AEPD · ps-00256-2025

Case No.: EXP202410271 DECISION ON DISCIPLINARY PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On June 27, 2024, a complaint was filed with the Spanish Data Protection Agency regarding a possible violation attributable to A.A.A., with Tax ID No. ***NIF.1 (hereinafter, A.A.A. or the respondent). The facts brought to the attention of this authority are as follows: The complainant states that she received a letter from a third party, in which she was asked to sign a document acknowledging that she was not the owner of a property, thereby removing it from the land registry, in order to register said property in the name of the third party who signed the letter. The complainant asserts that she is not currently, nor has she ever been, the owner of the aforementioned property. She also notes that, some time ago, the third party appeared at her residence with the intention of speaking with her. She points out that she does not understand how the notary’s office could have provided her personal data to a third party. She also states that her son contacted the notary’s office named in the CFR (Notary’s Office in ***LOCALITY.1), which denied the data breach, and with the notary association of LOCALITY.2, which has not provided an explanation regarding the source of the data breach. Attached to the complaint are: The CFR mentioned in the complaint, dated May 22, 2024, sent by B.B.B. to the complainant. Descriptive and Graphic Cadastral Certificate for an agricultural parcel located in LOCALITY.1 with cadastral reference ***NUMBER.1, to which the second proven fact refers. SECOND: Pursuant to Article 65.4 of Organic Law 3/2018, of December 5, on data protection and the Guarantee of Digital Rights (hereinafter hereinafter “LOPDGDD”), said complaint was forwarded to the notary’s office mentioned in the letter dated May 22, 2024, so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in data protection regulations. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/15 The notification of the referral of the complaint, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was made on July 23, 2024, as evidenced by the acknowledgment of receipt on file. Following several communications with said notary’s office, on September 26, 2024, this Agency received a written response indicating that the notary’s office had not disclosed personal data to third parties without legal authorization to do so. Furthermore, it was noted that a man had contacted the notary’s office regarding some parcels of land for which a third party had requested, by letter, a correction to the cadastral record with the purpose of resolving a discrepancy. The man had attached a cadastral certificate on which his mother’s first and last names appeared. Although this certificate had not been requested by that notary’s office, but rather by a different notary’s office, as noted at the bottom of the certificate. The man was informed that the notary’s office in question had not issued the cadastral certificate in question. To clarify the matter, he would need to contact the notary’s office that had requested the documentation, as indicated at the bottom of the certificate. THIRD: On September 27, 2024, in accordance with Article 65 of the LOPDGDD, the complaint was accepted for processing. FOURTH: The Subdirectorate General for Data Inspection (hereinafter, SGID) proceeded to conduct preliminary investigative proceedings to clarify the facts in question, by virtue of the functions assigned to the supervisory authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter “GDPR”), and in accordance with the provisions of Title VIII of the LOPDGDD. As a result of the actions taken, the following facts have come to light:

The General Directorate of the Cadastre, after consulting the access log of the Cadastral Electronic Headquarters, confirms that the Descriptive and Graphic Cadastral Certificate, which accompanies the complaint, was requested by Notary Public No. (...): This is reflected in the fourth proven fact. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/15 The following is a partial reproduction of the report on preliminary investigative actions: “On 11/12/2024, a request for information was sent via the SIR system to the GENERAL SUBDIRECTORATE OF CADASTRAL MANAGEMENT, COLLABORATION, AND CITIZEN SERVICES, requesting the of the applicant for the “Descriptive and Graphic Cadastral Certification” of the property ***NUMBER.1, with application date: ***DATE.1. On November 28, 2024, a response letter signed by the ***POSITION.1. They provided the following information: - “The User C.C.C., with Tax ID Number ***NIF.2, from the (...) in ***LOCALITY.2, obtained on ***DATE.1 at (…) o’clock, through the Cadastral Electronic Portal, a Descriptive and Graphical Cadastral Certificate for the aforementioned property with cadastral reference ***NUMBER.1, specifying the purpose as ‘informational.’” - They report that, following the inquiry made by the AEPD, they have requested that the Notary’s Office (...) provide additional information justifying access to protected data. They attach the request and state that they will forward the results to that Agency.” On December 17, 2024, the SGID received a new communication from the General Directorate of the Cadastre, forwarding a letter from the Notary’s Office (...), dated December 5, 2024. The aforementioned letter states, among other matters: “With regard to your cited letter, (…) I hereby inform the General Directorate that, indeed, the User Mr. C.C.C., with ID No. (…), (…), obtained on ***DATE.1, at (…) o’clock, a Descriptive and Graphic Cadastral Certificate (CCDG) for the property with cadastral reference ***NUMBER.1. Mr. C.C.C. obtained said CCDG at the request of a client of the notary’s office, specifically Ms. B.B.B., via email dated ***DATE.1, at (…) o’clock, who provided the cadastral reference number of the property, with the purpose, as she stated, of enabling, upon review of the obtained CCDG, a son of B.B.B. would enter into negotiations with the owner of the property to purchase or lease it, as he saw fit; a legal transaction that, to date, has not been carried out at this Notary’s Office. (…)” The name of the notary’s client matches that of the person who sent and signed the CFR referred to in the first established fact.

