Madrileña Red De Gas, S.A.U. – Court Ruling (Spain, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Spanish court overturned a fine against a gas company because the alleged data violation occurred before GDPR took effect. The court ruled that applying GDPR retroactively violated the Spanish Constitution's non-retroactivity principle. This decision clarifies that GDPR cannot be applied to actions before its enforcement date.
What happened
A Spanish court annulled a fine against a gas company because the alleged violation happened before GDPR was enforceable.
Who was affected
The gas distribution company that was initially fined by the Spanish data protection authority.
What the authority found
The court ruled that GDPR was applied retroactively, violating the constitutional principle of non-retroactivity, and annulled the fine.
Why this matters
This ruling underscores that GDPR cannot be applied to actions before its enforcement date, providing clarity on the regulation's temporal scope. Companies should be aware of the applicable laws at the time of any alleged data violations.
National Law Articles
A gas distribution company appealed the decision PS/00188/2019 of the Spanish DPA (AEPD) for considering that it was against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution], as the the Spanish DPA fined the controller in accordance with the GDPR, and the alleged infringement had occurred in April 2018, before the GDPR came into effect. Therefore, GDPR should not had applied. The Spanish National High Court (AN) analysed Recital 171 GDPR and noted that the Regulation had entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016, However, the Regulation only became directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, therefore providing, the Member States and their respective Supervisory Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the [https://www.boe.es/buscar/act.php?id=BOE-A-1999-23750 former Spanish Data Protection Act] were fully valid and applicable to the case at hand at the time of the infringement, while the AEPD applied the GDPR to the case. The AN held that the GDPR was not applicable when the alleged infringement happened, in April 2018, and that it had been retroactively applied by the AEPD, what goes against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution]. The Court further clarified that the GDPR only could have been applicable if it had been more favourable to the infringer than the law that was in effect at the moment. Consequently, the AN upheld the appeal and annulled the sanction imposed by the AEPD on the controller, ordering the refund of the amount of t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Madrileña Red De Gas, S.A.U. in ES
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Madrileña Red De Gas, S.A.U. - Spain (2021). Retrieved from cookiefines.eu
Last updated: