1/18
Procedure No: PS/00016/2022
IMI Reference: A60DD 403656 – A61VMA 298021 – Case Register 79805
FINAL DECISION ON PENALTY PROCEEDINGS
From the actions taken by the Spanish Data Protection Agency and based on the following
FACTS
FIRST: (hereinafter the complainant) lodged a complaint with the
Commission Nationale de l'Informatique et des Libertés (hereinafter, ‘French data protection
authority’). The complain is directed against VACACIONES EDREAMS, S.L., with VAT
B61965778 (hereinafter, EDREAMS). The grounds on which the complaint is based are as
follows:
The complainant has asked EDREAMS by e-mail for access to the recording of all telephone
exchanges with the company, but after one month no reply has been received.
Date on which the facts claimed took place: 5 January 2021
In addition to the complaint, he provides:
Copy of an email sent by the complainant to [email protected]
and [email protected] dated 5 January 2021 in the complaint concerning a
purchase made in Canadian dollars and requesting access to all discussions between the
complainant and the EDREAMS customer service on 14 August 2020, 26 October 2020, 17
November 2020 and 28 December 2020, and provide the following information for
identification: Name, date of birth and last four digits of the credit card.
SECOND: Via the ‘Internal Market Information System’ (hereinafter the IMI System), governed
by Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October
2012 (IMI Regulation), which aims to promote cross-border administrative cooperation, mutual
assistance between Member States and the exchange of information, on 21 May 2021, this
complaint was received by this Spanish Data Protection Agency (AEPD). This complaint is
forwarded to the AEPD in accordance with Article 56 of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27/04/2016 on the Protection of Individuals with
regard to the Processing of Personal Data and on the Free Movement of such Data (hereinafter
GDPR), taking into account its cross-border nature and the fact that this Agency is competent
to act as lead supervisory authority, given that EDREAMS has its registered office and single
establishment in Spain.
According to the information incorporated into the IMI system, pursuant to Article 60 of the
GDPR, in addition to the data protection authority of France, act as ‘concerned supervisory
authority’ the authorities of Portugal, Italy, Lower Saxony (Germany) and Denmark. All of them
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
2/18
pursuant to Article 4 (22) (b) GDPR, since data subjects residing in these Member States are
likely to be substantially affected by the processing at issue in these proceedings.
THIRD: The complaint lodged by the complainant was declared admissible on 1 June 2021.
FOURTH: The General Subdirectorate for Data Inspection carried out preliminary
investigations to clarify the facts in question, in accordance with the powers of investigation
conferred on the supervisory authorities in Article 58 (1) of Regulation (EU) 2016/679 (General
Data Protection Regulation, hereinafter ‘GDPR’), and in accordance with Title VII, Chapter I,
Section II of the Spanish Organic Law 3/2018 of 5 December on the Protection of Personal
Data and Guarantee of Digital Rights (LOPDGDD), having knowledge of the following:
Reply to a request for information submitted on behalf of EDREAMS with entry register
O00007128e2100036021, received at the AEPD on 27 August 2021, in which, inter alia, the
following information is provided:
1. A statement that they have not received any request from the complainant via the privacy
form on their website and has therefore not been processed by a specialised agent but has
been processed by the customer service.
2. A statement that an error occurred in this request because the customer service agent who
responded to this request closed it manually without managing it in accordance with internal
processes. These internal processes indicate that these requests have to be answered by
referring to the privacy form or by scaling up the exercise of rights internally.
3. A statement that they have answered to the complainant after becoming aware of the
complaint. They provide a copy of an email addressed to the complainant in French (and
its translation into Spanish), indicating that the recordings are attached.
4. As regards the causes of this incident, a statement that this occurred due to a human error
that occurred in a situation where the customer service was tripled in the number of requests
received due to cancellations caused by COVID-19 travel agency.
5. Declaration that the following measures have been taken: Reminder in the weekly newsletter
to customer service agents on the centralisation of attention to data protection rights in the
Privacy Formulation to be served by specialised agents; Advance data protection training
including the case of this complaint as a practical case in the training; Inform the officer who
dealt with the application and his manager at a meeting about what happened; And include
a reminder of the existence of the Privacy Form in the email received automatically by data
subjects in response to the emails received by the customer service.
On 30 December 2021, a search was made on the website https://web.archive.org for the
historical data contained in the privacy policy of the EDREAMS website addressed to the
Spanish public (https://www.EDREAMS.es/politica-de-privacidad/) on 13 January 2021 and
addressed to the French public (https://www.EDREAMS.fr/politique-confidentialite/) on 20
January 2021, giving the following information:
6. Both privacy policies indicate that their last update took place in June 2019.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
3/18
7. In both privacy policies, two means of exercising the rights are indicated: Via an online form,
or via a postal address. Specifically, the privacy policy in Spanish states the following: “To
be able to exercise your rights, click here or send your application by post to the following
address: Data protection — Calle Bailén, 67, 08009 Barcelona, Spain, European Union. In
your application you must clearly indicate your identity, specifying your full name and the e-
mail address you used to make the purchase or create an account, and the rights you wish
to exercise.”
