AEPD (Spain) - PS/00197/2020: Difference between revisions

From GDPRhub
No edit summary
Line 116: Line 116:
<pre>
<pre>


Page 1
1/37
 Procedure No.: PS / 00197/2020
938-0419
RESOLUTION OF SANCTIONING PROCEDURE
In the sanctioning procedure PS / 00197/2020, instructed by the Spanish Agency for
Data Protection, to the entity, I-DE REDES ELÉCTRICAS INTELIGENTES, SAU
(I-DE), previously known as IBERDROLA SA, with CIF: A95075578, (hereinafter
above, “the claimed entity”), by virtue of the complaints filed by the entity
WATIUM, SL, with CIF .: B86459260 and by the entity ENERGIA Y SERVICIOS ABY
2018, SL, with CIF .: B85114098, (hereinafter, “the complaining entities”), and in
based on the following:
BACKGROUND
FIRST: On 03/11/19, you had a written entry in this Agency, presented by
the complaining entity, WATIUM SL, in which he filed a claim against the entity
I-DE, for, among others, the sending of a series of letters to its clients by the
claimed entity distracting the purpose for which the data was transferred and
lacking the legal basis to contact them, in breach of formal
reiterated the principles of limitation of the purpose and the principle of minimization of
data. Said complaint is fully reproduced, both in the opening brief
of file, dated 07/24/20, as well as in the draft resolution proposal, of
date 11/25/20.
SECOND: In view of the facts set forth in the claim and the documents
provided by the claimant, the Subdirectorate General for Data Inspection proceeded
to carry out actions for its clarification, under the powers of investigation
granted to the control authorities in article 57.1 of the Regulation (EU)
2016/679 (RGPD). Thus, dated 06/25/19, informative requirements were addressed to the
claimed entity.
THIRD: On 06/25/19, the claimed entity sent this Agency a written
of allegations to the complaint presented by the complaining entity, reproduced, both
in the brief initiating the file, dated 07/24/20, as well as in the
Resolution, dated 11/25/20.
FOURTH: On 01/08/20, he entered this Agency, written by the entity
ENERGÍA Y SERVICIOS ABY 2018, SL., In which he filed a claim against the
entity I-DE, for, among others, the illicit remittance of a series of letters to its clients
by the claimed entity. Said complaint is fully reproduced, as-
to in the brief of initiation of the file, dated 07/24/20, as in the brief of
motion for a resolution, dated 11/25/20.
FIFTH: On 02/20/20, and in view of the facts presented in the allegations
submitted by the claimed entity, a request for a report is addressed to the COMMISSION
NATIONAL OF MARKETS AND COMPETITION, (CNMC), Subdirectorate of
Regulation of Electronic Communications.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 2
2/37
SIXTH: On 03/10/20, the CNMC sent an explanatory report to this Agency, including
fully reproduced, both in the brief of initiation of the file, dated
07/24/20, as in the draft resolution proposal, dated 11/25/20.
SEVENTH: In view of the denounced facts, of the documentation provided by
the parties and in accordance with the evidence available, the Director of the
Spanish Data Protection Agency, on 07/24/20, agreed to initiate procedures
sanctioning the entity claimed, by virtue of the powers established, by
alleged breach of the provisions of articles 5.1.b) and c) and 6.1.b) of the RGPD,
punishable in accordance with the provisions of art. 58.2 of the aforementioned RGPD, proposing a
initial penalty of 200,000 euros (two hundred thousand euros), without prejudice to what results
I know of the instruction of the sanctioning procedure.
EIGHTH: On 08/17/20, the claimed entity filed before this Agency in writing
to of allegations at the initiation of the sanctioning file, reproduced in the brief
resolution proposal, dated 11/25/20.
NINTH: On 10/21/20, the test practice period began, agreeing-
it is in the same: a) .- to consider reproduced for evidentiary purposes the complaint filed
by the complainant and its documentation, the documents obtained and generated that
are part of file E / 03624/2019 and b) .- consider reproduced for probable purposes.
tories, the allegations to the agreement to initiate PS / 00197/2020, presented by the entity
claimed dad.
TENTH: On 11/25/20, the claimed entity is notified of the proposed resolution
solution in which it was proposed that, by the Director of the Spanish Protection Agency
tion of Data the claimed entity is sanctioned, for infringement of the articles
5.1.b) and c) and 6.1.b) of the RGPD, with a fine of 200,000 euros (two hundred thousand euros),
in accordance with the provisions of article 58.2) of the aforementioned RGPD.
ELEVENTH: After notification of the proposed resolution, dated 12/18/20, the
claimed entity submitted a brief of allegations to the proposed resolution, in the
which indicated the following:
“As a preliminary question, this part considers it necessary to show that the same
ma can only reiterate the totality of what was indicated in its brief of allegations to the
Initiation Agreement relapsed in this file, since, in our opinion,
the content of the Proposed Resolution hardly contains different arguments or
additional to those expressed in the aforementioned Initiation Agreement.
And it is that even when the Proposal for Resolution appears to lead to
carry out a legal analysis of the question raised in the present proceeding, such a
This is purely apparent, for nearly thirty of his forty-eight parents
gines are limited to reproduce in their entirety the allegations made by this party
to the Initiation Agreement.
In turn, with regard to the fundamentals of law, under the guise of a
alleged refutation of the arguments supported by this part, the Proposal for Re-
solution does not even substantiate the reasons that lead to the rejection of the totality of
the allegations made by my client in the Initiation Agreement, limiting itself to
contradict what this party alleged in said brief through arguments that include
are partially reproduced, and not in their entirety, the applicable legal provisions
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 3
3/37
with the sole purpose of reinforcing the sanctioning sense of the decision adopted even
when the quotation of the precept on which they are apparently based is partial.
In this way, in the opinion of my client, the Proposal for a Resolution even includes:
Regarding the Initiation Agreement, less legal bases that allow this party to
You adequately defend the legality of the treatment of your clients' data carried out
carried out by sending the letters referred to in this procedure.
suffering, despite his appearance, from a complete lack of motivation that
prevents my client from making adequate use of his right to defense.
All of this implies, in our opinion, a violation by the Proposed Resolution
tion of the principle of legal certainty, as well as their right to judicial protection
effective, enshrined respectively by articles 9.3 and 24 of the Constitution.
Having made the above considerations, and even when this implies a certain reiteration
Regarding the allegations already made by my client, they will try to expose,
In short, the arguments that, in the opinion of my client, justify without any
No doubt, the complete lawfulness of his conduct. To do this, even altering the systematic
ca followed by the Proposal for Resolution, first reference will be made to the
substantive issue that is the subject of this proceeding, that is, to the
absolute legality of the conduct of my client in this case, to analyze later-
the serious formal defects in which, in the opinion of my principal, the
present procedure and, finally, the inadequate assessment made by the AEPD
of the circumstances that concur in the case and that, in his opinion, aggravate the responsibility
bility of I-DE.
SECOND.- NON-EXISTENCE IN THE CONDUCT OF I-DE VIOLATION OF THE
PERSONAL DATA PROTECTION REGULATIONS
1. On the full compliance of the action carried out by my client with the
Civil Code and the regulatory regulations of the electricity sector
My client, in the second of his allegations to the Initiation Agreement, fully
produced in the Proposal for Resolution, explained in detail the legality of the treatment
data collection carried out by the same as necessary for the proper performance
return of the contractual relationship that links you with the final energy consumer
with which you sign the corresponding network access contract (in addition,
above, “ATR”), with the marketer acting as a mere representative representative of the
representative of said consumer.
