1/9
File No: EXP202202885
IMI Reference: A56ID 375257- Case Register: 458465
FINAL DECISION
From the actions carried out by the Spanish Data Protection Agency and on the basis of
the following
BACKGROUND
FIRST: (hereinafter the complainant) lodged a complaint with the
French Data Protection Authority (CNIL) on 16 September 2021. The complaint is
brought against FESTINA LOTUS S.A., with VAT A08663684 (hereinafter FESTINA).
The grounds on which the complaint is based are as follows:
The complainant requested to remove her account from FESTINA’s website twice, on 23
July 2021 and 7 August 2021 without having received a reply.
The complaint has provided the following documentation:
Screenshot of an email sent by the complainant to [email protected], dated 23 July 2021,
with the following content: ‘Bonjour, merci de clóturer mon compte Festina enregistré
sous l’adresse mail et de supprimer toutes les informations
personnelles me concernant de vos bases de données.’ [Unofficial translation: ‘Good
morning, please delete my Festina account registered under the email “
and suppress all personal information concerning me in your databases.’]
Screenshot of an email sent by the complainant to [email protected], dated 7 August
2021, with the following content: ‘Bonjour, suite à mon précédent message du 23 juillet
dernier, je redemande la suppression du compte enregistré sous l’adresse mail
de votre site internet, ainsi que la suppression des
informations personnelles me concernant de vos bases de données, conformément à la
Loi Informatique et Libertés de la C.N.I.L. Cette précédente demande est en effet restée
sans suite. Merci’ [Unofficial translation: ‘Following my last message of 23 July, I request
the deletion of my account registered under the mail address
on your website, as well as the deletion of my personal information pursuant to the Act
on Information Technology, Data Files and Civil Liberties. The previous request was in
fact not followed up. Thank you.’]
SECOND: Via the ‘Internal Market Information System’ (hereinafter ‘IMI System’),
governed by Regulation (EU) No 1024/2012 of the European Parliament and of the
Council of 25 October 2012 (the IMI Regulation), which aims to promote cross-border
administrative cooperation, mutual assistance between the Member States and the
exchange of information, the complaint was sent to the Spanish Data Protection Agency
(AEPD) on 9 March 2022, and was registered on 10 March 2022. This complaint is
forwarded to the AEPD in accordance with Article 56 of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27/04/2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of
such data (‘GDPR’), taking into account its cross-border nature and that this Agency is
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/9
competent to act as the lead supervisory authority, given that FESTINA has its registered
office and single establishment in Spain.
The data processing carried out concerns data subjects in several Member States.
According to the information incorporated into the IMI system, pursuant to Article 60 of
the GDPR, act as a ‘concerned supervisory authority’, in addition to the data protection
authority of France, the authorities of Sweden, Belgium, Hungary, Slovakia, Italy, Poland,
and the German authority of Lower Saxony. All of them under Article 4 (22) GDPR, since
data subjects residing in these Member States are substantially affected, or are likely to
be substantially affected by the processing at issue in these proceedings.
THIRD: On 7 June 2022, in accordance with the Article 64 (3) previously in force of
Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee
of digital rights (LOPDGDD), the complaint lodged by the complainant was declared
admissible.
FOURTH: The General Subdirectorate for Data Inspection carried out preliminary
investigations to clarify the facts in question, in accordance with the tasks assigned to
the supervisory authorities in Article 57 (1) and the powers conferred on them in Article
58 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter
GDPR), and in accordance with Title VII, Chapter I, Section Two, of the LOPDGDD, and
is aware of the following:
On 30 November 2022, a letter was submitted to the AEPD on behalf of FESTINA in
response to a request for information (this request for information was received by
FESTINA on 15 November 2022), in which, among other things, the following information
was provided:
1. Declaration that the complainant registered her account via the form on the website
www.festina.com, and subsequently registered the newsletter service. A screenshot
of the audit record is provided with the date and time at which the complainant
registered her account (14 April 2021) and registered the newsletter service (15 April
2021).
2. Declaration that the complainant subsequently withdrew from the newsletter service
on 23 June 2021 using the link enabled for that purpose in a communication. A copy
of the audit record of a submission of 23 June 2021 showing that a subscription was
withdrawn is provided. This audit register also shows a register compatible with
registration, which is dated 15 April 2021.
3. Indication that the communications of 23 July 2021 and 7 August 2021 sent by the
complainant to [email protected] could not be answered by the Data Protection
Officer because, ‘given the large amount of ‘spam’ received by the email accounts,
the account filter interpreted (...) ‘hotmail.com’ mail as spam and for this reason was
not detected and was never answered’.
