AEPD (Spain) - PS/00368/2020

AEPD - PS/00368/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 21 GDPR 48(1)(b) LGT 23(4) LOPDGDD
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	17.12.2020
Published:	22.12.2020
Fine:	6000 EUR
Parties:	n/a
National Case Number/Name:	PS/00368/2020
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (Spain) (in ES)
Initial Contributor:	Paola L.

The Spanish DPA (AEPD) initiated a sanctioning procedure against the utility company, Iberdrola Clientes, S.A.U (the defendant) for infringing Article 21 GDPR, Article 48(1)(b) LGT, and Article 23(4) LOPDGDD. The initial proposed fine was €10.000 however, Iberdrola benefited from two reductions of 20% in accordance with Article 85 of the Administrative Procedure Common of Public Administrations (LPACAP), for admitting responsibility and making an early payment of the fine.

English Summary

Facts

On June 24, 2020, the claimant filed a complaint with the AEPD in which he indicated that the defendant had contacted him through his mobile phone on three occasions despite being included in the 'Robinson list' (a.k.a Do not Call Register).

The first contact was made on 19/06/2020 from telephone number 'T1' to promote an offer on electricity services, the claimant inquired about the call and was informed that his telephone number was included in a database. The second, on 19/06/2020 (a few minutes later after the first call) from telephone number 'T2', during this call, the caller tried to obtain further personal data about the claimant. The third contact was made on 22/06/2020 again from telephone number 'T2' to offer new electricity discounts.

The claimant submitted along with his complaint a proof of being included in the ‘Robinson list’ since March 2010 as well as proof of ownership of the receiver telephone number.

The AEPD, admitted the complaint of the claimant in accordance with article 65 of the LOPDGDD and proceeded to transfer the claim to the defendant stating that it must respond within a month.

In response to the claim, the defendant stated that

(i) it had no records on the claimant

(ii) it did not own telephone number 'T2' nor it had been used to make marketing calls

(iii) the telephone number 'T1' did belong to one of its processors, however, the call must have been made as a result of a human error since the claimant’s telephone number does not appear on the marketing campaign list.

Dispute

Were the defendant's actions a violation of Article 21 of the GDPR? Should have the defendant verify the 'Robinson list' before contacting the claimant?

Holding

Based on the facts presented, the AEPD considered that the actions of the defendant infringed the following articles and laws:

• Article 21 GDPR – Right to Object
• Article 48 (1) (b) of the Spanish General Law of Telecommunications (LGT) - Right to object to receiving unsolicited communications
• Article 23 (4) of the Spanish Data Protection and Digital Rights Law (LOPDGDD) - Failure to consult the ‘Robinson list’ prior to contacting the claimant.

The AEPD held that this offense is considered as ‘minor’ in accordance with Article 78 (11) LGT which may be sanctioned with a fine up to €50.000 as per article 79 (b) of the same law. However, based on the evidence obtained from the preliminary investigation phase, the AEPD decided that a fine of €10.000 may be imposed.

In determining the amount of the fine, the AEPD applied the criteria provided in article 80 (2) LGT which takes into consideration the economic situation of the defendant.

Iberdrola Clientes S.A.U acknowledged its responsibility in accordance with Article 85 (1) LPACAP which resulted in a 20% reduction of the fine. Furthermore, it carried out the voluntary payment of the proposed fine before the resolution of the procedure, so an additional reduction of 20% was applied as provided in Article 85 (2) LPACAP.

Therefore, Iberdrola benefited from the two 20% reductions and paid €6.000 instead of the initial €10.000 proposed fine.

In accordance with the above, the AEPD concluded the sanctioning procedure against Iberdrola Clientes, S.A.U.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                            1/8











     Procedure No.: PS / 00368/2020

RESOLUTION R / 00640/2020 OF TERMINATION OF THE PROCEDURE FOR PAYMENT
                                   VOLUNTARY


In the sanctioning procedure PS / 00368/2020, instructed by the Spanish Agency for
Data Protection to IBERDROLA CLIENTES, SAU, considering the complaint filed
by A.A.A., and based on the following,

                                 BACKGROUND


FIRST: On November 24, 2020, the Director of the Spanish Agency
of Data Protection agreed to initiate a sanctioning procedure against IBERDROLA
CLIENTES, SAU (hereinafter, the claimed), through the Agreement that is transcribed:


<<




Procedure Nº: PS / 00368/2020




           AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE




Of the actions carried out by the Spanish Agency for Data Protection and in
based on the following:




                                     ACTS



FIRST: D. A.A.A. (hereinafter, the claimant) dated June 24, 2020

filed a claim with the Spanish Agency for Data Protection. The
The claim is directed against IBERDROLA CLIENTES, SAU with NIF A95758389 (in

forward, the claimed).



       The claimant states that on June 19, 2020 at 7:55 p.m.

hours received on his mobile a phone call made from the number
*** TELEPHONE. 1 by a commercial informing him that he was going to apply an offer in
light supposedly from the company of the claimed. He requested access and they answered him

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/8








that their data was included in a database. Immediately after,
received another call from the line *** PHONE. 2 trying to get your data

personal.




