İnternet Sitesinde Eksik Gizlilik Bilgilendirmesi

EDPBI:ES:OSS:D:2021:263 — ES SA final decision (Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject))

1/25
Agency
Spanish
protection
data

Procedure No: PS/00462/2019

FINAL DECISION ON PENALTY PROCEEDINGS

Of the proceedings conducted by the Spanish Data Protection Agency and based
on the following

BACKGROUND

FIRST: Through the ‘Internal Market Information System’ (hereinafter ‘IMI’), governed by
Regulation (EU) No 1024/2012 of the European Parliament and o f the Council of 25
October 2012 (the IMI Regulation), the aim of which is to promote cross -border
administrative cooperation, mutual assistance between Member States and the exchange
of information, a complaint was received by this Spanish Data Protection Agency (AEPD),
on 11/09/18, from a data subject to the Commissioner for Data Protection and Freedom of
Information of Berlin-Hamburg (hereinafter: berlin).

This complaint is forwarded to the AEPD in accordance with Article 56 of Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement
of such data (GDPR); Given its cross -border nature, this Agency is competent to act as
lead supervisory authority.

The complaint is made against the website www.iconmobel.de for lack of privacy policy
and cookie policy. In addition, the complainant also complains that “the entity refuses to
issue an invoice unless it provides a tax identification number”.

The letter stated that:
“Ladies and gentlemen
I hereb y wish to lodge a complaint with the following company: Https://www.
Lack of data protection information or cookie warnings.
In addition, the company refuses to issue an invoice after my purchase unless it
gives them a tax identification number.
I suspect that invoices are issued only on demand and that the company is trying
to evade taxes.
With our b est wishes,
The complainant does not provide any additional documentation or evidence of the facts
reported.
The Berlin Supervisory Authority identifies FURNISHICON S.L.U. with its registered office
in Spain as responsible and points out that the websites www.muebledesign.com and
www.meublesconcept.fr are also dependent on the supplier FURNISHCONCEPT S.L.U..

The data processing carried out concerns data subjects in several Member States.
According to the information provided in IMI,
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

So
This document incorporates the electronic signature recognised in accordance with Law 6/2020 of 11 November regulating
certain aspects of electronic trust services and Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic transactions in the internal market. 0t
Signed by Director — Mar España Martí
Verification URL https://sedeaqpd.qob.es/validar-csv/ Page 1/25

2/25

Agency
Spanish
protection
data
pursuant to Article 56 GDPR, the supervisory authorities of North Rhine-Westphalia,
Rhineland-Palatinate, Lower Saxony, Saarland, Mecklenburg-Western Pomerania,
France, Norway and Italy have been identified as interested in these proceedings.

SECOND: In the light of the facts set out above, the Subdi rectorate-General for Data
Inspection carried out measures to clarify it in case E/1458/2019, in accordance with the
investigative powers conferred on the supervisory authorities in Article 57 (1) of the GDPR.
On 04/08/19, the websites belonging to FURNISHYOURSPACE, S.L. (CIF: B67094375),
which contains the privacy policy accessible from various links. It is also checked that the
websites complained of have the option of collecting personal data to open an account and
make online purchases. The report on previous inspection measures was issued on
09/04/2019.

With regard to privacy policy, the following facts can be found:

- The privacy policy of the website in Castilian, www.muebledesign.com, is available
at the following links: “Terms and Conditions”; “Privacy Policy” and “Legal Information” at
the bottom of the page.

- The privacy policy on the German website, www.iconmobel.de , is available from
the links: ‘Geschaftsbedingungen’; ‘Datenschutzerklarung’; “Versandinformationen”
“Widerrufsrecht” and “Reklamation”, located at the bottom of the page.

- The privacy policy of the French website, www.meublesconcept.fr is available from
the links: ‘Termes et conditions’; ‘Politique de Pretection de Données’; ‘Droit de
rétractation’ and ‘mentions légales’, located at the bottom of the page.

The information on the ‘Privacy Policy’ page, both on the Spanish website, on the German
website and on the French website, is the same in any of the three languages. Please find
below the information in Spanish:

- IDENTIFICATION.
In accordance with the ob ligation to provide information under Article 10 of the Act
34/2002, of 11 July of the Information Society Services and of
Electronic commerce means the operator’s information listed b elow
corresponds to the homepage serca.es
Name of company: FURNISHYOURSPACE SL
Location: Carrer Ecuador 95 3° 08029 Barcelona
Telephone: 931706086
E-mail: [email protected]
TAX ID: B67094375
- DATA PROTECTION POLICY
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of persons with regard to
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

So
This document incorporates the electronic signature recognised in accordance with Law 6/2020 of 11 November regulating
certain aspects of electronic trust services and Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic t ransactions in the internal market. 0t
Signed by Director — Mar España Martí
Verification URL https://sedeaqpd.qob.es/validar-csv/ Page 2/25

3/25

Agency
Spanish
protection
data
processing of personal data and the free movement of such data and its implementing
regulations are used to answer and process your comments and suggestions.
We collect your information when you register on our web site or order our products or
services. If you voluntarily participate in customer surveys, provide feedb ack and
participate in tenders, information about the client is collected.
The web site usage information is stored via cookies.
We store your IP address to diagnose problems on our server and m anage the web site.
An IP address is a number assigned to your computer when using the Internet. This is also
used to recognise it during a dedicated visit to the web site.
For the purchase to take place, the following information can b e requested: Name,
address, e-mail, date of b irth, telephone number and method of payment.
After completing the contact forms on the web site or sending emails or any other request
to switch information to Iconmobel, the data sub ject gives his or her express consent to
the processing of personal data and to the sending of advertisements.
Your data will b e treated confidentially b y Iconmobel and used only for the purposes
mentioned above. They shall not b e disclosed to third parties without the prior express
consent of the customer. The exception is the carrier, who accepts the order. In this case,
it will only b e received b y the carrier who needs it, so that he can process the logistics of
sending the orders placed. Such data are only necessary for the processing (name,
delivery address and telephone number to b e contacted). Icon furniture, in turn, ob liges
b usinesses to comply with the requirements of EU Regulation 2016/679.
Iconmobel undertakes to maintain professional secrecy and to take all necessary technical
and organisational measures to ensure the information in accordance with the
requirements of the ab ove-mentioned Regulation.
Your personal data will b e stored in our client register for two years. However, it can revoke
access to data for rectification or erasure at any time, as well as revocation of data
processing or transferab ility.
The b uyer authorises contact by telephone or e-mail about the details of the customer who
has provided Iconmobel as a source of information on the order it has executed.
The user is solely responsible for the accuracy and accuracy of the information provided.
In the case of the provision of false information or of third parties without its express
permission, Iconmobel reserves the right to destroy the information immediately in order
to protect the right of the b eneficial owner.
With regard to data, you can log in to your account b y email to exercise your rights. The
application must b e accompanied by an identification document so that we can b e sure
that you are the owner. Then your rights:
- The right to access your personal information and to know whether or not we are
processing your personal information.
- Right to request correction of incorrect information or its deletion if
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

4/25

Agency
Spanish
protection
data
other things, it is no longer necessary for its original purpose.
- Right to request to restrict the processing of your data. In this case, these are only stored
for the exercise or defence of claims.
- The right to ob ject to the processing of your data in certain circumstances and in relation
to your personal situation.
- Right to transfer your data.
- The right to revoke consent, without which the revocation affects the lawfulness of the
previous data processing that has b een approved.
- Right to lodge a complaint with a supervisory authority. If you think your rights have been
violated during data processing, you have the right to lodge a complaint with the Spanish
Data Protection Agency.