FIFTH: The Director of the AEPD adopted a proposal for a draft decision to initiate penalty
proceedings on 12 January 2022. Following the process set out in Article 60 of the GDPR, this
proposal was transmitted through the IMI System on 09 February 2022 and informed
supervisory authorities concerned that they had two weeks from that time to comment. Within
the time limit for this purpose, supervisory authorities concerned made their comments on the
matter.
SIXTH: On 24 May 2022, the Director of the AEPD adopted a draft decision to initiate penalty
proceedings. Following the process set out in Article 60 GDPR, this draft decision was
transmitted through the IMI system on 02 June 2022 and the supervisory authorities concerned
were informed that they had four weeks from that time to raise relevant and reasoned
objections. Within the deadline for this purpose, the supervisory authorities concerned did not
raise any relevant and reasoned objections in this regard and therefore all authorities were
considered to agree with and were bound by the draft decision in accordance with Article 60
(6) GDPR.
On 25 May 2022, this draft decision was notified to EDREAMS in accordance with Spanish
Law 39/2015 of 1 October 2015 on the Common Administrative Procedure of Public
Administrations (hereinafter LPACAP), as stated in the acknowledgement of receipt in the file.
SEVENTH: On 15 July 2022, the Director of the Spanish Data Protection Agency agreed to
initiate penalty proceedings against EDREAMS, in accordance with the provisions of Articles
63 and 64 of the Spanish LPACAP, for the alleged infringement of Article 15 of the GDPR, as
defined in Article 83.5 of the GDPR, in which it was indicated that it had a period of ten days
to submit arguments.
This agreement, which was notified to EDREAMS in accordance with the rules established in
the Spanish LPACAP, was collected on 18 July 2022, as stated in the acknowledgement of
receipt in the file.
EIGHTH: On 30 July 2022, the Spanish Agency received allegations from EDREAMS, in which
it submitted the followings arguments to the agreement to initiate penalty proceedings:
FIRST. — EXERCISE OF RIGHTS IN EDREAMS IN ACCORDANCE TO LAW.
EDREAMS centralises the management of the exercise of rights (including the right of access)
through its Privacy Form. In this way, users are facilitated the exercise of these exercises,
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
4/18
through this easily accessible tool, linked in our Privacy Notice and managed by a defined
process and by a team formed and dedicated to this purpose.
The Privacy Form allows in turn to automate part of the process, in order to provide a better
and faster response.
Initially, the data subject exercises his/her right through the Privacy Form. This request is
exclusively conditional on the agents specialised in the management of these rights being able
to confirm the information and there are sufficient guarantees that the person claims to be who
they are or that the representation of a third party is sufficiently accredited (usually the
confirmation passes because the client, who receives a verification email, confirms in his/her
personal email registered in our systems that he/she has requested the corresponding right).
After this confirmation, it connects with the appropriate departments, to execute the
corresponding actions based on the right exercised. Finally, once the necessary actions have
been carried out, we proceed to respond to the data subject according to an internal guide (in
this case, the guide to the right of access).
This process is carried out in accordance with our Privacy Notice and our Internal Privacy
Policy (see Appendix 1 – Index and applicable section of the Internal Privacy Policy), as well
as internal procedures; specifically, the Internal Guide on the Exercise of the Right of Access
(see Annex 2 – Internal Guide on the Exercise of the Right of Access) and the Data Protection
Regulations:
Article 12 GDPR: ‘The controller shall take appropriate measures to provide any information
referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating
to processing to the data subject in a concise, transparent, intelligible and easily accessible
form, using clear and plain language, in particular for any information addressed specifically to
a child. The information shall be provided in writing, or by other means, including, where
appropriate, by electronic means. When requested by the data subject, the information may
be provided orally, provided that the identity of the data subject is proven by other means.’
Article 11(1) LOPDGDD: ‘ When personal data are obtained from the data subject, the
controller may comply with the information duty established in article 13 of Regulation (EU)
2016/679, providing the data subject with the basic information referred to in the next section
and with an e-mail address or another means which enables an easy and immediate access
to the remaining information’.
Article 12(2) LOPDGDD: ‘The controller shall be obliged to inform the data subject about the
means available to exercise their rights. Such means shall be easily accessible by the data
subject. The exercise of the right may not be denied on the sole ground that the data subject
chooses a different means.’ In this regard we would like to insist that we do not deny the
exercise of the right (which would also have been managed if it was exercised by the Privacy
Form by the team and process dedicated to this purpose) but that the situation of exceptionality
and a human error in an agent led not to reiterate once again to the CUSTOMER, in
accordance with our Privacy Notice, the availability of the Privacy Form for the exercise of their
rights. We will elaborate on this point in the second allegation. We will also establish why and
how we have mitigated the risk of this happening again.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
5/18
European Commission – How should we deal with requests from individuals exercising their
data protection rights?: “When personal data is processed by electronic means, you must
provide means for applications to be submitted electronically.”
AEPD – Exercise your rights: The person responsible is obliged to inform you about the means
to exercise these rights. These means must be accessible and this right cannot be denied on
the sole ground that you opt for another means.
In addition, EDREAMS is aware that customers can contact us through different ways for
different purposes. Therefore, we train our Customer Service agents and carry out awareness
actions regarding the exercise of rights. In the same way, we provide a response guide to
which we will refer below, in order to know how to detect the exercise of rights and know how
to reiterate the information already contained in our Privacy Notice, regarding the Privacy Form
as a means to exercise the rights.
