The AEPD opens a file over your cameras: cutting the fine

The case, in five lines

What is brought

Defence of the party under investigation: written submissions on the grading criteria, evidence of the corrective measures taken and a reasoned decision on admitting liability and on voluntary payment.

Before which court

The AEPD (the Spanish data protection authority) both investigates and decides. Its penalty decision is then challenged before the administrative courts, unless the reductions requiring a waiver of administrative appeal have been accepted.

Deadline

For submissions, the period stated in the notice, no shorter than ten days and no longer than fifteen. Voluntary payment is possible at any time before the decision. The penalty file lapses twelve months after the notice of initiation.

Who can bring it

The controller or processor to whom the notice of initiation is addressed: the residents' association, the company or the professional that installed and operates the cameras.

Financial risk

Accepting the reductions closes off any administrative appeal against the penalty. And if you appeal and lose, you pay the full amount plus the cost of the proceedings, without the discounts that were on the table.

First check which provision is alleged, because it sets the ceiling

Article 83 of the Regulation separates two tiers of seriousness. Paragraph 4 penalises with up to 10,000,000 euros or, in the case of an undertaking, up to 2 per cent of total worldwide annual turnover of the preceding financial year, whichever is higher, breaches of the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43.

Paragraph 5 rises to 20,000,000 euros or 4 per cent where what is breached are the basic principles of processing, including the consent conditions in Articles 5, 6, 7 and 9, the data subject rights in Articles 12 to 22, international transfers or failure to comply with a supervisory authority decision.

That is why the first job is to read the notice of initiation closely and argue the classification before anything else. Being accused of lacking the informative sign is not the same as being accused of having no lawful basis under Article 6. Steering the allegation into the right tier can be worth more than any later mitigating factor.

Article 83.2 has eleven doors and Article 76 opens eight more

Article 83.2 requires due regard to be had, among other factors, to the nature, gravity and duration of the infringement, the number of data subjects affected and the level of damage, whether it was intentional or negligent, any measure taken to mitigate the damage, the degree of responsibility given the technical measures applied, previous infringements and the degree of cooperation with the authority.

The list goes on: the categories of data affected, how the authority became aware of the infringement and in particular whether the controller itself notified it, compliance with measures previously ordered in the same matter, adherence to codes of conduct or certification mechanisms, and any other aggravating or mitigating factor, such as benefits gained or losses avoided.

Article 76 of Organic Law 3/2018 adds eight further circumstances under that last door: the continuing nature of the breach, how far the offender's activity is tied to data processing, benefits obtained, possible inducement by the affected person's conduct, a later merger by absorption not attributable to the absorbing entity, effects on minors, having a data protection officer without being obliged to, and voluntary submission to alternative dispute resolution.

The two 20 per cent reductions come with small print

Article 85 of Law 39/2015 opens two exits. If the offender admits responsibility, the matter may be decided by imposing the appropriate penalty. And where the penalty is purely financial, voluntary payment at any time before the decision brings the proceedings to an end, except as regards restoring the altered situation and compensating the damage caused by the infringement.

In both cases, where the penalty is purely financial, the deciding body applies reductions of at least 20 per cent on the proposed amount, and they are cumulative with each other. Those reductions must be stated in the notice of initiation, so the final figure can be worked out from the first day of the file.

The small print is in the next sentence: the reductions take effect only on withdrawal of, or waiver of, any administrative action or appeal against the penalty. The discount is bought with the appeal. That is why the decision is not taken on impulse: the saving is weighed against what it would be worth to fight the classification or the grading to the end.

The Article 82 hearing is where the account is fixed

Article 82 of Law 39/2015 places the hearing immediately before the draft decision is written, making the file available to the interested parties. It gives them a period of no less than ten days and no more than fifteen to make submissions and produce the documents and evidence they consider relevant. That is the moment the file stops writing itself.

The usual mistake is to use that window to narrate the burglaries in the entrance hall. The investigation is not judging whether you were afraid, but whether the framing and the information complied with the rule. Useful submissions list verifiable facts: what has been corrected, when, with what evidence, how many people were affected and how long the disputed processing was running.

The same article allows the hearing to be dispensed with where no facts, submissions or evidence other than those put forward by the interested party appear in the file or are taken into account in the decision. That is worth knowing: producing documents early can speed up closure, and expressly declining to make submissions before the deadline is treated as the step having been taken.