       Subsequently, he received two calls on June 22, 2020 from the line
*** TELEPHONE.2 offering you new discounts on electricity.




        Providing the following documentation.



       Proof of registration of the receiving line *** TELEPHONE 3 in the List

Robinson, since March 29, 2010.



       Telephone bill that justifies the ownership of the receiving line.




SECOND: In accordance with article 65.4 of the LOPGDD, which has provided a
mechanism prior to the admission for processing of claims made before

the AEPD, consisting of transferring them to the Data Protection Delegates
designated by those responsible or in charge of the treatment, for the intended purposes
in article 37 of the aforementioned rule, or to these when it has not designated them,

transfer of the claim to the claimed entity to proceed with its analysis and
respond to the complaining party and this Agency within one month.




       As a result of this process, on August 12, 2020, the claimed
states that they have no data on the claimant in their databases.




       In addition, it indicates that the number *** TELEPHONE.2 is not owned nor has it been
used to make commercial campaigns. On the contrary, the number

*** TELEPHONE.1 does belong to one of your telesales collaborators. Have
consulted with them and they indicate that the dialing must have occurred due to an error
human because it does not appear in their campaigns.







C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/8








                           FOUNDATIONS OF LAW




                                            I



       In accordance with the provisions of article 84.3) of Law 9/2014, of 9

May, General of Telecommunications (LGT), the competition to resolve the
This Penalty Procedure corresponds to the Director of the Agency

Spanish Data Protection.



                                            II






       In the present case, it has been proven that the claimant is included in the

Robinson List.



       In accordance with the evidence available in the present

moment of agreement to initiate the sanctioning procedure, and without prejudice to what
result of the instruction, it is considered that the defendant has contravened the article
48.1 b) of the LGT, in relation to article 21 of the RGPD, and article 23.4 of the

LOPDGDD, since the claimant on June 19, 2020 at 7:55 p.m.
received a business call on his personal mobile phone from one of the
telesales collaborators of the claimed, as acknowledged by the claimed in their

demonstrations to this Agency on August 12 last, "that the number
*** TELEPHONE.1 does belong to one of your telesales collaborators. Have

consulted with them and they indicate that the dialing must have occurred due to an error
human because it doesn't appear in their campaigns ”.




       The facts presented (the violation of the right to object) could
suppose the commission by the claimed party of an infraction of article 48.1.b) of
the LGT Law, contained in its Title III, which states that: “Regarding the protection of

personal data and privacy in relation to subscriber directories, users
end of electronic communications services will have the following

rights: (…) b) To oppose receiving unwanted calls for the purposes of
commercial communication carried out through systems other than those
established in the previous letter and to be informed of this right ”,

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/8











        Although the aforementioned article does not configure such a right, so we must go to
the data protection regulations in which the right of opposition is regulated:
Article 21 of the RGPD, (Regulation (EU) 2016/679, of the European Parliament and of the

Council, of 04/27/2016, regarding the Protection of Individuals in what
Regarding the Processing of Personal Data and the Free Circulation of this Data) and

Article 23 of the LOPDGDD (Organic Law 3/2018, of December 5, on Protection
of Personal Data and Guarantee of Digital Rights).




        This offense is classified as "minor", in article 78.11) of
said norm, which considers as such: “The breach of the obligations of
public service, public obligations and violation of the

rights of consumers and end users as established in Title III
of the Law and its implementing regulations ”, which may be sanctioned with a fine of up to

€ 50,000, in accordance with article 79.d) of the aforementioned LGT.



                                              III




        In accordance with the indicated precepts, and without prejudice to what results from the

instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In the present case, it is considered that the sanction to be imposed should be adjusted according to
with the following criteria established in article 80.1) and 2) of the LGT:




   - The consideration of the economic situation of the offender, (point 2).




    After the evidence obtained in the preliminary investigation phase, it is considered
that the sanction to be imposed should be graduated in the amount of € 10,000 (ten thousand euros).




        Therefore, based on the foregoing,




        By the Director of the Spanish Agency for Data Protection,




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/8








       HE REMEMBERS:




FIRST: INITIATE SANCTIONING PROCEDURE for IBERDROLA CLIENTS,
SAU with NIF A95758389, for the alleged violation of article 48.1.b) of the LGT Law

classified as “mild” in article 78.11) of the aforementioned LGT Law in relation to
article 21 of the RGPD, and article 23.4 of the LOPDGDD.




SECOND: APPOINT D. B.B.B. as instructor. and, as secretary, Ms.
C.C.C., indicating that any of them may be challenged, where appropriate, in accordance with
the provisions of articles 23 and 24 of Law 40/2015, of October 1, on the Regime

Public Sector Legal (LRJSP).



THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the

claim filed by the claimant and his documentation, the documents
obtained and generated, which are part of the file.




FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1
October, of the Common Administrative Procedure of Public Administrations, the

The corresponding penalty would be € 10,000 (ten thousand euros), without prejudice to the
resulting from the instruction.




FIFTH: NOTIFY this agreement to IBERDROLA CLIENTES, SAU with NIF
A95758389, granting him a hearing period of ten business days to formulate
the allegations and present the evidence that it deems appropriate. In his writing of

allegations, you must provide your NIF and the procedure number that appears in the
heading of this document.




       If, within the stipulated period, no allegations are made to this initiation agreement, the
It may be considered a resolution proposal, as established in the
Article 64.2.f) of Law 39/2015, of October 1, on Administrative Procedure

Common of Public Administrations (hereinafter, LPACAP).



       In accordance with the provisions of article 85 of the LPACAP, in the event of

that the sanction to impose was a fine, you may recognize your responsibility within

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/8








of the term granted for the formulation of allegations to this initiation agreement; the
which will entail a reduction of 20% of the sanction to be imposed in

this procedure. With the application of this reduction, the sanction would be
established at € 8,000 (eight thousand euros), resolving the procedure with the

imposition of this sanction.



       In the same way, you may, at any time prior to the resolution of the

present procedure, carry out the voluntary payment of the proposed sanction,
which will mean a reduction of 20% of its amount. With the application of this
reduction, the penalty would be established € 8,000 (eight thousand euros), and its payment

will imply the termination of the procedure.



       The reduction for the voluntary payment of the penalty is cumulative to that

corresponds to apply for the recognition of responsibility, provided that this
acknowledgment of responsibility is revealed within the term

granted to formulate allegations at the opening of the procedure. The pay
Voluntary amount of the amount referred to in the previous paragraph may be done at any
time before resolution. In this case, if applicable, apply both

reductions, the amount of the penalty would be set at € 6,000 (six thousand euros).



       In any case, the effectiveness of either of the two mentioned reductions

It will be conditioned to the withdrawal or resignation of any action or remedy in progress.
administrative against the sanction.




       In the event that you choose to proceed to the voluntary payment of any of the
amounts indicated above (8,000 or 6,000 euros), you must make it effective

by entering the account number ES00 0000 0000 0000 0000 0000 open to
name of the Spanish Data Protection Agency in Banco CAIXABANK,
S.A., indicating in the concept the reference number of the procedure that appears in

the heading of this document and the cause of reduction of the amount to which
welcomes.




       Likewise, you must send proof of admission to the Subdirectorate General of
Inspection to continue the procedure according to the quantity
entered.




C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/8








       The procedure will have a maximum duration of nine months from
the date of the initiation agreement or, where appropriate, the draft initiation agreement.

After this period, its expiration will occur and, consequently, the file of
performances; in accordance with the provisions of article 64 of the LOPDGDD.




       Finally, it is pointed out that in accordance with the provisions of article 112.1 of the
LPACAP, against this act there is no administrative appeal.




Mar Spain Martí

Director of the Spanish Agency for Data Protection




>>

SECOND: On December 15, 2020, the defendant has made the payment of

the fine in the amount of 6,000 euros making use of the two reductions
provided for in the Initiation Agreement transcribed above, which implies the
acknowledgment of responsibility.

THIRD: The payment made, within the period granted to formulate allegations to

the opening of the procedure, entails the waiver of any action or appeal in the process
administrative against the sanction and the recognition of responsibility in relation to
the facts to which the Initiation Agreement refers.

                            FOUNDATIONS OF LAW


                                            I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in art. 47 of Organic Law 3/2018, of 5

December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said
Regulation; infractions of article 48 of Law 9/2014, of May 9, General
of Telecommunications (hereinafter LGT), in accordance with the provisions of the

article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and
38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.







C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/8








                                            II


Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter, LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:
"1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility,
the procedure may be resolved with the imposition of the appropriate sanction.


2. When the sanction is solely of a pecuniary nature or it is possible to impose a
pecuniary sanction and other non-pecuniary sanction, but the
inadmissibility of the second, the voluntary payment by the presumed responsible, in
any time prior to the resolution, will imply the termination of the procedure,

except in relation to the replacement of the altered situation or the determination of the
compensation for damages caused by the commission of the offense.

3. In both cases, when the sanction is solely of a pecuniary nature, the
competent body to resolve the procedure will apply reductions of, at least,

20% of the amount of the proposed penalty, these being cumulative among themselves.
The aforementioned reductions must be determined in the notice of initiation
of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of
any action or appeal in administrative proceedings against the sanction.


The percentage of reduction foreseen in this section may be increased
regulations.

In accordance with the above, the Director of the Spanish Agency for the Protection of
Data RESOLVES:


FIRST: DECLARE the termination of procedure PS / 00368/2020, of
in accordance with the provisions of article 85 of the LPACAP.

SECOND: NOTIFY this resolution to IBERDROLA CLIENTES, SAU.


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by

the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the

Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.


                                                                                  936-031219
Mar Spain Martí

Director of the Spanish Agency for Data Protection

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es