[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_caE5harB9_tNAeXPaEYtRWJY6uCu8qOgVItjEjw8z8":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"079657bd-2460-4682-8c1e-7186ebe745c1","AEPD (Spain) - PS-00008-2025","aepd-spain-ps-00008-2025-d8fa05","← Older revision Revision as of 13:48, 21 August 2026 Line 97: Line 97: === Facts === === Facts === RAMONA FILMS, S.L., the controller, operated websites offering audiovisual content through subscriptions. In November 2023, the DPA fined the controller in proceedings PS-00308-2023 for several GDPR infringements, including a breach of [[Article 28 GDPR|Article 28(3) GDPR]] concerning the absence of a data processing agreement with a payment service provider, the processor. The DPA also ordered the controller, pursuant to [[Article 58 GDPR|Article 58(2)(d) GDPR]], to provide within one month the processor agreement concluded with the processor. RAMONA FILMS, S.L., the controller, operated websites offering audiovisual content through subscriptions. In November 2023, the DPA fined the controller in proceedings [https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00308-2023.pdf PS-00308-2023] for several GDPR infringements, including a breach of [[Article 28 GDPR|Article 28(3) GDPR]] concerning the absence of a data processing agreement with a payment service provider, the processor. The DPA also ordered the controller, pursuant to [[Article 58 GDPR|Article 58(2)(d) GDPR]], to provide within one month the processor agreement concluded with the processor. In December 2023, instead of providing the requested agreement, the controller informed the DPA that the two companies should be considered joint controllers. Following an investigation, the controller provided an unsigned and undated purported joint controller agreement. It subsequently acknowledged that this agreement had never been signed. In December 2023, instead of providing the requested agreement, the controller informed the DPA that the two companies should be considered joint controllers. Following an investigation, the controller provided an unsigned and undated purported joint controller agreement. It subsequently acknowledged that this agreement had never been signed. Line 104: Line 104: The controller argued that it had complied with the measures imposed and requested the closure of the proceedings. The controller argued that it had complied with the measures imposed and requested the closure of the proceedings. === Holding === === Holding === The DPA found that the controller had infringed [[Article 58 GDPR|Article 58(2) GDPR]] by failing to comply with the corrective order issued in the previous proceedings. The DPA found that the controller had infringed [[Article 58 GDPR|Article 58(2) GDPR]] by failing to comply with the corrective order issued in the previous proceedings. The DPA held that the controller had neither concluded the processor agreement required by the previous decision nor demonstrated that its relationship with the processor had instead been validly established as joint controllership under [[Article 26 GDPR|Article 26 GDPR]]. In particular, the purported joint controller agreement was unsigned and undated, and the controller ultimately acknowledged that it had never been concluded. The DPA held that the controller had neither concluded the processor agreement required by the previous decision nor demonstrated that its relationship with the processor had instead been validly established as joint controllership under [[Article 26 GDPR]]. In particular, the purported joint controller agreement was unsigned and undated, and the controller ultimately acknowledged that it had never been concluded. The DPA also rejected the controller's arguments that the relationship with the processor and the subscription service had been terminated. It considered that the controller had provided contradictory information throughout the investigation and had failed to substantiate these claims. Consequently, the DPA found that the corrective measure imposed under [[Article 58 GDPR|Article 58(2)(d) GDPR]] remained unfulfilled. The DPA also rejected the controller's arguments that the relationship with the processor and the subscription service had been terminated. It considered that the controller had provided contradictory information throughout the investigation and had failed to substantiate these claims. Consequently, the DPA found that the corrective measure imposed under [[Article 58 GDPR|Article 58(2)(d) GDPR]] remained unfulfilled.","Spain's data protection authority (AEPD) has fined Ramona Films, S.L. for failing to comply with a corrective order issued in previous GDPR proceedings. The company was initially fined for lacking a data processing agreement with a payment service provider and was ordered to provide the agreement. Instead, Ramona Films claimed joint controllership, providing an unsigned and undated agreement, which it later admitted was never signed. The AEPD found this to be a violation of Article 58(2) GDPR.","Spain's AEPD fines Ramona Films for failing to comply with a previous GDPR order.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00008-2025&diff=52752&oldid=52748","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-08-21T13:48:17+00:00","2026-08-21T14:00:15.462815+00:00",7,[17,20],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[46],{"type":47,"value":48,"context":49},"url","https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00308-2023.pdf","Link to previous AEPD decision PS-00308-2023",[18,21],{"controls":52,"vendors":53},[],[],{"slug":55,"title":56,"body":57,"framework_refs":58,"framework_notes":67},"ramona-films-fined-for-ignoring-gdpr-corrective-order-on-data-processing-agreement","Ramona Films Fined for Ignoring GDPR Corrective Order on Data Processing Agreement","Ramona Films failed to comply with a corrective order from Spain's AEPD requiring a formal data processing agreement with their payment service provider, ultimately submitting an unsigned and undated document they later admitted was never executed. This case highlights that attempting to reframe a compliance obligation (shifting from processor to joint controller status) without proper legal basis compounds the original violation. Regulators treat non-compliance with corrective orders as a serious aggravating factor, demonstrating that procedural follow-through on GDPR obligations is just as critical as the initial compliance. Organizations must treat regulatory orders as binding legal deadlines, not suggestions, and ensure any agreements submitted as evidence are legally valid and verifiable.",[59,60,61,62,63,64,65,66],"GDPR Article 26 (Joint Controllers)","GDPR Article 28 (Processor Agreements)","GDPR Article 58(2) (Corrective Powers of Supervisory Authority)","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 PM-1 (Information Security Program Plan)","CIS Control 15 (Service Provider Management)","ISO 27001 Annex A.15.1 (Information Security in Supplier Relationships)","ITIL Service Design – Supplier Management",{}]