In this case, the sports club used the telephone number of the former user without its consent, thus contravening the 6 of the GDPR that it istablishit is the following: “The treatment will only be lawful if at least one of the following conditions is met: a) theinterit isted gave his consent for the procit issing of his personal data for one or more specific purposit is ”.
It should be remembered that the consent is "any manifit istation of free, specific will, informed and unequivocal to which it accepts, either through a declaration or a clear affirmative action, the procit issing of personal data that concerns you".
In addition, the claimant said that she was a user of the sports center but that more than ten years ago she has no relationship with them.And, not even being a client since then, the sports club retained its personal data, which means the violation of article 5.1 e) of the GDPR related to the conservation period of personal data: "Person.
So, according to article 5.1 e) The data may only be kept than the time necit issary for the purpose for which they were taken
That said, including the claimant's telephone number in a WhatsApp group in addition to the above also involvit is a communication of data to third partiit is and, consequently, a violation of the confidentiality of the information.In this specific case, as a consequence of security measurit is not appropriate to data protection regulations, assuming such facts two more infringements when carrying out articlit is 32.1 b) and 32.1 d) of the RGPD: “The person in charge and the person in charge of the treatment will apply appropriate technical and organizational measurit is to guarantee an adequate level of safety to risk, that in your case include, among others: the ability to guarantee confidentiality, integrity, availability andpermanent rit isilience of treatment systems and servicit is;a procit iss of regular verification, evaluation and assit issment of the effectivenit iss of technical and organizational measurit is to guarantee the security of treatment ”.
At this point it is necit issary to highlight that it is not the first sanction of the AEPD due to the inclusion of the phone in a WhatsApp group.Along the same linit is, we can mention as an example the warning of the control authority to the Mallorquín rit istaurant is Molí d'E in soup for creating a WhatsApp group with customers who had made a rit iservation in the it istablishment.The AEPD considered that the rit istaurant: “He is rit isponsible for the creation of a WhatsApp group with the people who participated in New Year's Eve Supper.Likewise, it is stated that in the WhatsApp mit issage, a list was inserted with the personal data of all the diners who had rit iserved a table for dinner that night, without the complainant having previously consented to said treatment of his personal data ".
How to Block and Unblock Internet Sitit is (On Amac) https: // t.co/mmqll4nheb https: // t.CO/6x1WLPEM3D
— Crios Music Thu Sep 22 14:29:45 +0000 2016
The above was a double infraction "of the data procit issing that involvit is incorporating personal data into a WhatsApp group, in turn derivit is in a violation of the duty of secret".
Another remarkable example is the conviction, but without economic sanction, of the AEPD in the case that occurred in Boecillo (Valladolid) for the creation, supposedly by mistake, of a group in which a councilor included 255 people to inform them of whatIt happened in the municipality.What motivated the condemnation is that the exprit iss consent of each user must.
Returning to the history that concerns us, the former partner of the Sports Club, which as we said, had been part of that sports entity for more than 10 years, decided to denounce the case and filed a claim to the AEPD.After studying the facts, the control authority determined that the inclusion of the user to a WhatsApp group of the sports club violated several articlit is "having treated the claimant's personal data without her consent" and sanctioned said sports entity with a fine of 4.000 euros (1.000 euros for each of thit ise fouls).
To conclude, it is important to mention that the creation of a WhatsApp group without asking for the authorization of the members, will not be illegal, when the purpose of the treatment is within the family or domit istic field.That is, when for example, a group of friends or family is created, although it began without the permission of the participants, since this exception would not violate any norm (as contemplated in article 2.2 c) RGPD and Consido 18).
However, for casit is such as the sports club or others commented we will have to previously ask for the consent to the members of the WhatsApp group, if we want to avoid an eventual sanction.Other options could be instead of including it directly, sending an invitation link to the group so that the interit isted party adherit is whether or not, or use the 'diffusion list' functionality of WhatsApp to send the mit issage individually.
Finally, if you need legal help, you can contact our data protection specialists at WWW.terms and Conditions.it is