THIRD: On 07/06/2019, the AEPD issued a draft decision proposing to close the
proceedings, taking the view that, on the basis of the inspections carried out, the privacy
policy in question was in line with the GDPR, and I therefore consider that Article 13 of th e
GDPR has not been infringed.

FOURTH: On 02/07/2019, the Berlin Supervisory Authority sent a letter stating that the
draft decision was incomplete. In summary, points out that privacy policy does not inform
about the legal basis of the processing; Whereas no information is provided about the
fouling of third party cookies when using the website and the user only has the option to
accept them (even it seems that they are installed prior to their acceptance) resulting in
disablement to the browser; And finally, that the draft decision does not refer to the claim
made that the buyer had requested the tax identification number in order to issue an
invoice.

FIFTH: On 17/10/2019, the AEPD issued a first revised draft decision identifying the
sections of the privacy policy referring to the legal basis of the processing, providing certain
information on the content to be included in simplified invoices, and informing that, with
regard to the subject of cookies, information will be required from the requested party and
may be sanctioned, where appropriate, in accordance with Spanish law.

On the basis of the above, the AEPD considered that there was no breach of Article 13
GDPR and proposed to close the proceedings.

SIXTH: On 01/11/19, the Berlin Supervisory Authority objected to the revised draft decision
on the following grounds:

• Existence of various offences relating to the information to be provided to the data subject
because, in accordance with the privacy policy of the website www.iconmobel.de in force
on 29/10/2019:

o the legal basis of the processing is not mentioned. This constitutes a breach of Article 13
(1) (c) GDPR.

o the cookie information is incorrect and incomplete. This would constitute a breach of
Article 13 (1) (a), (c), (e), (f) and (2) (a) GDPR (if the data has been obtained
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

5/25

Agency
Spanish
protection
data
of the data subject) or of 14.1 (a), (c), (e), (f) and (2) (a) of the GDPR (if the data have not
been obtained from the data subject).

o A list of third parties uploaded on the website, which implies communication of the IP
address to those third parties. Several of these third parties would use the data for
marketing purposes. Some of these third parties appear to be based outside the European
Economic Area. However, the privacy policy does not mention these third parties as
potential recipients of the data, but points out that it only communicates data to the
transport company.

Nor does it report that there will be an international transfer of data or the legal b asis for
such a transfer.

Therefore, there would have been a breach of Article 13 (1) (a), (c), (e), (f) and (2) (a)
GDPR (if the data were obtained from the data subject) or Article 14 (1) (a), (c), (e), (f) and
(2) (a) GDPR (if the data were not obtained from the data subject). In addition, there would
have been an infringement of Article 26 (2) and possibly of Article 44.

o Privacy policy is confusing and language is grammatical and uses terms that do not
belong to the common German language. This constitutes a breach of Article 12 (1) GDPR
in conjunction with Articles 13 and 14.

o The privacy policy does not mention the right to object to processing under Article 21 (2)
GDPR (which constitutes a violation of Article 21 (4)) and refers only to the AEPD as the
authority to file a complaint (breach of Article 13 (2) (d)).

• The only way to refuse the installation of cookies is through the browser settings.
Therefore, the consent obtained to accept cookies and third party content is invalid as it
has not been freely given. Furthermore, the consent collected does not cover the
disclosure of data to third parties uploading web content or its use for their own purposes.
All this leads to a breach of Article 6 GDPR.

• The Berlin Supervisory Authority does not agree that the tax identification number
is required for the issue of a simplified invoice. In addition, information on the requirements
for issuing an invoice appears only inconsistently in the section Privacy Policy Terms and
Conditions. This would constitute a breach of Article 6 GDPR.

SEVENTH: On 03/06/2020, the AEPD adopted, in accordance with Organic Law 3/2018
of 5 December 2007 on the protection of personal data and the guarantee of digital rights
(‘LOPDGDD’ or Organic Law), a draft agreement to initiate penalty proceedings for alleged
infringement of Article 13 of the GDPR.

EIGHT: On 26/06/2020, the AEPD issued a second revised draft decision sharing an
overview of the draft initiating agreement with the following content:

C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

6/25

Agency
Spanish
protection
data
Summary of the complaint
The Spanish authority received a complaint against Fumishicom S.L.U. as it does not
include the necessary information on the Inconmobel.de web site owned b y Furnishicom
S.L.U. in its views in different languages.

Competition
Article 56(1), Article 58 (2) and (4) and Article 60 GDPR, and in accordance with Article
48(1) and Article 64 of Organic Law 3/2018 of 5 December on the Protection of Personal
Data, the Director of the Spanish authority shall have the power to:

ADOPTION OF THIS REVISED DECISION

Enquiry of the Spanish Supervisory Authority
On the web site it has b een verified that personal data are collected. The Spanish web site
includes Privacy Policies, with other content such as Terms and Conditions of Use, on a
page accessib le from different links: Three in the INFORMATION section and others
from the cookie b anner.
Similar is the case on the German page, although in this case there are five links:
Terms and conditions Privacy policy Sub mission information Rejected
And the French page from five others.
With regard to the information provided to users, information is provided on:
• the identity and contact details of the responsib le person;
• The purposes of the processing for which the personal data are intended and the legal
b asis for the processing
• The recipients or categories of recipients of personal data
• the period for which personal data will b e available
• the existence of the right to request access from the controller of personal data
concerning the data sub ject, rectification, erasure, restriction of processing, ob jection as
well as the right to data portab ility. And the right to lodge a complaint with a supervisory
authority.
A revised draft decision will b e included in the system for the exchange of cross-b order
procedures for preparatory work, including infringements of Article 13 GDPR, failure to
include a legal b asis for processing, differences in the coverage of privacy policy,
information on the right to ob ject, lack of information on the possibility to lodge complaints
with other supervisory authorities, and request for a national ID card for simplified invoices.
As regards cookies, it is b eing penalised in accordance with our national legislation.

