Category: Spanish Data Protection

Spain imposes fine against Facebook

13. September 2017

The Spanish Data Protection Authority imposes a fine of €1,2m against Facebook. The social media network collects Personal Data of the users without a permission for this.

The responsible Data Protection Authority considers that Facebook collects personal information like gender, religious attitudes, personal preferences and personal beliefs without informing the persons concerned about the concrete use of this data.

The Data Protection Authority criticizes the unclear wording of Facebooks privacy policy. Moreover Facebook uses the personal data for advertising purposes without a permission. This constitutes a breach against Spanish Data Protection law.

Furthermore Facebook recognizes as well third party pages the user is referred if he clicks on links and illegally tracks visitors who are not Facebook users.

Finally is criticized that Facebook does not remove data, if a user unsubscribe the network. The collected information is stored for month even if the user terminates its account.

Not only Spain started an investigation against Facebook and imposes a fine as well as Spain also Belgium, France, Germany and the Netherlands are investigating against Facebook due to breaches against the local Data Protection law.

Spanish Constitutional Court legitimates employee monitoring without prior information

17. March 2016

In March 2016, the Spanish Constitutional Court rectified the existing Spanish jurisprudence regarding employee monitoring. This rectification is based on a constitutional appeal from an employee of a well-known fashion store, who was dismissed due to misappropriation of money from the cash register.

The company found out this conduct through the video surveillance cameras that it had installed in its premises. A distinctive sign was placed at a visible place of the shop window. However, the employees were not informed about the use of the surveillance cameras.

According to Art. 5.1 and Art. 6.1 of the Spanish Data Protection Act, the data subject must be informed about the processing of his/her personal data and give his/her unambiguous consent to this processing.

In this sentence, the Spanish Constitutional Court declares that the prior information and consent of the employee to video recording is not required in this case because a video surveillance system aims at contributing to the control and security of employees. Additionally, as a visible distinctive sign had been placed at the premises, the employer was exempted from informing each employee individually. Furthermore, Art. 20 of the Spanish Statute of Rights for Workers allows the employer to control and monitor its employees, in order to ensure that they fulfill their obligations. In this sense, the monitoring cannot violate the employee´s dignity.