RAMONA FILMS, S.L. – €60,000 Fine (Spain, 2026)

RAMONA FILMS, S.L., the controller, operated websites offering audiovisual content through subscriptions. In November 2023, the DPA fined the controller in proceedings [https://www.aepd.es/documento/ps-00308-2023.pdf PS-00308-2023] for several GDPR infringements, including a breach of Article 28(3) GDPR concerning the absence of a data processing agreement with a payment service provider, the processor. The DPA also ordered the controller, pursuant to Article 58(2)(d) GDPR, to provide within one month the processor agreement concluded with the processor. In December 2023, instead of providing the requested agreement, the controller informed the DPA that the two companies should be considered joint controllers. Following an investigation, the controller provided an unsigned and undated purported joint controller agreement. It subsequently acknowledged that this agreement had never been signed. The controller also stated that it had terminated its relationship with the processor and discontinued its subscription service. However, it was unable to provide evidence of the termination and the DPA found that subscriptions continued to be available through the website and redirected users to the processor's payment service. The controller argued that it had complied with the measures imposed and requested the closure of the proceedings. The DPA found that the controller had infringed Article 58(2) GDPR by failing to comply with the corrective order issued in the previous proceedings. The DPA held that the controller had neither concluded the processor agreement required by the previous decision nor demonstrated that its relationship with the processor had instead been validly established as joint controllership under Article 26 GDPR. In particular, the purported joint controller agreement was unsigned and undated, and the controller ultimately acknowledged that it had never been concluded. The DPA also rejected the controller's arguments that the relationship with the processor and the subscription service had been terminated. It considered that the controller had provided contradictory information throughout the investigation and had failed to substantiate these claims. Consequently, the DPA found that the corrective measure imposed under Article 58(2)(d) GDPR remained unfulfilled. When determining the fine, the DPA considered, inter alia, the duration and intentional nature of the infringement, the fact that the processing involved identification and payment data, the close connection between the controller's activity and personal data processing, and the fact that the previous €40,000 fine for the Article 28(3) GDPR infringement had not achieved sufficient deterrent effect. The DPA therefore imposed a €60,000 fine for the infringement of Article 58(2) GDPR, pursuant to Article 83(6) GDPR.