{"id":17294,"date":"2021-09-16T09:48:06","date_gmt":"2021-09-16T08:48:06","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=17294"},"modified":"2023-10-05T10:52:53","modified_gmt":"2023-10-05T09:52:53","slug":"hosting-services-100000-euro-fine-to-a-company","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/hosting-services-100000-euro-fine-to-a-company\/","title":{"rendered":"Hosting services: 100,000 euro fine to a company"},"content":{"rendered":"\n

The AEPD has fined<\/a><\/strong> a company that offered data and APP hosting services \u20ac100,000 for not returning the data hosted to one of its clients.<\/p>\n\n\n\n

What does the GDPR and the AEPD say about hosting services companies?<\/strong><\/h2>\n\n\n\n

From reading the sanctioning resolution and many others, it can be deduced that companies that host data (personal but also other types) on behalf of their clients are considered the processors<\/strong>. <\/p>\n\n\n\n

According to the GDPR, these are the ones who process personal data “on behalf of their clients”. In other words, when a company decides to subcontract a service and this implies that the provider is going to access personal data collected by the client, this service provider will be considered the party in charge of processing, or the processor. <\/p>\n\n\n\n

Its task is none other than to process (in the broadest sense of the term) the data, to fulfil the mandate of its clien<\/strong>t who is, in turn, the controller.<\/p>\n\n\n\n

What are the obligations of the processor? <\/strong><\/h2>\n\n\n\n

In essence, its functions and obligations are set out in a contract that must be signed<\/strong> between the processor and the controller. In this contract, which is mandatory according to the GDPR, the purpose or purposes of the processing or use of the data or information will be clearly established. Likewise, the obligation is set forth for the processor that, once the contract is resolved or terminated, he must, at the client\u2019s discretion, return the data or destroy it, proving in the latter case that destruction has been effective.<\/p>\n\n\n\n

Hosting services: What does the AEPD sanction?<\/strong><\/h2>\n\n\n\n

Although it is not an excessively recent sanction, it is exceptional because of its content, and it is certainly a warning for hosting companies (and other computer services) that they are clear about their obligations when entering into a contract with a client.<\/p>\n\n\n\n

In this case, the aforementioned client repeatedly asked for their databases and applications to be hosted on servers other than those managed by the hosting company. Faced with such a request, the provider delayed the solution to the point that it did not collaborate in any way in the efficient transfer of the data. <\/p>\n\n\n\n

This situation meant that the client was unable to comply with obligations and procedures as basic as the payment of certain taxes or bank transfers. Due to this situation and the damage caused to the client, the AEPD sanctioned the hosting provider with a fine of \u20ac 100,000.<\/p>\n\n\n\n

If you are a hosting company or other computer service company remember that<\/strong>:<\/h3>\n\n\n\n