Supervisory authorities concerned
The following supervisory authorities shall b e informed of this draft decision: Or
Pomerania Mecklenburg-West
or France
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

7/25

Agency
Spanish
protection
data
orItaly
or Lower Saxony
or North Rhine-Westphalia
or Norway or Renania-
PaJatinado
or Saarland
or Berlin

Rule alleged to have been infringed
— Transparency and information (Article 13)

Draft decision on the measures to be taken
Withrespect to The ‘Privacy Policy’ of the web site
Www.mueb ledesign.com:WWW. iconmobel.de and www.meub lesconcept.fr and in
application of Article 13 GDPR, the following anomalies have b een identified:
— Information is provided on the purposes of the processing of personal data, b ut not on
the legal b asis of the processing (Article 6 (1) GDPR).
— According to the German Data Protection Authority, the privacy policy of the web site
www.iconmob el.de contains a large amount of grammatical and spelling errors. It uses
terms that do not correspond to the terms used in the everyday German language and are
therefore entirely intelligible.”
— In the Privacy Policy, it only allows the right of data sub jects to ob ject to data
processing in accordance with Article 21 (1) GDPR, b ut not to the processing of personal
data for direct marketing purposes, the right to ob tain the processing of personal data at
any time.
— Under the heading “Right to lodge a complaint with a supervisory authority” it is stated
that: “If you b elieve that your rights have b een infringed during the processing of the data,
you have the right to lodge a complaint with the Spanish Data Protection Agency”, even if
the users are citizens or are on German or French territory.
The ‘D-INVIOSING’ section of the ‘C-ENVÍOS/Delivery’ section of the Privacy Policy states
that "Furure Design will generate a simplified invoice with payments accepted and received
provided that the total order does not exceed EUR 3 000 according to the legislation in
force. It will not b e possib le to process orders in excess of this amount if the DNI or TIN is
not notified ", b ut it is not specified that the provision of persona l data (in this case TIN or
CIF) is a legal or contractual requirement according to Article 13 (2) (e).
These facts could constitute a b reach of Article 13 GDPR, which sets out the information
to b e provided to the data sub ject at the time of collection of his or her personal data.
It is considered appropriate to impose a “warning” sanction for violation of Article 13 GDPR.
As regards cookies, it is b eing penalised — in accordance with the Spanish legislation —
the results will sub sequently b e communicated to the supervisory authorities of the
Memb er States that have declared the sub jects concerned.

Communications
As lead supervisory authority, the AEPD shall sub mit this draft decision to the other
supervisory authorities concerned in order to receive their views.
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

So
This document incorporates the electronic signature recognised in accordance with Law 6/2020 of 11 November regulating
certain aspects of electronic trust services and Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic transactions in the internal market. 0
Signed by
Verification URL
Director — Mar España Martí
https://sedeaqpd.qob.es/validar-csv/ Page 7/25
t

8/25

Agency
Spanish
protection
data
pursuant to Article 60(3) GDPR.
Furthermore, in accordance with Article 64(2) of Organic Law 3/2018 of 5 December on
the Protection of Personal Data, this draft decision will b e formally communicated to the
controller or processor. The adoption of this draft decision will interrupt the limitation period
for the infringement. In accordance with Article 64(4) of the Organic Law on Data Protection
and the Safeguarding of Digital Rights, the terms laid down in that Article shall be
automatically suspended when information, consultation, request for assistance or
mandatory ruling has to b e obtained from one or more authorities of another Member State
in accordance with the GDPR, for the time b etween the request and the notification of the
decision to the Spanish Data Protection Agency.
Once the comments sub mitted b y the supervisory authorities concerned have been
analysed, the draft decision to initiate the penalty procedure will b e notified to the controller
or processor, complying with all the requirements specified in Article 68 of the ab ove-
mentioned Organic Law.
Finally, in accordance with Article 112(1) of Law 39/2015 of 1 Octob er 1992 on the
Common Administrative Procedure of the Pub lic Administration, there is no right of appeal
against this Decision. ’

NINE: On 08/07/2020, the Berlin Supervisory Authority objected to this revised draft
decision (A60RD 133963).

Third-party content and co-responsibility

‘As stated in our second relevant and reasoned ob jection to the revised draft decision, we
found that the icmob el.de web site uploads the following servers on a first upload on the
homepage:
[...]

Ob viously, most of them are third parties, therefore Furnishicon discloses at least the
personal data “IP address” to third parties, many of which are located in third countries.

At least some of these third parties, prob ably most, use the visitor’s personal data of the
web site provided by Furnishicon for monitoring and other marketing purposes. With regard
to ECJ case law, at least many of these third-party content inclusions will give rise to joint
control b etween the company operating the web site (Furnishicon) and the external
provider.

For consideration, in section 6 on ‘Terms of service of Google Analytics’
(https://marketingplatform.google.com/about/analytics/terms/us/ in English or
https://marketingplatform.google.com/about/analytics/terms/de/ in German), Google
reserves the right to use the personal data of web site users for its own purposes. The
same applies to Yahoo Analytics (Yahoo Web -Analytics, see
https://policies.yahoo.com/xa/en/yahoo/privacy/topics/analytics/in dex.htm in English or
https://policies.yahoo. COM/ie/de/yahoo/privacy/topics/web analytics/index.htm EN
German). Twitter analytics and Twitter Audience are comparable to the Facek Insights
service (reference to ECJ, judgment of 5 June 2018 — C-210/16 —
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

So
This document incorporates the electronic signature recognised in accordance with Law 6/2020 of 11 November regulating
certain aspects of electronic trust services and Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic transactions in the internal market. 0
Signed by
Verification URL
Director — Mar España Martí
https://sedeaqpd.qob.es/validar-csv/ Page 8/25
t

9/25

Agency
Spanish
protection
data
Wirtschaftsakademie Schleswig-Holstein).

Furnishicon has therefore also b reached the second sentence of Article 26 (2) GDPR and
Article 44 GDPR (which will b e investigated b y the LSA).

From the first access to the web site, there is a b reach of the principle that should exist
prior to data processing (EDPB, Guidelines 05/2020 on consent under Regulation
2016/679, recital 90), as ‘consent’ cannot legitimise the processing. Furthermore, the
wording of the later collected “consent” does not cover the current processing.
Furthermore, as discussed in detail in our second relevant and reasoned ob jection,
‘consent’ is not valid, since it is not given fairly and the continued use of a web site does
not constitute valid consent. In fact, such consent would b e necessary at least for:

(1) any disclosure of the IP address and other personal data to third parties for whom it
should not b e ensured that they will not use the data for their own purposes, and

(2) any use of techniques to delay user interaction.

This leads to a b reach of Article 6(1) and Article 5(1)(a) GDPR.

Language and structure of privacy policy

‘The first sentence of Article 12 (1) GDPR requires that any information referred to in Article
13 and Article 14 GDPR b e provided in a concise, transparent, intelligible and easily
accessib le form, using clear and plain language.

As stated b y the AEPD, the Privacy Policy is readab le. It contains a large numb er of
grammar and spelling errors, uses terms that do not correspond to the terms used in the
GDPR or Germana law or in the everyday German language and are entirely intelligible.

Furthermore, the structure of the Privacy Policy is flawed. For example, under the title
‘cookies’, it also deals with social media and data subjects’ rights. Outside the Privacy
Policy section, under the terms and conditions, there is a section ‘Identity of the controller
(contact)’, which contains the sub sections ‘Child Protection Policy’ (containing a statement
not valid for all users minus) and ‘Links to other web sites’.

