1/9
Procedure No: PS/00165/2022
IMI Reference: A56ID 191737- Case Register 303351
FINAL DECISION
From the actions carried out by the Spanish Data Protection Agency and on the basis of
the following
BACKGROUND
FIRST: (hereinafter the complainant) lodged a complaint with the
data protection authority of Netherlands. The complaint is directed against GUUDJOB
WORLDWIDE S.L. (GUUDJOB) with VAT B86865979. The grounds on which the
complaint is based are as follows:
The complainant claims that he has attempted to erase his personal data without noticing
that this has occurred: he wrote a note about AVIS, so he had to create an account in
GUUDJOB. After that, he realized that his report had been published together with his
full name and attempted to erase his personal information on the website itself and by
emails sent to guudjob.com and [email protected], without receiving
any reply from GUUDJOB.
The complainant has provided the following documentation:
— A copy of the email sent from (hereinafter the
complainant’s email) to [email protected] dated 10 May 2020. In this email, the
complainant requests that his data be deleted. This email shows a mailing history of 27
March 2020, 8 April 2020 and 6 May 2020 sent from the complainant’s email asking for
information on how to delete his account; it is not clear who is the recipient of this email
history, although the first email in the history is a message sent by
guudjob.com indicating how to remember the password.
— A copy of the communication sent by the Data Protection Authority Netherlands to
, dated 5 January 2021, asking whether it has received the
complainant’s request for deletion, when and what has been made in respect of that
request for deletion; it requested to receive a reply by 5 February 2021.
SECOND: On 7 April 2021, the Spanish Data Protection Agency (AEPD) received the
complaint via the Internal Market Information System (hereinafter IMI), governed by
Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25
October 2012 (the IMI Regulation), which aims to promote cross-border administrative
cooperation, mutual assistance between Member States and the exchange of
information. This complaint is forwarded to the AEPD in accordance with Article 56 of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27/04/2016
on the protection of natural persons with regard to the processing of personal data and
on the free movement of such data (hereinafter GDPR), taking into account its cross-
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/9
border nature and that this Agency is competent to act as the lead supervisory authority,
given that GUUDJOB has its registered office and single establishment in Spain.
The data processing carried out concerns data subjects in several Member States .
According to the information incorporated into the IMI system, pursuant to Article 60 of
the GDPR, in addition to the data protection authority of the Netherlands, act as
‘concerned supervisory authority’ the authorities of Italy, Estonia, Belgium, and the
German authorities of Hesse and Lower Saxony. All of them under Article 4 (22) GDPR,
since data subjects residing in these Member States are likely to be substantially affected
by the processing at issue in these proceedings.
THIRD: On 1 June 2021, pursuant to Article 65 of Organic Law 3/2018 of 5 December
on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), the
complaint lodged by the complainant was declared admissible.
On 13 September 2021, in response to a request for information from this Agency,
GUUDJOB provided, inter alia, the following information:
1. A copy of the privacy policy published on the website https://www.guudjob.com/ on 10
May 2020 (indicating that it was last updated on 8 May 2018), which contains, inter
alia, the following information:
10.- EXERCISE OF RIGHTS
You can send a letter to Guudjob, at the address indicated in the heading of this
Policy, or via an email to [email protected], attaching photocopies of your
identity document, at any time and free of charge, to:
— Revoke the consents granted.
— To obtain confirmation as to whether you are processing your personal data in
Guudjob.
— Access your personal data.
— Rectify inaccurate or incomplete data.
— Request the deletion of your data when, inter alia, the data are no longer
necessary for the purposes for which they were collected.
— To obtain from Guudjob the restriction of the processing of your data when
one of the conditions laid down in the data protection regulation is met.
— Request the portability of your data in the cases provided for in the regulations.
— Lodge a complaint concerning the protection of your personal data with the
Spanish Data Protection Agency at Calle de Jorge Juan, 6, 28001 Madrid, when
you believe that Guudjob has infringed your rights recognised by the applicable
data protection legislation.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/9
2. Screenshot of the GUUDJOB Information Systems Administration Panel of “Users”
filtered by “EMAIL” containing the complainant’s email and appearing as a result “No
Users found”.
3. Screenshot of the GUUDJOB Information Systems Administration Panel of “Users”
filtered “FULL NAME” equal to the name and surname of the complainant and
appearing as a result “No Users found”.