Given the length of the aforementioned allegation and that, on the other hand, it has not
been object of an effective contradiction in the Proposed Resolution, understands this
part that now only proceeds to reiterate the summary of the aforementioned arguments
which was included in section 7 of the aforementioned second claim, in the following terms:
minos:
"1. Consumers of electricity must sign, together with the supply contract,
with a marketer, a contract for access to networks, with the distributor holding
of the existing network in its geographic area (in this case I-DE), being parts of di-
cho contract the distribution company and the final consumer. 2. The consumer may enter-
commend the signing of said contract to the marketer with whom they had contracted
supply, being able to sign the access contract with the distributor, but in
in any case as agent or substitute for the consumer and acting in any case in
name and on behalf of the former and by virtue of sufficient power of attorney. 3. In no
In this case, they will apply to the contract entered into by the marketer as a mandate.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 4
4/37
the client's rules of the non-representative mandate, maintaining the relationship
contractual, in any case, between the distributor and the customer who owns the supply point.
another. 4. Consequently, there would not be properly an assignment to the distributor of the data.
the consumer by the marketer, since these data would be obtained by the
distributor primarily, by referring to the party with whom it has a relationship
contractual, signed by a mere agent. 5. Within the different obligations
contractual of the access contract is the payment of the access tolls,
of which the mandatory marketer and the client would jointly and severally respond. He in-
fulfillment of this obligation two months after the request for
Payment of these tolls enables the distribution company to suspend supply
electric. 6. In the present case, even though the clients had satisfied the co-
marketing company the amount of access tolls, it had not paid I-DE the
amount of these, for which my client required payment to the marketer, directed
Giving the request to your home, as stated in the contract and in compliance with
compliance with current legislation. 7. After the legally established period has elapsed without the
request was attended, and thus showing my client the right to suspend the
supply, I-DE communicates to its customers this circumstance and the consequences that
This may be accompanied, expressly stating that said writing
In no way does it imply a request for payment to customers. 8. Therefore, my man-
dante is limited to communicate in the normal development of its contractual relationship with
his clients, highlighting the breach by his agent of the obligations
actions derived from the contract in order for the clients to adopt the measures
that it deems appropriate. 9. The CNMC is aware of the sending of these communications
nes, at least as a result of the complaint made by the marketer.
However, said Commission agrees not to proceed with any proceeding against me.
but to transfer the antecedents to the Directorate of Energy so that they can investigate
tigue the possible violation of the sectoral regulations by the marketer. "
2. Regarding the legality of sending the communications as a consequence of the non-compliance
payment of fees and suspension of supply that may lead to
corporal I-DE
The Proposal for a Resolution limits itself to stating that, even though it seems to be recognized
expressly the existence of an ATR contract between my client and the consumers
final authorities, only the acts of communication between the parties of this that
are expressly included in the law, being forbidden any communication
tion related to the contract itself that is not the subject of this express legal reflection.
Indeed, the Proposal focuses the entirety of its argumentation on considering that,
As indicated on page 43, after citing the acts of communication between the parties to the
contract that are included in the electrical legislation, "between the detailed relationship
exposed, no point is found or written about the sending of infor-
explanations explaining to the final consumer, among other things, the alleged non-compliance
contractual relationship between the marketing company and the distribution company, such as
is the case that concerns us ”, adding later that“ the sending of infor-
control to final consumers of the alleged contractual breaches of
the marketer with the distributor does not fall within the range of communications
tions necessary and pertinent for the performance of the contract by the entity
distribution authority ”, since, it seems, these communications should be carried out
carried out “only and exclusively through a marketer, as the latter has constituted
do as a consumer agent before the distributor ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 5
5/37
Thus, the Proposal seems to consider that even when there is a relationship
contractual agreement between the distribution company and the final consumer, even if the
cializer signs the ATR contract as agent (with express power, that is, without
act on their own behalf) of the consumer, the development of said relationship only
allows limited communication between the parties, and it is not possible for them to
are related not even for such an essential aspect within the framework of the relation
such as the suspension of the provision of one of the parties as a conse-
of the contractual breach attributable to the other, even though said non-compliance
compliance is committed by his agent, since the consumer responds solicitously
daily with the marketer of the payment of the fees.
And it is that, regarding the cause that, ultimately, justifies the remission of the communications
tions that, in the opinion of the AEPD determines the illegality of the conduct of my client,
The Proposed Resolution on pages 44 and 45 states the following:
“If we enter into the content of the letters sent by the claimed entity to the
final consumers (point 5 of the allegations), we must indicate that the article
52.3 of the LSE, refers to the possible suspension of the supply contract
when it is the final consumer who defaults and this is established in the referred
Article: “3.- (…) the supply of electricity to consumers may be suspended.
meters under voluntary prices for the small consumer or last-minute rates
appeal when at least two months have elapsed since they had been
reliably required payment without it having been made effective. (…) "
but in the present case, this does not happen, since, in the absence of evidence to the contrary, the
final consumer if he complies with his obligation to pay the cost of the invoice when trading
and apparently, it is he who fails to comply with his obligation vis-à-vis the distributor.
dor: "
Apart from the confusing wording of the paragraph reproduced, it causes at least per-
plejidad to my client the fact that the Proposal for Resolution omits, in the
production of article 52.3 of Law 24/2013, of December 26, on the Electricity Sector.
co (hereinafter, “LSE”) the referral made expressly in its first subsection, se-
according to which the possibility of suspension of supply will take place “[s] without prejudice to
what is established in the fourth section of this article, under the conditions
glamentarily determined ”.
And said omission is essential in the present case, since article 4.4 of the
Royal Decree 1164/2001, of October 26, which establishes access fees
to the electricity transmission and distribution networks (hereinafter, “RD
1164/2001 ”), which is the one that determines the conditions to which the aforementioned article refers.
Assignment 53.2, establishes the following:
“The distribution company may suspend the access fee contract when it has-
and at least two months have elapsed since he had reliably required the
payment to the consumer or his agent, in accordance with the scope of the
access raffles established in article 1, section 1, of this Royal Decree, without
that it had become effective. For these purposes, the requirement is practiced
It will be by referral, to the address that for communication purposes appears in the counter-
access fee, by any means that allows proof of reception.
tion by the interested party, as well as the date, identity and content of this, being
the distribution company obliged to keep in its possession the accreditation of the notification
cation made. In the event of rejection of the notification, the
circumstances of the attempt to notify and the process will be considered completed. Bliss
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 6
6/37
Communication must include the process of disconnection of the consumer from the networks of
distribution for non-payment, specifying the date from which the dis-
connection, if the amounts owed are not paid on a prior date. "
That is, article 4.4 of RD 1164/2001, which is the one that establishes the conditions in
that the suspension of the electricity supply may take place as a result of the
non-payment of the ATR contract rates, does not limit the communications of my client
with the client, but only the possibility of requesting the same directly the
payment of the fee (despite your status as a debtor and the joint and several liability that
proclaims in the same normative body). And indeed, my client at no time
ment has required the consumer to pay said fee which, on the other hand, he already
has satisfied the marketer, but is limited to showing him that this
marketer has not paid the fee, previously paid by him, and
that this may entail for that consumer the consequence, which evidently
It directly affects the suspension of the electricity supply.
