This decision illustrates a rare procedural case where a sanction procedure is closed not on the merits, but due to the expiration of the legal processing time by the supervisory authority, without a decision on the alleged infringements being issued.

Facts and context

The Spanish data protection authority (AEPD) has today published a decision closing the sanction procedure initiated against the Balearic Islands Health Service (IB-SALUT) concerning the implementation of separate queues for vaccinated and unvaccinated persons against COVID-19 at an airport.

The case originated from two complaints filed in October 2021, denouncing the installation of signs at Palma de Mallorca airport creating separate circuits for "vaccinated" and "unvaccinated" travelers, which led to a public disclosure of their vaccination status, a sensitive health data.

Grounds for the decision

The authority's decision does not rule on the substance of the initially alleged infringement but is based exclusively on a procedural ground:

• Closure of the procedure due to expiration of the legal deadline: The authority had initiated a sanction procedure on 22 July 2022 for an alleged violation of Article 32 of the GDPR. However, Spanish law, in its Article 64 of the Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), imposes a maximum duration of twelve months for such procedures from their opening date. This deadline having been exceeded without a final resolution being notified, the authority noted the expiration ("caducidad") of the procedure, which legally obliges it to archive the file without ruling on the alleged violation.

Authority's decision

Consequently, the authority declared the expiration of the procedure and ordered the archiving of the file.

Lessons learned

This decision specifies / recalls that:

• Procedural deadlines bind supervisory authorities, and their non-compliance may lead to the termination of the sanction procedure, regardless of the seriousness of the alleged facts.
• The closure of a file due to expiration of the procedural deadline does not constitute an acquittal decision on the merits and does not prevent the authority from opening a new procedure for the same facts if the statute of limitations for the offense has not expired.