PS/00032/2020

A. 1, (hereinafter, “the claimed entity”), by virtue of the complaint filed by Dª. , (hereinafter, “the claimant”), and based on the following, BACKGROUND FIRST: On 10/23/19, you had a written entry in this Agency, presented by the claimant, in which it stated, among others, the following: “I denounce the company Iberia since when looking for a trip it does not give me the option to reject cookies and it tells me I have to accept them to continue browsing ”. 1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD). A) Yes, dated 11/29/19, an informative request was addressed to the claimed entity. THIRD: On 01/28/20, the claimed entity sends this Agency written in which, among others, reports the following: "Prior to receiving the letter requesting information, my client had working since June 2019 on the design of the policy adaptation solution of cookies to the requirements of the General Data Protection Regulation and the New Organic Law on Data Protection and Guarantee of Digital Rights following, in addition, the guides of good practices issued by the authorities of control and very especially the one issued by the Agency last November 2019.

es 2/24 optimal compliance with the recommendations on this matter made by the Agency in the Guide that has been published in this regard since November 2019. It should be noted that since mid-January the Iberia website complies with the current regulations and with the recommendations published by the Agency. As already indicated above, at the time of receipt of the letter from the Mr. Inspector, Iberia had been working with different suppliers for months to carry out carry out the design and implementation of the ideal technical solution. Once the Guide for the use of cookies has been published by the Agency and verified the necessary adaptations in the design that had been prepared for comply with the recommendations contained therein, the operation of the new cookie banner with your configurator. Despite having had the Christmas and New Years holidays in the middle, thanks to the efforts made the new information and cookie configuration tool on the web Iberia has been in operation since the middle of this month of January 2020.

Currently, a banner is implemented that, in addition to informing about the responsibility for the use of cookies on the page, which corresponds to Iberia, allows configure the types of cookies found on the web, or accept all of them. The web cookies are always activated and are configurable, being a exception to this configuration those cookies of a technical nature that are used for the performance of the web and that allow the user a correct visualization of the herself. In addition, as seen on the website itself, no cookie is loaded, Except for the technical ones, without the user having accepted all the cookies or he has opposed those that he himself deems appropriate ”. 1, verifying that: Cookies are loaded in the browser when accessing the web page in question: (DoubleClick, Google, and among those of Iberia, Google analytics: _ga, _gid). E informs you that it stores cookies on your device to guarantee the proper functioning and security of our websites, and offer you the best browsing experience possible.

Click Accept Cookies if you agree to the use of these cookies, or change the settings whenever you want in Settings cookies. For more information, read the Iberia Cookies Policy ”. In the same banner there is the option to "Accept cookies" and a link to the page of "Cookie Settings". - If the "Cookies Policy" is accessed, information is offered on: - How and what are cookies used for. - What are cookies. - The types of cookies on the web and their purposes. - How to manage cookies. - To which recipients the data will be communicated. - Policy updates. - Cookies used. - If you access the "Cookies Configuration" through the link in the first layer, information is provided in sections: "User Privacy" section. It is reported that they can store or retrieve browser information, mainly in the form of cookies. This information it can be about the user, their preferences or their device and is mainly used to make the site work as expected.

Information is generally not identifies directly, but can give you a more web experience personalized. You can accept or reject the use of cookies for each category by moving the selector that you will find at the end of each of the lines of down. Every time you are offered to accept or reject the use of certain cookies. es 4/24 "Cookie policy", verifying that a series of cookies are installed without have formally accepted them. Section "Technical Cookies". It is reported that they are necessary for the website works and cannot be disabled (they are not configurable). "Performance Cookies" section. It is reported that they allow counting visits and traffic sources in order to evaluate the performance of our site and improve it. It allows deactivating them by clicking on the blue switch located in the corner Upper right. Section "Targeted Cookies" (for targeted advertising). It is reported that they may be established through the site by advertising partners.