SECOND.- EDREAMS MAKES EXTRA EFFORTS IN GENERIC CUSTOMER SERVICE
CHANNELS IN ORDER TO PROVIDE THE BEST SERVICE TO ITS CUSTOMERS.
First, it is necessary to confirm that after internal investigations we verify that the CUSTOMER
did not exercise their right in accordance with our Privacy Notice, through our Privacy Form
(mentioned in the first allegation and by which it is guaranteed that a specialised agent
manages the corresponding request). Secondly, we have analysed generic Customer Service
mailboxes and verified that we received a request from the CUSTOMER.
We have contacted the Customer Service team that has informed us that the agent manually
closed the ticket without properly managing it based on our internal processes that guarantee
the corresponding management of such request, referring to our Privacy Form (as indicated in
the internal process of managing data protection rights) or to escalate the exercise of rights
internally to the specialised department that is responsible for it. This manual error of the agent
occurs upon receipt of the communication on January 5, 2021, in which the agent does not
open internal response ticket and therefore does not instruct the CUSTOMER to exercise the
right in the Privacy Form, as they should have done at that time.
In addition, this occurs in a context of exceptional situation in which EDREAMS was found
given the unprecedented saturation of requests in our Customer Service email boxes that we
received due to the situation caused by COVID-19.
We have asked the Customer Service team for the number of emails received in our General
Customer Service email boxes and that we provide confidentially to the Spanish Data
Protection Agency: in the month in which the CLIENT’s communication to the Customer
Service department occurred, and due to the entire COVID-19 crisis, we had a communication
reception traffic consisting of an increase of 450 % compared to the communications received
the same month of the previous year; in particular, we received a total of 63.837
communications in January 2021, this being an unprecedented exceptional saturation.
Despite these devastating circumstances both economically and organizationally, we have
tried to continue to respond in the best possible way to all the requests of our clients, getting
internal support from other teams for this management and we have tried to get out of these
months as best as possible.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
6/18
In these customer service channels we try to answer as soon as possible but there is no fixed
deadline for response, since it depends on the filtering of topics and the prioritisation of them,
which is done manually by the Customer Service team and that entails risks of incorrect manual
categorisation unlike what happens when they are exercised by the appropriate means and
provided for the exercise of rights (the Privacy Form).
And it is precisely for this reason that a specific medium (through the Privacy Form) was
created, complying with data protection regulations and in order to be able to offer a mature
and as guaranteed and transparent process as possible for customers to exercise their data
protection rights.
In addition, we have automated this process with a specialised privacy tool (OneTrust), to
reduce risks and improve our responses, and it is managed with alerts to prevent deadlines
and respond to customers as soon as possible and with a maximum period of thirty days.
Proof of the same is the management of the priority and immediate response to the exercise
of the CLIENT’s right with maximum speed since we became aware of it: he was assigned to
a senior specialist to process this exercise of right immediately, performing all internal actions
in our systems, timely checks and the CUSTOMER as responded.
To our regret, the CUSTOMER’s case did not correctly address the timely information and
Privacy Form. The exceptional circumstances and the manual error of the agent, as well as
the measures implemented (which we convey to them below), make the risk of replicating this
case remote.
THIRD.- CONTINUOUS IMPROVEMENT OF TRANSPARENCY ON THE EXERCISE OF
RIGHTS
We take advantage of this case (produced by not exercising the right correctly and through the
appropriate means as well as by a manual error of the agent who did not follow our internal
policies and guidelines, in a context besides exceptionality) as an opportunity to analyse all
the causes and circumstances of this case, referred to above in the second allegation, and that
have allowed us to take extra measures to prevent similar situations from occurring.
We would like to emphasise that we believe that our compliance program in the area of privacy
and data protection is based on continuous monitoring and continuous improvement and
learning in order to increase levels of regulatory compliance.
In this context of exercising rights, we also maintain the same philosophy and take the rights
of datasubjects very seriously, not only as a fundamental compliance action, but because it is
the best way to guarantee the trust of our customers.
That is why we have a dedicated and specifically trained team, as well as an internal process
of exercising data protection rights, to ensure the best possible response to our clients, through
the Privacy Form, and internal coordination systems to deal with such requests in accordance
with the regulations.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
7/18
Likewise, as an extra effort to guarantee and safeguard the exercise of rights, Customer
Service agents are formed and instructed so that in case of receiving any matter of protection
of personal data, they must direct the customer to the Privacy Form so that the latter can
exercise their rights.
Despite understanding that this case occurs in the exceptional circumstances mentioned
above, and having received several manual errors from Customer Service agents in generic
channels of that service, we have taken the opportunity to implement a Customer Support
Form, which customers will access, either through the Customer Service Help Center, or by
sending an email to the generic Customer Service mailboxes still available.
This form has assessed categories, among which is the option of exercising rights that
redirects him/her to our Privacy Form (as the only means that must be used for the exercise
of any rights of the data subjects for the protection of personal data; as it is managed by a
specialised team dedicated to this purpose (see Annex 3 – Customer Service Form and Annex
4 – Help Center and FAQ).
In this way, we guarantee a specialised and guaranteed procedure, while also redirecting our
customers to contact us by other means (such as the general contact means of Customer
Service) in order to have a system that allows those who want to exercise their rights, can do
so without problems and mitigating the risks of manual errors of customer service agents.
