1/12
File No: PS/00184/2022
IMI Reference: A56ID 120466- Case Register 121188
FINAL DECISION
From the actions carried out by the Spanish Data Protection Agency and on the basis of
the following
BACKGROUND
FIRST: (hereinafter the complainant) lodged a complaint with the
Croatian Data Protection Authority on 7 January 2020. The complaint is directed against
FUNDACIÓN CitizenGo (hereinafter CitizenGo) with VAT G86736998. The grounds on
which the complaint are based are as follows:
The complainant claims to have received an email from the CitizenGo platform in his
private mailbox without consent.
In this email he is encouraged to vote in the second round of the presidential elections
in his country and to participate in the campaigns launched through the platform in
question.
SECOND: Via the ‘Internal Market Information System’ (hereinafter ‘IMI’), governed by
Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25
October 2012 (the IMI Regulation), which aims to promote cross-border administrative
cooperation, mutual assistance between the Member States and the exchange of
information, the complaint was transmitted on 8 April 2020 and was registered with the
Spanish Data Protection Agency (AEPD) on 8 April 2020. This complaint is forwarded to
the AEPD in accordance with Article 56 of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27/04/2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data
(hereinafter GDPR), taking into account its cross-border nature and that this Agency is
competent to act as lead supervisory authority, given that CitizenGo has its registered
office and single establishment in Spain.
The data processing carried out concerns data subjects in several Member States.
According to the information incorporated into the IMI System, pursuant to Article 60 of
the GDPR, act as a ‘concerned supervisory authority’, in addition to the Croatian data
protection authority, the authorities of Italy, Poland, Norway, Denmark, Portugal, France,
Latvia, Hungary, Slovakia, Sweden and the German authority in Berlin, Lower Saxony
and Bavaria. All of them under Article 4 (22) GDPR, since data subjects residing in these
Member States are likely to be substantially affected by the processing at issue in these
proceedings.
THIRD: On 15 April 2020, the AEPD requests, via IMI, the Croatian Data Protection
Authority to provide additional information on the complaint at least to share the original
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/12
complaint, as well as evidence of the unsolicited e-mail and his identification and contact
details.
The data protection authority of Croatia shared through IMI on 22 May 2020, with the
original complaint, the following documents provided by the complainant:
An e-mail sent on 3 January 2020 at 4:24 PM, from email ,
addressed to with the subject ‘ nije svegedno’ (in english, ‘does not
matter’) and with the following text (in Croatian in the original):
‘I am writing to you today because I am concerned that you will not go to the presidential
elections this Sunday.
As we are working on this every day to empower your voice towards police officers who
claim to share our values, I understand your disappointment, and I can tell you sincerely
that I share it.
But I always remind me that as citizens we are obliged to participate in democracy and
actively monitor how police officers represent us and react as necessary.
Only together can we teach politicians who have a duty to represent us, especially if they
are thanks to us in power.
It does not matter who during the next five years of two candidates will be President of
the Republic of Croatia, co-create foreign policy, represent us in the world, appoint am-
bassadors, constitutional judges and strongly influence the social climate in Croatia.
Before the last round of elections, we prepared a declaration.
‘Promise of freedom to the democratic Croatia’
We asked the candidates who said they shared the principles of values to read about
whether and how to advocate for their realisation.
We inform you about their answers and invite you to vote according to your conscience.
And this time we invite you to vote in accordance with your conscience.
I am sure that none of us wants a President who:
-actively act against the will of Croatian citizens expressed in a popular referen-
dum
-promote abortion
-actively work against the right to appeal to the conscience of medical profession-
als
-advocate for the indoctrination of children with gender ideology through school
curricula
- to oppose the state commemoration of the victims of communism
-prevent the extradition and trial of the organizers of the communist assassina-
tions
-open Croatian borders for illegal crossings of migrants
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/12
-introduce new ideological divisions into our society under the slogan "we or they”
It does not matter who will be the President of the Republic of Croatia at a time
when the world order and areas of influence change because Croatia is at the
intersection of the interests of the world’s superpowers.
I am sure that it does not matter to you either. On the contrary, it is very important for
you, like me.
Go to the elections and continue to actively participate in the CitizenGO campaigns be-
cause only our persistent commitment can make it clear to those in power that, unlike
now, we are really very active following what they will do after the elections.
So go to the polls on Sunday, January 5th.
Greetings,
Here you can read my email on this topic that I sent you earlier:
The presidential elections are on the door. You know For whom are you going to vote?