They can be used by those companies to create a profile of their interests and show relevant ads. It allows deactivate them by clicking on the blue switch located in the upper corner right. Section "Functionality Cookies". They are reported to allow the site to offer a better functionality and customization. They can be established by the holder of the page or by third parties whose services they have added to the page. Indicates that if these cookies are not allowed, some of your services will not work correctly. FIFTH: In view of the facts denounced, the documentation provided by the parties and in accordance with the evidence available, the Data Inspection of this Spanish Data Protection Agency considered that the performance of the The claimed entity did not meet the conditions imposed by the regulations in force, therefore that the opening of a sanctioning procedure proceeds. 2) of the LSSI, sanctioning nable in accordance with the provisions of art.

es 5/24 security of our websites, and offer you the best possible browsing experience. 1 of the guide). - In the first layer, it is indicated that to "Accept" all cookies must be done click on “accept”, or if you want to change the cookie settings you must do- Click on "Cookie settings", but it is not reported that when you access the page, without having performed any other action, cookies are loaded without having them accepted. Nor is it reported whether the cookies are own or third-party, nor is it reported information on the type of data to be collected in the event of profiling (behavioral advertising cookies). 2. guide). - Entering the second layer, through the link, "cookie settings" or the "Cookies policy" page, it allows the configuration of cookies in a granular way. But third-party cookies are not identified and the period of con- cookies in the browser (except for those used to balance brar the load on the website infrastructure).

SEVENTH: Notified the initiation agreement, the claimed entity, by writing of dated 06/15/20, made, in summary, the following allegations: "The facts on which the sanctioning procedure is initiated are not the same due to those who sent the request in file E / 11207/2019. com, and the use made of said cookies, as well as not including sion of an option of opposition to the processing of personal data that is carried out by through them. In response to said request, sent to the Agency on January 28, since the change and implementation of the new functionality and the banner infor- mative and self-configuring. It is clear and confirmed, in view of the terms of the communication letter of the mentioned sanctioning procedure, that the information provided by IBERIA was correct and true and that everything that was said on January 28 was true. es 6/24 Instead of parsing the terms of the functionality configuration tool, information and self-management banner and, where appropriate, submit a new request In order to request clarifications or modifications to the design of the same, the Agency has erroneously proceeded to initiate a sanctioning procedure when the facts that motivate the request sent at the end of November in the file E / 11207/2019 are significantly different from those that serve as the basis for this new dossier, which focuses on very specific aspects of the new functionality put into operation in January of this year without erasing the fact that di- cha functionality, in general terms, complies with the provisions of article 22 LSSI whose violation is invoked in the legal bases of the file initiated.

) When accessing the initial page and without having done- After no action, it is verified that non-necessary cookies such as the ana- Google policies: _ga, _gid), without any warning of said installation. 2). Thanks to these cookies (which do not store information about the IP from which you browse, but rather determine They only mine if the origin of the session is in any of the websites of said meta- search engines) the reference (“referal”) is obtained that allows to know if a session that nally ends up in purchase had its origin in a metasearch engine, so that it It allows both the metasearch engine and Iberia to carry out the correct billing between them lative to the generation of business / online sales. Tag Managers work in a similar way for what are called affair networks. liaison, which is also in charge of bringing qualified traffic to the Iberia website and has They use the same Cost Per Acquisition (CPA) mode as metasearch engines.

If these cookies were inactive from the first moment, the information would be lost. relational relationship and it would not be possible to manage and maintain the relationship between Iberia and the metasearch engines / affiliate networks. However, although they are active from the beginning At the moment they do not send information of any kind until the user gives their feeling. The existence of this type of cookies and the exchange of this type of information Training is included in our privacy policy in the third party section. es 7/24 Therefore, the relevant data for these purposes are: To fulfill its mission it is It is necessary that the aforementioned cookies are active from the moment you access the web for the correct treatment and identification of the session (not of the team from where you navigate); and - These cookies do not contain personal data. Cookies can be rejected, and only send information when it is they consent.