Because the consequence of the marketing company not paying the amount
of said rates to the distributor, regardless of her condition as agent of the
consumer at the signing of the contract, it will be the suspension of the electricity supply to said
consumer. For this purpose, it is irrelevant with regard to the application of article 52.3 of the
LSE that the consumer has or has not paid said rates to the marketer, given
that the consequence in either case will be the aforementioned suspension, no matter how much
The AEPD intends through the resolution that could fall into this procedure
I wish to alter the effect derived from this default.
And based on this indisputable conclusion, which is that in case of neglect of the
complaint by the marketer may proceed to the suspension of supply
electricity to the final consumer, my client understands that it is necessary for the
When maintenance and development of the contract that it holds with its client, the
end consumer, warn him of said suspension so that at least he can have co-
anticipation of a suspension of supply that I-DE may, in accordance with
I comply with the provisions of the legislation, carry out once two months have elapsed from the
realization of the requirement to the consumer himself or to the marketer.
In this sense, it is necessary to show that this behavior has occurred in all
case in relation to the Claimant, Watium, SL, to the extent that my mandate
as expressly communicated to WATIUM in burofax with a certificate of
content of November 2, 2018 (which appears on folios 49 to 52 and is reproduced
again on folios 87 to 89 of the administrative file), it has been forced,
only in the period between the months of January and October 2018, according to the
request Watium according to the aforementioned article 4.4 of RD 1164/2001 the payment of fees
access on FOUR HUNDRED TWENTY-NINE (429) occasions. Each of those
429 requirements refer to remittances of unpaid invoices from many million
of customers, with respect to whose supply contracts the procedure of
suspension of supply.
Finally, in 2018, my client had to reliably request
the mercantile Watium on FIVE HUNDRED THIRTY-SIX (536) occasions, in the fiscal year
2019 on FIVE HUNDRED THIRTEEN OCCASIONS (513) and so far this year
2020 on ONE HUNDRED TWELVE (112) occasions, having initiated the procedure of sus-
supply pension for tens of thousands of electricity supply contracts.
Well, the AEPD understands that this communication cannot take place, even when
where there is a contractual relationship between I-DE and the consumer, as it does not appear expressly
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 7
7/37
mind set in any standard. That is, according to the AEPD reason, my client does not
it cannot only inform the consumer of the suspension of the electricity supply due to
payment of ATR fees, but is obliged not to inform you, owing in all
case proceed to the suspension of supply without prior notice to the consumer, as another
This is a violation of the personal data protection regulations. The
The consumer must thus see his supply suspended without prior notice and even after knowing
diligently fulfilled its obligations derived from the ATR contract, given that in
If this warning is carried out, the AEPD would deploy against the distributor
all its coercive powers.
In this sense, it is still clarifying that the claim that gave rise to the
This procedure does not come from any of the I-DE clients, who are the
lares of the fundamental right to the protection of your personal data, but of Wa-
tium, and we also understand that this is not based on a will of said mercantile
to protect the rights of the interested parties, but solely and exclusively to prevent
my principal adopt the measures that may reveal the illegality of his
pious conduct. That is to say, in this context it might be asked whether, in view of the facts
concurrent, it is not surprising to the AEPD that no I-DE client considers
violated their right, not having made a single claim before it.
tion on the part of these and that, however, claims are only filed by
part of those who put the proper development of supply contracts at risk.
other of your customers.
In the opinion of my client, the conclusions contained in the Proposal for Resolution are not
may but be considered, at best, contrary to logic and sense.
common practice, since contrary to them is not being able to warn the consumer of
electrical energy from a possible suspension of supply.
Moreover, following the reasoning contained in the Proposal for Resolution, it is possible to
I would conclude, in the opinion of my principal, completely irrational, that
consumers who have the status of natural persons would see their position adversely affected
in the ATR contract, since I-DE could warn of the possible suspension of the
supply to its clients legal entities, since in that case it would not be applicable
tion of the personal data protection regulations, but such possibility would be prohibited
in relation to their clients natural persons under penalty, in the opinion of the AEPD, of violating
said regulation.
Such a glaring conclusion could only lead to the filing of the present proceedings.
inasmuch as, as indicated by the Advocate General of the Court of Justice,
of the European Union, Mr. Michael Bobek, in §99 of his conclusions referring to the
Case C-13/16 (Rīgas satiksme case), filed on January 26, 2017:
"In summary, common sense is not a source of law, but, of course,
it should serve as a guide for its interpretation. It would be most regrettable if
protection of personal data will be degraded in the obstruction of personal data-
them."
In the present case, said conclusion could not be more evident, since the sub-
protection of the consumer's personal data, to which the Pro-
Implementation of Resolution leads in practice to an obstruction of these that can
lead to a suspension, entirely surprising to the consumer, of the
electricity supply, with the important damages, losses and other consequences that
from this to be derived for the consumer. To this must also be added the fact that
not a single I-DE client has considered my client's violent behavior in
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 8
8/37
in any way your right to the protection of personal data and that, paradoxically,
the application of the rule would imply a more favorable treatment to clients who have the
condition of legal persons, as these are not holders of the fundamental right.
In short, there is a contractual relationship between my client and the consumers
recipients of the letters sent in which a situation may arise that
it is detrimental to them as a result of a breach
by its agent, so that the normal and proper development of the contractual relationship
This justifies my client making all the necessary efforts to implement
knowledge of the principal of the breaches carried out by the agent in order to
take the consequences that will only harm the consumer.
3. Regarding the intervention of the CNMC in the present case
The Motion for a Resolution considers that the statement contained in the allegations
of my principal to the Initiation Agreement, according to which it was indicated that the Commission
National Markets and Competition (hereinafter, "CNMC" or "the Commission")
was aware of the letters sent by the former to consumers.
expressly stated by the aforementioned Commission, summarily concluding that:
“It follows, therefore, that the distributor did NOT send the CNMC any letter to
their prior review, sending the informative letters to the final consumers without "the
review ”of the CNMC, and, therefore, being totally impossible,“ (…) ratify the legality
of the conduct of my principal (…) ”by the CNMC, as stated by the entity
claimed dad. "
However, it is enough to contrast the content of the response provided by the CNMC to
that AEPD to verify that the statement contained in the Proposal for Resolution
does not sympathize with the reality of the facts
Thus, in the first place, as already indicated in the allegations of my client to the Agreement
Inception, the CNMC indicates with absolute clarity that it has full knowledge of the
letters to which the request for information refers, despite the fact that the AEPD does not send
that one copy some of the same even when they work in the administrative file
tive. Thus, the third paragraph of the CNMC's response literally states:
“Although the request received from the Spanish Data Protection Agency does not
Attached sample of the information letter referred to, according to the data
that are provided, it can be considered that it is a certain letter that would be
I am aware of the existence of non-payment of network access tolls. "
That is, although the AEPD does not provide a copy of the letter, its content was more than
known to the CNMC. And it is that as it was already warned in the letter of Ale-
In addition to the Initiation Agreement, my client informed the CNMC of the
delo of letter that had made for these assumptions. It doesn't seem very difficult to
understand that my client is not going to request authorization to send the letters
every time a situation like the one we are dealing with occurs, as this would mean so much
such as making it impossible for the CNMC to carry out any other action other than
curl these types of letters.
It should be remembered that, as already indicated, only in the case of the company WA-
TIUM, my client has had to carry out since 2018 ONE THOUSAND ONE HUNDRED SE-
SIXTY-TWO (1162) reliable payment requirements for the same number of income
compliance with the obligation to pay access fees in. In this way, if
the reasoning of the AEPD is followed, my client should have requested the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 9
9/37
CNMC on 1162 occasions the authorization to send the letters to the mercantile
Watium.
