RODALI GESTIÓN INMOBILIARIA, S.L – €5,000 Fine (Spain, 2022)

The data subject purchased property from Rodali Gestión Inmobiliaria (controller), a real estate agency. She signed a contract to make a reservation of the property. This document included her personal data. The contract neither included a clause nor was the data subject otherwise informed on how her personal data would be processed. When the data subject discovered this, she filed a complaint with the DPA. The DPA tried to notify the controller about both the complaint and the start of a sanctioning procedure for the alleged infringement of Article 13 GDPR, but was unsuccesful. The notifications were repeatedly rejected and returned. The DPA noted that when a controller obtains personal data, it must provide the data subject with all information regarding their processing activities pursuant to Article 13 GDPR. In the present case, the controller omitted this obligation. The DPA therefore held that the controller violated Article 13 GDPR by neither informing the data subject nor including any clause about the processing of personal data in the contract. The DPA found that since the main activity of the controller was direcltly linked to the processing of personal data, the controller was required to have a higher level of rigorousness, professionalism and, consequently, responsibility regarding the processing. Because of this aggravating circumstance, the DPA imposed a fine of €5.000. The DPA further ordered the controller to bring its operations into compliance with Article 13 GDPR and thus making sure to inform its clients about the processing of their data.