This information would have been provided if instead of initiating procedures The sanctioner would have sent an informative request. ) "The banner about cookies that is displayed, when accessing the page, provides information that is not very concise or intelligible. By using expressions such as “(…) offer you the best possible browsing experience (…) ”lead to confusion…” In addition to the fact that the assertion is totally subjective and evaluative, the truth is that the phrase used as example is the only phrase in all texts of the functionality that could be the subject of that assessment. In any case, the structure and language of the all of the self-management functionality is descriptive and intuitive enough to that from an objective point of view the exact opposite is interpreted: that it is sufficiently clear and informative. In any case, the indicated phrase has already been modified, and if instead of having received a communication of the initiation procedure sanction if a request for information or modification had been received from the text the same result would have been obtained.

2. c) of the guide), informing only that, “Iberia LAE informs you that it stores cookies on your device (…) ”, checking that they install both their own and from third parties even without taking any action. ) above. Although it is true that the first layer of information did not specify the existence of both Iberia's own and third-party cookies (a circumstance that has already been specified in the text, just as if a request had been received instead of an initial procedure of sanctioning procedure), it is no less true that this information since was evident and notorious with the texts of the second layer, as for example in the case of "Targeted Cookies", which are described as "These cookies can be this- established through our site by our advertising partners. es 8/24 With all due respect, the Agency must not forget that the guides are indicative, not regulations, and that although they are useful for the administered, they are not the only co means to comply with the true regulation that they intend to put into practice.

3). " Once again, at this point the guide is confirmed not only as a possible form or pro- in order to comply with the regulations, but as one that does not necessarily respects the most common criterion or shared by the majority of European organizations worst regulators. It is not allowed to continue browsing because that is precisely the recommendation from the European Data Protection Board (EDPB) published on last May (it is true, after the date of issuance of the communication) initiation of the sanctioning file which is from March). 2 of the guide, which includes only an acceptance button and later the possibility of configuring cookies so that the user can accept or reject them as they consider, or even reject- all with one click. “To facilitate the selection, two buttons can be implemented on the panel, one for accept all cookies and another to reject them all, this option being recommended The higher the different number of cookies used, the greater the variable.

If you use the modality of "continue browsing" as a way of obtaining consent, you must- A button will be included in the panel to reject all cookies, in order to respect the I want it to be as easy to withdraw consent as it is to give it. " The Iberia website has had a configuration panel since January 2020 of cookies for acceptance and / or rejection. In addition, it is not allowed to continue browsing if there has been no acceptance of the configuration, complete or customized by the client, or complete rejection of all cookies. It is impossible to "continue browsing" without further ado, for- It is not a valid option as indicated in the EDPB guide (page 21). To pe- All in all, the text has been modified to give it a little more clarity. One time moreover, it does not seem that this reason serves to initiate a sanctioning proceeding instead having given rise to a request for information or modification.

es 9/24 b) Regarding the Second layer (cookie settings) "Accessing through the link, "cookie settings", it is allowed to accept or reject the use of certain mined categories of cookies such as: performance cookies, targeted cookies and functionality cookies. " It is true that, for technical reasons, in some browsers the policy ca cookies could not be accessed without previously accepting, configuring or rejecting the cookies. However, this problem has been solved / will be solved in the pr- next update scheduled for the end of this month of June. Again, this cir- This situation could also have been solved if instead of initiating a procedure sanctioning action, the Agency would have issued a request for information or identification of the Iberia website. com. Effectively, that's right. But it is equally true that the greatest Some of the same information is contained in the texts of the functionality of Self-management of cookies that precedes the text of the Cookies Policy itself.

cho. com the own cookies that are installed, but not those of third parties, nor the time they remain active on the computer terminal, (with the exception of those used to balance the load in the infrastructure of the website, which expire at the end of the session) As already indicated, the information on the existence of both own and third-party cookies it was already enough- detailed in the information made available to the user in the second layer of the self-management functionality. Users have been deprived of information or nor have they been misled in relation to the existence of third-party cookies. Lack of materiality for the initiation of a sanctioning file We understand, therefore, that in light of the explanations provided, of the small modifications carried out in the texts of the functionality and corrections techniques committed / carried out, depending on the case of each of the items in those that are intended to substantiate the initiation of the disciplinary proceedings have been shown, on the one hand, that there is no such foundation and that the legal purpose and good co protected by art.