Therefore, the first sentence of Article 12(1) GDPR has also b een infringed.”

Information on the right to obtain processing under Article 21 (2) GDPR is missing.

“As stated b y the AEPD, the Privacy Policy only allows for the modification of the right of
data sub jects to ob tain processing under Article 21 (1) GDPR (and this in a difficult way).
Privacy policy does not mention the right of
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

So
This document incorporates the electronic signature recognised in accordance with Law 6/2020 of 11 November regulating
certain aspects of electronic trust services and Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic transactions in the internal market. 0
Signed by
Verification URL
Director — Mar España Martí
https://sedeaqpd.qob.es/validar-csv/ Page 9/25
t

10/25

Agency
Spanish
protection
data
data sub jects under Article 21 (2) GDPR and therefore, as is the case for information on
the right to ob ject under Article 21 (1) GDPR, is erroneous and misleading.

Furnishicon therefore also violated Article 21 (4) GDPR, which is likely to prevent data
sub jects from exercising their rights of processing for direct marketing purposes “.”

Obligation to provide the tax identification number.

‘In its second revised draft decision, the AEPD mentions that Furnishicon requires DNI
(ob viously as a synonym for the tax identification number that Furnishicon requires the
applicant) even for simplified invoices on which there is no legal b asis for doing so, just as
we indicate in our second relevant and reasoned objective.

Furnishicon therefore also violated Article 6 (1) and Art. 5 (1) (a) GDPR .‘

Measures proposed

“AEPD proposed to issue a warning against Furnishicon. Since Furnishicon has not
sub stantially changed its illegal b ehaviour, a warning is not an acceptab le measure.

We suggest that the Spanish Data Protection Agency order compliance with the GDPR.
The icmob el.de privacy policy is explained in the same way as it is documented in our
relevant and reasoned ob jection, which the AEPD regards as a b reach of Article 13 GDPR
and which, as indicated above, also violates other provisions of the GDPR. However, when
the icmobel.de web site is constructed, the same cookie b anner appears, which allows the
web site to b e used in full only when the user clicks on ‘Acepto’ (‘Ich akzeptiere’). The other
‘More information’ b utton (in English only) links to the general terms and conditions, which
also face the Privacy Policy, b ut do not remove the cookie banner. There is no way to rebut
the cookie settings except through the b rowser settings. The wording of the consent
collected does not cover the interruption of personal data by integrating third -party content
into the web site, and there is no other legal basis. Furthermore, as discussed in detail
ab ove, Furnisicon has infringed many more provisions of the GDPR and has not yet solved
it.

Furthermore, the infringement cannot b e considered minor b ecause the illegality of the
transfer of personal data to third parties, in particular in third countries, the lack of
agreement and information pursuant to Article 26 GDPR and the complete lack of utility of
the Privacy Policy pose a significant threat to the data protection rights of the data subjects,
affects the very essence of the legal ob ligations in question and indicates a systemic
prob lem (253). The infringement was intentional (see WP253 III.b)). Furthermore, the
specific infringement is not remedied after it has b een detected, and has not b een
remedied to date, and Furnishicon has maintained this situation, even after Furnishicon
had b ecome aware of the illegality of its actions and AEPD had intervened (see WP253
III.c), (f)).
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

11/25

Agency
Spanish
protection
data
DECIM: In accordance with the procedure laid down in Article 60 of the GDPR, the Director
of the Spanish Data Protection Agency agreed to adopt a draft agreement to initiate penalty
proceedings against FURNISHYOURSPACE S.L., and in accordance with the procedure
laid down in Article 60 GDPR, the draft decision to initiate proceedings was transmitted via
the IMI system to the supervisory authorities concerned and informed them that if they did
not raise objections, the mandatory agreement to initiate proceedings wo uld be adopted.
THIRTEENTH: The draft opening of proceedings was submitted to the supervisory
authorities concerned pursuant to Article 60 (3) GDPR, no objections were raised within
the legal deadline.

THIRTEENTH: On 1 July 2021, the Director of the Spanis h Data Protection Agency
decided to initiate penalty proceedings against the complainant for alleged infringement of
Article 6 of the GDPR, Article 21 of the GDPR and Article 13 of the GDPR, as laid down in
Article 83 (5) of the GDPR.

THIRTEENTH: The decision to initiate was notified electronically to the notified party. This
is required by Article 14 (2) of Law 39/2015 on the Common Administrative Procedure of
Public Administrations (LPACAP), according to which ‘In all cases, electronic means shall
b e required to link with the pub lic administrations in order to carry out any formality of an
administrative procedure, at least the following sub jects: (a) Legal persons’.

In the file, the certificate issued by the FNMT-RCM Electronic Notifications and Authorised
Electronic Address Service, which records the sending of the agreement to initiate, AEPD
notification addressed to FURNISHYOURSPACE, S.L., via this medium, the date of
making available on the body’s website on 02/07/2021 and the date of automatic rejection
on 13/07/2021.

Article 43 (2) of the LPACAP provides that where notification by electronic means is
mandatory — as in the present case —‘shall be deemed to b e refused if ten calendar days
have elapsed since the notification was made available without access to its content’.

It should be added that Articles 41.5 and 41.1, third paragraph, of the LPACAP state,
respectively:

‘Where the person concerned or his representative refuses notification of an
administrative action, it shall b e recorded in the file specifying the circumstances of the
attempt to notify and the means b y which it was attempted, and the procedure shall be
deemed to have b een carried out and the procedure followed.’

‘Notifications shall b e valid irrespective of the means used, provided th at they make
it possib le to estab lish that they have b een sent or made available, that they have been
received or accessed b y the person concerned or their representative, of their dates and
times, of their content.
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

So
This document incorporates the electronic signature recognised in accordance with Law 6/2020 of 11 November regulating
certain aspects of electronic trust services and Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic transactions in the internal market. 0
Signed by
Verification URL
Director — Mar España Martí
https://sedeaqpd.qob.es/validar-csv/ Page 11/25
t

12/25

Agency
Spanish
protection
data
complete, and the true identity of the sender and recipient. Proof of the notification made
shall b e included in the file.’

Thus, given that the notice of initiation was notified to FURNISHYOURSPACE, S.L.,
electronically (Article 14 LPACAP), and that the notification was rejected after ten days, as
provided for in Article 43 (2) of the aforementioned law, the procedure was considered to
have been completed and the procedure continued (ex Article 41 (5) LPACAP).

FOURTEENTH: In accordance with Article 73.1 of the LPCAP, the period for submitting
observations on the Agreement of Initiation is ten days from the day following the date of
notification.

Article 64.2. LPACAP states that the complainant will be informed of the right to make
representations, of the ‘right to b e heard in the proceedings and of the time limits for
exercising it, and of the statement that if he fails to make any ob servations within the
prescrib ed period on the content of the decision to initiate proceedings, it may be
considered a motion for a decision if it contains a precise ruling on the liab ility charged’.