Twelve months to lapse, and six if it ends in a warning

Article 64 of Organic Law 3/2018 provides that proceedings aimed at determining whether an infringement exists have a maximum duration of twelve months from the date of the notice of initiation, and that once that period passes they lapse and the file is closed. It is a real limit, not decoration.

That clock can be stopped. The periods are automatically suspended where information, a consultation, assistance or a mandatory opinion must be sought from a European Union body or from other supervisory authorities, for the time between the request and notification of the reply. They may also be suspended by reasoned decision where obtaining information from a court is indispensable.

There is a third route sometimes overlooked. Where the nature of the facts allows and having regard to the Article 83.2 criteria, the authority may issue a warning and order corrective measures within a set period, after hearing the controller. Those proceedings have a maximum duration of six months from the notice of initiation and do not end in a fine.

How we run the case, step by step

1. 1

   Break down the notice of initiation

   We identify which provisions are alleged, whether they fall under paragraph 4 or 5 of Article 83, the amount proposed and which reductions the notice already states. That gives the ceiling and the floor of the negotiation.

2. 2

   Correct before you reply

   We redirect whatever needs redirecting, put up the informative device, adjust retention and document it all with dates. Article 83.2 gives weight to measures taken to mitigate the damage and to the degree of cooperation with the authority.

3. 3

   Argue the grading, not the fright

   The submission works through each of the Article 83.2 and Article 76 circumstances that favour you, with a document for every one, and challenges the classification where the provision alleged is not the one the facts fit.

4. 4

   Work out whether the reductions are worth it

   We compare the combined saving from the two 20 per cent cuts with the real prospect of shifting the classification. Taking them requires withdrawing or waiving any administrative action or appeal against the penalty.

5. 5

   Keep control of the file's calendar

   We note the date of the notice of initiation, monitor suspensions caused by consultations with other authorities and count the twelve month lapse period, or six months if the matter is steered towards a warning with corrective measures.

6. 6

   Decide on appeal with the decision in hand

   If the reductions were not taken, the decision is challenged before the administrative courts. We also weigh publication in the Official State Gazette, which applies only where the fine exceeds one million euros and the offender is a legal person.

The law that applies

• Art. 83 RGPD. It requires fines to be effective, proportionate and dissuasive, and lists eleven circumstances to be taken into account in setting them, from gravity and duration to cooperation with the authority and benefits obtained. It draws two tiers, up to 10,000,000 euros or 2 per cent of total worldwide annual turnover, and up to 20,000,000 or 4 per cent, depending on which obligations were breached, and caps the total fine at that for the gravest infringement where several concur. 32016R0679
• Art. 76 LOPDGDD. It directs that the Article 83 penalties be applied with their grading criteria and adds eight further circumstances: continuing nature, how far the activity is tied to data processing, benefits obtained, inducement by the affected person's conduct, a later merger by absorption, effects on minors, having a data protection officer without being obliged to, and voluntary submission to alternative dispute resolution. It also provides for publication in the Official State Gazette where the fine exceeds one million euros and the offender is a legal person. BOE-A-2018-16673
• Art. 85 Ley 39/2015. It allows the matter to be decided by imposing the appropriate penalty where the offender admits responsibility, and treats the proceedings as ended by voluntary payment at any time before the decision where the penalty is purely financial, except as to restoring the altered situation and compensating damage. In both cases reductions of at least 20 per cent on the proposed amount apply, cumulative with each other, which must appear in the notice of initiation and take effect only on waiving any administrative appeal. BOE-A-2015-10565
• Art. 82 Ley 39/2015. It places the hearing immediately before the draft decision is written, with the file made available to the interested parties, and gives them no less than ten and no more than fifteen days to make submissions and produce documents and evidence. It may be dispensed with where no facts, submissions or evidence other than those supplied by the party itself appear or are taken into account, and it is treated as done if the party states before the deadline that it will make no submissions. BOE-A-2015-10565
• Art. 64 LOPDGDD. It governs the start and duration of the authority's proceedings: six months to decide where the matter is only a failure to attend to the rights in Articles 15 to 22 of the Regulation, with the claim deemed upheld on silence; a maximum of twelve months from the notice of initiation in proceedings aimed at establishing an infringement, lapsing and closing on expiry; and six months where the matter is steered towards a warning with corrective measures. The periods are suspended where opinions must be sought from Union bodies or other supervisory authorities. BOE-A-2018-16673

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions