Birou Gas, S.L – €48,000 Fine (Spain, 2023)

The DPA received a complaint against the controller Birou Gas S.L, following which the DPA requested information from the controller as part of the investigation process. Two initial requests were answered by the controller within the 10 working day deadline. However, the controller did not respond to two later requests for information, received on 1 and 2 February 2023. The DPA initiated fine procedures on 10 April 2023 for the controller’s infringement of Article 58(1) GDPR in failing to respond to the requests for information. The controller subsequently requested suspension of the proposed fine because the person in charge of downloading the requests for information had been dismissed during this time, which was why the requests were misplaced by the controller. The controller also argued that the fine should be calculated according to the annual turnover of the company authorised by the controller to be the signatory to the contract agreed with the initial complainant. The DPA found that the controller had violated Article 58(1) GDPR in failing to respond to the requests for information. The DPA did not accept the controller’s arguments regarding the dismissal of the person in charge of downloading the notifications, as receipts were available showing the controller had accepted the notifications on 2 February 2023. The fact the controller had previously responded to requests for information was also not relevant to the current fine procedure. Additionally, the DPA did not accept the controller’s argument that the fine recipient should be the contract signatory, as the requests for information were sent to the controller. The DPA took the following factors into account when issuing an administrative fine of €48,000 to the controller (Article 83(2)(b) GDPR): - the controller was aware of the DPA’s actions to clarify the facts by receiving successive requests and requirements for information but intentionally or negligently omitted the information required; and - the controller had been active since 2014, together with an annual turnover of approximately €50,000,000, so it should have established procedures for compliance with data protection regulation obligations (including responding to DPA requests via a reliable procedure that ensured requests were answered). The DPA also applied a further aggravating factor by considering the financial benefits obtained or the losses avoided from the infringement (Article 83(2)(k) GDPR). The controller’s lack of response hindered the DPA's work of supervising the guarantees of the personal data processing of new clients on behalf of the controller by third parties, and which the controller used to obtain new income. A fine of €60,000 was originally ordered, but reduced by 20% to €48,000 following the controller’s voluntary agreement to pay the fine.