Birou Gas, S.L – €48,000 Fine (Spain, 2023)

The DPA received a complaint against the controller Birou Gas S.L, following which the DPA requested information from the controller as part of the investigation process. Two initial requests were answered by the controller within the 10 working day deadline. However, the controller did not respond to two later requests for information, received on 1 and 2 February 2023. The DPA initiated fine procedures on 10 April 2023 for the controller’s infringement of Article 58(1) GDPR in failing to respond to the requests for information. The controller subsequently requested suspension of the proposed fine because the person in charge of downloading the requests for information had been dismissed during this time, which was why the requests were misplaced by the controller. The controller also argued that the fine should be calculated according to the annual turnover of the company authorised by the controller to be the signatory to the contract agreed with the initial complainant. The DPA found that the controller had violated Article 58(1) GDPR in failing to respond to the requests for information. The DPA did not accept the controller’s arguments regarding the dismissal of the person in charge of downloading the notifications, as receipts were available showing the controller had accepted the notifications on 2 February 2023. The fact the controller had previously responded to requests for information was also not relevant to the current fine procedure. Additionally, the DPA did not accept the controller’s argument that the fine recipient should be the contract signatory, as the requests for information were sent to the controller. The DPA took the following factors into account when issuing an administrative fine of €48,000 to the controller (Article 83(2)(b) GDPR): - the controller was aware of the DPA’s actions to clarify the facts by receiving successive requests and requirements for information but intentionally or negligently omitted the information required;