4. A statement that ‘the mechanism indicated in the privacy policy for exercising the rights
of access, cancellation, rectification, objection, portability, etc. before FESTINA
LOTUS SA was another one, articulated via the link indicated in the privacy policy
(www.corp orate-ethicline.com/festina)’, stating that the complainant exercised her
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/9
right to erasure via this channel on 15 June 2022 and deleted her data, which was
communicated to the complainant by an email sent to the complainant from the
[email protected] email account on 13 July 2022.
5. Screenshot of the registration of a request from the channel ‘CORPORATE-ETHIC
LINE’ dated 15 June 2022 by the complainant, with the following text: ‘Bonjour, je
sollicite la clôture de mon compte client enregistré sous l'adresse mail
ainsi que mon droit d'annulation des données
personnelles en demandant la suppression de toutes les informations personnelles
me concernant de vos bases de données, conformément à l'article 17 du RGPD et
l'article 5 du LPD. Merci.’ [Non-official translation: ‘I request the closure of my client
account registered under the email address as well as my
right to erase my personal data by requesting the deletion of all personal information
concerning me from your databases, in accordance with Article 17 of the GDPR and
Article 5 of the DPA. Thank you.”]
6. Printout of email dated 13 July 2022 sent by [email protected] to
with an attached PDF document and the following content:
‘Bonsoir,
Dans le document ci-joint, vous trouverez le certificat attestant que toutes vos
données personnelles ont été supprimées de nos bases de données et d’autres
informations de votre intérêt.
Cordialement,
FESTINA LOTUS, S.A. – Data Protection Officer”
[Unofficial translation:
‘Good nights,
In the attached document, you will find the certificate that all your personal data
have been deleted from our databases and other information of your interest.
Cordially,
FESTINA LOTUS, S.A. – Data Protection Officer”]
7. Copy of the ‘Document justifying the deletion of data exercised’, consisting of a
communication signed and addressed to the complainant with the following content:
‘Conformément à votre demande formulée par le biais de notre canal éthique
de la ligne corporative, et conformément aux dispositions du règlement général
sur la protection des données (UE) 2016/679, de la loi organique 3/2018, du 5
décembre, sur la protection des données et la garantie des droits numériques
et du décret royal 1720/2007, du 21 décembre, je vous écris en ma qualité de
représentant de FESTINA LOTUS, S.A., dont le siège social est situé à 28002
- Madrid, Calle Velázquez, 150, 3º 1ª, pour certifier ce qui suit:
Que conformément à votre demande, nous avons procédé à l'examen de
l'existence de vos données personnelles dans nos bases de données et nous
vous informons que vos données ne figurent plus dans aucune des bases de
données de notre société. Nous vous rappelons également que vous avez
sélectionné l'option de désinscription le 23 juillet 2021.
Pour toutes ces raisons, et étant donné que notre société souhaite respecter
scrupuleusement vos souhaits, nous vous informons que ce sera la dernière
communication que nous aurons avec vous
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/9
Meilleures Salutations.’
[Unofficial translation:
‘In accordance with your request via our corporate ethical channel, and in
accordance with the provisions of General Data Protection Regulation (EU)
2016/679, Organic Law 3/2018 of 5 December on Data Protection and the
Guarantee of Digital Rights and Royal Decree 1720/2007 of 21 December, I am
writing to you in my capacity as representative of FESTINA LOTUS, S.A., with
its registered office in 28002 – Madrid, Calle Velázquez, 150, 3, 1, to certify the
following:
According to your request, we have examined the existence of your personal
data in our databases and inform you that your data are no longer included in
any of our company’s databases. We also remind you that you selected the
cancellation option on 23 July 2021.
For all these reasons, and given that our company wishes to respect your
wishes carefully, we would like to inform you that this will be the last
communication we will have with you.
Best regards.’
8. Indication that the channel for exercising data protection rights previously on the web
address www.corporate-ethicline.com/festina, at the time of submission of the
submission, had been changed to the address htps:// corporate-line.com/cnormativo-
grupofestina.
On 11 April 2023, on the website https://web.archive.org, the historical content of the
privacy policy of the FESTINA website in French (‘https://festina.com/fr-
FR/legal/confidentialite’) and in Spanish (https://festina.com/es-ES/legal/privacidad) was
obtained, with the following results:
9. On the website https://web.archive.org, the historical content of the French privacy
policy before and closest to the date of submission of the requests to exercise the
complainant’s right to erasure is dated 20 June 2021 and, in its section on the exercise
of data protection rights, it is stated, inter alia:
‘Les clients de FESTINA.COM, ont reconnu et peuvent exercer les droits
d'accès, d'annulation, de rectification et d'opposition devant FESTINA LOTUS
SA, soit par courrier à Vía Layetana nº 20 4ème étage, 08003 Barcelona en
indiquant vos données personnelles et en joignant une copie du DNI, ou via le
lien suivant: www.corporate-ethicline.com/festina .
