Spain: AEPD fines Unión Financiera €9,000 for unlawful processing
The Spanish data protection authority ('AEPD') published, on 24 November 2021, its decision in proceeding PS-00467-2021, as issued on 10 November 2021, in which it fined Unión Financiera Asturiana S.A. E.F.C. €15,000, then reduced to €9,000 for the recognition of responsibility to the allegations and voluntary payment, for violation of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following the unlawful processing of the complainant's personal data in the course of business activities.
Background to the decision
In particular, the AEPD stated that the complainant was initially informed by Unión Financiera that data processing operations were cancelled and then blocked. The AEPD noted that following this, Unión Financiera did not verify the cancellation of data processing, indicating to the claimant that the data was blocked without notifying them of the treatment being carried out, and later claiming that there had been no intention by the claimant to request for the deletion of the personal data, leading the claimant to raise a complaint with the AEPD.
Findings of the AEPD
Ultimately, the AEPD found that Unión Financiera had wrongfully processed the claimant's personal data since they were already blocking it, thus processing the personal data of the complainant without a legal basis in violation of Article 6(1) of the GDPR.
Notably, the AEPD considered the intentionality or negligence in the infringement of Article 6(1) of the GDPR, since Unión Financiera consulted the data of the claimant despite being blocked, as an aggravating factor in relation to the €15,000 fine.
Finally, Unión Financiera paid a reduced fine of €9,000 on account of recognition of responsibility and voluntary payment.
You can read the decision, only available in Spanish, here.