Notary’s Office No. (...) confirms that it submitted the request for information to the Cadastre and specifies the circumstances under which it made said inquiry: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/15 In this regard, the report on preliminary investigative proceedings states: “(…) On January 17, 2025, a written response signed by A.A.A. was received, setting forth the following points: - The inquiry to the Land Registry was made “as part of the in preparation for the sale of the property in question, which, according to the buyer, was to be executed but, for reasons that are unknown, was not ultimately formalized at this notary’s office” - It refers to Art. 53.2 of Royal Legislative Decree 1/2004, of March 5, which approves the consolidated text of the Real Estate Cadastre Law, which states the following: “The following may access protected cadastral information without the need for the consent of the affected party: a) The bodies of the General State Administration and other territorial public administrations, the State Tax Administration Agency, and the managing entities and shared services of the Social Security System, subject to the limitations arising from the principles of competence, suitability, and proportionality” - They refer to the Resolution of October 26, 2015, of the General Directorate of the Cadastre (Official State Gazette [BOE] of October 30, 2015), Section 8.4: “Notaries may obtain descriptive and graphical cadastral certificates for real estate, access information regarding the processing status of cadastral procedures affecting documents authorized by them or for which their execution is requested.” In the aforementioned letter, A.A.A. states: “In short, access to the information referred to in the AEPD’s request was carried out in the performance of notarial public functions, in in accordance with the provisions of the Notarial Act of May 28, 1862, the Decree of June 2, 1944, approving the Regulations on the Organization and Operation of the Notarial Profession, as well as the implementing legal regulations, which require the notarial action described.”

Concluding section of the preliminary investigation report: It states: “ - It has been determined that the Notary’s Office (...) of Notary A.A.A. obtained the cadastral certificate containing the personal data of the claimant and that it was transferred to a third party with an interest in the property. - The defendant claims to have obtained the information regarding the property pursuant to Article 53.2 of Royal Legislative Decree 1/2004, dated March 5, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es March 5, 15 , which approves the consolidated text of the Real Estate Cadastre Act and the Resolution of October 26, 2015, of the General Directorate of the Cadastre (BOE of October 30, 2015), Section 8.4. - The notary’s office has not responded to the information requested on several occasions by this Agency regarding the transfer of the complainant’s personal data (provision of the cadastral certificate to a third party) or to other issues raised.” FOURTH: On March 21, 2026, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against the respondent, for the alleged violation of Article 6.1 of the GDPR, as defined in Article 83.5 of the GDPR. FIFTH: After the aforementioned decision to initiate proceedings was served in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), and after the deadline granted for the submission of statements had elapsed, it was found that no statement had been received from the respondent. Article 64.2.f) of the LPACAP—a provision of which the respondent was informed in the decision to initiate the proceeding—provides that if no statements are submitted within the prescribed period regarding the content of the decision to initiate the proceeding, and when it contains a specific finding regarding the alleged liability, it may be considered a proposed resolution. In the present case, the decision to initiate disciplinary proceedings set forth the facts underlying the allegation, the GDPR violation attributed to the respondent, and the penalty that could be imposed. Therefore, taking into account that the respondent has not filed any complaints regarding the notice of initiation and in accordance with the provisions of Article 64.2.f) of the LPACAP, the aforementioned notice of initiation is considered, in this case, a proposed resolution. In light of all the proceedings, the Spanish Data Protection Agency considers the following to be established facts in this proceeding: ESTABLISHED FACTS FIRST: On May 24, 2024, B.B.B. sent a CFR to the claimant’s address in which he proposed that she sign a document acknowledging that she was not the owner of a property, thereby removing it from the cadastre, so that he could register said property in his name (B.B.B.’s). The CFR, dated May 22, 2024, describes the status of the aforementioned property, noting that it is listed in the claimant’s name in the cadastral registry and refers reference to the Descriptive and Graphic Cadastral Certificate, which was sent to the claimant along with the CFR. It also mentions that B.B.B. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/15 visited the claimant’s residence on a date prior to May 22, 2024, with the purpose of speaking with her about said parcel. SECOND: In the Descriptive and Graphic Cadastral Certificate (CCDG) for a parcel with cadastral reference ***NUMBER.1, which accompanied the CFR dated May 22, the claimant is identified as the owner of said parcel, with her name and last name, as well as her address (where B.B.B. appeared in person and to which the CFR dated May 22, 2024, was sent). THIRD: The first name, last name, identification number, and address of individuals who are registered in the Real Estate Cadastre as owners of properties are considered protected data, in accordance with cadastral regulations. FOURTH: The General Directorate of the Cadastre, after consulting the access log of the Cadastre’s Electronic Portal, has confirmed that the Descriptive and Graphical Cadastral Certificate (CCDG), which is the subject of this proceeding, was obtained by Notary’s Office Number (...) on ***DATE.1 for “informational” purposes. Notary’s Office (...) acknowledges that it issued the CCDG on ***DATE.1. FIFTH: Notary Public No. (...) provided its client, B.B.B., with the Descriptive and Graphical Cadastral Certificate (CCDG) referred to in the second established fact, which contained the claimant’s personal data, without having a legal basis for the processing in accordance with the provisions of Article 6.1 of the GDPR. LEGAL GROUNDS I Jurisdiction In accordance with the powers granted by Article 58(2) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and as established in Articles 47, 48(1), 64(2), and 68(1) of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to resolve this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “Proceedings C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/15 handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the regulatory provisions adopted to implement it, and, to the extent they do not conflict with them, on a subsidiarily, by the general rules on administrative procedures.” II Preliminary Issues Article 4(1) of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (‘the data subject’); an identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.” Article 4(2) of the GDPR defines “processing” as: “any operation or set of operations performed on personal data or sets of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.” Article 4(7) of the GDPR defines the “controller” or “data controller” as: “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing; if Union law Union or of the Member States determines the purposes and means of the processing, the controller or the specific criteria for its designation may be established by Union or Member State law.” In the present case, in accordance with the provisions of Article 4(1) and (2) of the GDPR, it is established that personal data processing is taking place, since A.A.A., owner of Notary Public Office No. (...), carries out, among other processing activities, the collection, recording, organization, storage, modification, retrieval, access, use, disclosure by transmission, etc., of personal data belonging to natural persons: for example, first and last names, national ID number, nationality, address, marital status, profession, etc. A.A.A. carries out this activity in its capacity as the controller, since it is the entity that determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR. III Breach of Obligation. Lawfulness of Processing The first paragraph of Article 6 of the GDPR establishes the following: “1. Processing is lawful only if at least one of the following conditions is met: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 8/15 a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b) the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation, at the data subject’s request, of pre-contractual measures; c) the processing is necessary for compliance with a legal obligation applicable to the controller; d) the processing is necessary to protect the vital interests of the data subject or of another natural person; e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary for the purposes of the legitimate interest pursued by the controller or by a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring data protection do not override those interests, in particular when the data subject is a child. The provisions of subparagraph (f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their functions." In the present case, B.B.B. sent the claimant, along with a letter, a Descriptive and Graphic Cadastral Certificate (CCDG) for a parcel with cadastral reference NUMBER.1, which included the claimant’s first and last names and address (first and second proven facts). That person visited the claimant’s residence and subsequently sent the claimant, via certified mail, a CFR requesting that the claimant draft and sign a document stating that she was not the owner of said parcel, thereby removing themselves from the Cadastral Registry, so that the parcel could be transferred to the sender’s name (first proven fact). In accordance with the foregoing, the information received by the complainant originates from an inquiry made to the Land Registry by Notary’s Office No. (…) on ***DATE.1 (fourth proven fact). Next, reference is made to relevant information contained in Royal Legislative Decree 1/2004, of March 5, approving the consolidated text of the Real Estate Cadastre Law: “Article 51. Protected Data. For the purposes of this title, the following are considered protected data: the first name, last name, business name, identification code, and address of those registered in the Real Estate Cadastre as owners, as well as the cadastral value and the cadastral values of the land and, where applicable, the structure of the individual real estate properties.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/15 Therefore, the inquiry made by Notary Public No. (...) was an inquiry that involved access to data protected under cadastral regulations, including, among others, the first name, last names, and address of the person listed in the Real Estate Cadastre as the owner of the parcel with cadastral reference ***NUMBER.1. Pursuant to the provisions of Article 52 of Royal Legislative Decree 1/2004, of March 5: “Article 52. General conditions for access. 1 Anyone may access information regarding real estate they own and information regarding unprotected data contained in the Real Estate Cadastre. 2 The General Directorate of the Cadastre may authorize the processing and subsequent distribution of cadastral information under the terms set forth in Article 21 of the Consolidated Text of the Intellectual Property Law, approved by Royal Legislative Decree 1/1996, of April 12, upon a request from the data subject, which must specify the number of copies of the transformed product intended for distribution.” For its part, Article 53 of Royal Legislative Decree 1/2004, of March 5, which regulates access to protected cadastral information, provides as follows: “1. Access to protected cadastral data may only be granted with the express, specific, and written consent of the affected party, or when a law excludes such consent or the information is collected in any of the following cases of legitimate and direct interest for data subjects: a) Para the execution of research projects of a historical, scientific, or cultural nature sponsored by universities or research centers, provided they are deemed relevant by the Ministry of Finance. b) For the identification and description of properties, as well as for the determination of cadastral changes related to the documents authorizing or registering rights, or for which authorization or registration is requested, by notaries and property registrars property, in accordance with the provisions of this Act and mortgage legislation. Likewise, notaries may access the cadastral resolutions resulting from such changes for delivery, where applicable, to the data subjects. c) For the identification of adjacent parcels, with the exception of the cadastral value of each property, by those listed in the Real Estate Cadastre as owners. d) By the owners or co-owners of rights in rem or of lease or sharecropping agreements pertaining to the real estate registered in the Real Estate Cadastre, with respect to said properties. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/15 e) By the heirs and successors, with respect to the real property of the decedent or transferor that is registered in the Real Estate Cadastre. 2 However, the following may access protected cadastral information without the need for consent from the affected party: a) The agencies of the General State Administration and other regional public administrations, the State Agency for Tax Administration, and the managing entities and common services of the Social Security, subject to the limitations arising from the principles of competence, suitability, and proportionality. b) Parliamentary commissions of inquiry, the Ombudsman, and the Court of Auditors, as well as regional institutions with analogous functions. c) Judges, courts, and the Public Prosecutor’s Office. d) Public agencies, corporations, and entities, for the exercise of their public functions, through the administrative body to which they report and provided that the conditions set forth in paragraph a) are met.” Therefore, Notary Public No. (...) could access the protected data of the complaining party contained in the Real Estate Cadastre if the conditions set forth in Article 53 of Royal Legislative Decree 1/2004, of March 5, were met. However, the processing of personal data carried out by said Notary’s Office—consisting of the disclosure of the descriptive and graphical cadastral certificate (CCDG), which contained the claimant’s first name, last names, and address, to a third party—was not justified. This processing was carried out without a lawful basis for the processing in accordance with the provisions of Article 6.1 of the GDPR. The legend appearing in the lower left corner of the Descriptive and Graphic Cadastral Certificate states: “This certificate reflects the data included in the Cadastral Database. It may only be used for the exercise of the applicant’s authority.” The third party to whom the cadastral certificate was provided used the personal data contained therein to visit the claimant’s residence and, subsequently, send the claimant a letter (first proven fact). In this regard, it should be noted that there is a discrepancy between the statements made by the notary’s office in a letter dated December 5, 2024, in which it is stated that (underlining added by the AEPD): “C.C.C. obtained said CCDG at the request of a client of the notary’s office, specifically B.B.B., via email dated ***DATE.1, at (…) o’clock, who provided the cadastral reference number of the property, located at C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/15 purpose, as she explained, of having, based on the CCDG obtained, a son of B.B.B. enter into negotiations with the owner of the property to purchase or lease it, as he saw fit; a legal transaction that, to date, has not been carried out at this Notary’s office.” Meanwhile, subsequently, and with reference to a letter dated January 17, 2025, it is stated that - The land registry inquiry was