22 LSSI has not been violated. In our opinion, it is not appropriate to enforcement of disciplinary proceedings against Iberia and should proceed to its ar- Billy Goat. es 10/24 We request from the Inspector in charge of this File that he has received this written together with the documentation that accompanies it, admits it and by virtue of it has for having made the allegations contained therein, it deems them and by virtue of it proceed to the archive of the disciplinary proceedings initiated against Iberia ”. - consider reproduced for evidentiary purposes, the allegations to the agreement to initiate PS / 00032/2020, presented by the entity- announced. 2 of the LSSI, with a fine of 30,000 euros. TENTH: After notification of the proposed resolution, dated 08/07/20, the in- The claimed entity presents a brief of allegations, in which, among others, it indicates: “The reasons for this sanctioning procedure are not related to the fact that It is stated in the complaint that it supposedly originates it and that it was corrected since January 2020.

The reasons for the alleged infringement alleged in this investigation phase have reduced to two and yet the same proposal for a resolution is maintained. tion and the amount of the fine. The sanction proposal is not properly founded mentioned and is inconsistent with the instruction practiced. The dis- put in articles 39bis and 40 LSSI neither by the Agency nor by Mr. - Regarding the information provided on the policy of cookies, the banner now provides concise and intelligible information, having modified After the message that was used, as of 01/31/20, “(…) stores cookies on your dis- positive to ensure the proper functioning and security of our websites, and offer you the best possible browsing experience (…) ”, for the message used, as of 07/20/20: “(…) We use analytical, personalization and advertising cookies (own and third parties) to make profiles based on browsing habits and show bring you useful content (…) ”.

es 11/24 In this layer, it is indicated that to "Accept" all cookies you must click on "Accept" and thus makes it possible to continue browsing. But, if the user wants to reject all cookies must access the "cookie settings" page and choose the option de, >, allowing only, from then on, to follow na- browsing the different pages of the web. 2. of the AEPD cookie guide. " However, as we will explain later in these allegations, the tool acceptance, rejection and / or configuration of cookies according to their typology that Iberia established during the month of January 2020 it fulfilled in this regard already by then with art. 2 LSSI and with the criteria of the European Data Protection Board (EDPB), which the Spanish Agency itself has endorsed in the latest update. tion of its Interpretive Guide published this past July. - Second, we transcribe the resolution proposal on page 16. - Regarding the configuration of cookies, it is verified that the configuration of tion of cookies in a granular way or the rejection of all cookies in a single time, in the second layer, but, although there is information about own cookies and from third parties, there is not enough information about the time they remain active on the terminal equipment.

" As we will explain later and following the fully collaborative spirit of IBERIA with the Agency, as of the date of presentation of this brief of allegations, has been incorporated into the cookie management tool by the interested parties, through the information provided in the Iberia Cookies Policy, information detailed information on the time of active permanence of each of the cookies in the Web. We must focus on three fundamental ideas: - The complaint of the claimant that his- it actually gives rise to this sanctioning procedure, it deals with a very concrete (“I denounce the Iberia company since when looking for a trip it does not give me the option to reject cookies and it tells me that I have to accept them to continue browsing ”). - The cookie management tools implemented by Iberia on its website since January 2020, as was previously reported to this Agency, they correct for complete the denounced fact since they give the option to accept all cookies or al- alternatively to configure them according to their typology; and in this second step, in addition, the option is provided either of rejecting them all, or of saving the personal configuration finalized for each type of cookie as indicated by the in- teresado.

