This lesson explains who is responsible if the rules are broken, what the AEPD can do, what penalties exist and what role the data protection officer has.
The Spanish Data Protection Agency
The AEPD is Spain's independent supervisory authority. Under article 58 of the GDPR and the LOPDGDD, it can, among other things:
- investigate and ask for information or access to premises and equipment
- warn and reprimand those who break the rules
- order that people's rights be honoured or that processing be brought into line with the rules
- restrict or ban processing
- impose administrative fines
It also handles complaints from the people affected. Unlike in some other countries, the AEPD does impose fines directly. It does not fine public administrations, however: it issues a decision declaring the infringement and setting the measures to put it right (article 77 of the LOPDGDD).
Fines
Article 83 of the GDPR sets two levels:
- up to 10 million euros or 2 % of total worldwide annual turnover of the previous financial year, whichever is higher, for infringements such as not applying security measures, not notifying a breach or not complying with the obligations of processors
- up to 20 million euros or 4 % of that turnover, whichever is higher, for infringements of the basic principles, of the bases for processing or of people's rights
The fine must be effective, proportionate and dissuasive. The AEPD takes into account factors such as seriousness, duration, intent or negligence, the measures taken and cooperation with it.
Infringements and limitation periods
The LOPDGDD classifies infringements in three grades (articles 72 to 74):
- very serious: for example, processing data without a valid lawful basis. They lapse after three years
- serious: for example, not applying adequate security measures, not notifying a breach or processing the data of a child under 14 without the consent of the holder of parental authority. They lapse after two years
- minor: for example, not giving all the information required to people. They lapse after one year
The penalties imposed also lapse (article 78): after one year for those up to 40,000 euros, after two years for those from 40,001 to 300,000 euros and after three years for those over 300,000 euros.
And what about me, as an employee?
The AEPD's fine normally falls on the company, which is the controller. But that does not mean you answer for nothing:
- If you break the instructions or reveal data without permission, the company can take disciplinary measures against you, including dismissal, for breach of contractual good faith and abuse of trust (article 54 of the Estatuto de los Trabajadores).
- Accessing confidential data without authorisation or spreading it may amount to the crime of discovering and revealing secrets (articles 197 and following of the Código Penal, the Criminal Code).
- The people affected can claim compensation for the damage they have suffered (article 82 of the GDPR).
The data protection officer (DPO)
The DPO advises the company, monitors compliance, cooperates with the AEPD and deals with the people affected. The DPO must act with independence and cannot be penalised or dismissed for performing their duties (article 38 of the GDPR).
A DPO is mandatory for public authorities and bodies, and for organisations whose core activity consists of regular and systematic monitoring of people on a large scale or of processing special categories of data on a large scale (article 37 of the GDPR). Article 34 of the LOPDGDD also lists other cases, such as professional associations, educational centres, insurance companies or sports federations that process data about minors. Their contact details are published and communicated to the AEPD: the designation, appointment and removal are notified to the Agency within ten days. If your company has a DPO, you can go to them with your questions.
What the company must keep doing
This course is general training. The company must also keep the record of processing activities (article 30 of the GDPR), inform staff about how it processes their data, have internal protocols for rights and breaches, give written instructions suited to each job and make it easy to contact the DPO, if there is one.
Remember: complying with the rules is a task for everyone in the company. The rules exist to protect people, and that includes you.