We also train annually on a mandatory basis in terms of data protection and specialised in the
exercise of rights, including practical cases such as the present case, as well as awareness-
raising actions by the Customer Service team (see Annex 5 – Awareness articles on the
exercise of rights), such as covering topics such as “what is an exercise of data protection
rights” and “how to accompany customers to exercise them through the Privacy Form”.
On the other hand, we have carried out in recent months a migration of the tool of the Privacy
Form and rights management, going from a generic one to one specialised in privacy (as it is
OneTrust) in which apart from being managed by a specialised and highly qualified team and
sensitised in data protection, we work on an automation of processes to be more agile and
reduce risks of human errors.
We are sorry for what happened in this exceptional case. At the same time, we understand
that in the circumstances and measures described above, EDREAMS complies with the data
protection regulations as well as with the guidelines of the AEPD itself (previously referred to
in the first allegation) and that the closure of the penalty proceedings against EDREAMS with
a reprimand entails a disproportionate interpretation of the data protection regulations, in a
context of a global pandemic with unexperienced effects. Especially for the tourism industry in
which the company carries out its activity, as well as for the efforts made by it, especially when
we have mitigated that the risk of cases similar to this again, with a Customer Service Form
that guides customers in the event that, without having read or ignored the Privacy Notice, they
want to exercise their rights, and can be guided accordingly and their rights managed, through
the Privacy Form.
We reiterate the commitment of the EDREAMS team to work tirelessly with respect to learning
and continuous improvement of our processes, with the aim of not only complying with the
regulations, but also strengthening the trust of our customers in us. And in this context, we will
continue to monitor and continuously improve the policies, processes, actions and measures
referred to here.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
8/18
NINTH: On 02 September 2022, the instructor of the penalty proceedings made a proposal of
resolution, in which it is proposed that the Director of the AEPD address a reprimand to
EDREAMS, with VAT B61965778, for an infringement of Article 15 of the GDPR, as defined in
Article 83.5 of the GDPR.
This proposal for a resolution, which was notified to EDREAMS in accordance with the rules
establishes in the Spanish LPACAP, was collected on 02 September 2022, as stated in the
acknowledgement of receipt contained in the file.
TENTH: On 16 September 2022, the Agency received allegations from EDREAMS in which it
submitted arguments to the proposal for a resolution in which it stated that:
“UNIQUE.- EXERCISE OF RIGHTS IN EDREAMS IN ACCORDANCE WITH THE LAW.
EDREAMS reiterates its previous submissions and understands that it complies with the reg-
ulations in the terms described below.
On the one hand, it has an official channel, the Privacy Form (Annex 1 – Privacy Form), which
is transparently informed and made available to data subjects in our Privacy Notice, resulting
in easy access for the data subject (Annex 2 – Privacy Notice: exercise of rights).
On the other hand, it has processes, tools, training materials and other appropriate measures
in which it is contemplated that the hypothetical exercise of rights cannot be denied simply
because it is exercised through other channels than the official channel.
In the latter direction, EDREAMS works tirelessly on the continuous improvement of the
measures referred to above, and which were substantiated in accordance with the third argu-
ment in our reply to the agreement to initiate penalty proceedings dated 29 July 2022 (regis-
tration number O00007128e22P0006395), so that in all its customer service channels the cus-
tomers are redirected to the official channel and dedicated for the management of them (the
aforementioned Privacy Form), in the event that they were used for the exercise of rights.
We share that an organisation must have an official channel that collects a guarantee proce-
dure in the terms collected by the data protection regulations, as well as appropriate measures
that guide the action of any employee of the same to inform any data subject about how to
exercise their data protection rights. However, an interpretation requiring the same degree of
diligence that the official channel must have (provided it is transparently informed in the Privacy
Notice) to any other channel of the organisation, would entail, on the one hand, an overload
and dedication of disproportionate resources of the organisation and, on the other, we believe
that it would be contrary to the fact that the regulations require an official channel for the exer-
cise of rights.
The above interpretation is based on the fact that the rule in question (Article 12.2 LOPDGDD)
clearly states that the controller can determine an official channel, provided it is easily acces-
sible (as in our case).
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
9/18
It is clear that the rule has wanted to go further and therefore requires organisations to coop-
erate more effectively in order to enhance the effectiveness of rights and, therefore, it has been
stated that the organisations cannot hide in the fact that the corresponding right had been
exercised by another channel of the officer, to directly deny it without having internal controls
in this regard (in Article 12(2) LOPDGDD).
But does that mean that an organisation must have in any channel a system of filtering and
ticket management that, not only is it very urgent – due to the urgent nature of the period of
exercise of rights contained in data protection regulations – but that is also infallible, because
otherwise it opens penalty proceedings against the organisation, despite having appropriate
measures for those channels not specially dedicated to the exercise of rights (despite having
an official channel, which is transparently informed in the Privacy Notice and easily accessible
according to the regulations, as well as measures to reduce the risk of a possible manual error
of an agent who manages an unofficial channel)?
EDREAMS considers an interpretation that would lead to a positive answer to the previous
question disproportionate and therefore asks that that interpretative position be reconsidered,
on the understanding that that conclusion cannot be drawn that, in practice, it would result in
the absence of an official channel, but that any channel of communication of the company
would automatically become an official channel of exercise of rights.