4. Indication that users who are deleted from GUUDJOB information systems are
blocked for a period of 12 months. This blocking consists of users moving to a list of
deleted users for consultation for the resolution of questions and disputes. It is also
stated that, when the data are deleted after the period of 12-month has passed, there
is no trace of any communication. And a screenshot from the GUUDJOB Information
Systems Administration Panel is provided from a ‘Deleted Users’ are filtered by
‘EMAIL’ containing the complainant’s email and appearing as a result ‘No Deleted
Users found’.
5. Indication that, when deleting the data, no trace of the communications is kept, but
that a communication has been sent to the complainant after having received the
request for information; and it is provided a copy of a letter sent by a representative
of GUUDJOB to the complainant’s email at 14:37, informing the complainant that his
data was deleted more than a year ago and regretting that they did not send the reply
to his request for deletion, which coincided with COVID related difficulties.
SIGNIFICANT EVIDENCE FOR THE GRADUATION OF THE PENALTY:
Duration of the infringement: we have evidence that 18 months have elapsed between
the request for deregistration and the sending of the email stating that the data have
been deleted.
Repeated infringement of the same nature as the facts under investigation: There is no
evidence that proceedings for infringements by GUUDJOB have been resolved.
Link between GUUDJOB’s activity and the processing of personal data: The conduct of
the entity’s business requires continuous processing of personal data.
Nature and amount of damage caused: there is no evidence of any specific financial loss
on the part of GUUDJOB.
Financial benefits gained from the infringement: we have no evidence.
Total worldwide turnover: According to a consultation carried out at
https://monitoriza.axesor.es/ on 30 March 2022, GUUDJOB WORLDWID, S.L.’s sales in
the 2019 financial year, amounted to EUR and had employees.
The entity has diligently regularised the situation: they informed the complainant that his
data had been deleted.
The conduct of the data subject may have given rise to the facts under investigation: No.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/9
GUUDJOB has spontaneously acknowledged its guilt: They acknowledged that there
was a human failure.
FIFTH: The Director of the AEPD adopted an informal proposal for a draft decision to
initiate penalty proceedings on 18 April 2022. Following the process set out in Article 60
of the GDPR, this proposal was transmitted via the IMI system on 28 April 2022 and the
concerned authorities were informed that they had four weeks from that time to comment.
Within the deadline, they did not comment on this issue.
SIXTH: On 7 June 2022, the Director of the AEPD declared the proceedings time-barred,
since more than 12 months had elapsed since the date on which the complaint was
declared admissible, thus new investigation measures were opened under number
AI/00244/2022, and the documentation contained in E/06404/2021 was added to these
new actions.
SEVENTH: On 8 June 2022, the General Subdirectorate of Data Inspection of this
Agency took a screenshot on the website https://archive.org/web/ concerning the content
of the website https://www.guudjob.com/privacidad_condiciones_de_uso on 22 May
2019 at 18:53 and concerning the content of the website
https://www.guudjob.com/en/guudjob-policy-and-terms-of-use on 10 January 2020 at
15:21. The following information was obtained, inter alia:
The privacy policy at https://www.guudjob.com/privacidad_condiciones_de_uso on 22
May 2019 at 18:53 and 8 June 2022 provides, inter alia, as a means of exercising the
rights, [email protected].
The privacy policy at https://www.guudjob.com/en/guudjobpolicy-and-terms-of-use on 10
January 2020 at 15:21 provides, inter alia, as a means of exercising the rights, the email
address [email protected].
EIGHTH: On 28 June 2022, the Director of the AEPD adopted a draft decision to initiate
penalty proceedings. Following the process set out in Article 60 GDPR, this draft decision
was transmitted via the IMI system on 7 July 2022 and the authorities concerned were
informed that they had four weeks from that time to raise relevant and reasoned
objections.
Within the deadline for this purpose, the supervisory authorities concerned did not raise
any relevant and reasoned objections to it and therefore all authorities are deemed to
agree with and are bound by the draft decision in accordance with Article 60(6) GDPR.
This draft decision was notified to GUUDJOB on 30 June 2022, in accordance with the
Spanish Law 39/2015 of 1 October 2015 on the Common Administrative Procedure of
Public Administrations (LPACAP) as stated in the acknowledgement of receipt contained
in the file.
NINTH: On 21 September 2022, the Director of the Spanish Data Protection Agency
decided to initiate penalty proceedings against GUUDJOB in order to impose a fine of
1,000 EUR, in accordance with Articles 63 and 64 of the Spanish LPACAP), for the
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/9
alleged infringement of Article 17 of the GDPR, as defined in Article 83 (5) of the GDPR,
in which it was informed that it had a period of ten days to submit allegations.