The CNMC replied that what it did not know was the specific letter sent to customers
of Watium, but that, nevertheless, he did know that these letters were sent to the
I-DE clients whose marketing company did not pay access fees after
have completed the voluntary payment period and after having been reliably required-
To this end, as expressly provided by the applicable legislation, in avoidance of
that the supply was suspended without the knowledge of the contract holder, or
der have it, that his access contract was in default.
Moreover, made by Watium a complaint against my client on the occasion of the letter to
their clients, as expressly stated in the response offered by the CNMC
(folio 132 of the administrative file), the aforementioned Commission not only considered sending
of the same perfectly lawful and in accordance with the sectoral regulations, compared to what
now seems to consider the AEPD, but also specifically agreed to give “tras-
side of the information to the Directorate of Energy […] for different purposes (assessing
tion of the possible breach by the marketer Watium, SL of the regulations
applicable policy regarding the payment of the network access toll) ”.
In conclusion: the CNMC was not only perfectly aware of the existence of the letters,
Rather, when he became aware of them (years before that AEPD and with
reason for a complaint such as the one at hand), his decision was, as
it appears in the administrative file, analyze the possible initiation of a file
sanctioning company Watium for breach of its legal obligations.
laws and regulations and in defense, among others, of the rights of customers affected by
tados.
4. On the legal basis of the treatment in the present case.
It has already been amply analyzed in section 2 of this allegation that my command
proceeded to the processing of the personal data of its clients for the sending of the
mentioned letters as said sending is necessary for the normal development of
the contractual relationship that binds both parties, since it can only consider-
it is, according to all logic, necessary to warn customers of the suspension of the supply
as a consequence of non-payment of ATR rates instead of proceeding to suspend
hang it without notice.
However, for the denied assumption that this AEPD, against the criterion supported
even by the energy regulator, the CNMC, consider that the legal basis of the treatment
ment cannot be considered the adequate development of the contractual relationship,
There is no doubt that the communication to I-DE clients that said sus-
pension is going to take place will be, at least, in their interest, who may
adopt the measures they deem appropriate to avoid said suspension. Of this
Thus, it would be applicable to the assumption, at least, and although the
legal basis of the contractual relationship, the rule of the prevailing legitimate interest established
cited in article 6.1 f) of the RGPD.
It should be remembered that the first paragraph of recital 47 of the RGPD states that:
“The legitimate interest of a person responsible for the treatment, including that of a person responsible for
that personal data may be communicated, or that of a third party, may constitute a
legal basis for the treatment, provided that the interests or rights do not prevail.
rights and freedoms of the interested party, taking into account the reasonable expectations of
the interested parties based on their relationship with the controller. Such legitimate interest could
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 10
10/37
occur, for example, when there is a relevant and appropriate relationship between the
and the person in charge, as in situations in which the interested party is a
at the service of the person in charge. "
Note that the RGPD considers that the prevalence of legitimate interest can be seen
reinforced in cases such as the one analyzed, given that the information provided to the
sado would refer to the suspension of the contract concluded by him with my command.
tea. In other words, there would not only be a legitimate interest for I-DE to put this
knowledge of their customers, but even a legitimate interest of them in not seeing
supply was suspended, to a greater extent, when said customers would have
made the payment of the amount corresponding to said access toll to the
distribution. And it should be emphasized that the aforementioned suspension may take place independently of
pendency of the person who has materially signed the ATR contract, as
expressly follows from article 4.4 of RD 1164/2001, which develops the provisions
to in article 52.3 of the LSE and to which it refers literally.
Even though the two legitimating bases referred to with
previously, they could be considered, in light of what was indicated by my client, insufficient
tes for the purposes of enabling and legitimizing the processing of personal data to which
referred to in the present file, it should be remembered lastly that the origin of the mentioned
cited letters is found in the fact that the trading companies do not
have paid I-DE the amount of the ATR tariffs, that is, of the so-called pea-
jes.
At this point, it should be remembered that the payment to I-DE of the aforementioned rates will not be
puts an income for it, but its mere collection as system income
electricity, we reiterate not yours, with said funds being allocated to the maintenance and
maintenance of said system in the terms established in the electrical legislation.
In this sense, article 13.1 of the LSE provides that:
"The actions of the Public Administrations and other subjects included in
The scope of this law will be subject to the principle of economic sustainability.
mica and financial of the electrical system. Economic sustainability and fi-
financial system of the electricity system the ability to meet all the costs of
this, in accordance with the provisions of this law and its implementing regulations. "
And article 13.2 a) expressly establishes that “[t] he costs of the system will be finan-
generated by the income from the electricity system that will comprise […] [t] he tolls
access to transmission and distribution networks satisfied by consumers and
producers and agents for energy exports to non-EU countries.
rivers, destined to cover the remuneration of transport and distribution ”.
In turn, as provided in article 18 of the LSE:
Article 18. Collection and settlement of tolls, charges, prices and regulatory remuneration.
you give.
"The access tolls to the transmission and distribution networks and the prices or charges
for other regulated services destined to the supply of electrical energy will be
issued by the distribution companies and, where appropriate, by the system operator,
having to give to the amounts entered the application that proceeds in accordance with the
general liquidation procedure provided for in this law and its regulations
developmental. For these purposes, the income from tolls or charges will be those that would have
due to be invoiced by application of the regulations that establish them, regardless of
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 11
11/37
dence of its effective billing and collection by the subjects obliged to its re-
caudation. "
Legal obligation to collect that is reiterated in article 40.1. j) of the LSE when stating what
following:
“Article 40. Obligations and rights of the distribution companies. 1. The distributors
Owners, as owners of the distribution networks, will have the following obligations:
“J) Apply, invoice and collect the access tolls to the transport and distribution networks
to marketers or consumers, as appropriate and where appropriate,
ductors connected to their networks by breaking down the billing to the user in
the form determined by regulation "
And finally, article 14.1 establishes the following:
“The activities destined to the supply of electrical energy will be rewarded in the
form provided in the present law charged to the income of the electrical system defined
nested in article 13, to those derived from the participation in the product market.
tion, as well as the income from the application of the provisions of the
Se law and its implementing regulations. The income from the electricity system will be
to pay exclusively their own remuneration for activities aimed at
electricity supply and the rest of the system costs defined in article 13, without
that can be used for other purposes. "
Therefore, the collection of access fees is a legal obligation that is imposed
use distribution companies as a way to obtain the necessary income to
defray the costs of the electrical system and thus allow users to
electricity supply can have access to this service of economic interest ge-
general.
And to such an extent the collection of these access fees is so transcendental to
the effects described, which is imposed on the distribution companies not only the obligation to
to collect them but also to enter the electricity system tariffs.
access that they bill, regardless of whether or not they are charged by those obliged to
payment, ultimately, the holders of electricity supply contracts. For
As a result, non-payment of access fees causes patrimonial damage to the company
distributor, which has to enter the invoiced rates, even if they are not paid.
To compensate for the pass-through of commercial risk of a tax collection activity
legally put to someone who is not the beneficiary of the amounts collected, the LSE and
its implementing regulations establish:
a) In the event that the customer has contracted the supply through the company
trading company (which acts against the distribution company as agent of the
client, case that concerns us), the obligation to pay the access fees in
men of solidarity by the contract holder and the marketing company, to whom
Indistinctly, the distribution company can request and claim payment, solidarity
that can only be broken by the holder of the supply contract with prior accreditation of
to be up to date with the payment with the marketing company Arts. 40.2. j), 44.2.b) and 46
1.d) of the LSE and 4.2. of RD 1164/2001.
b) The possibility of suspending the electricity supply in the event of non-payment of rates
of access (regardless of whether the payment of these has been accredited by the
of the contract to the trading companies). Arts. 52 of the LSE and 4.4 of the RD
1164/2001.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 12
12/37
c) The classification of the breach of the obligation to pay the access fees
by the marketing company as a very serious, serious or minor infraction according to
amount of non-payment (in this case very serious), which may also give rise to the
disqualification of the marketing company for the exercise of the activity Arts. 47,
64.4., 65.3 and 66.1 of the LSE.
For the aforementioned reasons, the collection of access fees, as soon as it has
for the purpose of obtaining the amounts of said rates for their contribution to maintaining
maintenance and proper operation of the electrical system is directly related
with the fulfillment of a mission of public interest, which is also imposed on the
distribution companies by legal mandate, which would even allow to substantiate the
treatment in the provisions of article 6.1 e) of the RGPD.
In conclusion, as indicated in this document, there is no doubt that I-
DE is fully entitled to process data for the purpose
to carry out the aforementioned communications to its clients as a consequence
of the development of the contractual relationship maintained with them. But even in the
denied assuming that said legal basis was again discarded by the
AEPD, the treatment would also be based on the legitimate interest of the con-
electrical sinks to maintain the contracted electricity supply and in the public interest
derived from the fact that the income from the payment of the ATR tariffs is nothing but
an act of collecting said income for its contribution to the maintenance of the
electric system. And ultimately, the legitimate interest of
the distribution company, legally obliged to carry out this collection activity and
bear the risks of non-payment, in recovering amounts that it has been forced to
enter for the electrical system despite not having charged them.
Being sufficient the concurrence of a legitimizing base to determine the conformity
to the right of a treatment, it turns out that, in the present case, there are elements
enough to be able to assess the fit of the treatment carried out by my
dante in four of the legal bases established in article 6.1 of the RGPD, therefore
It is certainly surprising that Wade's complaint has not been shelved.
tium.
THIRD.- ON THE SETTING OF THE AMOUNT OF THE PENALTY IN THE AGREEMENT
DO OF START
My client already revealed in the first of his allegations to the Agreement of
Initiation of this disciplinary proceedings that it incurred a substantive vice
nullity, as the sanctioning body has established in audita part the im-
size of the sanction to be imposed on I-DE. With this, the guarantees are broken
of the sanctioning process and the right of my client to allege what his right
proceeded prior to said determination, with the consequent causation to
the same of a blatant defenselessness.
In the same way, the obvious confusion between the phases of ins-
resolution and resolution, by anticipating the sanctioning body the amount of the sanction that
I would proceed to impose on my client. Something that in the present procedure has been
made clear, when looking at the Proposal for Resolution by the order
The instructor won an amount identical to the one that the sanctioning body had already proposed to him.
nador in the Initiation Agreement.
The Proposal for Resolution is limited to indicating that what was alleged by my client
it can be taken for granted. However, and even when, as anticipated, it is practical
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 13
13/37
It is completely indecipherable to know for sure which are the arguments in which the
Proposal bases such affirmation, my client understands it is necessary to make determinations.
give considerations, delving into what was already indicated in their allegations to the Agreement
Of start:
1. In the first place, contrary to what the Proposal for a Resol-
tion, neither Article 64 nor Article 85 of the LPACAP establishes that in the
At the beginning, the specific amount of the penalty to be applied must be expressly determined.
da to impose the interested party in order, as it seems to be deduced from the Proposed Resolution
tion, that the applicant can make use of the benefit of the reduction of the amount of
the sanction for their acknowledgment of guilt or prompt payment.
And it is that, contrary to what this part that the Proposal intends to indicate
Resolution, the provisions of article 64.2 of the LPACAP do not imply any inno-
variation of the legal system with respect to the norms that had been in force in the past.
prior to its entry into force the administrative sanctioning procedure and, in particular,
cular, the sanctioning procedure included in the data protection regulations
personal.
Indeed, this part fails to find the novel aspect of the aforementioned forecast
legal regarding the sanctioning regime contained in Law 30/1992, of June 26, the
Regulation of the Procedure for the Exercise of Sanctioning Power, approving
by Royal Decree 1398/1993, of August 4 (hereinafter, “REPEPOS”) and the Regulation
development of Organic Law 15/1999, of December 13, on the Protection of
personal data, approved Royal Decree 1720/2007, of December 21 (in
hereinafter, "RLOPD"), under which the AEPD did not establish the aforementioned amount
in your startup agreements.
In all these norms it was indicated that the Agreement to initiate the sanctioning procedure
nador had to incorporate “the sanctions that may correspond, without prejudice to
what results from the instruction ”. This was stated in article 13.1 b) of REPEPOS and
it was reiterated by article 127.1 b) of the RLOPD. However, the AEPD considered
that this did not mean more than indicating the maximum and minimum limits of the sanction that
it would be appropriate to impose, if the actual commission of the aforementioned offense is appreciated,
mentioned in the agreement without carrying out in the Initiation Agreement any valuation of
the concurrent circumstances in the case or the mitigating or aggravating circumstances that
should be taken into consideration to determine the final amount of the sanction to
impose.
The difference between the action just mentioned and the one carried out
carried out in the present procedure is evident, since in the first case the act of
situation of the sanctioning body when agreeing to start the file did not imply the realization of
zation for its part of valuation activity any of the concurrent circumstances
in the specific case, nor did he anticipate the examining body what was, in his opinion, the way
in which the former had to act in setting the amount of the penalty within the limits
legally established, which was limited to remembering by a direct application and without
any statement of the rule regulating the sanction.
However, in the present procedure, without modifying one iota, it is necessary to
We reiterate it, the regulatory regime of the procedure, the sanctioning body is not
not to remember which is the applicable sanctioning norm, but effectively assesses
you, without paying attention at any time to what the insert could invoke, how concrete
sanction, within the limits established by the norm, should be imposed. That is, the
objectivity of the sanctioning body at the time of initiating the procedure remains
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 14
14/37
questioned by its assessment, in audita part, of the facts and circumstances and
more necessarily influences the performance of the examining body, since it tends to
It will be necessary to send him a proposal for a resolution that meets this pre-established criterion.
do.
