1/5
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:44:37
National File Number: E/05523/2021 – CO/00139/2021
IMI Reference Number: A56ID 296410
FINAL DECISION
To discontinue proceedings carried out upon the reception in the Spanish supervisory
authority (hereinafter, AEPD) of a complaint reporting an alleged infringement of the
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data
and on the free movement of such data (from now on, the GDPR) and based on the
following:
FACTS
El documento consta de un total de 5 páginas. Página 1 de 5.
FIRST: On 1st of April of 2021 and with entry number e2100014874, a complaint was
lodged at the AEPD by A.A.A. (the claimant, hereinafter) regarding a cross-border
processing carried out by the owner of the website HTTPS://DOCUMENTOP.COM (the
data controller), for a potential breach of arts. 12 and 17 of GDPR.
The complaint relies on the following arguments:
• A PDF document has been published in the HTTPS://DOCUMENTOP.COM
website, showing the claimant’s personal data as participant of a public call to fill
posts for temporary teachers of Secundary School in the academic year 2016/17.
• The claimant considers that this material has no relationship with his actual post,
nor has it any public interest (it belongs to his private sphere). But that’s not all,
its disclosure is causing him a harm in his professional life, and this is the reason
why he requested its removal or delisting to its controller, through e-mail sent to
the address indicated in the website. However, the e-mail has been returned,
which implies that the contact data is wrong, and the privacy policy does not
comply with the basic requirements of information and transparency established
by the GDPR.
• Furthermore, the document has been indexed by the Google search engine. He
has also requested its removal to Google, but his petition has been denied.
Google tells him to contact the site’s webmaster – thing that, as has been
explained, was not feasible. The affected individual requests that the
abovementioned document stops being indexed by any search engine.
Alongside with the complaint, the following relevant evidence was provided: copy of the
e-mail sent on 12th of December of 2020 by the claimant to the mailbox
[email protected], as well as three delivery failure notifications, received on dates
13th, 14th and 15th of December of 2020. A screenshot of the published document is also
provided, showing the claimant’s personal data highlighted in yellow. However, no
evidence of the delisting request sent to Google has been supplied.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/5
The document containing claimant’s personal data is available via the following URL:
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:44:37
***LINK.1
SECOND: The “contact” section of the reported website (available at
https://documentop.com/contact) refers to B.B.B. and a postal address in Austria
(***ADDRESS.1). Its privacy policy does not name formally any data controller.
THIRD: Taking into account the cross-border nature of the complaint, on 14th of May of
2021 it was agreed to provisionally discontinue the proceedings and inform the Austrian
supervisory authority– Datenschutzbehörde (DSB), or, in English, the Data Protection
Authority –about the complaint, so that it could handle it as lead supervisory authority
(LSA), pursuant to Article 56(1) of the General Data Protection Regulation (GDPR).
FOURTH: The complaint was communicated through the Internal Market Information
El documento consta de un total de 5 páginas. Página 2 de 5.
System (IMI) to the Austrian data protection authority, who accepted to handle the case
as LSA, on 14th of May of 2021. No supervisory authorities declared themselves as
concerned, others than the receiving SA (the AEPD).
FIFTH: In accordance with the procedure laid down in Article 60 GDPR, after agreeing
to dismiss or reject the complaint, the Austrian SA has broadcasted among the
concerned SAs the draft decision, which has been accepted.
LEGAL GROUNDS
I – Competence
Pursuant to Article 60(8) of GDPR, the Director of the Spanish SA shall have competence
to adopt this decision, in compliance with both the art. 12(2)(i) of the Royal Decree
428/1993, of 26th of March, which approves the Charter of the Spanish Agency for Data
Protection, and the First Transitory Provision of the Organic Law 3/2018 of 5 December
on Personal Data Protection and safeguard of digital rights (hereinafter, LOPDGDD).
II – The Internal Market Information System (IMI)
The Internal Market Information System is regulated by Regulation (EU) Nº 1024/2012
of the European Parliament and of the Council of 25 October 2012 on administrative
cooperation through the Internal Market Information System and repealing Commission
Decision 2008/49/EC (‘the IMI Regulation’). It helps competent authorities of Member
States to fulfil their cross-border administrative cooperation, mutual assistance and
information exchange.
III – Determination of the territorial scope
The art. 66 of LOPDGDD specifies that:
“1. Except for the cases referred to in article 64.3 of this organic law, the Spanish Data
Protection Agency shall, prior to the execution of any other action, including the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/5
admission for processing of a complaint or the commencement of preliminary
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:44:37
investigation proceedings, examine its competence and determine the national or cross-
border nature of the procedure to be followed, in any of its forms.
2. If the Spanish Data Protection Agency considers that it does not have the status of
lead supervisory authority for handling the procedure, it shall, without any further delay,
refer the complaint submitted to the lead supervisory authority deemed competent, so
that it may be properly addressed. The Spanish Data Protection Agency shall notify this
situation to the person who has submitted the complaint, as the case may be.
The agreement which resolves the referral mentioned in the preceding paragraph shall
imply the provisional filing of the procedure, without prejudice to the Spanish Data
Protection Agency issuing, as appropriate, the resolution referred to in paragraph 8 of
article 60 of Regulation (EU) 2016/679.”
IV – Main establishment, cross-border processing and lead supervisory authority
El documento consta de un total de 5 páginas. Página 3 de 5.
