The Spanish data protection authority ('AEPD') published, on 22 April 2022, its decision in proceeding PS/00533/2021, in which it imposed a total fine of €2,000 on Movalia Traslados, S.L.U, which was subsequently reduced to €1,200, for violations of Articles 6(1) and 13 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint by Agente Service Transfers, S.L.

Background to the case

In particular, the AEPD stated that the complaint related to Movalia Traslados' website, where, in connection with an advertisement for a taxi service, website visitors could insert their personal data on a form to request a taxi. In this regard, the AEPD further noted that data subjects had not been provided with information about the processing of their personal data via the form, and that they were able to submit the form to request a taxi without having read and accepted the company's privacy policy. Furthermore, the AEPD noted the lack of a privacy policy.

Findings of the AEPD 

Notably, the AEPD found that allowing the website visitors to submit their personal data without the provision of a privacy policy, Movalia Traslados had infringed Article 6(1)(a) of the GDPR as data subjects had not provided free and voluntary consent to the processing of their personal data obtained through the website form. Furthermore, the AEPD found that failure to provide information on the website operator and the nature of data processing therein, as well as a privacy policy amounted to an infringement of Article 13 of the GDPR. 

Outcomes

Consequently, the AEPD imposed on Movalia Traslados a fine of €2,000, which was subsequently reduced to €1,200, upon voluntary payment and acknowledgment of responsibility, thereby terminating the proceedings.

You can read the decision, only available in Spanish, here.