The agreement to initiate the penalty proceedings in question contained a precise ruling
on the liability of FURNISHYOURSPACE, S.L.. the agreement specified the infringing
conduct, the type of sanction in which it was subsumable, the circumstances altering the
liability considered to be concurrent and the amount of the penalty that the AEPD considers
it appropriate to impose.

In view of the above, and in accordance with Article 64 (2) (f) of the LPACAP, the
agreement to initiate the procedure for PS/00462/2019 is considered a motion for a
resolution.

In the light of all the foregoing, the Spanish Data Protection Agency in these proceedings
considers the following facts to be established:

FACTS

FIRST: The websites www.muebledesign.com: www.iconmobel.de and
www.meublesconcept.fr provide information on:

- the identity and the contact details of the controller;

- the period for which personal data will be stored;

- on users’ rights, (Right to access their personal information: Right to request
correction of information; The right to request restrictions on the processing of your
data; The right to object to the processing of your data in certain circumstances;
Right to transfer your data; Right to revoke consent and right to lodge a complaint
with a Spanish supervisory authority).

C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

13/25

Agency
Spanish
protection
data
However, the following shortcomings have been identified:

• On the website www.iconmobel.de. the identity and contact details of the controller
are provided under a misleading title (“Gůschaftszeck”, which seems to mean a
commercial purpose).

• The purposes of the processing are not clearly s tated. they can only be derived
from information given in another context. Spanish law requires that some
documents containing personal data of clients for tax purposes are kept by the
controller and this information is not included.

• No information is provided on the legal basis for the processing of personal data.

• The period during which the personal data will be stored is only provided with
respect to the ‘client register’; Without informing about the period of retention of
customers’ personal data for tax purposes.

• The right of data subjects to object to data processing under Article 21 (1) of the
GDPR is mentioned but there is no reference to the data subject’s right under
Article 21(2) that “Where the processing of personal data is for direct marketing,
the data sub ject shall have the right to ob ject at any time to the processing of
personal data concerning him or her, including profiling in so far as it relates to
such marketing”.

• Information is provided on the right to lodge a complaint with the Spanish Data
Protection Agency, even if the users are citizens or individuals on German or
French territory. Article 13 (2) (d) refers to the “right to lodge a complaint with a
supervisory authority”, which means that the complaint may be submitted to any
supervisory authority, not only to the Spanish Data Protection Agency.

• The ‘D-FACTURATION’ section of the ‘Terms and Conditions’ states that ‘A
simplified invoice shall b e generated for the order once the payment has been
accepted and received provided that the total order does not exceed EUR 3,000 in
accordance with the legislation in force. Orders ab ove this amount cannot be
processed if you do not notify your ID card or TIN ", but it is not specified whether
providing these personal data (in this case TIN or CIF) is a legal or contractual
requirement.

SECOND: The privacy policy on the website www. iconmobel.de is difficult to read and its
structure is confusing. It contains a large number of grammatical and spelling errors and
uses terms that do not correspond to words used in the daily German language in German
law or in the GDPR (completely unintelligible).
C/Jorge Juan. 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

14/25

Agency
Spanish
protection
data
THIRD: There is no information on the right of the data subject to object to data processing
where the processing is for the purpose of direct marketing and the information submitted
concerning the right to object to processing is drafted in a confusing manner, misleading
data subjects. This would make it difficult for data subjects to exercise their right to object
to data processing for direct marketing purposes.

FOURTH: FURNISHYOURSPACE, S.L., requests that a tax identification number be
provided in order to proceed with the issue of the simplified invoice. The controller informs
on his website that simplified invoices will be issued for transactions not exceeding EUR
3,000 and that orders in excess of this amount cannot be processed if a tax identification
number is not provided.

GROUNDS

Under the powers conferred on each supervisory authority by Article 58 (2) of the GDPR,
and as laid down in Articles 47 and 48.1 of the LOPDGDD, the Director of the Spanish
Data Protection Agency is competent to resolve this procedure.

II.

Article 5 GDPR on the principles governing the processing of personal data mentions
among them the principle of transparency. Paragraph 1 of the provision provides: ‘Personal
data shall b e:
a) processed lawfully, fairly and transparently in relation to the data sub ject
(‘lawfulness, loyalty and transparency’)’
Expression of the principle of transparency is the obligation on data controllers to inform,
in the terms of Article 13 GDPR, the data subject when the personal data are obtained
directly from the data subject:

‘1. Where personal data relating to a data subject are collected from the data subject,
the controller shall, at the time when personal data are ob tained, provide the data sub ject
with all of the following information:
a) the identity and the contact details of the controller and, where applicable, of
the controller’s representative;
b ) the contact details of the data protection officer, where applicab le;
c) the purposes of the processing for which the personal data are intended as
well as the legal b asis for the processing;
d) where the processing is b ased on Article 6(1)(f), the legitimate interests of the
controller or of a third party;
e) the recipients or categories of recipients of the personal data, if any;

C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

15/25

Agency
Spanish
protection
data
f) where applicab le, the fact that the controller intends to transfer personal data to
a third country or international organisation and the existence or ab sence of an
adequacy decision b y the Commission, or in the case of transfers referred to in
Article 46 or 47, or the second sub paragraph of Article 49(1), reference to th e
appropriate or suitab le safeguards and the means b y which to ob tain a copy of
them or where they have b een made available.

2. In addition to the information referred to in paragraph 1, the controller shall, at
the time when personal data are ob tained, provide the data sub ject with the following
further information necessary to ensure fair and transparent processing:

a) the period for which the personal data will b e stored, or, where that is not
possib le, the criteria used to determine that period;
b ) the existence of the right to request from the controller access to and
rectification or erasure of personal data or restriction of processing concerning the
data sub ject or to ob ject to processing as well as the right to data portab ility;
c) where processing is b ased on Article 6(1)(a) or Article 9(2)(a), the existence of
the right to withdraw consent at any time, without affecting the lawfulness of
processing b ased on consent prior to its withdrawal;
d) the right to lodge a complaint to a supervisory authority;
e) whether the provision of personal data is a statutory or contractual requirement,
or a requirement necessary to enter into a contract, as well as whether the data
sub ject is ob liged to provide the personal data and of the possib le consequences
of failure to provide such data;
f) the existence of automated decision-making, including profiling, referred to in
Article 22 (1) and (4) and, at least in those cases, meaningful information about the
logic involved, as well as the significance and the envisaged consequences of such
processing for the data sub ject.

