The Spanish Data Protection Agency terminates the sanctioning regime of the LOPD, and fully enters into the million-dollar sanctions of the RGPD
In effect, to date the SPANISH DATA PROTECTION AGENCY had been characterized by having a serious and coherent sanctioning policy, with the framework established by the LORTAD in its day and lately with the LOPD, with a range of amounts of certain relation in Regarding type of infraction, mitigating, aggravating circumstances and other modifying circumstances of administrative responsibility (with some exceptions, of course):
With surprise for locals and foreigners, in recent weeks various sanctioning resolutions of especially striking amounts have been published, (BBVA PS / 70/2019 case and Caixa Bank PS / 477/2019 case), which establish millionaire sanctions for both serious infractions, and what is more surprising, for mild in the exposed cases.
It is a clear change in the line of argument in the correction of behaviors and of course of administrative precedent. Therefore, canceling any guiding criteria prior to the RGPD regarding the amount of sanctions.
In the words of the control body itself â€... It is useless to argue that the LOPD provided sanctions for lower amounts.... The truth is that, in this aspect, as in many others, the RGPD has meant a paradigm shift in the protection of personal data, establishing measures with a clear deterrent nature. It is enough to examine the sanctions that other European countries have recently imposed on this matter, which are public, to understand the scope of the change that the application of the RGPD entails ... "
It is clear that the European framework, as well as the new legal capacities, opened the door to the new sanctioning regime.
The sanctions mentioned are of an extraordinary volume (5 million and 6 million euros) compared to the precedents linked to the old LOPD, but absolutely consistent with the actions that other control authorities are taking in Europe. It should be noted that these are extensive, meticulous administrative resolutions and undoubtedly very elaborate technically, as is the custom of the AEPD (146 pages one and 177 the other...).
The question that arises in the sector is whether the more than foreseeable judicial remedies that the entities sanctioned today will bring will prosper, and if so, to what extent.
In effect, the subjective element of the sanction takes into account the devaluation of the shares and the benefit obtained directly from the illegal sanction, the lack of structure, etc. We are sure that the appellants will argue about the administrative precedent of the amounts for similar offenses established in the LOPD, the possible mitigations of the old article 45.5 of the LOPD (today 83.2 of the RGPD), but as it seems to be deduced from the resolution, it will be of little use if the only line of defense to challenge the amount of the proposed sanction is the application of precedents of a repealed rule for this factual assumption such as the LOPD.
In any case, we assume that sooner or later, we will have a more than foreseeable contentious administrative appeal filed by the parties, we have no doubt that the judicial resolution of the Contentious Chamber of the National Court, which is the body competent to know this type of resources, it will be worthy of study, since it will mark a line of action in the matter of application of graduation of sanctions of the RGPD, either by validating and ratifying the performance of the AEPD and its new millionaire sanctioning framework or by on the contrary, it will “soften†amounts, qualifying any element that could change the sign of the contested resolution, adjusting amounts and interpretations to more classical positions and close to the old LOPD.
We will see it in a while, we will be waiting and we will keep you informed.
Greetings.