CitizenGo ask for a statement to the presidential candidates whether they will preserve
and represent our values in the exercise of Presidential duty.
We invite you to sign and share the additional letter we sent them to be as convincing as
possible in your message that we will give the vote only those who will defend our inter-
ests and our values at the forefront of the Republic Of Croatia
Signatures
Good morning
Elections for the President of the Republic of Croatia in front of us. The first round of the
elections will take place 22 December 2019.
Although limited by excellent power, the role of the President of the Republic is very
important as a guarantor of the constitutional legal order, in the Foreign Policy Plan and
as a key morality the leadership of the country.
That is why CitizenGO has prepared a statement for the presidential candidates who
want to represent us. We ask them to indicate whether they will preserve and represent
our values in the exercise of the presidential duty.
Candidates may comment on our inquiry by 19 December 2019, after which we will in-
form all signatories of this declaration about the candidate for President/President of the
Republic of Croatia’s replies. If you wish to find out the candidate’s answers, please sign
the petition by clicking here:
I want a President to protect my values.
Sign and share an additional statement we send to candidates who say they share our
values.
By signing this declaration, you send a clear message that will give one vote only to the
candidate who will defend your values and interests:
Sign and ask the presidential candidates to speak!
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/12
Many changes are taking place at national level, but also in international politics, where
the fate of Croatia was so often decided in our past. The person to be elected President
of the Republic shall have an influence on these processes.
All signatories to this petition will be informed of which candidates replied to us.
If they want us to vote, they have to assume some obligations towards us.
Thank you for not giving up and striving for the good of Croatia,’
FOURTH: On 25 June 2020, pursuant to Article 64 (3) of Organic Law 3/2018 of 5
December on the Protection of Personal Data and Guarantee of Digital Rights
(LOPDGDD), the complaint lodged by the complainant was declared admissible.
FIFTH: The General Subdirectorate for Data Inspection carried out preliminary
investigations to clarify the facts in question, in accordance with the tasks assigned to
the supervisory authorities in Article 57 (1) and the powers conferred on them in Article
58 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter
GDPR), and in accordance with Title VII, Chapter I, Section Two, of the LOPDGDD, and
was aware of the following:
In response to a request for information from this Agency, on 21 July 2020 CitizenGo
stated that:
The account holder details were entered in their database after an
email alert from the CitizenGO Foundation in Croatia was signed on 30 December 2019
at https://citizengo.org/hr/176171-koje-mjere-planiratepoduzeti-kako-biste-sprijecili-
daljnjezagadenje-rijeke-zrmanje-i. They provide screenshots of the email programme
showing the signature of the campaign.
As proof of the complainant’s consent to receive information about other campaigns from
the CitizenGO Foundation, they enclosed a screenshot of the email program containing
the data that the complainant entered in the signature form:
• Name:
• Surname:
• Email:
• Country: Croatia
• Postal code:
As indicated by the representatives of the entity in the screenshot, the IP of the person
who filled in the signature form appears. However, the documentation provided does not
show this information.
With regard to the procedure followed to obtain consent for receiving emails relating to
campaigns other than the one being signed, the representatives of the organisation
stated that it was necessary to take the positive action to tick the acceptance box.
If this box is not ticked, the user will not receive more mails from CitizenGO. There has
been no change in the consent request process. The screenshot provided contains the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/12
columns ‘subscribe (E-mail list subscription status)’ and ‘gdpr_agreement’ appearing
with a ‘1’, indicating that at the time of signing the request referred to above, the signatory
expressly agreed to receive emails from CitizenGO. Specifically, this is the text
appearing on the signature form, following a “radio button” button which he expressly
ticked:
‘Želim znati hoće li OVA peticija uspjeti i kako mogu uežati druge peticije.’
The Spanish translation of that text is as follows:
‘I want to know if this petition wins and how I can help other citizens’ petitions.’
Below this text it appears:
‘Ne Želim primati novosti niti o ovoj peticiji niti o drugim kampanjama’
The translation of that text is as follows:
‘I don’t want to receive news about this petition or other campaigns’
On the other hand, next to this button and the signature button, they include the following
text, linked to their privacy policy and their rules of use; ‘Vaše podatke obra, ujemo u
skladu s našim Pravilima o privatnosti i uvjetima korištenja.’ The english translation of
that text is as follows:
‘We process your personal data in accordance with our Privacy Policy and Rules of Use.’
The complainant withdrew his subscription on 11 January 2020 at 8:54 pm, as shown in
the screenshot of the marketing programme.