3. Where the controller intends to further process the personal data for a purpose
other than that for which the personal data were collected, the controller shall provide the
data sub ject prior to that further processing with information on that other purpose and with
any relevant further information as referred to in paragraph 2.
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data sub ject
already has the information. ’
Article 5 (1) (a) GDPR lays down the principle of‘lawfulness, loyalty andtransparency’, a
principle which is the subject of Recital 39: ‘‘All processing of personal data must b e lawful
and fair. It should b e transparent to natural persons that personal data concerning them
are collected, used, consulted or otherwise processed and to what extent the personal
data are or will b e processed. The principle of transparency requires that any information
and communication relating to the processing of those data should b e easily accessible
and easy to understand, and that clear and plain language is used. That principle concerns
in particular the
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

16/25

Agency
Spanish
protection
data
information of data sub jects on the identity of the controller and the purposes of the
processing and on the information added to ensure fair and transparent processing with
regard to the natural persons concerned and their right to ob tain confirmation and
communication of personal data concerning them which are b eing processed. Individuals
should b e aware of the risks, rules, safeguards and rights relating to the processing of
personal data, as well as how to assert their rights in relation to the processing. In
particular, the specific purposes for which personal data are processed should b e explicit
and legitimate and determined at the time of the collection of the personal data. ...’

Recital 60 links the duty to provide information with the principle of transparency, stating
that ‘The principles of fair and transparent processing require that the data sub ject b e
informed of the existence of the processing operation and its purposes. The controller
should provide the data sub ject with any further information necessary to ensure fair and
transparent processing taking into account the specific circumstances and con text in which
the personal data are processed. The data sub ject should also b e informed of the profiling
and the consequences of such profiling. If personal data are ob tained from data sub jects,
they should also b e informed whether they are ob liged to provide them and of the
consequences if they do not do so [...]“. In this order, Article 12 (1) GDPR regulates the
conditions for ensuring its effective materialisation and Article 13 specifies what information
should be provided when the data are obtained from the data subject.

Article 12 (1) GDPR states that "The controller shall take appropriate measures to provide
any information referred to in Articles 13 and 14 and any communication pursuant to
Articles 15 to 22 and 34 relating to processing to the data sub ject in a concise, transparent,
intelligible and easily accessible form, using clear and plain language, in particular any
information addressed specifically to a child. The information shall b e provided in writing,
or b y other means, including, where appropriate, b y electronic means. At the request of
the data sub ject, the information may b e provided orally provided that the identity of the
data sub ject is demonstrated b y other means.’

III.

Part of the complaint relates to the privacy policy included in the web pages of which
FURNISHYOURSPACE, S.L.

As regards transparency, as expressed by the Berlin Supervisory Authority, the privacy
policy on the website www.iconmobel.de, which is written in German, is difficult to read. It
contains a large number of grammatical and spelling errors and uses terms that do not
correspond to words used in the daily German language, German law or the GDPR
(therefore completely unintelligible).

The structure of privacy policy is also confusing, as, for example, social media and data
subjects’ rights are also referred to under cookies. Outside the privacy policy, there is a
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

17/25

Agency
Spanish
protection
data
it contains two subsections on child protection policy and links to other websites.

Based on the above, the privacy policy violates Article 12 (1) GDPR with regard to the duty
to provide information in a concise, transparent, intelligible and easily accessible form.

With regard to the ‘Privacy Policy’ included on the web pageswww.muebledesign.com:
HYPERLINK "http://www.meublesconcept.fr"WWW. iconmobel.de and
www.meublesconcept.fr and in application of Article 13 GDPR, it has been found that they
provide information on: The identity and the contact details of the controller; The period for
which personal data will be stored; And on users’ rights, (Right to access their personal
information; Right to request correction of information; The right to request restrictions on
the processing of your data; The right to object to the processing of your data in certain
circumstances; Right to transfer your data; Right to revoke consent and right to lodge a
complaint with a Spanish supervisory authority).

However, the following shortcomings, already set out in the established facts, have been
identified:
• On the website www.iconmobel.de. the identity and contact details of the controller
are provided under a misleading title (“Gůschaftszeck”, which seems to mean a
commercial purpose).
• The purposes of the processing are not clearly defined, but can only be derived
from information given in another context. In addition, Spanish law requires the
controller to keep certain documents containing customers’ personal data for tax
purposes; This information is missing.
• Information is provided on the purposes of the processing for which the personal
data are intended (with some limitations as mentioned above), but not on the legal
basis of the processing (Article 13 (1) (c)).
• The period during which personal data will be stored is only provided with respect
to the “client register”. However, Spanish law requires the controller to keep certain
documents containing customers’ personal data for tax purposes; This reten tion
period is missing for this treatment.
• The right of data subjects to object to data processing under Article 21(1) GDPR is
mentioned, but there is no reference to the data subject’s right under Article 21(2)
that “Where the processing of personal data is for direct marketing, the data subject
shall have the right to ob ject at any time to the processing of personal data
concerning him or her, including profiling in so far as it relates to such marketing”.
• Information is provided on the right to lodge a complaint with the Spanish Data
Protection Agency, even if the users are citizens or individuals on German or
French territory. Article 13(2)(d) refers to the ‘right to lodge a complaint with a
supervisory authority’, which means that the complaint may be

C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

18/25

Agency
Spanish
protection
data
submitted to any supervisory authority, not only to the Spanish Data Protection
Agency.
• The ‘D-FACTURATION’ section of the ‘Terms and Conditions’ states that ‘A simplified
invoice shall b e generated for the order once the payment has b een accepted and
received provided that the total order does not exceed EUR 3,000 in accordance
with the legislation in force. Orders ab ove this amount cannot b e processed if you
do not notify your ID card or TIN ", but it is not specified whether the provision of
personal data (in this case TIN or CIF) is a legal or contractual requirement, as set
out in Article 13 (2) (e).

In those circumstances, the facts known constitute an infringement, attributable to the one
complained of, for breach of Article 13 GDPR, which sets out the information to be provided
to the data subject at the time of collection of his or her personal data.

The requested person, in its capacity as controller, was obliged under Article 13 GDPR to
include on its websites, by which it collects the data of third parties various information
which it has completely and completely omitted.

Thewebsites by which you collect personal data violate Article 12 and Article 13 of the
GDPR, which is covered by Article 83.5 GDPR, which provides: ‘Infringements of the
following provisions shall, in accordance with paragraph 2, b e sub ject to administrative
fines of not more than EUR 20.000.000 or, in the case of an undertaking, up to 4 % of the
total total annual turnover of the preceding financial year, whichever is higher:
a) (...)
b ) The rights of data sub jects under Articles 12 to 22;”

For the sole purposes of prescription, Article 72 (1) (h) of the LOPDGDD describes as very
serious‘the failure to inform the data sub ject of the processing of his personal data in
accordance with Articles 13 and 14 of Regulation (EU) 2016/679 and 12 of this Organic
Law’. The limitation period for very serious infringements provided for in the LOPDGDD is
three years.

Stemming from the fact set out in Legal Basis II and III regarding the lack of information on
the right of the data subject to object to data processing where the processing is for the
purpose of direct marketing and that the information submitted concerning the right to
object to processing under Article 21 (1) is drafted in a confusing manner, data subjects
would be misled.

This has the consequence of making it more difficult for data subjects to exercise their right
to object to processing of data for direct marketing purposes, and there is therefore an
infringement of Article 21 (4), which states that “The right referred to in paragraphs 1 and
2 shall b e explicitly mentioned to the data sub ject and shall b e presented clearly and
independently of any other information.”
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

19/25

Agency
Spanish
protection
data
The factsidentified constitute an infringement, attributable to the one complained of, for
breach of Article 21 GDPR, which provides for the right to object to the processing of your
personal data for advertising purposes.