If the law had intended such a conclusion, requiring the same level of diligence for any channel
of the organisation, the draft should have included the following position: ‘The controller shall
be obliged to inform the data subject of the fact that in any means of contact the organisation
may exercise its rights and provide the list thereof.’
In the present case, it is necessary to insist that these customer service channels are intended
for consumer purposes, and, therefore, you cannot have an expectation of privacy channel
due to their nature and demand the same high level of diligence that a channel dedicated to
the exercise of rights supports.
Even so, in order to try to ensure that the data subject has the Privacy Form at hand even in
spite of a possible exceptional mistake of a customer service agent, we have implemented a
footnote to our generic Customer Service emails, in which the customer is again informed of
the existence of the Privacy Form for a simple management of the exercise of rights and that
allows the correct verification of the identity of the data subjects (Annex 3 – Footnote of the
Customer Service emails).
For all these reasons, EDREAMS considers that the provision in question requires a reasona-
ble, but not maximalist duty of care. And, in this logic, without prejudice to the previously rec-
ognised position regarding the interpretation of the precept in question, we would like to insist
that we feel what happened in this exceptional case, and we reiterate EDREAMS’s commit-
ment to continue working tirelessly on the continuous improvement of its processes, tools, and
training in all its customer service channels so that, in the event that they are used for the
exercise of rights, it is directed to customers to the special channel dedicated for the manage-
ment of them (the aforementioned Privacy Form).
For final clarification purposes, we understand that in the motion for a resolution there is an
error in the reference to Article 112.1 of the LPACAP (which refers to the final resolution), with
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
10/18
only Article 89(2) of the LPACAP (which refers to the proposal for a resolution) being applicable
and, according to it, we present the present argument here.
For all these reasons, this part:
REQUESTS
1. To have this claim submitted in due time and in a timely manner.
2. That it is good in the final resolution, taking into account that this is an exceptional manual
error of non-compliance with our internal policies and procedures, caused by not having exer-
cised the right of access by the channel intended and described in our Privacy Notice (Privacy
Form) having addressed generic channels of Customer Service in which the expectation of
response to exercise of rights cannot be the same as being intended for consumer issues.
Likewise, it should be noted that EDREAMS has acted and acts diligently in the respect, de-
fense and exercise of the rights of the data subjects and always in a collaborative way with the
AEPD and that all this is not diminished by this exceptional case”.
The actions taken in these proceedings and the documentation contained in the file have
shown the following:
PROVEN FACTS
FIRST: On 5 January 2021, the complainant sent e-mails to customerservice-
[email protected] and [email protected], where he complained about
a purchase made in Canadian dollars and requested access to all discussions between the
complainant and EDREAMS customer service on 14 August 2020, 26 October 2020, 17
November 2020 and 28 December 2020, and provided the following data for identification: first
and last name, date of birth and last four digits of his credit card.
SECOND: EDREAMS did not provide the complainant with access to the recording of all
telephone exchanges with the company, without the complainant having received any
response within one month.
THIRD: According to EDREAMS in its arguments, the lack of attention to the exercise of the
right of access occurred because ‘... the agent mistakenly closed the ticket without having
properly managed it... This manual error of the agent occurs upon receipt of the communication
on 5 January 2021, in which the agent does not open an internal reply ticket’.
FOURTH: According to the search carried out on 30 December 2021, on the website
https://web.archive.org of the historical data appearing in the Privacy Policy of the EDREAMS
website addressed to the Spanish public on 13 January 2021 and addressed to the French
public on 20 January 2021, the following information was obtained:
- Both privacy policies indicate that their last update took place in June 2019.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
11/18
- In both privacy policies, two means of exercising the rights are indicated: through an
online form, or through a postal address. Specifically, the privacy policy in Spanish
states the following: Inorder to exercise your rights, click here or send your request by
post to the following address: Data protection – Calle Bailén, 67, 08009 Barcelona,
Spain, European Union. In your request you must clearly state your identity, specifying
your full name and the e-mail address you used to make the purchase or create an
account, and the rights you wish to exercise.
LEGAL GROUNDS
I
Competence and applicable law
In accordance with Article 58 (2) of Regulation (EU) 2016/679 of European Parliament and of
the Council of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on free movement of these data (GDPR), and as set out in Articles 47,
48.1, 64.2, 68.1 and 68.2 of Organic Law 3/2018 of 5 December 1995 on the protection of
personal data and guarantee of digital rights (hereinafter LOPDGDD) the Director of the
Spanish Data Protection Agency is responsible for initiating and deciding on this procedure.
In addition, Article 63(2) of the LOPDGDD provides that: “The procedures handled by the
Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU)
2016/679, of this organic law, by the regulatory provisions dictated in their development and,
insofar as they are not contradicted, alternatively, by the general rules on administrative
procedures”.
II
Preliminary remarks
In the present case, in accordance with Article 4 (1) of the GDPR, there is a processing of
personal data, since EDREAMS collects and stores, among others, the following personal data
of natural persons: first and last name, email and recordings of calls, among other processing.
EDREAMS carries out this activity in its capacity as controller, since it is the controller who
determines the purposes and means of such activity, pursuant to Article 4 (7) of the GDPR. In
addition, it is a cross-border processing, since EDREAMS is established in Spain, although it
serves other countries of the European Union.
