GAVANOVA DE IMMOBLES, S.L. – €2,000 Fine (Spain, 2023)

The data subject is a former customer (tenant) of the controller (Gavanova de immobles, S.L.). On 29 July 2020 the data subject signed the reservation document for the property, then on 4 September 2020 the lease agreement / contract was signed. After approximately two years the lease was terminated on 31 January 2022. On 30 June 2022 the Spanish Data Protection Agency (AEPD) received a complaint from the data subject stating, that they didn’t feel that their data was protected by the controller. The data subject suspected that their personal data had been used to enter into a contract with a third party (a cleaning company) without their knowledge. When the data subject went on the real estate´s website, the Privacy Policy page was blank. The data subject also found out that the contract and lease resolution made between the two parties, contained data protection law which was not up to date with the current law. Following the complaint lodged by the data subject, the Spanish DPA accessed the website of the controller on 27 July 2022 and confirmed that the Privacy Policy section was in fact blank. As a result, the DPA asked the controller to explain themselves. The reason for that step was, that the controller could proceed with the analysis and inform the DPA within one month of actions carried out to adapt to the requirements set out in the data protection regulations. This was carried out in accordance with Spanish Public Administration Law (Common Administrative Procedure for Public Administrations) by electronic means. However, the controller did not take up the required steps and it was understood to have rejected them. Nevertheless, a copy was sent via post which was notified on 31 August 2022. In this notification, the controller was reminded to interact electronically and that from now on they would be notified exclusively by electronic means. The controller did not reply. On 20 September 2022 the complaint was admitted for processing. Shortly after,