Alvea Soluciones Tecnológicas, S.L – €21,000 Fine (Spain, 2025)

On 7 October 2024,  a data subject filed a complaint to the  DPA  against Alvea Soluciones Tecnológicas, S.L. (the controller). They alleged that the controller sent an email to candidates for a job offer (data subjects) requesting the processing of their data. Further, such an email included a link to a Google form indicating the disclosure of the data subjects’ personal data by transmission of the controller to third companies that work with it (processors). The form entailed a spreadsheet with the name and ID of data subjects who had denied the processing of their data. Lastly, that spreadsheet could be accessed by anyone with the form’s URL. On 17 October 2024, the DPA  requested information on the measures taken by the controller to comply with the GDPR. In response, the controller admitted an administrative error, claiming that a new technician included both internal and external links in the email sent to the data subject, instead of just the external one. Furthermore, the controller has implemented several measures to address the error. Three measures were crucial for the development of the complaint. First, analysing the need for a Data Protection Officer (DPO), which led to the controller appointing one. Second, restricting access to the internal link, deactivating it. Third, proving that only the controller’s authorized members could open the internal link. On 23 October 2024, the controller informed the data subjects about the error in the previous email and requested its deletion. On 15 November 2024, the complaint was allowed to proceed. First, the DPA held that the controller had violated Article 5(1)(f)GDPR.  The controller had enabled access to an internal spreadsheet containing candidates' personal data and had transmitted its link without any limitations or control. Therefore, under Articles 83(5)(a)GDPR and [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a7-3 71 Organic Law on Protection of Personal Data and Guarantee of Digital Rights 3/2018 (“LOPDGDD”)], the DPA  imposed an administrative fine on the controller because of the lack of confidentiality and integrity in processing personal data. Secondly, the DPA  set three criteria to determine the fine amount.  First, the access to personal data of 10.837 people, and the potential damage to all data subjects included in the controller’s internal list (Article 83(2)(a)GDPR). Second, the controller’s negligence in ensuring confidentiality in the processing of personal data (Article 83(2)(b)GDPR). Third, an aggravating factor regarding the necessity of a careful processing of personal data by the controller, considering its business purpose and volume (Articles 83(2)(k)GDPR and [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673#a7-8 76(2)(b) LOPDGDD]). The fine was initially set at €35,000, but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €21,000, based on [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10565#a85 Article 85(3) Law 39/2015]. Finally, the DPA  held that the controller should adopt two measures. One concerns the implementation of measures to prevent emails and other client communications from granting access to third-party data. Another consists of obtaining a DPO assessment of deployed controls.