Article 56(1) of the GDPR provides for cases of cross-border processing, as provided for in
Article 423 thereof, in relation to the competence of the lead supervisory authority, that, without
prejudice to Article 55, the supervisory authority of the main establishment or the single
establishment of the controller or processor shall be competent to act as the primary
supervisory authority for cross-border processing carried out by that controller or processor in
accordance with the procedure laid down in Article 60. In the case examined, as explained
above, EDREAMS has its single establishment in Spain, and the Spanish Data Protection
Agency therefore is competent to act as the lead supervisory authority.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
12/18
For its part, the right of access to personal data is regulated by Article 15 of the GDPR.
III
Reply to the allegations made by EDREAMS
With regard to the allegations in response to the decision to initiate the present penalty
proceedings, we will respond to them in the order set out by EDREAMS:
1.- EXERCISE OF RIGHTS IN EDREAMS IN ACCORDANCE WITH LAW.
The existence of a “Privacy Form”, through which EDREAMS centralises the management of
the exercise of rights, should not prevent a request for the exercise of rights regarding the
protection of personal data from being addressed when it is presented by other means. As
EDREAMS itself states in its submissions, Article 12(2) of the LOPDGDD provides that: ‘The
controller shall be obliged to inform the data subject about the means available to exercise
their rights. Such means shall be easily accessible by the data subject. The exercise of the
right may not be denied on the sole ground that the data subject chooses a different means’.
The negligence of the employee in attending to the request for the exercise of the right of
access does not exempt EDREAMS from liability. The liability of the company for the negligent
act of an employee that supposes the infringement of the data protection regulations has been
confirmed by the jurisprudence of the Spanish Supreme Court. In this regard, reference should
be made to the Spanish Supreme Court Judgment No. 188/2022 (Dispute Chamber, Section
3) of 15 February 2022 (rec. 7359/2020), for which the Fourth Legal Ground provides: ‘The
fact that it was the negligence of an employee does not relieve it of its responsibility as
responsible for the correct use of the security measures which should have ensured the proper
use of the data recording system designed. As we argued in STS No 196/2020 of 15 February
2021 (rec. 1916/2020) the processor is also responsible for the actions of their employees and
cannot excuse itself in its diligent action, separately from the actions of its employees, but is
the ‘guilty’ of those employees, as a result of the infringement of existing security measures
that underpins the liability of the company in the area of penalties for acts “own” of their
employees or positions, not of third parties.
The ruling continues by arguing about the liability of legal persons in our legal system: ‘...It
simply happens that, being admitted in our Administrative Law the direct liability of legal
persons, to whom it is therefore recognised, the subjective element of the infringement is
reflected in these cases differently from that of natural persons, so that, as pointed out in the
constitutional doctrine outlined above -SsTC STC 246/1991, of December 19 (F.J. 2) and
129/2003, of 30 June (F.J. 8) – the direct reproachability derives from the legal asset protected
by the rule that is infringed and the need for such protection to be genuinely effective and
because of the risk that the legal person who is subject to compliance with that rule must
therefore assume.’
2.- EDREAMS MAKES EXTRA EFFORTS IN GENERIC CUSTOMER SERVICE CHANNELS
IN ORDER TO GIVE THE BEST SERVICE TO ITS CUSTOMERS.
The measures taken by EDREAMS in order to ensure due compliance by their employees with
data protection regulations, without undermining their responsibility in the facts, together with
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
13/18
the prompt attention to the exercise of the right of access on the occasion of the request for
information made by this Agency, have been taken into account for the purpose of deciding
the corrective power to apply, considering the reprimand as more appropriate than an
administrative fine.
3.-CONTINUOUS IMPROVEMENT OF TRANSPARENCY ON THE EXERCISE OF RIGHTS
As stated in response to the above argument, the measures taken by EDREAMS to facilitate
the exercise of data protection rights, without calling into question the liability arising from the
commission of the infringement, have been taken into account for the purpose of deciding the
corrective power to be applied, considering the reprimand as more appropriate than an
administrative fine.
Once the proposal for a resolution was made, arguments were presented by EDREAMS
reiterating its previous arguments. It should be noted that the need for requests for the exercise
of the right of access to personal data not to be limited to requests made through a given
channel is a shared criterion with the European Data Protection Board (hereinafter EDPB),
which, in fulfilment of the objective of ensuring the consistent application of the General Data
Protection Regulation (as attributed to it by Article 70 GDPR), is developing guidance to
provide a clear and transparent basis on the exercise of the right of access (Guidelines 01/2022
on the rights of data subjects – the right of access) “Guidelines 01/2022 on data subject rights
– Right of access”.
Paragraph 3.1.2 (paragraphs 52 to 57) of the version subject to public consultation of the
abovementioned Guidelines (https://edpb.europa.eu/system/files/2022-
01/edpb_guidelines_012022_right-of-access_0.pdf) states the following concerning the
requirements for the application for the exercise of the right of access:
‘52. As noted previously, the GDPR does not impose any requirements on data subjects
regarding the form of the request for access to the personal data. Therefore, there are in
principle no requirements under the GDPR that the data subjectsmust observe when choosing
a communication channel through which they enter into contact with the controller.
53. The EDPB encourages the controllers to provide the most appropriate and user-friendly
communication channels, in line with Art. 12(2) and Art. 25, to enable the data subject to make
an effective request. Nevertheless, if the data subject makes a request using a communication
channel provided by the controller, which is different from the one indicated as the preferable
one, such request shall be, in general, considered effective and the controller should handle
such a request accordingly (see the examples below). The controllers should undertake all
reasonable efforts to make sure that the exercise of data subject rights is facilitated (for
example, in case the data subject sends the request to an employee who is on leave, an
automatic message informing the data subject about an alternative communication channel for
its request could be a reasonable effort).
54. It should be noted that the controller is not obliged to act on a request sent to a random or
incorrect email (or postal) address, not directly provided by the controller, or to any
communication channel that is clearly not intended to receive requests regarding data subject's
rights, if the controller has provided an appropriate communication channel, that can be used
by the data subject.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
14/18
55. The controller is also not obliged to act on a request sent to the e-mail address of a
controller’s employee who may not be involved in the processing of requests concerning data
subjects’ rights (e.g. drivers, cleaning staff, etc.). Such requests shall not be considered
effective, if the controller has clearly provided the data subject with appropriate communication
channel. However, if the data subject sends a request to the controller’s employee who deals
with the data subject’s affairs on a daily basis (single contact of a customer, such as e.g.
personal account manager), such contact should not to be considered as a random one and
the controller should make all reasonable efforts, to handle such a request so that it can be
redirected to the contact point and answered within the time limits provided for by the GDPR.
56. Nevertheless, the EDPB recommends, as good practice, that controllers introduce, where
possible, mechanisms to improve internal communication between employees on requests
received by those who may not be competent to deal with such requests. In order to facilitate
the exercise of data subjects’ rights.
57. Date of receipt of the request by the controller triggers, as a rule, the one month period for
the controller to provide information on action taken on a request, in accordance with Art. 12(3)
(further guidance on timing is provided in section 5.3). The EDPB considers as good practice
for the controllers to confirm receipt of requests in writing, for example by sending e-mails (or
information by post, if applicable) to the requesting persons confirming that their requests have
been received and that the one month period runs from day X to day Y.’
These criteria determine a broad interpretation as regards the acceptance of requests for the
exercise of the right of access addressed by a data subject to the controller. In general, the
request for the exercise of the right of access to personal data should be considered effective
and the controllers should therefore make all reasonable efforts to ensure that the exercise of
the rights of data subjects is facilitated. The complainant sent the request to two emails
belonging to EDREAMS, namely to its customer service. This service cannot be understood
as excluded from the obligation to attend to requests for the exercise of rights made by
EDREAMS customers, either directly or by transfer to the corresponding unit. According to
paragraph 55 of Guide 01/2022, the controller is not obliged to respond to a request, sent to
the e-mail address of its employees, who cannot participate in the processing of requests
relating to the rights of data subjects, such as drivers or cleaning service. However, a
department whose activity is the attention to the public, such as the customer service of
EDREAMS, which performs functions that involve the processing of personal data of citizens,
cannot be excluded from the obligation to attend to the requests of its customers in the exercise
of the right of access to their personal data. Thus, EDREAMS itself, as explained in its
SECOND claim, has internal processes for the customer service team to manage requests for
the exercise of data protection rights, which did not apply to the request made by the
complainant: “...We have contacted the Customer Service team who informed us that the agent
manually closed the ticket by mistake without properly managing it based on our internal
processes that guarantee the corresponding management of that request, referring to our
Privacy Form (as indicated in the internal data protection rights management process) or to
escalate the exercise of rights internally to the specialised department that is responsible for
it.”
In the present case, despite the measures referred to in EDREAMS, the failure to respond to
the complainant’s exercise of the right of access within one month of receipt of the request has
been substantiated in the present proceedings. Those arguments do not call into question any
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
15/18
of the facts established, having been taken into account for the purposes of assessing the
circumstances concurrent in the commission of the infringement.
In the light of the above, all the allegations are rejected.
IV
Right of access
Article 15 ‘Right of access by the data subject’ of the GDPR provides:
‘1. The data subject shall have the right to obtain from the controller confirmation as to whether
or not personal data concerning him or her are being processed, and, where that is the case,
access to the personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be
disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not
possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal
data or restriction of processing of personal data concerning the data subject or to object to
such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information
as to their source;
(h) the existence of automated decision-making, including profiling, referred to in Article 22(1)
and (4) and, at least in those cases, meaningful information about the logic involved, as well
as the significance and the envisaged consequences of such processing for the data subject.
2.Where personal data are transferred to a third country or to an international organisation, the
data subject shall have the right to be informed of the appropriate safeguards pursuant to
Article 46 relating to the transfer.
3.The controller shall provide a copy of the personal data undergoing processing. For any
further copies requested by the data subject, the controller may charge a reasonable fee based
on administrative costs. Where the data subject makes the request by electronic means, and
unless otherwise requested by the data subject, the information shall be provided in a
commonly used electronic form.
4.The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and
freedoms of others.’