The email cited by the complainant was sent during the election campaign in Croatia and
provided information on the content of competing party programmes and the special
circumstances of the elections in that country.
The above mentioned email was sent to all those who had signed alerts on the Croatian
website up to that date and who had confirmed that they wished to receive information
on how to help other citizens’ campaigns.
SIXTH: On 25 June 2021, a proposal for a draft decision to discontinue proceedings was
signed, which was shared with the concerned authorities on 30 June 2021, and the
concerned authorities were informed that they had four weeks from that time to comment
on the matter. Within the deadline given for this purpose, the Portuguese supervisory
authority commented that the consent given by the data subjects is not specific, in so far
as it implies that, even if the data subjects only want to know what is happening with the
request they have signed, they will always have to agree to receive all alerts from other
requests as well. Therefore, in order to have a real choice, consents must be
autonomous.
SEVENTH: On 12 August 2021, the Director of the AEPD declared the proceedings time-
barred because more than 12 months had elapsed since the date on which the complaint
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
6/12
was declared admissible, and as the infringement was not time-barred, new investigative
files were opened under number E/08405/2021, and the documentation contained in
E/05432/2020 was added to these.
EIGHTH: On 19 April 2022, a measure was taken to include to the file screenshots of:
- The procedure to be followed to sign a campaign on the website
“https://citizengo.org/hazteoir” in Spain, where a box was observed without
ticking the following message, when selecting Spain as the country of the person
signing: “I want to know if this petition wins and how I can help other citizens’
petitions.”
- The procedure to be followed to sign a campaign on the Croatian website
“https://citizengo.org/hr”, where a box was observed without ticking the following
message, when selecting Croatia (Hrvatska) as the country of the person signing:
“Želim znati hoće li OVA peticija uspjeti i kako mogu uežati druge peticije”.
NINTH: On 25 May 2022, the Director of the AEPD adopted a proposal for a draft
decision initiating penalty proceedings. Following the process set out in Article 60 of the
GDPR, this draft decision proposal was transmitted via IMI on 9 June 2022 as an informal
consultation and informed the authorities concerned that they had four weeks from that
point in time to comment.
TENTH: On 18 July 2022, the Director of the AEPD adopted a draft decision to initiate
penalty proceedings. Following the process set out in Article 60 GDPR, this draft decision
was transmitted via IMI on 22 July 2022 and the authorities concerned were informed
that they had four weeks from that moment to raise relevant and reasoned objections.
Within the deadline for that purpose, the supervisory authorities concerned did not raise
any relevant and reasoned objections to it, and therefore all the authorities were deemed
to agree with and were bound by that draft decision, in accordance with Article 60(6) of
the GDPR.
This draft decision was notified to CITIZENGO in accordance with the rules laid down in
Law 39/2015 of 1 October 2015 on the Common Administrative Procedure of Public
Administrations (LPACAP) on 26 July 2022, as stated in the acknowledgement of receipt
in the file.
ELEVENTH: On 26 October 2022 the Director of the Spanish Data Protection Agency
decided to initiate penalty proceedings against CITIZENGO in order to impose a fine of
5,000 EUR, in accordance with Articles 63 and 64 of the Spanish LPACAP, for the
alleged infringement of Article 7 of the GDPR, as defined in Article 83 (5) of the GDPR,
in which it was informed that it had a period of ten days to submit allegations.
This agreement, which was notified in accordance with the rules laid down in the
LPACAP by electronic notification, was collected by CITIZENGO on 29 June 2023, in
accordance with the Spanish Law 39/2015 of 1 October on the Common Administrative
Procedure of Public Administrations (LPACAP), as stated in the acknowledgement of
receipt contained in the file.
TWELFTH: On 14 November 2022, CITIZENGO paid the penalty.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
7/12
The payment made entails the waiver of any action or appeal against the final decision,
in relation to the facts referred to in the agreement to initiate penalty proceedings.
LEGAL GROUNDS
I
Competence
In accordance with Articles 58.2 and 60 of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data
(GDPR), and in accordance with Articles 47, 48.1, 64.2, 68.1 and 68.2 of Organic Law
3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights
(hereinafter LOPDGDD), the Director of the Spanish Data Protection Agency is
responsible for initiating and finalizing this procedure.
In addition, Article 63(2) of the LOPDGDD provides that: ‘The procedures handled by the
Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU)
2016/679, of this organic law, by the regulatory provisions dictated in their development
and, insofar as they are not contradicted, alternatively, by the general rules on
administrative procedures’.
