish Data Protection Agency
at the bank CAIXABANK, S.A., indicating in the
concept the reference number of the procedure that appears in the heading
of this document and the reason for the reduction of the amount to which you are entitled.

Likewise, proof of payment must be sent to the Subdirectorate General of Inspection
along with the express communication of withdrawal or waiver of any

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/14

action or appeal through administrative channels against the sanction in order to continue with the
procedure in accordance with the amount paid.

Finally, it is noted that in accordance with the provisions of article 112.1 of the LPACAP,
there is no administrative appeal against this act.

1479-141024
Mar España Martí
Director of the Spanish Data Protection Agency

>>

SECOND: On December 31, 2024, CLUB ESPORTIU has proceeded to
pay the fine in the amount of 600.00 euros using the two
reductions provided for in the initiation agreement transcribed above, which implies the
recognition of responsibility in relation to the facts referred to in the
initiation agreement and its legal qualification.

THIRD: CLUB ESPORTIU has expressly renounced any action or
appeal through administrative channels against the sanction.

FOURTH: The initiation agreement transcribed above indicated that, if
the infringement is confirmed, it could be agreed to impose on the person responsible the adoption of
appropriate measures to adjust its performance to the regulations mentioned in this act, in accordance with the provisions of the cited article 58.2 d) of the RGPD, according to which

each supervisory authority may “order the person responsible or in charge of the treatment that the treatment operations comply with the provisions of
this Regulation, where appropriate, in a certain manner and within a specified period…”.

Having recognized the responsibility for the infringement, the imposition of
the measures included in the initiation agreement is appropriate.

FUNDAMENTALS OF LAW

I
Competence

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/14

In accordance with the powers granted to each supervisory authority by article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter RGPD) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and
guarantee of digital rights (hereinafter, LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to
resolve this procedure.

Likewise, article 63.2 of the LOPDGDD determines that: "The procedures

processed by the Spanish Data Protection Agency will be governed by the provisions
of Regulation (EU) 2016/679, in this organic law, by the regulatory
provisions issued in its development and, insofar as they do not contradict them,
on a subsidiary basis, by the general rules on administrative procedures."

II
Termination of the procedure

Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP), under the heading
"Termination of sanctioning procedures" provides the following:

"1. Once a sanctioning procedure has been initiated, if the offender acknowledges his responsibility,
the procedure may be resolved with the imposition of the appropriate sanction.

2. When the sanction is of a purely monetary nature or when it is possible to impose a

monetary sanction and another of a non-monetary nature but the
inappropriateness of the second has been justified, the voluntary payment by the presumed responsible party,
at any time prior to the resolution, will imply the termination of the procedure,
except in relation to the restoration of the altered situation or the determination of
compensation for the damages and losses caused by the commission of the infringement.

3. In both cases, when the sanction is of a purely monetary nature, the
body competent to resolve the procedure will apply reductions of at least
20% on the amount of the proposed sanction, these being cumulative with each other.
The aforementioned reductions must be determined in the notification of the initiation
of the procedure and their effectiveness will be conditional on the withdrawal or waiver of

any action or appeal in administrative proceedings against the sanction.

The percentage of reduction provided for in this section may be increased by
regulation.”

III
Voluntary payment and recognition of responsibility

In accordance with the provisions of the aforementioned article 85 of the LPACAP, the notified

initiation agreement reported on the possibility of recognizing responsibility and

of making voluntary payment of the proposed fine, which would entail two
cumulative reductions of 20% each. With the application of these two
reductions, the fine would be set at 600.00 euros and its payment would imply the

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/14

termination of the procedure, without prejudice to the imposition of the corresponding

measures. Following notification of the aforementioned initiation agreement, CLUB ESPORTIU has proceeded to
acknowledge responsibility and to voluntarily pay the fine, accepting
the two reductions provided for and expressly renouncing any action or
appeal through administrative channels.

It should be noted that, in accordance with the provisions of the LPACAP, as well

as the jurisprudence of the Supreme Court in this matter, the exercise of voluntary payment
by the alleged responsible party does not exempt the administration from the obligation to
resolve and notify all procedures, whatever their form of initiation. Likewise, article 88 of the aforementioned rule establishes that the resolution
that ends the procedure will decide all the issues raised by the

interested parties and any other issues arising from it.

Therefore, in accordance with the applicable legislation and having assessed the criteria for grading the sanctions whose existence has been proven, the Presidency of the Spanish Data Protection Agency RESOLVES:

FIRST: TO DECLARE the commission of the infringements and CONFIRM the sanctions determined in the operative part of the initiation agreement transcribed in this resolution.

The sum of the aforementioned amounts gives a total amount of 1,000.00 euros.

After CLUB ESPORTIU VILA OLÍMPICA has proceeded to prompt payment and
recognition of liability, pursuant to article 85 of the LPACAP,

a 40% reduction of the total mentioned is carried out, which represents the final amount of
600.00 euros.

SECOND: DECLARE the termination of procedure EXP202409570, in accordance with the provisions of article 85 of the LPACAP.

THIRD: ORDER CLUB ESPORTIU VILA OLÍMPICA to notify the Agency within a period of
2 months from the date this resolution becomes final and enforceable, of the adoption of the measures described in the legal grounds of the
initiation agreement transcribed in this resolution.

FOURTH: NOTIFY this resolution to CLUB ESPORTIU VILA OLÍMPICA.

FIFTH: In accordance with the provisions of article 85 of the LPACAP, which makes voluntary payment reduction and recognition of liability conditional on the withdrawal or waiver of any action or appeal through administrative channels, the present authority accepts the waiver expressly stated by CLUB ESPORTIU
VILA OLÍMPICA, and consequently no optional appeal may be filed against this resolution, all without prejudice to the possibility of resorting to the contentious-administrative court.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/14

Consequently, taking into account the provisions of article 90 of the LPACAP,

since no appeal through administrative channels may be filed as the waiver has been expressly
stated, this resolution will be firm and fully enforceable from the moment it is
notified.

However, in accordance with the provisions of article 90.3.a) of the LPACAP, the final decision may be provisionally suspended by administrative means if the interested party
states his intention to lodge an administrative appeal. If this is the case, the interested party must formally communicate this fact by means of a letter

addressed to the Spanish Data Protection Agency, presenting it through the
Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-web/], or
through one of the other registries provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1. He must also transfer to the Agency the documentation
that proves the effective filing of the administrative appeal. If the

Agency is not aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

1259-180225
Olga Pérez Sanjuán
The Deputy Director General of Data Inspection, in accordance with art. 48.2

LOPDGDD, due to vacancy in the position of President and Deputy

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es