The Spanish DPA fined a company € 9,000.00 for using unnecessary cookies without consent, without a reject option and without a banner.
Cookies that were not necessary, were activated directly when viewed on the online video portal run by JIMBO NETWORKS S.L., without the users’ consent. Some of these activated cookies were provided by third-party vendors.
The website does not provide the option to disable all or specific cookies. Users were instead instructed to configure the cookies through their browser settings.
The cookie policy also lacked information on whether the cookies used were created by the firm or by third-party suppliers, as well as when they were active on the users’ end devices. Furthermore, the videoportal lacked a cookie banner.
The initial fine of EUR 15,000 was made up of the following components:
- EUR 5000 for a breach of Art. 6 (1) GDPR;
- EUR 5000 for a violation of Art. 13 GDPR; and
- EUR 5000 for a violation of Art. 22 (2) LSSI.
It was lowered to EUR 9’000 due to acknowledgment of guilt and voluntary payment.
During its examination, the Spanish DPA discovered that Jimbo Networks had breached Articles 6(1) and 13 of the GDPR by processing personal data without a valid basis and without the data subject’s agreement, and that that information had not been effectively communicated to data subjects. Furthermore, the DPA found Jimbo Networks to be in violation of Article 22(2) of the LSSI since the website lacked an effective cookie policy.
Want to see how to create an effective GDPR compliant cookie policy in under 2 minutes? Watch the video here!