2. Secondly, reference should be made to what, despite its more than confusing
wording seems to want to indicate the Proposed Resolution when on pages 41
and 42 of the same, the following is stated:
“It is therefore not true, as the claimed entity affirms, that Article 85 establishes-
ca: “(…) For this purpose, it should be recalled that, according to Article 85, the amount of the penalty
pecuniary may be determined "initiated the sanctioning procedure (...)"
ral of said article refers to the recognition of the responsibility of the offender and
no to the decision of the amount of the sanction as it is literally established that: “1.-
Initiated a sanctioning procedure, if the offender acknowledges his responsibility,
may resolve the procedure with the imposition of the appropriate sanction ”and thus,
must interpret, that is, according to the proper sense of the words, and not the discretion of
the part. (…)
Regarding the statement made by the claimed entity when indicating that, “in the present
In this case, said amount is set in the act of initiation of said procedure and not
when this is already "started", it could not be considered true, because in the
"Agreement" to initiate the file is expressly indicated that, "for the purposes of the
seen in art. 64.2 b) of the LPACAP, the corresponding sanction would be
a fine of 200,000 euros (two hundred thousand euros), without prejudice to what results from the
instruction","
Despite the less complex wording reproduced, he intuits this part that is
wants to refute by the same what has already been alleged by my client in the sense of remembering
that article 85.1 of the LPACAP provides that “[i] initiated a sanctioning procedure-
dor, if the offender acknowledges his responsibility, the procedure may be resolved with
the imposition of the appropriate sanction ”(the underlining is ours) and that the first
ciso of article 85.3 of the LPACAP adds that “[i] n both cases, when the sanction
is solely of a pecuniary nature, the competent body to resolve the procedure
ment will apply reductions of at least 20% on the amount of the penalty provided
put, these being cumulative with each other ”(emphasis added)
As can be seen, from the literality of the precept to which the Pro-
Resolution does not follow, as it seems to indicate, that the benefits
seen in the same require the quantification of the sanction in the Initiation Agreement, for
how much:
 First, Article 85.1 of the LPACAP does not require such a prior determination,
since it does not refer to a pre-established sanction, but to the imposition of the sanction.
tion as appropriate. That is, the norm, which in any case is applicable “initiated the proce-
procedure ”, provides for the possible acknowledgment of responsibility that may determine the
imposition of the sanction "that proceeds", so that this fixation seems to be foreseen with
after the acknowledgment of responsibility itself.
 Second, Article 85.3 provides that reductions must be adopted on the basis of
on the “proposed” sanction, which requires that it has actually been determined in
procedure what is that amount, and the diction of the precept itself seems effective-
refer to the motion for a resolution as the ideal place to determine the
tion of said amount.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 15
15/37
 In any case, as already indicated, the application of the precept, which supposes a
Benefit for the accused cannot in any case imply a bankruptcy of his
rights under the excuse of granting the aforementioned benefit.
In short, the fact that the acknowledgment of guilt can be
produce “once the procedure has started” (something that is obvious, given that the
The accused cannot have prior knowledge of the existence of the accused.
tion) in no way implies that the Initiation Agreement is the place where it should determine
undermine the amount of the specific penalty "appropriate" to impose, so that
sanction should be determined at a later time, that article 85.3 seems
assimilate to the proposed resolution, since the sanctioning body could not,
In accordance with the principles of the administrative sanctioning procedure, "propose" that
sanction, as such power corresponds to the investigating body.
And this conclusion is not contradicted by the fact that the initial agreement is the
place where, according to the final paragraph of article 85.3 of the LPACAP, the
of manifest to the insert the discounts that in his case would proceed to impose in case
recognition of responsibility and advance payment of the penalty, whenever
that both are benefits granted to the same who must know from the moment
the very beginning of the procedure, even though the sanction cannot be found when
tified, as said insert could not be heard in the processing of the file,
that has not been started.
It only remains to reiterate in this place that the very processing of this procedure
This statement merely demonstrates the effects that the decision adopted by the
sanctioner has produced in the performance of the investigating body, which mimetically
reproduces in its Proposal for Resolution what was argued by the sanctioning body
in its Initiation Agreement both in the quantification of the sanction and in the enumeration
tion of the concurrent circumstances in the present case.
3. Third, the Proposed Resolution, again in terms that in the opinion
from this part are respectfully completely confused, it seems to give
tend that the setting of the amount of the sanction in the Initiation Agreement is clearly
adequate, inasmuch as my client has had the opportunity to express himself about the
concurrent circumstances in the case both before and after
at the initiation of the sanctioning procedure.
Thus, in relation to the activity prior to the aforementioned Agreement, the Proposal for Re-
solution (the underlining is ours):
"On the statement made by the claimed entity of:" IDE has not had occasion in
no time to reveal to the aforementioned body which could be the
circumstances that could be applicable in the present case ”, it should be remembered
that, on 05/23/19, this Agency notified the claimed entity,
the complaint presented by the complaining entity, in the reference file
E / 3624/2020, requiring the entity, at that time called, IBERDROLA
DISTRIBUCIÓN ELÉCTRICA, SAU, to proceed with its analysis, respond and
submit to this Agency, within a period of one month from its notification,
all the information deemed appropriate for this purpose. Information that the entity collects
Claimed filed on 06/24/19, one day after the deadline granted for this purpose, through
through the electronic registry of the General State Administration "
The aforementioned transfer, under the heading "transfer of claim and request for information",
was carried out, according to the document itself (folio 69 of the administrative file
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 16
16/37
vo) “[d] e in accordance with article 65.4 of Organic Law 3/2018, of December 5,
on, Protection of Personal Data and guarantee of digital rights ”(in addition,
lante, “LOPDGDD”), which refers to article 37.2 of the regulation itself in which it is
state the following:
“When the affected party files a claim with the Spanish Protection Agency
tion of Data or, where appropriate, before the regional data protection authorities,
They may refer the claim to the data protection officer so that
this responds within a month. If after this period the delegate of
data protection would not have communicated to the competent data protection authority
tente the answer given to the claim, said authority will continue the procedure
in accordance with the provisions of Title VIII of this organic law and its regulations for
developing."
From the provisions of said rule it is unequivocally inferred that the transfer carried out
In the first place, it has a completely optional character, being carried out in
In any case, prior to the processing of the procedure and without its purpose being,
on the other hand, the making of any allegation as to the modified circumstances
ficative of the responsibility of the entity to which it is addressed, since such responsibility
bility has in no way been determined by opening the proceeding
sanctioner.
Regarding the fact, subsequently invoked in the Motion for Resolution that
my client has had the opportunity to contest what was stated in the Initiation Agreement, by
be granted a period for the issuance of allegations, which will effectively
mind made at the appropriate procedural moment, such a circumstance in a high way
One can remedy the helplessness caused to it as a consequence of the
assessment carried out in audita part of the concurrent circumstances in the assumption or
supposes an enervation of vice consisting of the confusion of the phases of instruction
tion and resolution and the consequent "contamination" of the former as
of the content of the initiation agreement.
All this supposes a breach of the inspiring principles of the sanctioning law
that cannot be corrected by the mere fact that it has been required by
that AEPD to report the facts contained in the claim not because my
The principal holds the right, as it could not be otherwise in accordance with the
cido in article 53.1 e) of the LPACAP, to formulate allegations.
Therefore, my client considers that by determining the amount of
the sanction and establishment of aggravating and mitigating circumstances in the Agreement of
Inception, their right to defense has been violated, with the consequent cause of inde-
fension, proscribed by article 24 of the Constitution, also breaking the
principle of impartiality of the sanctioning body. All this must derive the necessary-
mind in the nullity of full right of the present procedure.
FOURTH.- APPLICATION IN THE PRESENT CASE OF THE PRINCIPLE OF PROPORTION
TIONALITY AND MODIFICATION CIRCUMSTANCES OF LIABILITY
DAD CONCURRENT IN THE SAME
Although reference has already been made to the absolute lack of motivation of the Proposal for
Resolution, in which hardly any different or additional arguments are offered to the
had in the Initiation Agreement compared to what was stated by my representative in his
allegations to it, this lack is evidenced even more clearly when
The Proposal appears to clarify what was indicated by my principal in relation to the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 17
17/37
concurrent circumstances in this case. In effect, the Proposal for a Resolution repro-
at this point, in an almost mimetic way, what is stated in the Initiation Agreement without
carry out a minimum exercise of analysis of what is alleged by this party.
