1/5
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:42:02
National file number: E/01659/2020
IMI Case Register number: 119470
FINAL DECISION TO DISCONTINUE PROCEEDINGS
According to the action taken after the complaint lodged with the Spain supervisory
authority (hereinafter AEPD), related to the following:
FACTS
FIRST: On 14 January 2020, a notification of a personal data breach was received from
RIDE HIVE OPERATIONS, S.L. (hereinafter, HIVE), informing the Spanish Data
Protection Agency that, on 9 January 2020, the ***COMPANY.1 had informed them that
El documento consta de un total de 5 páginas. Página 1 de 5.
***CONFIDENTIAL had been published on the internet. ***CONFIDENTIAL.
The data that could be accessed corresponded to basic and contact data of
approximately 65.0000 clients (195.000 registers concerned) and although the
notification had been made to the Spanish Data Protection Agency, there could be users
from Austria, Greece, Italy, Poland and Portugal.
HIVE stated that the breach would not be communicated to the data subjects due to the
low risk for the rights and freedoms of natural persons.
It also stated that an attempt had been made to notify the Spanish Agency on 12 January,
but due to technical problems the notification was sent to [email protected].
SECOND: HIVE has its main or single establishment in Spain.
THIRD: On 17 February 2020, the Director of the Spanish Data Protection Agency
ordered the General Subdirectorate of Data Inspection to carry out appropriate
preliminary investigations in order to establish a possible infringement of data protection
rules.
Via the ‘Internal Market Information System’ (hereinafter ‘IMI’), regulated by Regulation
(EU) Nº 1024/2012 of the European Parliament and of the Council of 25 October 2012
(‘the IMI Regulation’), the aim of which is to promote cross-border administrative
cooperation, mutual assistance between Member States and the exchange of
information, on 27 February 2020 the Spanish Agency declares itself the lead authority
in the present case.
According to the information incorporated into the IMI system, in accordance with Article
60 of Regulation (EU) 2016/679 of the European Parliament and of the Council of
27/04/2016 on the protection of natural persons with regard to the processing of personal
data and the free movement of such data (GDPR), the Austrian Supervisory Authority
and the German authority of Hamburg have declared themselves concerned authorities
in the present proceedings.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/5
FORTH: In accordance with the procedure provided in Article 60 GDPR, the lead
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:42:02
supervisory authority and the supervisory authorities concerned agreed on the draft
decision taken by Spain.
LEGAL GROUNDS
I – Competence
Pursuant to art. 60(8) of GDPR and according to art. 12.2 litt. i) of Royal Decree
428/1993, of 26 of March, which approved Spanish Data Protection Agency’s Statutes,
and the First Transitory Provision of the Organic Spanish Law 3/2018 (LOPDGDD), the
Director of the Spanish Data Protection Agency is competent to adopt this decision.
II – The Internal Market Information System (IMI)
El documento consta de un total de 5 páginas. Página 2 de 5.
The Internal Market Information System is regulated by Regulation (EU) Nº 1024/2012
of the European Parliament and of the Council of 25 October 2012 on administrative
cooperation through the Internal Market Information System and repealing Commission
Decision 2008/49/EC (‘the IMI Regulation’). It helps competent authorities of Member
States to fulfil their cross-border administrative cooperation, mutual assistance and
information exchange.
III – Main establishment, cross-border processing and lead supervisory authority
Article 4(16) of GDPR defines «main establishment»:
‘(a) as regards a controller with establishments in more than one Member State, the
place of its central administration in the Union, unless the decisions on the purposes
and means of the processing of personal data are taken in another establishment of
the controller in the Union and the latter establishment has the power to have such
decisions implemented, in which case the establishment having taken such
decisions is to be considered to be the main establishment;
(b) as regards a processor with establishments in more than one Member State, the
place of its central administration in the Union, or, if the processor has no central
administration in the Union, the establishment of the processor in the Union where
the main processing activities in the context of the activities of an establishment of
the processor take place to the extent that the processor is subject to specific
obligations under this Regulation;’
According to Article 4(23) of GDPR «cross-border processing» means either:
‘(a) processing of personal data which takes place in the context of the activities of
establishments in more than one Member State of a controller or processor in the
Union where the controller or processor is established in more than one Member
State; or
(b) processing of personal data which takes place in the context of the activities of
a single establishment of a controller or processor in the Union but which
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/5
substantially affects or is likely to substantially affect data subjects in more than one
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:42:02
Member State’.