For its part, Article 72 (1) (k) of the LOPDGDD cons iders that it is very serious, for the
purposes of limitation, ‘whether the exercise of the rights laid down in Articles 15 to 22 of
Regulation (EU) 2016/679 is prevented or hindered or repeatedly neglected’.

This infringement may be sanctioned by a maximum fine of EUR 20.000.000 or, in the
case of an undertaking, up to 4 % of the total overall annual turnover of the preceding
financial year, whichever is the higher, in accordance with Article 83 (5) (b) GDPR.

As stated above, Article 5 (1) (a) of the GDPR lays down, as one of the principles relating
to processing, the obligation for personal data to be processed “lawfully, fairly and
transparently in relation to the data subject (“lawfulness, loyalty and transparency”) and in
order for such processing to be lawful, the data subject must be able to rely on one of the
legitimate grounds set out in Article 6 (1) of the GDPR:

‘Processing shall be lawful only if and to the extent that at least one of the following
applies:
a) the data sub ject gave his or her consent to the processing of his or her data
personal for one or more specific purposes;
b ) processing is necessary for the performance of a contract to which the data
sub ject is party or in order to take steps at the request of the data sub ject prior to entering
into a contract;
c) processing is necessary for compliance with a legal ob ligation to which the
controller is sub ject;
d) processing is necessary in order to protect the vital interests of the data sub ject
or of another natural person;
e) processing is necessary for the performance of a task carried out in the pub lic
interestorin the exercise of official authorityvested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by
the controller or b y a third party, except where such interests are overridden b y the
interests or fundamental rights and freedoms of the data sub ject which require protection
of personal data, in particular where the data sub ject is a child.
Point (f) of the first sub paragraph shall not apply to processing carried out by public
authorities in the performance of their tasks. ’

In that connection, the applicant’s complaint referred to the trader’s request for the need
to provide a tax identification number in order to issue the invoice. Bearing in mind tha t, as
reported by the controller on his/her website, an invoice will be issued.
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

20/25

Agency
Spanish
protection
data
simplified for transactions not exceeding EUR 3,000 which cannot be ordered in excess of
that amount if a tax identification number is not provided, the fact that the order of the
person concerned was processed without the need for such a tax identification number
would mean that the person concerned has the right to request a simplified invoice without
being asked for the identification number to be issued.

According to the above, the request for a tax identification number made has no legitimate
basis, which constitutes a breach of Article 6 (1) and, consequently, of the principle laid
down in Article 5 (1) (a) GDPR.

For its part, Article 72 (1) (b) of the LOPDGDD considers that ‘the processing of personal
data without complying with one of the conditions for lawful processing laid down in Article
6 of Regulation (EU) 2016/679’ is very serious for the purposes of prescription.

In accordance with the evidence available at the present time, it is considered that the facts
set out do not comply with Articles 5.1 (a), 6.1, 12.1, 13 and 21.4 of the GDPR, which
implies the commission of the two offences laid down in Article 83 (5) of the GDPR.

The corrective powers available to the Spanish Data Protection Agency, as the supervisory
authority, are set out in Article 58 (2) GDPR. These include the power to address a warning
(Article 58 (2) (b)), the power to impose an administrative fine under Article 83 of the GDPR
— Article 58 (2) (i) — or the power to order the controller or processor to ensure that the
processing operations comply with the provisions of the GDPR, where applicable, in a
specific manner and within a specified timeframe — Article 58.2 (d).

According to Article 83 (2) GDPR, the measure provided for in Article 58 (2) (d) GDPR is
compatible with the sanction in the form of an administrative fine.

In order to determine the administrative fine to be imposed, the provisions of Articles 83.1
and 83.2 of the GDPR must be observed, which state:

‘1. Each supervisory authority shall ensure that the imposition of administrative fines
pursuant to this Article in respect of infringements of this Regulation referred to in
paragraphs 4, 9 and 6 shall in each individual case b e effective, proportionate and
dissuasive.

2. Administrative fines shall b e imposed, depending on the circumstances of each
individual case, in addition to or in place of the measures referred to in the
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

21/25

Agency
Spanish
protection
data
Article 58(2) (a) to (h) and (j). When deciding whether to impose an administrative fine and
deciding on the amount of the administrative fine in each individual case due regard shall
b e given to the following:
a) the nature, gravity and duration of the infringement taking into account the nature scope
or purpose of the processing concerned as well as the numb er of data sub jects affected
and the level of damage suffered b y them;
b ) the intentional or negligent character of the infringement.
c) any action taken b y the controller or processor to mitigate the damage suffere d b y data
sub jects;
d) the degree of responsibility of the controller or processor taking into account technical
and organisational measures implemented b y them pursuant to Articles 25 and 32;
e) any relevant previous infringements b y the controller or processor.
f) the degree of cooperation with the supervisory authority in order to remedy the
infringement and mitigate the possib le adverse effects of the infringement;
g) the categories of personal data affected b y the infringement;
h) the manner in which the infringement b ecame known to the supervisory authority, in
particular whether, and if so to what extent, the controller or processor notified the
infringement;
i) where measures referred to in Article 58(2) have previously b een ordered against the
controller or processor concerned with regard to the same subject-matter, compliance with
those measures;
j) adherence to approved codes of conduct pursuant to Article 40 or approved
certification mechanisms pursuant to Article 42; and
k) any other aggravating or mitigating factor applicable to the circumstances of the case,
such as financial b enefits gained, or losses avoided, directly or indirectly, from the
infringement. ’

Article 76 ‘Penalties and corrective measures’ of the LOPDGDD provides :

‘1. The penalties provided for in Article 83 (4), (5) and (6) of Regulation (EU) 2016/679
shall b e applied taking into account the graduation criteria set out in paragraph 2 of that
Article.

2. In accordance with Article 83 (2) (k) of Regulation (EU) 2016/679, account may also be
taken of:

a) The continuous nature of the infringement;
b ) The link b etween the offender’s activity and the processing of personal data.
c) The profits made as a result of the infringement.
d) The possib ility that the conduct of the person concerned might have led to the
commission of the infringement.
e) The existence of a merger b y acquisition after the infringement has b een committed,
which cannot b e attrib uted to the acquiring entity.
f) The impact on the rights of minors.
g) Have, where this is not required, a data protection officer.
h) The referral b y the controller or processor, on a voluntary b asis, to alternative dispute
resolution mechanisms, in cases where
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

22/25

Agency
Spanish
protection
data
there are disputes b etween them and any interested party. ’

In accordance with the provisions set out above, for the purpose of determining the amount
of the fines to be imposed in the present case on the defendant, who is responsible for the
offences referred to in Article 83 (5) (a) and (b) of the GDPR, the fine to be imposed for
each of the alleged infringements s hould be graduated.