In the present case, it has been established that the complainant sent an email to
[email protected] and [email protected] on 5 January
2021 complaining about a purchase made in Canadian dollars and requesting access to all
discussions between the complainant and eDreams’ customer service on 14 August 2020, 26
October 2020, 17 November 2020 and 28 December 2020. EDreams responded to that
request only after receiving the request for information from the Spanish Agency.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
16/18
Therefore, in accordance with the evidence available in this final decision to end penalty
proceedings, we consider that the facts known constitute an infringement of Article 15 GDPR,
attributable to eDreams.
V
Classification of the infringement under Article 15 GDPR
The aforementioned infringement of Article 15 GDPR lead to the commission of the
infringements defined in Article 83 (5) of the GDPR which, under the heading ‘General
conditions for imposing administrative fines’, provides:
‘Infringements of the following provisions shall, in accordance with paragraph 2, be subject to
administrative fines of up to 20 000 000 EUR or, in the case of an undertaking, up to 4 % of
the total worldwide annual turnover of the preceding financial year, whichever is higher:
(...)
(b) the data subjects’ rights pursuant to Articles 12 to 22; (...)’
In this regard, Article 71 (‘Infringements’) of the Spanish LOPDGDD, states that: ‘The actions
and behaviours referred to in sections 4, 5 and 6 of Regulation (EU) 2016/679, as well as those
which are contrary to this organic law, shall constitute infringements’.
For the purposes of the limitation period, Article 74 ‘Infringements considered to be minor’ of
the Spanish LOPDGDD states:
‘In accordance with sections 4 and 5 of article 83 of Regulation (EU) 2016/679, any
infringement consisting on merely formal lack of compliance with the provisions mentioned
therein, especially the ones listed below, shall be considered a minor infringement and its
limitation period shall be one year:
(...)
(c) Failing to attend to the requirements to exercise any of the rights established by
articles 15 to 22 of Regulation (EU) 2016/679, unless this results from the
implementation of article 7.2.k) of this organic law. (…)’
VI
Sanction for the infringement of Article 15 GDPR
Without prejudice to Article 83 GDPR, Article 58 (2) (b) ‘Powers’ provides that:
‘Each supervisory authority shall have all of the following corrective powers:
(...)
(b) to issue reprimands to a controller or a processor where processing operations have
infringed provisions of this Regulation; (...)”
Recital 148 GDPR states:
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
17/18
‘(…) In a case of a minor infringement or if the fine likely to be imposed would constitute a
disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due
regard should however be given to the nature, gravity and duration of the infringement, the
intentional character of the infringement, actions taken to mitigate the damage suffered, degree
of responsibility or any relevant previous infringements, the manner in which the infringement
became known to the supervisory authority, compliance with measures ordered against the
controller or processor, adherence to a code of conduct and any other aggravating or mitigating
factor..’
In accordance with the evidence available at the time of this final decision to end penalty
proceedings, it is considered that the infringement in question is minor for the purposes of
Article 83 (2) GDPR, given that in the present case, there is no record in this Agency of
penalties imposed to eDreams for not complying the provisions of the GDPR for similar
infringements in the year preceding the facts, given that the complainant sent the request to
the customer service e-mail addresses instead of the one indicated in the privacy policy or
through the form to that effect, and the request for access in question was met diligently after
receiving this Agency’s request for information, all of which makes it possible to consider a
reduction of the fault in the facts and it is therefore considered to be lawful, not to impose a
penalty consisting of an administrative fine and to replace it by issuing a reprimand to eDreams.
Having regard to the abovementioned provisions and others of general application and
assessed the criteria for the graduation of penalties whose existence has been established,
the Director of the Spanish Data Protection Agency DECIDES:
FIRST: TO ISSUE a reprimand to VACACIONES EDREAMS, S.L., with VAT B61965778, for
an infringement of Article 15 of the GDPR, as set out in Article 83.5 of the GDPR.
SECOND: Notify this resolution to VACACIONES EDREAMS, S.L.
In accordance with Article 50 of the Spanish LOPDGDD, this Resolution shall be made public
once it has been notified to the interested parties.
In accordance with Article 48.6 of the Spanish LOPDGDD, and in accordance with Article 123
of the Spanish LPACAP, interested parties may, by way of option, lodge an appeal against this
decision with the Director of the Spanish Data Protection Agency within one month of the day
following notification of this decision or direct administrative appeal to the Administrative
Appeals Chamber of the National High Court, in accordance with Article 25 and paragraph 5
of the Fourth Additional Provision of Spanish Law 29/1998 of 13 July on Administrative
Jurisdiction, within two months of the day following notification of this act, as provided for in
Article 46 (1) of that Law.
Finally, we would point out that, in accordance with Article 90.3 (a) of the Spanish LPACAP,
the final administrative decision may be suspended as a provisional measure if the interested
party indicates their intention to lodge an administrative appeal. If this is the case, the
interested party must formally inform the Spanish Data Protection Agency of this fact by
submitting it via the Spanish Agency’s electronic register [https://sedeagpd.gob.es/sede-
electronica-web/] or through one of the other registers provided for in Article 16.4 of Spanish
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
18/18
Law 39/2015 of 1 October. It shall also forward to the Spanish Agency the documentation
proving that the administrative appeal has actually been lodged. If the Spanish Agency is not
aware of the lodging of the administrative appeal within two months of the day following
notification of this decision, it shall terminate the provisional suspension.
938-120722
Mar España Martí
Director of the Spanish Data Protection Agency
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es