Choose between any of these three options (accept all cookies, re- select them all, or customize their configuration) is necessary to be able to follow na- browsing on the Iberia website. Therefore, from the first requirement, the following was corrected situation raised by the complainant, complying not only with art. es 12/24 also with the criteria of the European Data Protection Board (EDPB), that the Spanish Agency has endorsed in the latest update of its Interpretive Guide published this past July. - Apart from what is indicated in section b) of the sanctioning -although Mr. Instructor completely errs in his assertion as I have- explained above and later we will prove- none of the irregularities indicated by the Agency later, in the communication of initiation of proceedings. sanctioner and throughout his instruction until now has nothing to do with with the fact that appears in the complaint that originates this procedure.

In another vein and independently of the above, the instructor himself acknowledged ce the effort made by IBERIA to comply with all the indicated indications by the Agency to comply with art. 2 LSSI in light of the successive updates zations of the Agency's Interpretive Guide on cookies. Despite having been drastically reduced in number and importance, the certain aspects contrary to the regulations revealed by the Agency and the recognition of the willingness shown by IBERIA to collaborate and correct all those aspects that - in the opinion of the Agency - required it, the sanction finally proposed by the Instructor is exactly the same as at the beginning of the procedure, which is to say that for the Agency both one thing and the other have been totally irrelevant for the purpose of assessing the infraction and setting the amount of the sanction that it was to carry. Clearly, the proposal raised by Mr.

40 ("Graduation of sanctions") mentioned above, to the application of said article 39bis; and ii) IBERIA has diligently regularized, one by one, all the alleged deficiencies reported by the Agency (without prejudice of what will be said later in this writing regarding the lack of information on on the time of active permanence of cookies and on what conditions are allowed whether or not to continue browsing the Iberia website); Therefore, as a starting point for these allegations, we understand that: - The proposal sanction is not properly substantiated, since it does not indicate what type of infringement has been committed according to the corresponding legal precept, nor does it enter evaluate the graduation criteria of the applicable sanction but is limited to applying it in its maximum degree; - In line with the foregoing, the sanction proposal is inconsistent- you with the allegations, inquiries and proven facts in the investigation phase, as well as against the own acts of the Agency and Mr.

Instructor; - The proposal of The sanction goes against the provisions of the LSSI itself with regard to the mation of the amount of the proposed sanction, in view of the instruction carried out; Y - As we have maintained from the outset, the initial sanctioning procedure cted in itself goes against the provisions of art. 2 and -except that in this specific case in the spirit of the Agency, the collection spirit prevails through sanctioning powers - should never have been initiated since: i) the only alleged non-compliance alleged in the instruction that really corresponds to the complaint that would have originated it in no case is such a breach since since January 2020 a user is not obliged to accept cookies to be able to se- continue browsing, but has to choose between accepting them all, rejecting them all, or figure them according to their typology at your convenience; and ii) since all other assumptions are manifestly different breaches and, in the best of cases, accessories to the main default and never susceptible as a whole to a higher rating Beyond a minor violation of the LSSI, a request for correction would have been more sufficient to obtain the correction of the alleged situation contrary to the LSSI but, in the best of cases, to the criteria of the Interpretative Guide on the use of cookies promulgated by the Agency, which on the other hand has been recent- subject to updating by the Agency itself.

The cookie management tool existing on the Iberia website since January 2020 complies with art. es 14/24 Board (EDPB), which the Spanish Agency itself has endorsed in the latest update. 1 for the first time, the following message was obtained: The browser allowed (and allows) to scroll up and down but does not allow clicking so- Open any action button or navigate within the page. To this day the only difference is that this sandwich now comes out at the bottom of the screen: In this way, the user can find out about the cookie policy, and either accept all of them or proceed to customize your settings, in which case you get the following screen: That is: - With just one click the interested party can accept all cookies, - With just two clicks can reject them all; - Customizing them would take one to three more clicks only. The foregoing is fully consistent with what is recommended in the “Guide on the use of cookies ”published by the Agency itself, in its recent update.

