Data protection: GDPR rights and claiming before the AEPD

The General Data Protection Regulation (GDPR, EU Regulation 2016/679) and Ley Orgánica 3/2018 (the Spanish Data Protection Act) grant you a set of rights that you can exercise against any company or organisation processing your data. They are free and personal: you exercise them yourself or through an authorised representative.

The main ones are: access (knowing what data they have about you and what for), rectification (correcting inaccurate data), erasure or right to be forgotten (having them deleted), objection (stopping them from using them for a purpose, for example advertising), restriction of processing (keeping them but not using them while a discrepancy is resolved) and portability (receiving your data in a reusable format and taking them to another company).

You must direct the request to the data controller (the company). As a general rule, it does not need to be motivated: the objection to processing for direct marketing or advertising purposes is unconditional and does not require stating any reason (article 21.2 GDPR), whereas the objection based on the legitimate interest of the controller or a public interest mission does require you to express reasons related to your particular situation (article 21.1 GDPR). The company is obliged to answer you and cannot charge you, unless the request is manifestly unfounded or excessive (article 12.5 GDPR).

If you have exercised a right and the company does not answer you within the deadline, or the response is unsatisfactory, you can submit a claim for failure to attend to the exercise of your rights before the Spanish Data Protection Agency (AEPD), which the Agency processes as a rights procedure. You can also claim for an improper use of your data: unwanted advertising, transfer without consent, inclusion in a defaulters file or video surveillance.

The claim is preferably submitted online, filling in the form on the AEPD electronic headquarters (sedeaepd.gob.es), identifying yourself with a digital certificate, DNIe or Cl@ve (the Spanish electronic identity system). It can also be done on paper in accordance with Ley 39/2015 (the Spanish Administrative Procedure Act). Claiming before the AEPD is free.

You must provide evidence or indications of the infringement: in the claim for unattended rights, the copy of the request you sent to the company and the response received (or proof that there was none). The AEPD examines the admission for processing and, where appropriate, opens investigation proceedings against the company.

Managora drafts your claim, gathers the evidence and submits it for you at the AEPD headquarters. You can see the updated amount in the reclamacion_aepd procedure file.

The right to be forgotten is the digital aspect of the right to erasure: it allows you to request that your personal data be deleted when they are no longer necessary, when you have withdrawn consent, when you object and there is no prevailing legitimate reason, or when they have been processed unlawfully (article 17 GDPR).

On search engines, you can request the removal of results associated with your name when the information is inadequate, irrelevant or excessive. The search engine must assess your request and, if it denies it or does not respond, you can claim before the AEPD. Erasure is not absolute: it can yield to freedom of information, legal conservation obligations or public interest.

Managora prepares the erasure request before the company or the search engine and, if they do not attend to it, the claim before the AEPD. You can see the amount in the derecho_olvido_aepd file.

A security breach is any incident that causes the destruction, loss, alteration or unauthorised access or communication of personal data: a cyberattack, sending data to the wrong recipients, losing a device or the theft of a database.

The company (data controller) must notify the breach to the AEPD without undue delay and, at the latest, within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to people's rights (article 33 GDPR). If the breach entails a high risk, it must also communicate it without delay to those affected (article 34 GDPR).

Failing to notify on time is a punishable offence. If you are the affected company, Managora prepares and submits the breach notification at the AEPD headquarters within 72 hours. You can see the amount in the denuncia_aepd_brecha_seguridad file. If you are an individual affected by a breach, you can claim before the AEPD for the improper use of your data.

The Data Protection Officer (DPO, or DPD in Spanish) is the person who supervises GDPR compliance in the organisation. It is mandatory in 3 cases under article 37 GDPR: when the processing is carried out by a public authority or body; when the core activity requires regular and systematic monitoring of individuals on a large scale; and when special categories of data (health, ideology, biometrics) or criminal data are processed on a large scale.

The LOPDGDD (article 34) extends the obligation to numerous sectors: professional associations, educational centres and universities, credit and financial institutions, insurance companies, investment firms, energy distributors, information society service providers that profile on a large scale, healthcare centres, advertising and commercial prospecting companies, private security companies and gambling operators, among others.

Once appointed, their contact details must be communicated to the AEPD within 10 days (article 34.3 LOPDGDD). Managora communicates and registers your DPO with the AEPD. You can see the amount in the aepd_inscripcion_dpd file.

Exercising your rights before a company is free and submitting a claim before the AEPD is too: the Agency does not charge a tasa (official fee). Managora's cost for preparing and submitting the procedure appears in each file (reclamacion_aepd, derecho_olvido_aepd, denuncia_aepd_brecha_seguridad, aepd_inscripcion_dpd): you can see the updated amount there.

The legal deadlines are clear: the company has 1 month to respond to your request (extendable by 2 more months if it is complex); the notification of a breach to the AEPD is 72 hours; and the communication of the DPO is 10 days. The subsequent processing by the AEPD after a claim depends on each case.