Controllers and processors: Spanish fine underlines the importance of the factual analysis

The Spanish DPA, the AEPD, has fined a parcel delivery company €200,000 for failing to have an agreement in place with a parcel locker provider that met the requirements of Article 28 of the GDPR. The decision serves as a reminder that it's important to analyse the actual data flows and decision-making when contracting for a new service, and to ensure that your contractual characterisation of the parties' roles reflects the the factual position. 

The delivery company, SEUR GEOPOST, had an agreement with CITIBOX, which provided parcel lockers in residential buildings. SEUR's courier would deposit a parcel and provide CITIBOX with the phone number of the addressee. CITIBOX would then contact the addressee by text message, telling them how they could retrieve their parcel. The agreement between the parties addressed the transfer of personal data between the two companies on the basis that they were both postal operators and acted as independent controllers. The AEPD acknowledged that the parties had made an effort to define their roles, but considered their analysis was incorrect.

Referring extensively to EDPB Guidelines 07/2020, the AEPD emphasised the importance of considering the factual context. The specific processing operations carried out by CITIBOX had no independent existence, and only made sense within the framework of SEUR's overall responsibility for the delivery of the parcel. This factual context took precedence over how the parties had formally classified themselves in their contract. In this situation CITIBOX was acting as a data processor for SEUR, even if it might be a data controller when acting as a postal operator in other contexts.

This had significant implications as an Article 28-compliant contract not only articulates the legal relationship between the parties, but also serves as a guarantee of the rights and freedoms of the data subjects. In addition to imposing the fine, the AEPD instructed SEUR to demonstrate that it had an appropriate data processing agreement in place within three months.

The full decision can be found here.