Article 4(16) of GDPR defines «main establishment»:
“(a) as regards a controller with establishments in more than one Member State, the
place of its central administration in the Union, unless the decisions on the purposes and
means of the processing of personal data are taken in another establishment of the
controller in the Union and the latter establishment has the power to have such decisions
implemented, in which case the establishment having taken such decisions is to be
considered to be the main establishment;
(b) as regards a processor with establishments in more than one Member State, the
place of its central administration in the Union, or, if the processor has no central
administration in the Union, the establishment of the processor in the Union where the
main processing activities in the context of the activities of an establishment of the
processor take place to the extent that the processor is subject to specific obligations
under this Regulation;”
According to Article 4(23) of GDPR «cross-border processing» means either:
(a) processing of personal data which takes place in the context of the activities of
establishments in more than one Member State of a controller or processor in the Union
where the controller or processor is established in more than one Member State; or
(b) processing of personal data which takes place in the context of the activities of a
single establishment of a controller or processor in the Union but which substantially
affects or is likely to substantially affect data subjects in more than one Member State.
Pursuant to Article 56(1), regarding the competence of the lead supervisory authority,
and without prejudice to Article 55, the supervisory authority of the main establishment
or of the single establishment of the controller or processor shall be competent to act as
lead supervisory authority for the cross-border processing carried out by that controller
or processor in accordance with the procedure provided in Article 60.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/5
In the case under examination, as outlined above, the owner of the reported website
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:44:37
seems to have its main or single establishment in Austria and, therefore, the Austrian
supervisory authority is the competent authority to act as lead supervisory authority.
V – Concerned Supervisory Authorities (CSAs)
In accordance with Article 4(22) of GDPR, ‘concerned supervisory authority’ means a
supervisory authority which is concerned by the processing of personal data because:
(a) the controller or processor is established on the territory of the Member State of that
supervisory authority;
(b) data subjects residing in the Member State of that supervisory authority are
substantially affected or likely to be substantially affected by the processing; or
(c) a complaint has been lodged with that supervisory authority;
El documento consta de un total de 5 páginas. Página 4 de 5.
In this procedure, the supervisory authorities concerned are those enumerated in the
fourth fact.
VI – Cooperation and consistency procedure
In the present case, the complaint has been handled according to the procedure
established in Article 60.8, which states the following:
“8. By derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.”
VII – Subject-matter of the complaint and legal reasoning
In this case, a complaint has been lodged at the AEPD in connection with a cross-border
data processing carried out by the owner of the website HTTPS://DOCUMENTOP.COM
because of an alleged infringement of the following provisions: arts. 12 and 17 GDPR.
The website’s privacy policy does not name formally any data controller. Nevertheless,
the “contact” section of the reported website (available at
https://documentop.com/contact) refers to B.B.B. and a postal address in Austria
(***ADDRESS.1). Taking into account the cross-border nature of the complaint, it was
agreed to inform the Austrian supervisory authority (DSB) about the complaint, so that it
could handle it as lead supervisory authority (LSA), pursuant to Article 56(1) of the
General Data Protection Regulation (GDPR).
On 14th of July of 2021, the Austrian SA has broadcasted the draft decision. As it
explains, the DSB first turned to the postal address mentioned in the website
(***ADDRESS.1) and sent a written information request to them. A response from the
current mailbox owner was received. This person, named C.C.C., replied that the former
mailbox had been blocked since mid 2019; that B.B.B. was the additional identification
provided by the former mailbox’s owner when signing up for the service. He was a
Vietnamese citizen, D.D.D., who stayed for an indeterminate time in Austria. The current
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/5
mailbox owner provided also the contact data supplied by this person: a postal address
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:44:37
in Vietnam, and an e-mail address.
The DSB issued a notification to this electronic mailbox, but received a message saying
that its letter was addressing a wrong recipient, and that it might have been sent to a
wrong address.
Furthermore, the DSB queried the WHOIS service regarding the website’s domain,
HTTPS://DOCUMENTOP.COM, but the identification data of its owner were protected
and the access to them was denied.
For all these reasons, the Austrian SA has proposed to close the case, since, after
fulfilling every conceivable step within an inquiry procedure, it has not been able to find
and identify the data controller. The name and address indicated in the website cannot
be linked to any natural or legal person.
El documento consta de un total de 5 páginas. Página 5 de 5.
In the light of this outcome, this Agency considers that, as the data controller has not
been identified, it is only possible to conclude the current proceedings and close the file.
Consistently with the conclusions described, it is agreed by the Director of the Spanish
SA:
FIRST: TO DISCONTINUE the proceedings and dismiss the complaint.
SECOND: TO NOTIFY this decision to the CLAIMANT.
Pursuant to Article 50 of LOPDGDD, this resolution shall be published after the
notification of the parties concerned.
This resolution finalizes the administrative procedure pursuant to Article 114 (1) (c) of
the Act 39/2015 of 1 October on Common Administrative Procedure of Public
Administration. According to Articles 112 and 123 of the aforementioned Act 39/2015, it
is possible to appeal this decision before the Director of the Spanish SA within a month
starting the day which follows the receipt of this notification. In accordance with Article
25 and Additional Provision 4(5) of the Act 29/1998 of 13 July regulating the Jurisdiction
for Judicial Review, it is also possible directly appeal before the contentious-
administrative division of the Spanish National High Court. Pursuant to Article 46 (1) of
the Act 29/1998, the period for filing for judicial review shall be two months long, counting
from the day following the date of this notification.
1196-280421
Mar España Martí
Director of the Spanish SA
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es