Pursuant to Article 56 (1), regarding the competence of the lead supervisory authority,
and without prejudice to Article 55, the supervisory authority of the main establishment
or of the single establishment of the controller or processor shall be competent to act as
lead supervisory authority for the cross-border processing carried out by that controller
or processor in accordance with the procedure provided in Article 60.
In the case under examination, as outlined above, HIVE has its main establishment in
Spain and therefore this Agency is the competent authority to act as lead supervisory
authority.
IV – Supervisory authority concerned
In accordance with Article 4(22) of GDPR, ‘supervisory authority concerned’ means a
El documento consta de un total de 5 páginas. Página 3 de 5.
supervisory authority which is concerned by the processing of personal data because:
(a) the controller or processor is established on the territory of the Member State of
that supervisory authority;
(b) data subjects residing in the Member State of that supervisory authority are
substantially affected or likely to be substantially affected by the processing; or
(c) a complaint has been lodged with that supervisory authority.
In this procedure, the supervisory authorities concerned are the Austrian Supervisory
Authority and the German authority of Hamburg.
V – Cooperation and consistency procedure
In the present case, the notification of the personal data breach has been handled
according to the procedure established in articles 60(3) and 60(8), which state the
following:
‘3. The lead supervisory authority shall, without delay, communicate the relevant
information on the matter to the other supervisory authorities concerned. It shall
without delay submit a draft decision to the other supervisory authorities concerned
for their opinion and take due account of their views.’
‘8. By derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision
and notify it to the complainant and shall inform the controller thereof.’
VI – Personal data security breach and legal reasonings
In this case, the Spanish Data Protection Agency has processed the notification of
HIVE’s personal data security breach for an alleged infringement of Article 32 GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/5
The GDPR broadly defines ‘personal data breaches’ (hereinafter ‘security breaches’) as
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:42:02
‘a breach of security leading to the accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise
processed.’
In the present case, there is a personal data security breach in the circumstances
described above, categorised as a possible confidentiality breach, as a result of possible
undue access by third parties outside HIVE’s database.
It appears from the investigation that HIVE had reasonable technical and organisational
preventive measures to prevent this type of incident and commensurate with the level of
risk.
HIVE has also been diligently confronted with identifying and correcting the breach,
analysing and classifying the alleged personal data security incident and promptly
reacting to it in order to notify, minimise the impact and implement new reasonable and
El documento consta de un total de 5 páginas. Página 4 de 5.
proportionate measures to prevent a recurrence of the alleged occurrence in the future.
There are no complaints from affected customers to this Spanish Agency.
As a result, HIVE’s action, as the entity responsible for processing, was in line with the
rules on the protection of personal data and we consider that it is not appropriate to
initiate a penalty procedure as it has put in place new security measures commensurate
with the risk assessed in order to avoid the repetition of similar incidents in the future,
and it is therefore decided to close the action taken.
Consistently with the conclusions described, it is agreed by the Director of the Spain-SA:
FIRST: TO DISCONTINUE the investigation proceedings against RIDE HIVE
OPERATIONS, S.L.
SECOND: NOTIFY this decision to RIDE HIVE OPERATIONS, S.L.
Pursuant to Article 50 of LOPDGDD, this resolution shall be published after the
notification of the parties concerned.
This resolution finalises the administrative procedure pursuant to Article 114 (1) (c) of
the Act 39/2015 of 1 October on Common Administrative Procedure of Public
Administration. According to Articles 112 and 123 of the aforementioned Act 39/2015, it
is possible to appeal this decision before the Director of the Spain-SA within a month
starting the day which follows the receipt of this notification. In accordance with Article
25 and Additional Provision 4(5) of the Act 29/1998 of 13 July regulating the Jurisdiction
for Judicial Review, it is also possible directly appeal before the contentious-
administrative division of the Spanish national high court. Pursuant to Article 46 (1) of
the Act 29/1998, the period for filing for judicial review shall be two months long, counting
from the day following the date of this notification.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
FIRMADO ELECTRÓNICAMENTE por : Agencia Española de Protección de Datos. A fecha : 11/02/2022 09:42:02
El documento consta de un total de 5 páginas. Página 5 de 5.
C/ Jorge Juan, 6
28001 – Madrid
Mar España Martí
Director of the Spanish Data Protection Agency
www.aepd.es
5/5
sedeagpd.gob.es
1155-100820