AEPD (Spain) - PS-00008-2025

Summary

Spain's data protection authority (AEPD) has fined RAMONA FILMS, S.L. €60,000 for failing to comply with a corrective order. The company was previously fined for GDPR infringements, including lacking a data processing agreement with a payment provider. The DPA ordered RAMONA FILMS to formalize and report its relationship with the processor, but the company failed to provide the required agreement, instead submitting an unsigned and undated document, and was found to have continued its relationship with the processor.

Full text

Help AEPD (Spain) - PS-00008-2025: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 12:20, 21 August 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators269 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 12:20, 21 August 2026 AEPD - PS-00008-2025 Authority: AEPD (Spain) Jurisdiction: Spain Relevant Law: Article 28(3) GDPR Article 58(2) GDPR Article 76 LOPDGDD Type: Investigation Outcome: Violation Found Started: 11.08.2025 Decided: 09.03.2026 Published: 19.08.2026 Fine: 60000.0 EUR Parties: RAMONA FILMS, S.L. National Case Number/Name: PS-00008-2025 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Spanish Original Source: AEPD (in ES) Initial Contributor: bms he DPA fined a controller €60,000 for failing to comply with a corrective order requiring it to formalise and report its relationship with a processor. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts RAMONA FILMS, S.L., the controller, operated websites offering audiovisual content through subscriptions. In November 2023, the DPA fined the controller in proceedings PS-00308-2023 for several GDPR infringements, including a breach of Article 28(3) GDPR concerning the absence of a data processing agreement with a payment service provider, the processor. The DPA also ordered the controller, pursuant to Article 58(2)(d) GDPR, to provide within one month the processor agreement concluded with the processor. In December 2023, instead of providing the requested agreement, the controller informed the DPA that the two companies should be considered joint controllers. Following an investigation, the controller provided an unsigned and undated purported joint controller agreement. It subsequently acknowledged that this agreement had never been signed. The controller also stated that it had terminated its relationship with the processor and discontinued its subscription service. However, it was unable to provide evidence of the termination and the DPA found that subscriptions continued to be available through the website and redirected users to the processor's payment service. The controller argued that it had complied with the measures imposed and requested the closure of the proceedings. Holding The DPA found that the controller had infringed Article 58(2) GDPR by failing to comply with the corrective order issued in the previous proceedings. The DPA held that the controller had neither concluded the processor agreement required by the previous decision nor demonstrated that its relationship with the processor had instead been validly established as joint controllership under Article 26 GDPR. In particular, the purported joint controller agreement was unsigned and undated, and the controller ultimately acknowledged that it had never been concluded. The DPA also rejected the controller's arguments that the relationship with the processor and the subscription service had been terminated. It considered that the controller had provided contradictory information throughout the investigation and had failed to substantiate these claims. Consequently, the DPA found that the corrective measure imposed under Article 58(2)(d) GDPR remained unfulfilled. When determining the fine, the DPA considered, inter alia, the duration and intentional nature of the infringement, the fact that the processing involved identification and payment data, the close connection between the controller's activity and personal data processing, and the fact that the previous €40,000 fine for the Article 28(3) GDPR infringement had not achieved sufficient deterrent effect. The DPA therefore imposed a €60,000 fine for the infringement of Article 58(2) GDPR, pursuant to Article 83(6) GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. Case No.: EXP202404290 DECISION ON DISCIPLINARY PROCEEDINGS TABLE OF CONTENTS TABLE OF CONTENTS...........................................................................................................................1 BACKGROUND..........................................................................................................2 FIRST:.................................................................................................................2 SECOND:................................................................................................................4 THIRD PARTY:...............................................................................................................11 FOURTH:.................................................................................................................11 FIFTH:..................................................................................................................13 SIXTH:....................................................................................................................13 PROVEN FACTS................................................................................................13 FIRST:...............................................................................................................13 SECOND:..............................................................................................................13 THIRD:...............................................................................................................14 FOURTH:.................................................................................................................15 FIFTH:..................................................................................................................16 SIXTH:....................................................................................................................16 SEVENTH:................................................................................................................16 EIGHTH:..................................................................................................................17 LEGAL BASIS.................................................................................................17 I Jurisdiction.........................................................................................................17 II Preliminary Issues................................................................................................18 III Response to the Allegations in the Proposal to Initiate Proceedings......................................19 IV Breach of Obligation. Article 58 of the GDPR, Corrective Powers of the Supervisory Authority.................................................................................................................................22 V Classification of the violation of Article 58(2) of the GDPR and determination for the purposes of the statute of limitations..............................................................................................................28 VI Penalty................................................................................................................29 RESOLVES:.................................................................................................................33 FIRST:...............................................................................................................33 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/33 SECOND:..............................................................................................................33 THIRD:...............................................................................................................33 Regarding the proceedings conducted by the

Entities