The usual practice of picking up packages sent to a neighbor may have its days numbered.
The Spanish Agency for Data Protection (AEPD) has imposed a fine of 70,000 euros on the courier company UPS
for delivering an order placed over the Internet to the Media Markt company to a neighbor of the recipient without their authorization.
The events date back to March 2021, when the person who made the purchase denounced that by leaving the shipment to another person
, their personal data had been transferred to a third party, without their consent
.
And this is how the agency has understood it, which considers that
precept 5.1 f) of the General Data Protection Regulation (RGPD) and article 32 of the RGPD have been violated "by violating the principle of integrity and confidentiality
, as well as not adopting the necessary security measures to guarantee the protection of the personal data of its clients", according to the resolution.
For the first
it imposes a fine of 50,000 euros on UPS and 20,000 for the second
.
Initial claim to Media Markt
Although the user initially complained to Media Markt,
the AEPD considers that United Parcel Service (UPS) is responsible for guaranteeing the protection of customer data
.
The resolution takes into account that in the contract between the two companies, UPS specifies that "if the receiver is not available,
the package may be deposited in the mailbox of the receiver's address, if it is considered appropriate, or delivered to the neighbor
unless the sender has excluded this delivery option by choosing the applicable additional service."
However, for the Spanish Agency for Data Protection,
although Media Markt has not notified anything to that effect to UPS, the carrier cannot provide the personal data to a third party and for that reason imposes the fine
.
The courier company can appeal the resolution before the Contentious-Administrative Chamber of the National High Court.
Conforms to The Trust Project criteria
Know more