conducted “as part of the preparatory steps for the sale of the property in question, which, according to the buyer, was to be executed but, for reasons that are unknown, was never formalized at this Notary’s office” Therefore, it is considered that the known facts constitute an infraction, attributable to A.A.A., for violation of the provisions of Article 6.1 of the GDPR. V Classification of the violation of Article 6.1 of the GDPR and assessment for purposes of the statute of limitations Article 83.5 of the GDPR classifies a violation of the following article, which shall be punishable, in accordance with paragraph 2, by administrative fines of up to 20,000,000 EUR or, in the case of an enterprise, an amount equivalent to up to 4% of the total annual global turnover of the preceding financial year, whichever is higher: “a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9;” For its part, article 71 of the LOPDGDD, titled “Violations,” states that: “Acts and conduct referred to in paragraphs 4, 5, and 6 of article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this organic law.” For the sole purpose of the statute of limitations, Article 72.1 of the LOPDGDD provides as follows: “Pursuant to Article 83.5 of Regulation (EU) 2016/679, , infringements that constitute a substantial violation of the articles mentioned therein, and, in particular, the following, shall be considered very serious and shall be subject to a three-year statute of limitations: b) The processing of personal data without meeting any of the conditions for the lawfulness of processing set forth in Article 6 of Regulation (EU) 2016/679.” VI Penalty C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/15 In order to determine the administrative fine to be imposed, the provisions of Articles 83(1) and 83(2) of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the administrative fines administrative fines pursuant to this article for the infringements of this Regulation referred to in paragraphs 4, 9, and 6 are, in each individual case, effective, proportionate, and dissuasive. 2 Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or in lieu of the measures set forth in Article 58(2)(a) through (h) and (j). When deciding whether to impose an administrative fine and determining its amount in each individual case, due into account: a) the nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered; b) whether the infringement was intentional or due to negligence; c) any measures taken by the controller or processor to mitigate the harm suffered by the data subjects; d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32; e) any previous violations committed by the controller or processor; f) the extent of cooperation with the supervisory authority to remedy the violation and mitigate its potential adverse effects; g) the categories of data affected by the breach; h) how the supervisory authority became aware of the breach, in particular whether the controller or processor notified the supervisory authority of the breach and, if so, to what extent; i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved in accordance with Article 42, and k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as the financial benefits obtained or the losses avoided, directly or indirectly, as a result of the violation.” For its part, article 76, “Sanctions and Corrective Measures,” of the LOPDGDD provides: “1. The sanctions provided for in paragraphs 4, 5, and 6 of article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the level of the penalty set forth in paragraph 2 of that article. 2 In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679, , the following may also be taken into account: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/15 a) The ongoing nature of the violation. b) The connection between the violator’s activity and the processing of personal data. c) The benefits obtained as a result of committing the violation. d) The possibility that the data subject’s conduct may have contributed to the commission of the violation. e) The existence of a merger by absorption occurring after the commission of the violation, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having a data protection officer, when not otherwise required. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms, in those cases where disputes exist between them and any data subject.” In the present case, with regard to the seriousness of the possible violation, with particular regard to the consequences its commission has on those affected, a fine should be imposed, in addition to the adoption of measures, if appropriate. The fine imposed must be, in each individual case, effective, proportionate, and dissuasive, in accordance with article 83(1) of the GDPR. In light of the facts set forth, it is considered appropriate to impose a sanction on the respondent for the violation of Article 6.1 of the GDPR, as defined in Article 83.5.a) of the GDPR. The appropriate sanction is an administrative fine in the amount of 2,000.00 euros VI Corrective Measures Now that the violation has been confirmed, this decision establishes the corrective measures that the offending entity must adopt to put an end to the breach of personal data protection, in this case Article 6(1) of the GDPR, in accordance with the provisions of the aforementioned Article 58(2)(d) of the GDPR, pursuant to which each supervisory authority may “order the controller or processor to ensure that processing operations comply