This agreement, which was notified in accordance with the rules laid down in the
LPACAP by electronic notification, was collected by GUUDJOB on 22 September 2022,
in accordance with the Spanish Law 39/2015 of 1 October on the Common
Administrative Procedure of Public Administrations (LPACAP), as stated in the
acknowledgement of receipt contained in the file.
TENTH: On 1 October 2022, GUUDJOB paid the penalty.
The payment made entails the waiver of any action or appeal against the final decision,
in relation to the facts referred to in the agreement to initiate penalty proceedings.
LEGAL GROUNDS
I
Competence and applicable legislation
In accordance with Article 58 (2) of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data
(GDPR), and as set out in Articles 47, 48.1, 64.2, 68.1 and 68.2 of Organic Law 3/2018
of 5 December on the Protection of Personal Data and Guarantee of Digital Rights
(hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency is
responsible for adopting this draft decision.
In addition, Article 63(2) of the LOPDGDD provides that: “The procedures handled by
the Spanish Data Protection Agency shall be governed by the provisions of Regulation
(EU) 2016/679, of this organic law, by the regulatory provisions dictated in their
development and, insofar as they are not contradicted, alternatively, by the general rules
on administrative procedures”.
II
Preliminary remarks
In the present case, in accordance with Article 4 (1) and (4.2) of the GDPR, there is a
processing of personal data, since GUUDJOB collects, inter alia, the following personal
data of natural persons: first name, surname, telephone and e-mail, including other
treatments.
GUUDJOB carries out this activity in its capacity as controller, since it is the controller
who determines the purposes and means of that activity, pursuant to Article 4 (7) of the
GDPR. In addition, this is a cross-border processing, given that GUUDJOB is established
in Spain, although it serves other countries of the European Union.
The GDPR provides, in Article 56 (1), for cases of cross-border processing, as provided
for in Article 4 (23), in relation to the competence of the lead supervisory authority, that,
without prejudice to Article 55, the supervisory authority of the main establishment or the
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
6/9
single establishment of the controller or processor shall be competent to act as lead
supervisory authority for cross-border processing carried out by that controller or
processor in accordance with the procedure set out in Article 60. In the case under
consideration, as explained above, GUUDJOB has its single establishment in Spain, so
the Spanish Data Protection Agency is therefore competent to act as the lead
supervisory authority.
For its part, Article 17 of the GDPR governs the right of data subjects to erase their
personal data, while Article 12 of the GDPR governs how that right must be exercised.
III
Right to erasure
Article 17 “Right to erasure (“the right to be forgotten”)” of the GDPR provides that:
‘1. The data subject shall have the right to obtain from the controller the erasure of
personal data concerning him or her without undue delay and the controller shall have
the obligation to erase personal data without undue delay where one of the following
grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to
point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal
ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no
overriding legitimate grounds for the processing, or the data subject objects to the
processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union
or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society
services referred to in Article 8(1).
(...)’;
In the present case, the complainant had requested the deletion of his personal data, at
least once, at the email address ‘[email protected]’, which is the address
appearing in GUUDJOB’s privacy policy for the exercise of rights. It appears from the file
that the complainant has more often tried to delete his data, the first on 27 March 2020.
IV
Modalities for exercising the rights of the data subject
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
7/9
Article 12 ‘Transparent information, communication and modalities for the exercise of the
rights of the data subject’ of the GDPR provides that:
“(...).
2. The controller shall facilitate the exercise of data subject rights under Articles 15 to
22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the
request of the data subject for exercising his or her rights under Articles 15 to 22, unless
the controller demonstrates that it is not in a position to identify the data subject.
3. The controller shall provide information on action taken on a request under Articles 15
to 22 to the data subject without undue delay and in any event within one month of receipt
of the request. That period may be extended by two further months where necessary,
taking into account the complexity and number of the requests. The controller shall
inform the data subject of any such extension within one month of receipt of the request,
together with the reasons for the delay. Where the data subject makes the request by
electronic form means, the information shall be provided by electronic means where
possible, unless otherwise requested by the data subject.
4. If the controller does not take action on the request of the data subject, the controller
shall inform the data subject without delay and at the latest within one month of receipt
of the request of the reasons for not taking action and on the possibility of lodging a
complaint with a supervisory authority and seeking a judicial remedy.
(...)’
