Home

Internal

Global

Contatto

Rödl & Partner ha prestato la propria consulenza per il perfezionamento dell'acquisizione del Gruppo italiano FGV da parte di Hettich |

In tutto il mondo

Utilizziamo cookie tecnici per personalizzare il sito web e offrire all’utente un servizio di maggior valore. Chiudendo il banner e continuando con la navigazione verranno installati nel Suo dispositivo i cookie tecnici necessari ai fini della navigazione nel Sito. L’installazione dei cookie tecnici non richiede alcun consenso da parte Sua. Ulteriori informazioni sono contenute nella nostra Cookie Policy.

The largest sanction of the Spanish Data Protection Authority

The Spanish Data Protection Authority (hereinafter, the “SDPA”) has issued its largest sanction to date. It consists, in a penalty of more than 8 million euros to a telecommunications services provider (hereinafter, the “Company”).

Taking into account those sanctions issued by the European homologues of the SDPA, it is a penalty that may even be considered low. However, it is part of an upward trend in which the various operators are warned that the SDPA is now fully operational and has the necessary muscle to work within the environment of the General Data Protection Regulation with ease.

The most significant aspect about this penalty is not the amount, but one of the main objects of the penalty: the SDPA analyzes the legal relation between the Company and its suppliers. In this sense, the SDPA considers companies providing direct marketing services with their own client portfolio as data processors and not as data controllers, focusing the responsibility for processing on the contractors, considering them as controllers. This question highlights the level of scrutiny to which a sanctioning process can delve and produces an interesting effect on companies, in order to persuade them to comply with the GDPR obligations, since it remarks an important fact, in which a company is sanctioned for not carrying out the necessary accountability work when deciding on a processor, both in eligendo and in vigilando obligations.

Another matter of interest is the null response to the data subjects when they wished to exercise their right of opposition, which is considered for the estimation of the indemnity quantum.

Of course this sanction will have to be qualified by Courts, nevertheless it implies a warning: the SDPA has warmed up and is ready.

This sanction is part of a new agency intensity strategy. Not only are the penalty amounts increasing, but also the number of sanctioning proceedings, particularly in large businesses. The last year, the total amount of SDPA sanctions amounted up to 14 million euros. In the present year 2021, that figure is likely to be surpassed in the first half of the year.