with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time limit…” Thus, the responsible entity may be required to bring its actions into compliance with personal data protection regulations, to the extent set forth in the preceding Legal Grounds. This order sets forth the alleged violation committed and the facts giving rise to a breach of data protection regulations, from which clearly indicates the measures to be adopted, without prejudice to the fact that the specific type of procedures, mechanisms, or instruments for implementing them is the responsibility of the sanctioned party, since it is the controller who C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 14/15 has full knowledge of its organization and must decide, based on accountability and a risk-based approach, how to comply with the GDPR and the LOPDGDD. In this case, A.A.A. is required, within a maximum period of 3 months, counting from the date the final decision concluding this proceeding becomes enforceable, to adopt the following measures: - Demonstrate that it has adopted the necessary measures to ensure compliance with the provisions of Article 6.1 of the GDPR in all personal data processing operations it carries out. The imposition of this measure is compatible with the sanction consisting of an administrative fine, in accordance with Art. 83.2 of the GDPR. Please be advised that failure to comply with the order to adopt the measures imposed by this agency in the sanctioning decision may be considered an under the provisions of the GDPR, classified as an infringement in Articles 83.5 and 83.6, and such conduct may lead to the initiation of a subsequent administrative sanctioning proceeding. Therefore, in accordance with applicable law and after evaluating the criteria for determining the severity of the sanctions, the existence of which has been established, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO IMPOSE on A.A.A., with Tax ID No. ***NIF.1, for a violation of Article 6.1 of the GDPR, as defined in Article 83.5.a) of the GDPR, a fine of 2,000.00 euros (TWO THOUSAND EUROS). SECOND: TO ORDER A.A.A., with Tax ID No. ***NIF.1, that, pursuant to Article 58.2.d) of the GDPR, within a maximum period of 3 months from the date this decision becomes final and enforceable, to provide evidence that it has implemented the necessary measures to ensure compliance with the provisions of Article 6.1 of the GDPR in all personal data processing operations it carries out. THIRD PARTY: NOTIFY A.A.A. of this decision. FOURTH: This decision shall become enforceable once the deadline for filing the optional appeal for reconsideration has expired (one month from the day following the notification of this decision) without the data subject having exercised this right. The party subject to the sanction is hereby notified that they must pay the imposed sanction once this decision becomes enforceable, in accordance with the provisions of Art. 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Art. 68 of the General Collection Regulation, approved by Royal Decree 939/2005, dated July 29, in conjunction with Art. 62 of Law 58/2003, dated December 17, by making a payment, indicating the taxpayer identification number (NIF) of the party subject to the penalty and the procedure number appearing in the header of this document, into the restricted account No. IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT code: CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at C/ Jorge Juan, 6www.aepd.es 28001 – Madrid sedeaepd.gob.es 15/15 the bank CAIXABANK, S.A. Otherwise, the debt will be collected through enforcement proceedings. Once the notice has been received and becomes enforceable, if the date on which it becomes enforceable falls between the 1st and 15th of each month, inclusive, the deadline for making the shall be until the 20th of the following month or the next business day thereafter; and if it falls between the 16th and the last day of each month, inclusive, the deadline for payment shall be until the 5th of the second following month or the next business day thereafter. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution shall be made public. Publication shall take place once it has been notified to the data subjects. Against this resolution, which concludes the administrative proceedings pursuant to Article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the data subjects may, at their discretion, file a motion for reconsideration with the Presidency of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, governing the Administrative Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. Finally, it is noted that, in accordance with the provisions of Article 90.3(a) of the LPACAP, the final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal. If this is the case, the data subject must formally notify the Spanish Data Protection Agency of this fact by submitting a written notice addressed to the Agency through the Agency’s Electronic Registry web/, or through any of the other registries provided for in Art. 16.4 of the aforementioned Law 39/2015, of October 1 The data subject must also submit to the Agency the documentation proving that the contentious-administrative appeal has been effectively filed. If the Agency is not notified of the filing of the contentious-administrative appeal within two months from the day following the notification of this decision, it will terminate the provisional suspension. 938-090326 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es