In 2018, following a complaint from an affected individual and together with the participants [1]<\/a> to our university postgraduate program in Technopolitics and Rights in the Digital Age<\/a>, we began investigating how it was possible that the personal data of the vast majority of freelancers\u2014those data we are required to provide when registering as a freelancer, including sensitive information like our home address\u2014were being sold online by private consulting firms without our consent or benefit. Where was the breach in data custody by institutions?<\/p>\n In 2022, we published a compelling report, “Abuses in the labor field: sale of data of freelancers<\/strong>” where we explained that it was the very Chamber of Commerce that allowed and facilitated this violation of rights: We reported this in December 2022 to the Spanish Data Protection, which opened an investigation in April 2023, and…<\/p>\n Today, they issued a statement confirming that they agree with what we requested and a total fines amount to one million euros.<\/strong> In the case concerning the Spanish Chamber of Commerce, multiple infringements of the General Data Protection Regulation (GDPR) were identified:<\/strong><\/p>\n 2. Article 5(1)(b) GDPR \u2013 Purpose Limitation 3. Article 5(1)(f) GDPR \u2013 Integrity and Confidentiality 4. Article 5(1)(a) GDPR \u2013 Lawfulness, Fairness, and Transparency 5. Article 14 GDPR \u2013 Duty to Inform Data Subjects Total amount of sanctions: \u20ac500,000<\/strong>.<\/ul>\n 6. In addition to the financial penalties, the Spanish Data Protection Agency (AEPD) has expressly ordered the Spanish Chamber of Commerce<\/strong> to:<\/p>\n – Cease the transfer of personal data to Camerdata within one month<\/strong> from the date the decision becomes final and enforceable. <\/p>\n Xnet\u2019s work is explicitly acknowledged and highlighted in the AEPD\u2019s resolution, which can be accessed through the provided viewer<\/strong>.<\/p>\n [pdf]https:\/\/xnet-x.net\/?p=28525[\/pdf] (Chamber of Commerce fine of \u20ac500,000)<\/a> TOTAL AMOUNT: \u20ac1,518,000 <\/p>\n<\/div>\n
\nhttps:\/\/xnet-x.net\/en\/abuses-labor-field-sale-data-freelancers\/<\/a><\/p>\n
\nhttps:\/\/xnet.maadix.org\/nextcloud\/index.php\/s\/6pijiTLrggWHeTs<\/a><\/p>\n
\nhttps:\/\/www.aepd.es\/informes-y-resoluciones\/criterios-juridicos-aepd\/tratamiento-datos-personales-empresarios-autonomos<\/a>
\n <\/p>\nSome of the press echoes:
\nGDPRhub
\nhttps:\/\/gdprhub.eu\/index.php?title=AEPD_(Spain)_-_EXP202404641<\/a>
\nEl Pa\u00eds
\nProtecci\u00f3n de Datos ordena el borrado masivo de los listados de aut\u00f3nomos de las bases de datos empresariales<\/a>
\nEl Peri\u00f3dico
\nRev\u00e9s a la C\u00e1mara de Comercio de Espa\u00f1a por desproteger los datos personales de millones de aut\u00f3nomos<\/a>
\nXataka
\nLa AEPD ya sabe de d\u00f3nde han salido los datos de millones de aut\u00f3nomos que estaban a la venta en internet: la C\u00e1mara de Comercio<\/a><\/ul>\nInfringements reported by us and confirmed by the AEPD<\/h4>\n
\n
\n1. Article 6(1) GDPR \u2013 Lawfulness of Processing<\/strong>
\nThe Chamber unlawfully disclosed personal data to Camerdata without a valid legal basis.
\nAdministrative fine: \u20ac100,000<\/strong>.<\/p>\n
\nPersonal data initially collected to create a public census was subsequently used for purposes incompatible with the original one, namely for commercial use.
\nAdministrative fine: \u20ac100,000<\/strong>.<\/p>\n
\nThe Chamber failed to ensure the security and confidentiality of the Tax Identification Number (NIF) and other personal data.
\nAdministrative fine: \u20ac100,000<\/strong>.<\/p>\n
\nThe principle of fairness was violated in relation to self-employed individuals who had provided their personal data in good faith, trusting it would not be disclosed without their consent.
\nAdministrative fine: \u20ac100,000<\/strong>.<\/p>\n
\nThe Chamber failed to properly inform data subjects (self-employed individuals) of the data transfer to Camerdata.
\nAdministrative fine: \u20ac100,000<\/strong>.<\/p>\n\n
\n– Failure to comply with this order may result in the initiation of an additional sanctioning procedure by the AEPD.<\/ul>\n
\n <\/p>\n
\n(Camerdata fine of \u20ac260,000)<\/a>
\n(\u20ac900,000)<\/a>
\n(\u20ac360,000)<\/a>
\n(\u20ac18,000)<\/a><\/p>\n