Ramona Films, S.L. – €8,000 Fine (Spain, 2022)

The Spanish DPA (AEPD) initiated proceedings exercising its investigation powers under Article 58 GDPR against Ramona Films S.L. (previously Kalandrakas Films S.L.), owner of https://www.putalocura.com, a website containing adult and pornographic material. The investigation was related to the possible processing of personal data and profiling of data subjects below the age of 14. In particular, the AEPD inquired the controller regarding the risk of processing activities that could take place if a minor gained unauthorised access to the website’s contents, a data protection impact assessment related to these risks, the technical and organisational measures implemented to ensure data protection, as well as its privacy policy. In its investigation, the AEPD determined that the page contained a warning that the website contained adult material, and to abandon the website in case of being a minor. However, the AEPD found that the website did not have a mechanism that permitted the rejection of non-essential cookies, or a second layer to allow the granular acceptance of specific cookies. Additionally, the AEPD also found that when accessing the website, the use of non-essential cookies took place without prior consent, and that there was insufficient information related to the nature of the cookies, and if any of them were third party cookies. The AEPD held that the website’s cookie policy violated Article 22.2 of the [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758 Spanish Law of Information Society Services (LSSI)], which establishes that clear and complete information on the use of cookies and the purposes of the data processing must be provided to data subjects, and that where the use of a cookie entails processing that makes it possible to identify the user, data controllers must provide users with information in compliance with the provisions of the GDPR. Furthermore, the AEPD found that the website’s privacy policy referred to the previous data protection l