Ramona Films, S.L. – €8,000 Fine (Spain, 2022)

The Spanish DPA (AEPD) initiated proceedings exercising its investigation powers under Article 58 GDPR against Ramona Films S.L. (previously Kalandrakas Films S.L.), owner of https://www.putalocura.com, a website containing adult and pornographic material. The investigation was related to the possible processing of personal data and profiling of data subjects below the age of 14. In particular, the AEPD inquired the controller regarding the risk of processing activities that could take place if a minor gained unauthorised access to the website’s contents, a data protection impact assessment related to these risks, the technical and organisational measures implemented to ensure data protection, as well as its privacy policy. In its investigation, the AEPD determined that the page contained a warning that the website contained adult material, and to abandon the website in case of being a minor. However, the AEPD found that the website did not have a mechanism that permitted the rejection of non-essential cookies, or a second layer to allow the granular acceptance of specific cookies. Additionally, the AEPD also found that when accessing the website, the use of non-essential cookies took place without prior consent, and that there was insufficient information related to the nature of the cookies, and if any of them were third party cookies. The AEPD held that the website’s cookie policy violated Article 22.2 of the [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758 Spanish Law of Information Society Services (LSSI)], which establishes that clear and complete information on the use of cookies and the purposes of the data processing must be provided to data subjects, and that where the use of a cookie entails processing that makes it possible to identify the user, data controllers must provide users with information in compliance with the provisions of the GDPR. Furthermore, the AEPD found that the website’s privacy policy referred to the previous data protection laws in Spain, which were derogated when the GDPR entered into force. Therefore, the AEPD held that the website did not provide users with adequate data protection information, in violation of Article 13 GDPR. Based on these considerations, the AEPD issued a total fine of €10,000 on the controller, €5000 for the violation of Article 22.2 LSSI and €5000 for the violation of Article 13 GDPR. However, this fine was reduced to €8000 because the controller did not object to the fine and paid it voluntarily within the period established by the AEPD to do so, although the reduction of the fee paid for by the controller did not include an express acceptance of culpability regarding the violations held by the AEPD. The AEPD also ordered the controller to modify its privacy and cookie policy in order to comply with GDPR.