Publications

---

Spain’s Data Protection Commissioner (better known by its Spanish acronym, AEPD) has shocked the market by announcing that it has initiated a criminal sanction procedure and decided to impose a large fine against Google.

Google Inc. and its Spanish subsidiary could be fined over €2.4 million for a total of what the AEPD deemed five serious infringements of the Spanish Data Protection Act.

In its announcement on October 18, the AEPD explained that in the course of investigations carried out since May of this year, it had discovered that Google's Street View service had not only collected information about Wi-Fi networks, but also the names and surnames of people using those networks, usernames and passwords – a significant violation of Spanish data protection laws.

This was not the only piece of bad news for Google. The AEPD also announced that it had decided to temporarily suspend the sanction procedure and to send a special report of its conclusions to a criminal court in Madrid, which had previously opened a parallel investigation of charges that Google committed a criminal offense under the Spanish Criminal Code.

Google’s first reaction was to try to appease the AEPD, keeping a low profile, promising to do its best to improve compliance with local data protection laws and asserting that the most controversial data collection activities were carried out unintentionally. Showing a positive attitude is believed to help avert aggressive AEPD action: in theory, the AEPD can open a separate procedure for each individual affected by the alleged infringements, multiplying the amount of its high fines exponentially (although it has generally not done so in recent years). In addition, data subjects are entitled under the Spanish Data Protection Law to claim cash compensation; infringers hope that their conciliatory behavior may forestall such claims. Nevertheless, as every Spanish data protection practitioner knows, other companies have tried the conciliatory approach in the past in order to avoid heavy fines – with little success.

Spanish data protection law works on the principle that privacy is a constitutional right, and therefore companies must be extremely careful when handling personal information of individuals. There is no room for negligence, error or good faith mistakes. The sensitivity of data protection in Spain is such that negligence is considered almost automatically as gross negligence. Google must therefore rapidly mount additional arguments to support its position. The good news for Google is that it is not short of them.

Street View is a relatively new service. Furthermore, it is also close to unique in Spain. This is an advantage because in previous cases of first impression for AEPD, fines have been historically reduced to a symbolic amount (a famous precedent is the "zero balance" decision against an international bank who kept the details of former bad debtors once the balance of the debt was zero). Another US technology conglomerate, Microsoft, also received a modest penalty from AEPD for its first relevant infringement in Spain. Google could claim, not without good reason, that it would be unfair to subject it to different treatment.

An additional argument is that, even if Google actually collected the type of data the AEPD claims it collected and transferred to the US, it is still unclear whether such data, if bundled into a confusing melange of information, is relevant for the purposes of the Spanish Data Protection Act. Clearly the AEPD thinks so, but as Spanish data protection practitioners remember, an AEPD opinion on what constitutes a "structured database" was challenged by the Spanish Supreme Court not long ago in the matter of the Valencia de-baptisms. The AEPD ruled that books of baptisms kept by the Catholic Church, many of them already in electronic form and containing names, surnames, dates of birth and many other details of the baptized child and his or her relatives, should be considered a "structured database" and therefore covered by the Spanish Data Protection Act. The Spanish Supreme Court reversed that decision, however, and the case is currently being reviewed by the Spanish Constitutional Court. If the decision of the Supreme Court is upheld, Google can argue that its "information bundles" are in fact less structured than the electronic book of baptisms, allowing Google to hold such bundles and move them relatively freely. Conversely, if the Constitutional Court rules in favor of the AEPD (and the precedent of the European Court of Justice in the Lindqvist case suggests it may), then Google would be have less basis for raising this argument.

Google may have also another card to play. The opening of a criminal sanctions procedure is bad news for any company, but ordinarily no one would really notice it until a final decision has been adopted. By taking the unusual step of issuing a press release asserting that Google had actually committed a number of infringements, as if its procedure had been concluded, the AEPD has actually taken a big risk. There is no final decision in the case. Google is legally entitled at the next stage of the procedure to provide evidence to demonstrate beyond any doubt that it has not committed any infringement. In that scenario, its reputation would have been seriously damaged before the final decision was made. Furthermore, because the AEPD stated explicitly in the press release that actual infringements had taken place, even before the case was heard, Google's constitutional right to be considered innocent until the contrary has been finally established by a court or a public authority would have been violated. This could support Google arguments seeking nullification of the whole proceeding.

It is true that when the dust settles, Google may be fined as much as €2.4 million. However, the overall impression from the information disclosed so far is that the game has just started and that a much lower fine is perhaps more likely. One thing is certain: this case will be followed closely both in Spain and abroad.