EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. – €3,000 Fine (Spain, 2025)

The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U. On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technicalThe Spanish DPA uses the expression "technical cookies" in reference to all cookies that fall under either of the two exemptions of Article 5(3) ePrivacy Directive. In other words: technical cookies are needed to make the communication possible over the network, or (more likely) are strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. and unnecessary cookies without the user's prior consent. The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required. The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent. The DPA found a breach of the national ePrivacy implementation law (LSSI)Law 34/2002, of July 11, on information society services and electronic commerce (Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico). [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a22 Article 22.2 LSSI] on the installation of cookies before the user's consent. The exemptions under this Article apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents. The DPA decided this infraction was minor based on Article [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a38 38(4)(g) LSSI]. According to the criteria of [https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758#a40 Article 40 LSSI], the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence. The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3,000.