of July 2020, which on pages 20 and 21 indicates the following: … Another valid example of a first layer, with the same type of cookies, would be the following: tea: As in the previous example, if the “Accept” button is not pressed, the user is not auto- curing the use of cookies (therefore, the use of cookies is not legitimized if the user Rio does not press the button to accept cookies). It will be necessary for the user to perform an action that can be qualified as a clear affirmative action for consent to be considered validly granted. Obtaining consent through user behavior other than a acceptance button, but consisting of a clear affirmative action, will be admissible provided that the conditions in which the behavior occurs offer sufficient certainty that informed and unequivocal consent is given and that it can be proven that such conduct has been carried out. In any case, the mere fact of staying alive scrolling, scrolling or browsing the website will not be considered a clear affirmative action under any circumstances.

It will be necessary that the information of the first layer is completed with a system or configuration panel in which the user can choose whether or not to accept cookies in granular form, or a link that leads to said system or panel. es 15/24 The user can also be given a third option, consisting of including two buttons. nes, to accept or configure / reject cookies: A paragraph later, the guide says verbatim (shading is added by no- sotros): The link or button to manage preferences must take the user directly- the configuration panel, without having to scroll through large amounts of text messages looking for the information, which must remain accessible in a permanent. The panel can be integrated into the second informational layer. To facilitate the selection, two buttons can be implemented on the panel, one for accept all cookies and another to reject them all, this option being recommended The higher the different number of cookies used, the greater the variable.

If you use the second or third example as a way of obtaining consent, must include- There is a button on the panel to reject all cookies, to respect the requirement of that it is as easy to withdraw consent as it is to give it. The configuration of the first layer implanted by Iberia since January 2020 continues the "Example number 3" indicated in the Guide: allows you to choose between "accept all cookies "or" configure "them to the user's taste; and the button "configuration Cookies ”leads directly to what the Guide refers to as the“ configuration panel ”. And finally, in addition, in said configuration panel a button is clearly visible to "Reject all" - once again complying with what is recommended in the guide - and another to "Confirm my preferences" once the user has established them. Therefore, the fact denounced by “the claimant” originally remained complete. completely corrected with the implantations carried out in January 2020 and THERE IS NO IN- COMPLIANCE with art.

2 LSSI in this sense by IBERIA, since the implemented cookie management tool then strictly complies with the requirements recommendations issued in its Guide updated by the Agency itself, which must obviously extended retroactively to last January. As has been said, with the only exception related to being able to view the Iberia cookies in compliance with the duty of information required by both art. 2 LSSI such as the NLOPD and GDPR, by reference, the user must necessarily choose between any of the three options made available to you (accept all cookies, reject them all, or configure them) in order to continue browsing the web. This ensures - in accordance with the most recent recommendations of the project pia Spanish Data Protection Agency- the requirement that the client provide a duly informed and unconditional consent, having therefore sub- healed since January 2020 the reason for the complaint by “the claimant” (as as this has been defined in the motion for a resolution).

es 16/24 As of the date of presentation of this brief of allegations, it has already been incorporated into the cookie management tool, through the information provided in the Policy of Iberia Cookies, detailed information on the time of active permanence of each of the cookies on the Iberia website In the first place we must insist once again that the lack of information on the time of active permanence of cookies was not the subject of the complaint that originated this sanctioning procedure. com website, in section “6. com the different cookie configuration possibilities (in accept all mode, reject zar all, or confirm custom settings) conforms to the criteria most recent published by the Agency. - The reason for the complaint of the claimant that causes the initiation of this experience sanctioning tooth (we rewrite it: “I denounce the Iberia company and that when looking for a trip it does not give me the option to reject cookies and tells me I have to accept them to continue browsing ") had already been dili- people remedied by IBERIA.