This would justify a mere reference to said arguments, with the legitimate expectation
that they are effectively analyzed by the Control Authority. Not obs-
Therefore, in order to facilitate this task, reference will be made again, even in summary, in
this writing, to the reasons why my client understands that he does not concur in this
In the event of not a single aggravating circumstance mentioned by the AEPD in the Proposal:
1. Regarding the volume of the letters sent, the AEPD seems to continue without evaluating
really if they refer to natural or legal persons, since it does not seem to be
In another sense, the reference to the total number of letters sent to Wa-
tium, even though it is recognized that in reality it would only be referring to
It refers to just over half of those included in the Initiation Agreement.
However, this circumstance seems irrelevant for the AEPD, given that the reduction
The number of cards from 2,598 to 1,462 has no effect on the determination of
tion of the degree to which the conduct would be aggravated, since the sanction continues
being the same as that included in the Initiation Agreement.
For this, the AEPD seems to hide behind the fact that “in addition, the other complaining entity,
ENERGÍA Y SERVICIOS ABY 2018, SL., Reports that all its clients have received
the informative letters of the complaining entity ”. Yet nowhere is it
refers to what the aforementioned total amount may be or if said customers are personal
physical or legal rights, being the AEPD which would be responsible for accrediting
how many shipments could have taken place, which does not appear to have taken place given
that nowhere in the Proposed Resolution, apart from in the room
transferors of the same and in its sixth fact, reference is made to these shipments, which without
However, they are taken into account to aggravate the sanctioning reproach to my client.
In this sense, it is relevant to take into account that neither the inspection actions carried out
listed (folios 187 to 189 of the administrative file), nor the request for information to
the CNMC or any of the reasoning in the Initiation Agreement or the Proposal for Re-
solution make any mention of Energía y Servicios ABY, SL, except for this mention
concise aimed at maintaining the aggravation of the behavior of my client without
provide any accreditation related to such shipments.
2. The AEPD affirms that in the present case the facts have been denounced by the
interested parties, noting that “the claimed entity, by making an illicit use of the data
personal data of the clients of the marketing entities, this Agency has had
knowledge of the alleged infringement through the agents of the interested parties
(sic.)".
Although it is difficult to understand the actual content of such a statement, given the
that the recipients are clients not only of the marketers, as seems to be indicated
the AEPD, but also the distributors, the truth is that not even in its written
claim or in the query made at the time to the Legal Office of the AEPD
Nor in the complaint made at the time before the CNMC, Watium claims to act in
representation of its clients (which are also my client), but only and ex-
exclusively in his own name.
And understand this part that the AEPD cannot take as true or assume in any way
some a representation that not only is not accredited in any case, but also
furthermore, he refuses, since Watium always claims to act on his own behalf. For
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 18
18/37
Therefore, there is no doubt that this entity holds the status of interested party for the purposes of
the provisions of the data protection regulations, it is completely inadmissible to
application of such an aggravating circumstance.
3. Thirdly, the AEPD says that I-DE acted “knowing that there were different
complaints filed and reports issued by different public bodies
who rejected said action, the entity continued to send information letters to the
end customers, and, therefore, could constitute an illegal act ”.
My client cannot but reiterate that he does not know what those reports are and that he
tions that she was supposed to know when she carried out the treatment of the
data. Indeed, since obviously they cannot be the ones that are the object
of this procedure there are only two possibilities: that the AEPD refers to the
Announcement filed by Watium with the CNMC or that it is the report requested by
that entity to the Legal Office of the AEPD.
Well, as a first consideration, both the complaint and the request for a report
were after treatment, so it could hardly be done after
knowing the "resolution" issued or the report issued.
In addition, with respect to the claims made mentioned in the Proposal for
Resolution, it is necessary to show that the complaint made by Watium
before the CNMC (the only one to which reference could be made) was inadmissible for processing
mite, as stated in the administrative file, starting on the contrary
an investigation of Watium herself. Therefore, there was no reproach from the
CNMC to the behavior of my client.
It is true that this reproach is contained in the report of the Legal Cabinet in respect of
put to the query raised by Watium, but it is that my client has not had
knowledge of said report until the Agreement to initiate this procedure
made mention of this. All this, without prejudice to the fact that, as we understand that
given sufficiently accredited, said report lacks an admissible legal basis
in right.
That is, and paraphrasing what was stated in the Proposal, my client issued the letters
without knowing that a claim would be made later that was inadmissible and
would issue by that AEPD (not by different agencies) a single report, not communicating
do to I-DE, who rejected said action.
All this without prejudice to the fact that, as was carefully analyzed in the allegations to
the Proposal for Resolution and it has been insisted in this writing, the criterion supported
made by the Legal Cabinet in the aforementioned report not only is not coherent
with the personal data protection regulations, but even contravenes the
criteria that in relation to the interpretation of the precepts that it carries out
adopted by the National Energy Commission.
In any case, as can be contrasted, what is stated in the Proposal for a Resolution
tion and the reality of the case as regards the intentionality of my principal or
they keep the slightest relationship.
4. Regarding the categories of data being processed, the Proposed Resolution
tion points out, in our view quite surprisingly, that “in this
case, when the claimed entity makes use of the name, surname, address, etc., of
the clients illegally, it is clear use of data protected by the RGPD and, by
therefore, subject to aggravation in application of section g) of article 83.2 of the RGPD ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 19
19/37
In the first place, my client only tried to send the communications the name
name, surname and address of your customers, so it is unknown what the
Proposal with the inclusion of the term "etc.".
But it is that, in addition, from what is literally stated in the Proposal it follows that
The use of "data protected by the RGPD" necessarily implies the aggravation of the
sanction. Well, if the data is not protected by the RGPD, it is not that it does not proceed.
gives the aggravation of the sanction, is that the conduct would not be subject to the RGPD, as
it is manifest and evident. Thus, what the Proposal indicates, and let us
To say that this causes enormous perplexity to this part is that the use of personal data
sonal, subject to the RGPD implies the aggravation of the sanction by application of the
Article 83.2 g) of the RGPD, referring to the categories of data affected by the alleged
infringement, since all categories of data are protected by the aforementioned text
to legal.
5. In relation to the supposed economic benefit, the Proposal for Resolution is
mite to reiterate what is indicated in the Initiation Agreement. Suffice it at this point to add that,
As stated in section 4 of the third claim of this writing, the in-
The revenues referred to in the Proposal are not typical of I-DE, but are collected
by it for the maintenance and support of the electrical system, in accordance with the
Articles 13, 14 and 18 of the LSE, so my client does not know what benefit was obtained
vo with the sending of the communications.
6. And finally, regarding my client's relationship with the realization of treatment-
data, the Proposal is limited to indicating the volume of customers and employees
I-DE to indicate that such a relationship exists.
We must first point out that, now, it seems that finally the AEPD,
even with the intention of aggravating the sanction imposed, it recognizes that
The clients to whom the communication was directed are, in effect, clients of I-DE and
that it maintains a contractual relationship with them.
But having said this, my client understands that the treatment object of this proceeding
Marketing is not an essential part of their activity, which is none other than electrical distribution.
trica in the terms established in the LSE and its implementing regulations.