In order to quantify the fines for each infringement, as a mitigating circumstance for all
infringements, we must consider it to be a small undertaking.

And as aggravating circumstances of the infringements, we should consider the
following:

1.Infringement of Article 12 and Article 13 GDPR as defined in Article 83(5)(b) GDPR:

The following criteria to be taken into consideration are considered to be met:

. The nature, gravity and duration of the infringement, as the lack of information p revents
the full extent of the processing of personal data and hinders the exercise of rights by data
subjects.

. The continuous nature of the infringement.

. High number of data subjects, as all those who access the pages and whose data are
processed from several EU countries are affected.

In the light of the above factors, the amount of the fine for this infringement is EUR 3,000.

2.Infringement of Article 21 GDPR, as defined in Article 83(5)(a) GDPR:

The following criteria to be taken into account are considered to be met:

. The nature, gravity and duration of the infringement, having regard to the nature, scope
or purpose of the processing operations concerned, since the exercise of a right of data
subjects is effectively prevented.

. The continuous nature of the infringement;

In the light of the above factors, the amount of the fine for this infringement is EUR 1,000.

3.Infringement of Article 5(1)(a) and Article 6(1) GDPR, as defined in Article 83(5)(a)
GDPR:

The following criteria to be taken into consideration are considered to be met:

C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

23/25

Agency
Spanish
protection
data
. The nature, gravity and duration of the offence, taking into account the nature, scope or
purpose of the processing operations concerned, given that the lack of locus standi in
relation to the application for the tax identification number makes it impossible in itself to
process personal data.

In the light of the above factors, the amount of the fine for the infringement is EUR 2,000’
VII

In accordance with Article 58 (2) (d) GDPR, each supervisory authority may “order the
controller or processor to comply with the provisions of this Regulation, where appropriate,
in a specific manner and within a specified time limit...’.

In this case, having regard to the circumstances expressed in relation to the defects
identified, from the point of view of data protection law, it is appropriate to require the
controller to:

• Align its privacy policy with Article 12 GDPR in terms of conciseness,
transparency and intelligibility, which in particular requires the use of terms used in data
protection law or at least in a common language and an easily understandable structure
mentioning each information under the correct title;

• Align the information with Article 13 GDPR, which in particular requires to
clearly set out:

o All purposes pursued with the processing, including processing which the
controller is obliged to carry out by law; O The term for which the personal
data will be stored, indicated in such a way as to leave no doubt as to what
retention period applies to the processing of which data and for what purpose;
O The legal basis for each processing, indicated in such a way as to leave no
room for doubt on which legal basis applies to the processing of which data
and for what purpose;
o The right to object to processing for direct marketing purposes;
or In what circumstances the customer is obliged to provide his tax
identification number and that this follows from Spanish law;
o In accordance with Article 13(2)(d) GDPR, they must inform about the right
to lodge a complaint with a supervisory authority.

• Not requesting the customer’s tax identification number unless the controller
has obtained a valid consent or is required by law to process this data in order to include
it in an invoice

Give a period of three months from the date of publication of the decision to comply with
the above measures.
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

24/25

Agency
Spanish
protection
data
Inaddition, any measures that may be taken in the decision terminating the procedure, in
relation to the processing activities, the information provided to data subjects and the
exercise of the rights, shall apply in all the countries of the European Union in which the
requested party operates.

It should be noted that failure to comply with the requests made by that body may be
regarded as a serious administrative infringement because it ‘does not cooperate with the
supervisory authority’ in the light of the requests made, and such conduct may be assessed
at the time of the opening of an administrative procedure leading to a fine.

Therefore, in accordance with the above, the Director of the Spanish Data Protection
Agency RESUELVE:

FIRST: On the basis of the complaint received through the IMI system set out in the
background and, in accordance with the facts and points of law contained in this act, adopt
a draft decision on the penalty proceedings against FURNISHYOURSPACE, S.L., which
will lead, where appropriate, to the adoption of the following agreements:

1. Penalise the entity FURNISHYOURSPACE, S.L., for an infringement of Articles 12 and
13 of the GDPR, which is defined in Article 83 (5) (b) and classified as very serious for the
purposes of limitation in Article 72 (h) of the LOPDGDD, with a fine of EUR 3,000 (three
thousand euros).

2. Penalise the entity FURNISHYOURSPACE, S.L., for an infringement of Article 21 (4)
GDPR, referred to in Article 83 (5) (b) and classified as very serious for the purposes of
limitation in Article 72 (k) of the LOPDGDD, with a fine of EUR 1,000 (thousand euros).

3. Penalise the entity FURNISHYOURSPACE, S.L., for an infringement of Article 5 (1 ) (a)
and (6) of the GDPR, laid down in Article 83 (5) (a) and classified as very serious for the
purposes of limitation in Article 72 (1) (b) of the LOPDGDD, with a fine of EUR 2,000 (two
thousand euros).

4. To request FURNISHYOURSPACE, S.L, to comply, within three months, with the rules
on the protection of personal data, the processing operations which it carries out, the
information provided to its clients, to the extent stated in Article VII of Law. This should
also be implemented in all the countries of the European Economic Area in which
FURNISHYOURSPACE operates.

SECOND: In accordance with the procedure laid down in Article 60 of the GDPR, this draft
penalty decision is transmitted through the IMI system without delay to the supervisory
authorities concerned, informing them that, if no objections are raised within four we eks of
the consultation, the necessary decision on the penalty procedure will be adopted, in which
the infringements referred to in the
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

25/25

Agency
Spanish
protection
data
Legal grounds, with the imposition of the sanctions and measures indicated.

In accordance with Article 123 of Law 39/2015 of 1 October on the Common Administrative
Procedure of Public Administrations (LPACAP), interested parties may, in accordance with
Article 46 of Law 29/1998 of 13 July on the Common Administrative Procedure of Public
Administrations, lodge an appeal for reconsideration with the Dire ctor of the Spanish Data
Protection Agency within one month of the date of notification of this decision or a direct
administrative appeal before the Administrative Chamber of the Spanish Data Protection
Agency, in accordance with the additional provision of the Spanish Data Protection Law,
in accordance with the date of notification of this decision or a direct administrative appeal
before the Administrative Chamber of the Fourth Section of the Audiencia, in accordance
with the additional provision of the Spanish Data Protection Law, in accordance with Article
25 (5), as from the day following the notification of this decision or a direct administrative
appeal before the Administrative Chamber of the National High Court, in accordance with
of the Spanish Law, in accordance with (1).

Finally, we would point out that, in accordance with Article 90.3 (a) of the LPACAP, the
final administrative decision may be suspended as a precautionary measure if the person
concerned indicates his intention to bring an administrative appeal.

Mar España Martí
Director of the Spanish Data Protection Agency

C/Jorge Juan,
6 28001 —
Madrid

www.aepd.es
sedeagpd.gob.es

]
Secure Verification Code:
Legislation
Date 21/07/2021
m U

26/25

İnternet Sitesinde Eksik Gizlilik Bilgilendirmesi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni