In this article we shall analyse a sanction proceedings lead by the Spanish Data Protection Agency (or Agencia Española de Protección de Datos, hereinafter “AEPD”) regarding the access to a customer’s own telephone conversations with a company.
In this particular case, it is a client of the airline Iberia. The claimant states that 4 telephone recordings had not been provided, although the customer had exercised the right to access them. The reply from the company was “Iberia cannot attend to your request unless a court order is provided”.
As a consequence, the customer filed a claim before the AEPD as the right to access had not been correctly attended to. Additionally, the company, as well as not attending to the right of access, did not communicate the actions carried out to the AEPD, which gave rise to a sanction proceedings pursuant to which the airline company was presented with a penalty for Euro 7,500.
Following these events, the company continued not to fulfil its obligations and did not comply, even once the term granted for doing so had expired in excess, with the AEPD’s legal protection resolution which ordered the company to facilitate the requested telephone recordings.
The AEPD initiated the corresponding investigation actions, and found that information had been facilitated to the affected party in relation with the Iberia Plus programme, data regarding reservations, communications between the parties, etc. but it found no evidence that the requested recordings had been provided.
Likewise, it was accredited that the claimant had exercised the right of access before the defendant, without obtaining the legally required response, as well as the failure to cooperate with the AEPD in order to remedy the infringement.
As a result of the foregoing, the AEPD imposed a penalty on Iberia for the amount of Euro 40,000.
As the sanction proceedings developed, the AEPD offered Iberia two options in order to reduce the amount of the penalty:
a) In accordance with article 85 of Law 39/2015, of 1st October, on the Common Administrative Procedure of the Public Administrations, where the sanction being imposed is a fine, the defendant would be able to acknowledge its liability within the term allowed for the submission of claims under the commencement agreement; which will entail a 20% reduction of the penalty to be imposed in this procedure, equivalent in this case to Euro 8,000. With the application of this reduction, the sanction would be set at Euro 32,000, the procedure being thus resolved with the imposition of this penalty.
b) In the same way, at any time prior to the resolution of this procedure, Iberia may carry out the voluntary payment of the proposed penalty, which will mean a reduction of 20% of the amount, equivalent in this case to Euro 8,000. With the application of this reduction, the sanction would be set at Euro 32,000 and the payment thereof would imply the termination of the procedure.
The reduction arising from the voluntary payment of the penalty is accumulative to that which would be applied for the acknowledgment of responsibility, provided that the acknowledgment of responsibility is brought to light during the term granted for formulation allegations at the opening of the proceedings. In this case, if both reductions were applicable and duly applied, the penalty would be reduced to Euro 24,000.
Thus, pursuant to the above, in the end, Iberia paid the amount of the Euro 24,000 fine for neglecting its data protection obligations.
For the above reasons, we remind you of the need to correctly structure company operations with regard to data protection, and to duly consult with experts in the field.
Andreas Terán
Vilá Abogados
For more information, please contact:
23rd October 2020
