ORGANIC AND NATUR 03, S.L – €4,000 Fine (Spain, 2020)

The Territorial Delegation of the Department of Health and Families of the Regional Government of Andalusia filed a complaint with the AEPD against ORGANIC AND NATUR 03 S.L. on the issue of a membership contract that incorporates pre-determined clauses regarding data protection, thus preventing effective negotiation and the express consent of the signatory client. In the aforementioned contract it was indicated that the client authorised the transfer of all his/her data for the purpose of managing the credit, as well as, to send him/her commercial offers. The fact that different data processing purposes were being accepted in the same clause without express consent for each one could mean a breach of the duty to inform the customer of the purposes of data processing. Are the failure to update the privacy policy and the failure to collect consent for each of the purposes of data processing infringements of Articles 13 GDPR and 7 GDPR respectively? To determine the amount of the penalty, the AEPD took into account three criteria in Article 83(2) GDPR: unintentional negligence (paragraph b); the categories of personal data affected by the infringement (paragraph g); and the way in which the AEPD became aware of the infringement, which was reported by the complainant (paragraph h). Account has also been taken of Article 76 (2) (b) LOPDGDD concerning the link between the activity of the offender and the processing of personal data. In view of the above, a penalty of € 4000 was set for the infringement of Article 13 GDPR and a warning sanction for the infringement of Article 7 GDPR.