- All other considerations and alleged breaches of the indications of the Agency Guide as a whole were not covered in the complaint. presented by “the claimant” and they were not contemplated in the complaint issued by the Agency at the end of 2019, and those that do not constitute would have as a whole and in the worst case more than a SINGLE INFRACTION- LEVE TION of the LSSI regulations. - Meeting the requirements established in art. 2 LSSI. - Having raised this same allegation in the brief presented at the ment in which the Agency communicated the initiation of the sanctioning procedure, the The Agency has not been able to provide a reasoned answer to why it started the procedure. sanctioning instead of opting for this other route, just as effective and much less burdensome for my represented. - It has been accredited in the instruction phase that each and every one of the su- posts breaches of the recommendations of the Cookie Guide of the Agency had already been corrected by IBERIA before even having issued the sanction proposal, except for the display of information about the period of active permanence of cookies that required a greater technical and analytical effort and that, in light of the circumstances We have been suffering since last March due to the pandemic mia COVID19 and the state of alarm decreed and finalized in the month of June It has not been possible to correct with more advance, although today the website of IBERIA also complies with the Agency's Cookie Guide.

For all the above, WE REQUEST: - Declare ex officio the NULLITY of the disciplinary proceedings initiated for being based on a previous requirement of the Agency to IBERIA that has would have been attended to in a timely manner, having corrected the reason for the complaint on which said requirement was based. 2 in relation to the rest of the alleged breaches cited in the initiation communication of said sanctioning file - Failing that, proceed to file said file without imposing a penalty. es 18/24 paid by IBERIA, without there being, therefore, a reason for such experience. tooth. 1, “if you like continue browsing the cookie policy must be accepted by not giving no option to reject them ”, therefore, on 11/29/19, said announces to the claimed entity, indicating in the letter that, “In the IBE web portal- RIA does not provide the option to object or not consent to the treatment. to personal data made by means of "cookies", these being installed from the moment moment that the visit to the home page occurs ”and requiring the company to enter form of the decision taken regarding the claim; the measures taken to avoid similar incidents, implementation dates and the consequences trolls performed to check their effectiveness.

- On 01/28/20, the claimed entity, in response to the request of this Agency, acknowledges that, “it had been working since June 2019 on the design of the solution to adapt the cookie policy to the requirements of the RGPD and the LO- PDGDD; and that since mid-January the Iberia website complied with the norm valid policy and with the recommendations published by the Agency, (guide on cookies, published in November 2019) ”. 1 of the AEPD guide. 2. of the AEPD guide. On the other hand, if the second layer was entered, through the link, "configuration of cookies ”or on the“ cookie policy ”page, the configuration of the cookies in a granular way but the rejection of all cookies was not allowed at the time. 1 of the guide published by the AEPD. - In the first layer (initial page) a banner about cookies appears, in the part central page, with the legend: "Cookies are important to you, they influence your browsing experience.

Uses- We use analytical, personalization and advertising cookies (own and third-party) to make profiles based on browsing habits and show you useful content. You can accept this type of cookies by pressing the "Accept" button or configure them or reject their use in Cookie Settings ”. - "User Privacy" section. It is reported: “Because we respect your privacy, you can accept or reject our use of cookies for each category of cookies by moving the selector that you will find at the end of each of the lines below. Every time you are offered to accept or reject the use of certain categories of cookies, we will provide you with the information essential you need to know to make your choice. However, if you block some types of cookies, your experience of using the web may be affected and also the services we can offer you. For more information on the management of cookies carried out by Iberia, access our policy.

More information". If you click on "More Information", the website redirects to "cookie policy". - Section "Technical and Necessary Cookies". They are reported to be active you always go and that: “These cookies are necessary for the website to function and cannot be deactivated. var in our systems. They are configured in response to your actions taken by bid services, such as setting your privacy preferences, logging in, or compiling fill out forms. You can configure your browser to block or alert about these cookies, but some areas of the site will not work. These cookies do not store any guna personally identifiable information ”. - Section "Performance Cookies". It is reported that they allow counting visits and traffic sources to be able to evaluate the performance of our site and improve it. It allows deactivating them by clicking on the blue switch located in the upper corner. upper right.