En cas de question relative à la protection de vos données, vous pouvez
contacter par mail notre délégué à la protection des données du groupe en
écrivant à l'adresse postale suivante:
FESTINA LOTUS SA
Délégué à la protection des données
Via layetana 20 quatrième étage
08003 Barcelone (Espagne)
Ou par email à l'adresse suivante:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/9
Délégué à la protection des données: [email protected]’
[Unofficial translation: ‘The clients of FESTINA.COM have recognized and can
exercise the rights of access, cancellation, rectification and objection to
FESTINA LOTUS SA, either by post to Via Layetana No 20 4th floor, 08003
Barcelona, indicating their personal data and attaching a copy of the ID card, or
via the following link: www.corporate-ethicline.com/ festine.
In case of a question related to the protection of your data, you can contact our
Group Data Protection Officer by email at the following postal address:
FESTINA LOTUS YOUR
Data Protection Officer
VIa Layetana 20 fourth floor
08003 Barcelona (Spain)
Or by email to the following address:
Data Protection Officer: [email protected]”]
Total annual turnover: According to a consultation carried out in Axesor’s monitoring
service (https://monitoriza.axesor.es/) on 12 April 2023, it is established that the entity
under investigation is a ‘ ’ company with sales volume in the 2021 financial
year of EUR and employees.
SIXTH: On 24 May 2023, the Director of the AEPD adopted a draft decision to initiate
penalty proceedings. Following the process set out in Article 60 GDPR, this draft decision
was transmitted via IMI on the same day and the authorities concerned were informed
that they had four weeks from that time to raise relevant and reasoned objections.
The period for processing the present penalty proceedings was automatically suspended
during these four weeks, in accordance with the provisions of Article 64(5) of the
LOPDGDD.
Within the deadline for that purpose, the supervisory authorities concerned did not raise
any relevant and reasoned objections to it, and therefore all authorities are deemed to
agree with and are bound by the draft decision in accordance with Article 60(6) GDPR.
SEVENTH: On 28 June 2023, the Director of the Spanish Data Protection Agency
decided to initiate penalty proceedings against FESTINA in order to impose a fine of
1,000 EUR, in accordance with Articles 63 and 64 of the Spanish LPACAP, for the
alleged infringement of Article 21 of the GDPR, as defined in Article 83 (5) of the GDPR,
in which it was informed that it had a period of ten days to submit allegations.
This agreement, which was notified in accordance with the rules laid down in the
LPACAP by electronic notification, was collected by FESTINA on 29 June 2023, in
accordance with the Spanish Law 39/2015 of 1 October on the Common Administrative
Procedure of Public Administrations (LPACAP), as stated in the acknowledgement of
receipt contained in the file.
EIGHTH: On 10 August 2023, FESTINA paid the penalty.
The payment made entails the waiver of any action or appeal against the final decision,
in relation to the facts referred to in the agreement to initiate penalty proceedings.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
6/9
LEGAL GROUNDS
I
Competence
In accordance with Article 58 (2) of Regulation (EU) 2016/679 of European Parliament
and of the Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on free movement of these data (GDPR), and as
set out in Articles 47, 48.1, 64.2, 68.1 and 68.2 of the Spanish Organic Law 3/2018 of 5
December 1995 on the protection of personal data and guarantee of digital rights
(hereinafter LOPDGDD) is competent to adopt this final decision the Director of the
Spanish Data Protection Agency.
In addition, Article 63(2) of the LOPDGDD provides that: “The procedures handled by
the Spanish Data Protection Agency shall be governed by the provisions of Regulation
(EU) 2016/679, of this organic law, by the regulatory provisions dictated in their
development and, insofar as they are not contradicted, alternatively, by the general rules
on administrative procedures”.
II
Preliminary remarks
In the present case, in accordance with Article 4 (1) and (4.2) of the GDPR, there is the
processing of personal data, since FESTINA collects and stores, inter alia, the following
personal data of natural persons, names, identity cards, postal or electronic addresses,
economic or banking data, among other processing operations.
FESTINA carries out this activity in its capacity as controller, as it determines the
purposes and means of that activity, pursuant to Article 4 (7) of the GDPR. In addition,
this is a cross-border processing, given that FESTINA is established in Spain, although
it serves other countries of the European Union.
The GDPR provides, in Article 56 (1), for cases of cross-border processing, as provided
for in Article 4 (23), in relation to the competence of the lead supervisory authority, that,
without prejudice to Article 55, the supervisory authority of the main establishment or the
single establishment of the controller or processor shall be competent to act as lead
supervisory authority for the cross-border processing carried out by that controller or
processor in accordance with the procedure set out in Article 60. In the case under
consideration, as explained above, FESTINA has its sole establishment in Spain, so the
Spanish Data Protection Agency is competent to act as the lead supervisory authority.