II
Preliminary remarks
In the present case, in accordance with Article 4 (1) and (4.2) of the GDPR, there is a
processing of personal data, since CITIZENGO collects, inter alia, the following personal
data of natural persons: first name, surname, country and e-mail, including other
processing.
CITIZENGO carries out this activity in its capacity as controller, as it determines the
purposes and means of that activity, pursuant to Article 4 (7) GDPR. In addition, this is
a cross-border processing, given that CITIZENGO is established in Spain, although it
serves the whole of the European Union.
The GDPR provides, in Article 56 (1), for cases of cross-border processing, as provided
for in Article 4 (23), in relation to the competence of the lead supervisory authority, that,
without prejudice to Article 55, the supervisory authority of the main establishment or the
single establishment of the controller or processor shall be competent to act as lead
supervisory authority for the cross-border processing carried out by that controller or
processor in accordance with the procedure set out in Article 60. In the case under
consideration, as explained above, CitizenGo has its sole establishment in Spain, so the
Spanish Data Protection Agency is competent to act as the lead supervisory authority.
Article 6 of the GDPR governs the lawfulness of the processing of personal data. And, in
particular, the conditions for consent are detailed in Article 7 GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
8/12
III
Lawfulness of the processing
Article 6(1) ‘lawfulness of processing’ of the GDPR provides:
‘1. Processing shall be lawful only if and to the extent that at least one of the following
applies:
(a) the data subject has given consent to the processing of his or her personal data for
one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject
is party or in order to take steps at the request of the data subject prior to entering into a
contract;
(c) processing is necessary for compliance with a legal obligation to which the controller
is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of
another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require protection of
personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.’
In the present case, the processing of the data subjects’ personal data collected on
CitizenGo’s website was not covered by any possible legal basis other than consent.
IV
Consent of the data subject
Article 4 (11) GDPR defines the data subject’s consent as ‘any freely given, specific,
informed and unambiguous indication of the data subject's wishes by which he or she,
by a statement or by a clear affirmative action, signifies agreement to the processing of
personal data relating to him or her’.
In this regard, Article 6 (1) of the Spanish LOPDGDD provides that ‘In accordance with
the provisions of article 4.11 of Regulation (EU) 2016/679, consent of the data subject
shall be understood as any freely given, specific, informed and unambiguous indication
through which they agree, by means of a declaration or a clear affirmative action, to the
processing of personal data relating to them’.
Article 7 of the GDPR, ‘Conditions for consent’, provides:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
9/12
‘1. Where processing is based on consent, the controller shall be able to demonstrate
that the data subject has consented to processing of his or her personal data.
2. If the data subject's consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible
form, using clear and plain language. Any part of such a declaration which constitutes
an infringement of this Regulation shall not be binding.
3. (...).
4. (...)”.
In the present case, it is common ground that the consent given by the complainant is
not specific to the signed petition, in so far as it implies that, even if the data subject
merely wishes to know what is happening with the petition he/she has signed, he/she
will always have to agree to receive all alerts from other petitions as well.
The consent thus given does not comply with the requirements of Article 7 GDPR, as it
is not a free, specific and distinguishable consent from other matters, in so far as to
receive information about the signed request, he/she consents to receive information
from other requests.
It has also been established, by means of a document included in the procedure on 19
April 2022, that the conditions under which consent is given when entering CITIZENGO’S
website have not been altered.
Therefore, in accordance with the evidence available at this stage, it is considered that
known facts constitute an infringement, attributable to CITIZENGO, of Article 7 of the
GDPR.
V
Classification of the infringement of Article 7 GDPR
The known facts constitute an infringement, attributable to CITIZENGO, as defined in
Article 83 (5) of the GDPR, which, under the heading ‘General conditions for the
imposition of administrative fines’, provides:
‘Infringements of the following provisions shall, in accordance with paragraph 2, be
subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking,
up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher:
(...)
(a) the basic principles for processing, including conditions for consent, pursuant
to Articles 5, 6, 7 and 9; (…)’
In this regard, Article 71 (‘Infringements’) of the LOPDGDD states that ‘The actions and
behaviours referred to in sections 4, 5 and 6 of Regulation (EU) 2016/679, as well as
those which are contrary to this organic law, shall constitute infringements’.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
10/12
For the purposes of the limitation period, Article 72 ‘Infringements deemed to be very
serious’ of the Spanish LOPDGDD states:
“1. In accordance with article 83.5 of Regulation (EU) 2016/679, any infringement
consisting on a substantial infringement of the provisions mentioned therein, especially
the ones listed below, shall be considered very serious infringements and its limitation
period shall be three years:
(...)