- Section "Targeted Cookies" (for targeted advertising). It is reported that can be set through the site by advertising partners. They may be used by those companies to create a profile of their interests and show relevant ads. It allows deactivating them by clicking on the blue switch located in the upper corner. upper right. -Section "Functionality Cookies". It is reported that they allow the si- tio offer better functionality and customization. They can be established by the owner of the page or by third parties whose services have been added to the page. It is indicated that if these cookies are not allowed, some of their services cios will not work properly. es 21/24 It allows deactivating them by clicking on the blue switch located in the upper corner. upper right. - If the "Cookies Policy" is accessed, through the corresponding link, there is a tente on the home page or through the link (more information), existing on the page gina of "cookie settings", the web redirects to a new page where it offers- ce information on: - How and what are cookies used for.

- What are cookies. - The types of cookies on the web and their purposes. - To which recipients the data will be communicated. - Policy updates. - Cookies used. - In the option “how to manage cookies” the following information is provided mation: You can allow, block or delete the cookies installed on your computer by using the configuration of your Internet browser options. In case it does not allow After the installation of cookies in your browser, you may not be able to access al- some of the services and that your experience on our website may be less knowledgeable. satisfactory. How do I refuse or do not give my consent for the use of cookies? You can refuse to accept cookies by modifying your browser settings from In- ternet (for example, Internet Explorer, Chrome, or Firefox). Please note that if not allows the use of cookies in some areas of our website, it is possible that the content is not accessible or does not work properly.

es 22/24 In the following links you have at your disposal all the information to configure or disable your cookies in each browser (…): Finally, and in case you have any problem related to the use of the cookies on this Website, or you want to exercise your rights of access, rectification, su- pressure, limitation, opposition and portability you can contact us through the following you email address *** EMAIL. 1. FOUNDATIONS OF LAW I The Director of the Spanish Agency is competent to resolve this procedure of Data Protection, in accordance with the provisions of art. 2 of the GDPR in the art. 47 of LOPDGDD. II The joint assessment of the documentary evidence in the procedure brings to knowledge of the AEPD, a vision of the denounced action that has been strapped in the facts declared proven above related. 1 did not provide the option to reject the cookies that were installed on the ter- minal and that if any user wanted to continue browsing the page, they had to accept It is compulsory to use cookies, which is why it was in breach of current regulations.

Due to these facts, in November of said year, information was required from the entity so that it was explained about the denounced facts being the response of the entity, two months later, that is, in January 2020, that: “I had been working since June of 2019 in the design of the solution for adapting the cookie policy to the requirements agencies of the General Data Protection Regulation and the New Organic Law of Data Protection and Guarantee of Digital Rights, also following the guides of good practices issued by the control authorities and very especially the issued by the Agency last November 2019 (…) ”. He also informed this Agency, in January 2020, that: “(…) it was implemented a banner that in addition to informing about the responsibility of the use of cookies in the page, which corresponds to Iberia, allows you to configure the types of cookies that are they can be found on the web, or accept all of them ”.

es 23/24 this Agency in its Guide on Cookies, thus checking that the entity has not- had complied with what was stated a few days before, so based on this, we proceeded to the opening of this sanctioning file and it is not until the claimed entity receives the initiation of the sanctioning file PS / 0032/2020 for non-compliance with the stipulated in the LSSI Law, with a proposed penalty of 30,000 euros, when proceeds to modify the web page, in relation to the cookie policy and thus verified by this Agency, on 07/22/20. 2 LSSI ”would have been the right thing to do if the entity had made or attempted to make the changes you indicated were made in January of 2020 and that this Agency verified, in February, that they were not really made. A. 2. of the LSSI. A. UNIPERSONAL OPERATOR (IBERIA) and INFORM the claimant- you about the result of the claim. b) of Law 39/2015, of October 1, on the Administrative Procedure Co- of the Public Administrations (LPACAP), within the voluntary payment period that points out article 68 of the General Collection Regulations, approved by Royal De- Creto 939/2005, of July 29, in relation to art.