‹ All enforcement EU & UK

Mr. A.A.A. (Claimant) v. Just Landed, S.L.

Jurisdiction

EU & UK

Authority

Spanish DPA (AEPD)

Date

25 Feb 2019

Case number

PS/00036/2020

Outcome

€ 3000 in fines

Case summary

Just Landed, a Spanish entity, has been fined by the Spanish DPA for having a privacy policy written only in English and not providing a mechanism to accept, reject or manage cookies.

Our analysis

The Spanish DPA has fined the entity behind the URL.1 website for violating GDPR and LOPDGDD regulations. The website's privacy policy was written only in English, despite the entity being located in Spanish territory which amounts to language discontinuity. Additionally, the website did not have a banner or notice related to the existence of cookies, and there was no link or mechanism for users to accept, reject or manage cookie installation. Cookies were loaded automatically without any prior action, amounting to forced action. These deceptive patterns violate article 13 of the GDPR, which requires the provision of information to interested parties at the time of data collection.

Outcome

The outcome is a €3,000 sanction for improper use of data storage and recovery devices without consent. JUST LANDED, SL must include a Spanish "privacy policy" and information on cookies, with a mechanism for users to manage preferences. They must also ensure cookies are not installed unnecessarily. Failure to comply may result in a €30,000 fine.

Parties

Mr. A.A.A. (Claimant) and Just Landed, S.L.

View the decision

Related deceptive patterns

Trick wording ›The user is misled into taking an action, due to the presentation of confusing or misleading language. Forced action ›The user wants to do something, but they are required to do something else undesirable in return.

Related rules

GDPR - Article 13 ›Controllers must provide identity, contact details, processing purposes and legal basis, recipient information, retention period, and data subject rights when collecting personal data.GDPR - Article 58 ›Empowers supervisory authorities to carry out investigations and order controllers and processors to comply with the regulation.GDPR - Article 83 ›Outlines conditions for fines and penalties for non-compliance, including up to 4% of global annual revenue or €20 million, whichever is greater.Spanish Law on Information Society Services - Article 22 ›Requires informed consent for the use of data storage and retrieval devices, unless they are strictly necessary for service provision, and mandates clear information provision for such use.