AEPD fining procedures regarding cookies

#SomosRyC

18 de Noviembre de 2019

In terms of cookies, the Spanish Data Protection Agency (“AEPD”) has followed the provisions of the Spanish E-commerce Act[1], except in very few cases where it also decided to analyze the related privacy policy (as a result of the same claim) based on GDPR requirements.

The following is a summary of the main sanctions imposed in this area from 2015 to November 2019.

[1] Spanish E-commerce Act: Act 34/2002 of 11 July on Information Society Services and Electronic Commerce, transposes (i) Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market, (ii) Directive 98/27/EC of the European Parliament and of the Council of 19 May 1998 on injunctions for the protection of consumers' interests and (iii) Directive 2009/136/EC EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws.

Company /individual	Facts	Regulation and section(s) infringed	Penalty	Link
VUELING AIRLINES, S.A.	The webpage did not offer the user the possibility to withraw the given consent for the installation of cookies (save as otherwise provided through the options of the browser, which is not sufficient). In this sense, it did not offer a granular cookies-setting panel.	Art. 22.2[1] Spanish E-commerce Act	Initial proposed fine: 30.000€ Final fine: 18.000€ due to responsibility recognition and prompt payment.	https://www.aepd.es/resoluciones/PS-00300-2019_ORI.pdf [1]
TELEFONICA MOVILES ESPAÑA, S.A.U.	TELEFONICA used "super cookies" when accessing the mobile network from terminals, without duly informing the user and without his or her consent.	Art. 22.2 Spanish E-commerce Act	20.000 €	https://www.aepd.es/resoluciones/PS-00005-2016_REC.pdf [2]
BANKINTER, S.A.	The installation of cookies from the website was carried out by accessing the website and not after providing the user with the information and the request for consent.	Art. 22.2 Spanish E-commerce Act	Initial proposed fine: 10.000€ Final fine: 6.000€ due to responsibility recognition and prompt payment.	https://www.aepd.es/resoluciones/PS-00435-2016_ORI.pdf [3]
ABELHAS.PT LIMITED	The defendant owned a website that used third party cookies with analytics purposes and cookies for social network management purposes. The information included a first layer that did not specify the purposes of the cookies used, and a second layer that did not refer to local storage related to social networks.	Art. 22.2 Spanish E-commerce Act	5.000 €	https://www.aepd.es/resoluciones/PS-00372-2016_ORI.pdf [4]
VF JEANSWEAR ESPAÑA, S.L.	Installation of cookies without giving proper information and without requesting the user consent.	Art. 22.2 Spanish E-commerce Act	Initial proposed fine: 5.000€ Final fine: 3.000€ due to responsibility recognition and prompt payment.	https://www.aepd.es/resoluciones/PS-00175-2019_ORI.pdf [5]
PACSOLUTOR, S.L.	Lack of information in the cookie information notice on the website. Specifically, no information was provided about the purpose of third party analytical and advertising cookies installed.	Art. 22.2 Spanish E-commerce Act	3.000€	https://www.aepd.es/resoluciones/PS-00581-2016_ORI.pdf [6]
FRONTERA SISTEMAS DE ESPAÑA, S.L.	The webpage provided incomplete information about the installation of cookies and with regard to the type and purposes of the cookies used.	Art. 22.2 Spanish E-commerce Act	Initial proposed fine: 3.000€ Final fine: 1.800€ due to responsibility recognition and prompt payment.	https://www.aepd.es/resoluciones/PS-00582-2016_ORI.pdf [7]
I.S.G.F. INFORMES COMERCIALES, S.L.	Third party cookies were installed before providing clear and complete information to users about their use. Also, the user did not have the possibility to reject or accept its use by means of a free, specific, informed and unequivocal action. In addition, the information displayed at both levels of information was neither clear nor complete.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00014-2019_ORI.pdf [8]
PASTOR TOYS INTERNACIONAL, S.L.	The website did not offer a granular cookies setting panel. The information about the tools provided by various browsers to configure cookies through the browser would be complementary to the previous one, but insufficient on its own.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00022-2019_ORI.pdf [9]
VOYAGE PRIVE ESPAÑA, S.L.	The webpage considered the installation of cookies to be accepted if the user continues navigating through it.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00023-2019_ORI.pdf [10]
PARAULA.CENTRE DE SERVEIS LINGÜISTICS DE LES ILLES BALEARS	Lack of required information in the cookie information notice (first layer). In addition, the "ACCEPT" button was included, which is incompatible with the "continue browsing" mode offered in this case. The second layer did not provide information on the system for managing the acceptance, rejection of given consent or rejection of cookies in granular form.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00002-2019_ORI.pdf [11]
COMUNICACIONES DEL CAMPO ESPAÑOL, S.L.U.	Third party cookies were installed prior to obtaining the valid consent of the user, since they were installed without giving proper information and without any affirmative action of acceptance. Also, there was a lack of essential information in the cookies information notice (first layer).	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00017-2019_ORI.pdf [12]
IDEARIUM 3.0, S.L.	The website prevented the user from navigating if he or she did not accept the cookies information notice. On the other hand, cookies from third parties were installed without giving information or asking for the necessary consent from the user, nor giving the information of how to delete cookies installed.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00012-2019_ORI.pdf [13]