Article 12 of the LOPDGDD, entitled ‘General provisions on the exercise of the rights’,
provides:
“(...)
4. The evidence of compliance with the duty to respond to the request for the exercise
of rights submitted by the data subject shall be the responsibility of the controller.
(...)”.
After the request for information sent by AEPD, GUUDJOB has established that it had
deleted the data relating to the complainant, having provided the corresponding
screenshots which show that there were no data from the complainant in the last 12
months.
However, the communication to the complainant took place when the previous actions
were initiated at this Agency, since the email informing the complainant that his personal
data had been deleted more than a year ago coincides with his request, and after
receiving the notification from this Agency, it informed him that his data had already been
deleted, and regretted that they had not replied to their request, adding that it was during
COVID time and that was the reason it was not possible to reply.
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
8/9
Therefore, in accordance with the evidence available at this stage, it is considered that
the known facts constitute an infringement of Article 12 of the GDPR, read in conjunction
with Article 17 of the GDPR, attributable to GUUDJOB.
V
Classification of the infringement of Article 12 GDPR
The known facts constitute an infringement, attributable to GUUDJOB, as defined in
Article 83 (5) of the GDPR, which, under the heading ‘General conditions for the
imposition of administrative fines’, provides:
‘Infringements of the following provisions shall, in accordance with paragraph 2, be
subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking,
up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher:
(...)
(b) the data subjects' rights pursuant to Articles 12 to 22; (…)’
In this regard, Article 71 (‘Infringements’) of the Spanish LOPDGDD states that ‘The
actions and behaviours referred to in sections 4, 5 and 6 of Regulation (EU) 2016/679,
as well as those which are contrary to this organic law, shall constitute infringements.’.
For the purposes of the limitation period, Article 74 (c) ‘Minor infringements’ of the
LOPDGDD states: ‘The remaining infringements of the Articles referred to in Article 83
(4) and (5) of Regulation (EU) 2016/679, and in particular the following, shall be
considered a minor infringement and its limitation period shall be one year: (...)
(c) Failing to attend to the requirements to exercise any of the rights established by
articles 15 to 22 of Regulation (EU) 2016/679, unless this results from the implementation
of article 7.2.k) of this organic law’.
VI
Sanction for the infringement of Article 12 GDPR
This infringement may be fined up to 20.000.000 EUR or, in the case of an undertaking,
up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher, in accordance with Article 83 (5) of the GDPR.
Furthermore, for the purposes of deciding on the imposition of an administrative fine and
its amount, in accordance with the evidence available at this stage, it is considered that
the balance of the circumstances referred to in Article 83(2) of the GDPR and 76.2 of the
Spanish LOPDGDD, with regard of the infringement of Article 12 of the GDPR, in
conjunction with Article 17, makes it possible to impose a penalty of 1,000 EUR (1000
EUR).
VII
Termination of proceedings
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
9/9
Article 85 of Spanish Law 39/2015 of 1 October 2015 on the Common Administrative
Procedure of Public Administrations (LPACAP), entitled ‘Termination in penalty
proceedings’, provides:
‘1. If the offender recognises his or her responsibility, the proceedings may be resolved
by imposing the appropriate penalty.
2. Where the penalty is of a purely financial nature or where a financial penalty and a
non-pecuniary penalty may be imposed, but the latter is justified, voluntary payment by
the alleged person, at any time prior to the decision, shall entail the termination of the
proceedings, except as regards the restoration of the altered situation or the
determination of compensation for the damage caused by the infringement. (…)’
In accordance with the above,
Director of the Spanish Data Protection Agency DECIDES TO:
FIRST: Declare the termination of proceeding PS/00165/2022, in accordance with Article
85 of the LPACAP.
SECOND: Notify this resolution to GUUDJOB WORLDWIDE S.L.
In accordance with Article 50 of the LOPDGDD, this Resolution will be made public once
it has been notified to the interested parties.
Against this decision, which terminates the administrative procedure in accordance with
the provisions of Article 114.1 (c) of Law 39/2015 of 1 October on the Common
Administrative Procedure of Public Administrations, interested parties may lodge an
administrative appeal with the Administrative Appeals Chamber of the National High
Court, in accordance with Article 25 and paragraph 5 of the fourth additional provision of
Law 29/1998 of 13 July governing the administrative courts, within two months from the
day following notification of this act, in accordance with Article 46 (1) of that Law.
937-181022
Mar España Martí
Director of the Spanish Data Protection Agency
C/Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es