The Spanish authority sanctions a company for failing to comply with a previous injunction ordering it to formalize its relationship with a service provider. The company attempted to reclassify the relationship as joint controllership, provided contradictory information, and failed to inform the authority of the sale of its assets, which constitutes obstruction of the authority's powers.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a sanction decision against RAMONA FILMS, S.L. (including the imposition of a €60,000 fine) for breaches related to non-compliance with an injunction issued in a previous decision.

The case stems from the follow-up of a previous sanction decision dated 17 November 2023, which had ordered the company to regularize its contractual relationship with a service provider within one month.

Grounds for the decision

• Obstruction of the supervisory authority's powers (Article 58(2) of the GDPR): The authority had ordered RAMONA FILMS, S.L. to inform it of the signing of a data processing agreement with the company ***EMPRESA.1, following the finding of a violation of Article 28 of the GDPR. In response, the company initially claimed that the relationship was actually a joint controllership, then provided an undated and unsigned draft joint controllership agreement. When faced with the authority's requests, it finally admitted that no agreement had ever been formalized due to reluctance on the part of ***EMPRESA.1 and declared having "de facto" ended the relationship, without being able to provide evidence. Furthermore, the company only informed the authority of the sale of its domains to another entity, Clams & Turnips Enterprise Korlátolt Felelősségű Társaság, several months after the transaction and only after being prompted. The authority concluded that these contradictory responses and the absence of documentary evidence demonstrated a deliberate failure to comply with a binding measure imposed under its powers.

Authority's decision

Consequently, the authority imposed a fine of €60,000 on RAMONA FILMS, S.L.

Lessons learned

This decision reminds that:

• Failure to comply with an injunction issued by a supervisory authority constitutes a separate and serious infringement, specifically sanctioned by the GDPR.
• Reclassifying a data processing relationship as joint controllership must be justified and formalized by a contractual agreement compliant with Article 26 of the GDPR, and not used as a means to evade obligations.
• Data controllers must demonstrate transparency and cooperation during investigations, as providing contradictory, incomplete, or late information is considered obstruction.
• The transfer of assets (such as domain names and associated activities) during ongoing proceedings must be proactively communicated to the supervisory authority, under penalty of being interpreted as an attempt to evade responsibilities.