Article 17 of the GDPR governs the right to erasure (right to be forgotten).
III
Right to erasure (Right to be forgotten)
Article 17 ‘Right to erasure (‘the right to be forgotten’)’ of the GDPR provides:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
7/9
‘1. The data subject shall have the right to obtain from the controller the erasure of
personal data concerning him or her without undue delay and the controller shall have
the obligation to erase personal data without undue delay where one of the following
grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which
they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based
according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there
is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there
are no overriding legitimate grounds for the processing, or the data subject
objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in
Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information
society services referred to in Article 8(1).
(...)”
In the present case, the complainant had requested the deletion of her personal data on
three occasions. The first two, on 23 July 2021 and 7 August 2021, were sent at the
email address ([email protected]) and were not answered.
The third was carried out via the channel authorised for that purpose (www.corporate-
ethicline.com/festina) on 15 June 2022 and, following the activation of the protocol of
that channel, the complainant’s data were deleted, and the complainant was informed
on 13 July 2022 from the [email protected] account, attaching a document
justifying the deletion of the data requested.
Therefore, in accordance with the evidence available at this stage, it is considered that
the complainant initially requested the deletion of her personal data on 23 July and 7
August 2021 from the email account ([email protected]), which was not complied with,
considering that these facts constitute an infringement, attributable to FESTINA, for
infringement of Article 17 of the GDPR.
IV
Classification of the infringement of Article 17 GDPR
In accordance with the evidence available at this stage, it is considered that FESTINA
has not duly complied with the right to erasure requested by the complainant.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
8/9
The known facts constitute an infringement, attributable to FESTINA, as defined in Article
83 (5) of the GDPR, which, under the heading ‘General conditions for the imposition of
administrative fines’, provides:
‘Infringements of the following provisions shall, in accordance with paragraph 2, be
subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking,
up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher:
(b) the data subjects' rights pursuant to Articles 12 to 22; (…)’
For the purposes of the limitation period, Article 74 ‘Minor infringements’ of the
LOPDGDD states:
In accordance with sections 4 and 5 of article 83 of Regulation (EU) 2016/679, any
infringement consisting on merely formal lack of compliance with the provisions
mentioned therein, especially the ones listed below, shall be considered a minor
infringement and its limitation period shall be one year:
[...]
(c) Failing to attend to the requirements to exercise any of the rights established
by articles 15 to 22 of Regulation (EU) 2016/679, unless this results from the
implementation of article 7.2.k) of this organic law.’
V
Sanction for infringement of Article 17 GDPR
This infringement may be fined up to 20.000.000 EUR or, in the case of an undertaking,
up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher, in accordance with Article 83 (5) of the GDPR.
Furthermore, for the purposes of deciding on the imposition of an administrative fine and
its amount, in accordance with the evidence available at this stage, it is considered that
the balance of the circumstances referred to in Article 83 (2) of the GDPR and 76.2 of
the LOPDGDD, with regard to the infringement of Article 17 of the GDPR, makes it
possible to impose a penalty of 1000 EUR (one thousand euros).
VI
Termination of proceedings
Article 85 of Spanish Law 39/2015 of 1 October 2015 on the Common Administrative
Procedure of Public Administrations (LPACAP), entitled ‘Termination in penalty
proceedings’, provides:
‘1. If the offender recognises his or her responsibility, the proceedings may be resolved
by imposing the appropriate penalty.
2. Where the penalty is of a purely financial nature or where a financial penalty and a
non-pecuniary penalty may be imposed, but the latter is justified, voluntary payment by
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
9/9
the alleged person, at any time prior to the decision, shall entail the termination of the
proceedings, except as regards the restoration of the altered situation or the
determination of compensation for the damage caused by the infringement. (…)’
According to the above,
the Director of the Spanish Agency for Data Protection DECIDES TO:
FIRST: DECLARE the termination of proceeding EXP202202885 in accordance with
Article 85 of the LPACAP.
SECOND: Notify this resolution to FESTINA LOTUS S.A.
In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be
made public once it has been notified to the interested parties.
Against this decision, which terminates the administrative procedure in accordance with
the provisions of Article 114.1 (c) of Law 39/2015 of 1 October on the Common
Administrative Procedure of Public Administrations, interested parties may lodge an
administrative appeal with the Administrative Appeals Chamber of the National High
Court, in accordance with Article 25 and paragraph 5 of the fourth additional provision of
Law 29/1998 of 13 July governing the administrative courts, within two months from the
day following notification of this act, in accordance with Article 46 (1) of that Law.
936-040822
Mar España Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es