(b) failure to comply with the requirements of Article 7 of Regulation (EU)
2016/679’
VI
Sanction for infringement of Article 7 GDPR
This infringement may be fined up to 20.000.000 EUR or, in the case of an undertaking,
up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher, in accordance with Article 83 (5) of the GDPR.
The amount of the administrative fine, has been graduated the sanction in accordance
with the following criteria established in Article 83.2 of the RGPD:
As aggravating factors:
- The nature, gravity and duration of the infringement, taking into account the
nature, scope or purpose of the processing operation concerned as well as the number
of data subjects concerned and the level of damage suffered by them (paragraph (a)):
this is due to the invalid collection of consent from at least 17.118.674 users (active
citizens), which is the number of users (and potential affected) of the platform, in
accordance with the diligence entered in the file on 19 April 2022, at least since 3 January
2020, as the clause for obtaining consent has not been amended.
- Negligence in the infringement (paragraph b): CitizenGo has been negligent in
assessing whether the consent thus collected was valid, in particular since even when it
replied to the Agency’s request it did not carry out an assessment of that consent under
conditions.
As a mitigating factor:
- Any action taken by the controller or processor to mitigate the damage suffered
by data subjects (paragraph c): CitizenGo deleted the complainant’s data after
receiving the complainant’s request.
The balance of the circumstances referred to in Article 83 (2) of the GDPR with regard
to the infringement committed in breach of Article 7 of the GDPR makes it possible to
impose a penalty of 5,000 EUR (five thousand euros).
VII
Termination of proceedings
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
11/12
Article 85 of Spanish Law 39/2015 of 1 October 2015 on the Common Administrative
Procedure of Public Administrations (LPACAP), entitled ‘Termination in penalty
proceedings’, provides:
‘1. If the offender recognises his or her responsibility, the proceedings may be resolved
by imposing the appropriate penalty.
2. Where the penalty is of a purely financial nature or where a financial penalty and a
non-pecuniary penalty may be imposed, but the latter is justified, voluntary payment by
the alleged person, at any time prior to the decision, shall entail the termination of the
proceedings, except as regards the restoration of the altered situation or the
determination of compensation for the damage caused by the infringement. (…)’
VIII
Imposition of measures
In the Agreement to initiate penalty proceedings of the Director of the Spanish Data
Protection Agency it was decided it could be agreed to impose the controller the adoption
of appropriate measures to adjust its action to the regulations mentioned in this act, in
accordance with the provisions of the aforementioned Article 58.2 (d) of the GDPR,
according to which each supervisory authority may ‘order the controller or processor to
bring processing operations into compliance with the provisions of this Regulation, where
appropriate, in a specified manner and within a specified period…’
The imposition of this measure is compatible with the penalty consisting of an
administrative fine, as provided for in Article 83.2 GDPR.
Having received a letter by which FUNDACIÓN CITIZENGO informs that it has taken the
necessary measures so that the decisive facts of the infringement committed do not
reoccur, this Agency acknowledges receipt of it, without this declaration implying any
pronouncement on the regularity or legality of the measures adopted.
We draw attention to the provisions of Article 5.2 of the GDPR, which establishes the
principle of proactive responsibility when it states that ‘The controller shall be responsible
for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).’ This
principle refers to the obligation that falls on the controller not only to design, implement
and observe the appropriate legal, technical and organizational measures so that the
processing of data is in accordance with the regulations, but to remain actively attentive
throughout the entire life cycle of the processing so that compliance is correct, being also
able to demonstrate it.
According to the above,
the Director of the Spanish Agency for Data Protection DECIDES TO:
FIRST: DECLARE the termination of proceeding PS/00184/2022 in accordance with
Article 85 of the LPACAP.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
12/12
SECOND: NOTIFY this decision to FOUNDACIÓN CITIZENGO.
In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be
made public once it has been notified to the interested parties.
Against this decision, which terminates the administrative procedure in accordance with
the provisions of Article 114.1 (c) of Law 39/2015 of 1 October on the Common
Administrative Procedure of Public Administrations, interested parties may lodge an
administrative appeal with the Administrative Appeals Chamber of the National High
Court, in accordance with Article 25 and paragraph 5 of the fourth additional provision of
Law 29/1998 of 13 July governing the administrative courts, within two months from the
day following notification of this act, in accordance with Article 46 (1) of that Law.
1219-181022
Mar España Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es