CHOLLOMODA FASHION RETAIL, S.L.	Some functions of the website were only available by accepting the installation of cookies. In fact, the installation of third party cookies was carried out immediately after accessing the website, without any information or action by the user. No information was given about third party cookies or the possibility of managing consent. It is interesting to note that, for the same complaint from an individual, the AEPD also opened a procedure for lack of update and information in the privacy policy.	Art. 22.2 Spanish E-commerce Act Art. 13 GDPR	Warning for both procedures	Cookies: https://www.aepd.es/resoluciones/A-00020-2019_ORI.pdf [14] Privacy: https://www.aepd.es/resoluciones/PS-00172-2019_ORI.pdf [15]
AGROMILLORA CATALANA, S.A.U.	The cookies information notice was incomplete. By accessing to the Cookie Policy, the user did not receive information about some types of cookies used. Also, the installation of some types of cookies was carried out by just accessing the website	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00010-2019_ORI.pdf [16]
INDIVIDUAL	The Respondent owned two websites where there was no link that referred to the cookie Policy.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/PS-00390-2016_ORI.pdf [17]
RANDSTAD ESPAÑA, S.L.U.	Information on the use of cookies was incomplete and therefore no informed consent was collected from the client.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00458-2016_ORI.pdf [18]
MEDITERRANEO REAL, S.L.	The respondent's website did not report on the use of cookies despite the use of third party analytical and advertising cookies.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00299-2015_ORI.pdf [19]
PACSOLUTOR, S.L.U.	Installation of cookies on the claimant’s device without having previously requested consent for the installation and without informing the user of the consequences and without collecting the proper informed consent.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00248-2015_ORI.pdf [20]
ARKISA PROYECTOS INMOBILIARIOS, S.L.	There was no information about the use of cookies provided on the respondent's website, and also there was no collection of proper consent for the installation and use of third party cookies (more specifically Google, Facebook and Twitter).	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00133-2015_ORI.pdf [21]
MAGUS CREATIVA EUROPE, S.L.	There was no clear and complete information provided about the use of cookies on the website (there was no mention of the purposes for which the cookies were installed in users' terminals).	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00075-2015_ORI.pdf [22]
CUATRO DATOS SOLUCIONES Y DESARROLLO, S.L.	The owner of the website installed third party cookies without informing users and therefore without their prior informed consent. It was sanctioned in accordance with the E-commerce act, although there was a reference to the characteristics of the informed consent established in the RGPD.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00005-2019_ORI.pdf [23]
LIVING TERRITORIWEB, S.L.	The owner of the website did not inform about the use of cookies and did not have a Cookie Policy. In addition, he did not display an cookie information notice about such devices when accessing the website. In the absence of a "Legal Notice", no information was provided specifying the holder's data. It was sanctioned in accordance with the E-commerce act, although there was a reference to the characteristics of the informed consent established in the RGPD.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00001-2019_ORI.pdf [24]
ALLIGATOR MULTIMEDIA, S.L.	The cookies information notice did not provide information regarding the use of own and third party cookies, nor was there any mention of the purposes for which the advertising and analytical cookies were installed in users' terminals.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00269-2018_ORI.pdf [25]
CEMEDIC, S.L.	When accessing the website of the respondent, third party persistent cookies were automatically installed without requiring the acceptance and the performance of any action on the page was enough for the installation. The information given was just the included in the cookies notice, without extending it with all the data required.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00259-2018_ORI.pdf [26]
INDIVIDUAL	The owner for two websites proceeded to install third party cookies on users' computers without providing the necessary information and therefore, without obtaining the appropriate consent.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00105-2018_ORI.pdf [27]
LIVE NATION ESPAÑA, S.A.U.	The Spanish Food Safety and Nutrition Agency denounced the website www.livenation.es [28] for the violation of legal obligations about information and consent regarding the use of cookies.	Art. 22.2 Spanish E-commerce Act	Warning	https://www.aepd.es/resoluciones/A-00169-2017_ORI.pdf [29]

[1] Art. 22.2: “When service providers employ devices for the storage and recovery of data from terminal equipment, they shall inform recipients of the use and finality of such devices in a clear and comprehensive manner, offering recipients the opportunity to refuse, by a simple means and free of charge, to allow their data to be processed.

This shall not prevent any storage of or access to data for the purpose of carrying out or technically facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the recipient”.

Madrid

Almagro, 16-18
Madrid 28010
T: (+34) 91 576 19 00

Barcelona

Avenida Diagonal 615, 8ª planta.
08028
T (+34) 93 494 74 82