And it should be reiterated here that in the opinion of my client, the AEPD carries out an interpretation
completely maximalist treatment of the aggravating factors established in the RGPD and the
LOPDGDD, every time, as we already said in the allegations to the Initiation Agreement, “se-
According to its criteria the treatment of any data, even if it is merely identifying,
constitutes, by itself, an aggravating factor and, on the other hand, any entity that has
As stable clients to individuals, their activity will be linked to the treatment
to the personal data ”. Suffice it at this point to add that this conclusion applies
equally to any entity that had employees.
By virtue of all of which,
REQUESTS THE SPANISH DATA PROTECTION AGENCY that, having
By presenting this writing, please admit it, consider the allegations to
the Proposal for a Resolution in Procedure PS / 00197/2020 and, after the formalities
legally established, issue a resolution declaring the nullity of full right of the
procedure for the reasons described in the second argument of this brief
or, failing that, on the merits of what is manifested in the body thereof, the ar-
goad of the aforementioned procedure or, failing that, the imposition of a warning
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 20
20/37
notice or warning or a significant reduction in the amount established in the
Initiation Agreement, in view of the numerous attenuating circumstances
tes in the case of fact prosecuted.
Of the actions carried out in this procedure, of the information and documents
documentation presented by the parties, the following facts have been accredited
chos:
PROVEN FACTS
1.- WATIUM, SL, an electric power trading company, has subscribed with the
energy distribution company, I-DE REDES ELÉCTRICAS INTELIGENTES, SAU
(I-DE), a network access contract (ATR), through which, it exercises functions of
agent or substitute for end customers, as established in articles 3.2 and
3.3 of Royal Decree 1435/2002, of December 27, which regulates the
basic conditions of contracts for the acquisition of energy and access to the
low voltage networks.
2.- The entity WATIUM SL provides a copy of the "Network Access Contract" model
between the trading company (WATIUM SL.) and the supplying company (I-DE).
This contract includes, among other information, the identification and contact of the client
end, the logo of (Iberdrola Distribución Eléctrica, current I-DE) and the identification of
the company WATIUM, SL
The contract is signed by, on the one hand, the trading entity, and on the other, the entity
distributor. There is no place for the signature of the final consumer. Stands out in the text
of the contract the following:
"The undersigned acting as agent and substitute for the client for the purposes of the
art. 3.2 and 3 of RD 1435/2002 of December 27, contracts with IBERDROLA
DISTRIBUCIÓN ELÉCTRICA, SAU access to the network for the electricity supply in
the supply point outlined, being obliged to keep the documentation that
accredits him as agent and substitute for the client and to make it available to the
distribution company if required, both parties being obliged to comply with the
Specific, Special and General Conditions included in this policy,
all of them in accordance with the legal prescriptions in force, being signed on the day
of the date in duplicate and for a single effect. " In the "Payment Term" section
It states: "The Client or his agent will pay this company the amounts of the
electric power supplies within 30 days from the issuance of the
bill."
3.- According to the complaint, in mid-January 2018, WATIUM, SL had
knowledge of the referral, by I-DE, of a series of letters (more than 2,500,
according to complaint), to the clients of WATIUM, SL These letters were of a
informative and exposed the contractual breaches committed by WATIUM SL
regarding I-DE, and invited them to contact WATIUM SL,
to urge you to pay the amount of the contract for access to the distribution network,
further indicating that the lack of payment by WATIUM, SL, to I-DE, could
lead to the suspension of the power supply.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 21
21/37
3.- In the letters sent by IBERDROLA (current I-DE), to WATIUM clients
SL, you can read the following text:
"Dear Consumer: By means of this letter we inform you
that, on February 8, 2018, we were forced to send your
electric power marketer WATIUM, SL., in accordance with the regulations
in force (art. 4.3 and 4.4 of Royal Decree 7764/2007, of October 26), a
reliable request for payment, given that, after the voluntary payment period
established by law, the amount of the invoice for third-party access to the
network corresponding to the contract and supply point of which you are the owner that,
It is detailed below, it is unpaid: (…)
Non-payment of third party access fees to the network may give rise, according to
with current regulations (art. 4.4. of RD 7764/2007, of October 26), to the
suspension of power supply.
For all these reasons, we ask that you urgently contact your company
marketing company to remedy this situation without this letter
informative suppose a request of payment towards you by this company
distributor. Without any other particular, sincerely ”.
4.- As indicated by the entity WATIUM SL, on 01/22/18, informs, through
of a complaint, the facts before the National Markets Commission and the
Competition (CNMC) and before this Data Protection Agency, on 02/19/18.
5.- In the legal report issued by this AEPD, dated 07/23/18- N / REF
059338/2018, includes, among others, the following:
"Consequently, without it corresponding to this AEPD to rule on these
legal aspects that may emerge from the letter, it could be concluded that the
processing of personal data carried out by the distribution company object of
the query has violated data protection regulations both what it does
reference to the legal basis of the treatment as in relation to the principles
relating to treatment. Regarding the first, the appropriate legal basis for the
treatment of these personal data of consumers would be the one that allows
the execution of a contract in which the interested party is a party (art. 6.1. c) RGPD), but
We will already have stated above that the treatment of the personal data of the
Consumers acting through an agent are not necessary for
fulfillment of said contract, since precisely the existence of the agent
makes it necessary to address communications regarding compliance with the
contract.
Regarding the principles relating to the treatment, consequently, it could be concluded that the
processing of said personal data would have been carried out in a manner
incompatible with the determined, explicit and legitimate purposes, for which they were
collected (limitation of the purpose), which, as has also been stated, was for
the supply of electrical energy to the supply point for which the
access. This also implies that the provisions of art.
5.1 letter c) RGPD. inasmuch as or said personal data processed are neither adequate
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 22
22/37
nor relevant in relation to the purposes for which they are processed (principle of
data minimization ”.
6.- On 01/08/20, the entity ENERGIA Y SERVICIOS ABY 2018, SL,
marketer of the electric energy supplied by IBERDROLA (I-DE),
reported to this Agency the sending of identical letters, by IBERDROLA (I-
DE), to their clients, informing them of the non-payment by the marketer, and
inviting them to contact it to proceed with the correction
of said problem.
7º.- For its part, the claimed entity, at the request of this Agency, reported what
following points:
a) That the access fees are charged by the distributors, but they are not in-
own income, but rather the national electricity system.
b) That the WATIUM client is the holder of the ATR contract signed with IBER-
DROLA.
c) That the client, as the holder of the ATR contract, is obliged to
Narrow the access rates to the distribution company.
d) That the distribution company issues the access invoices to the trading company
cializadora who passes them on to customers in their supply invoices. What
the customer must pay these invoices.
e) That the distribution company cannot demand the payment of the direct access toll
straight to the consumer.
f) That both the client and the marketing company are obliged
two jointly and severally to the payment of access fees to the distribution company.
g) That the marketing company must pay the distribution company the
access fees, even if these have not been satisfied by your client.
h) That in the event that access fees are not paid within the deadlines
established in current regulations, the distribution company may initiate the
supply suspension procedure. (art. 52 LSE, 4.4 RD 1164/2001,
art 85 RD 1955/2000.).
i) That the causes that have motivated the incident are a consequence of non-compliance
service by WATIUM within the payment period for each invoice remittance
of ATR, for which they are forced to reliably require the payment of
these rates, warning of the start of the procedure for suspending supplies
tr electric.
j) That since WATIUM collects these access fees from its customers, it trans-
After certain days from the issuance of the reliable request by
non-payment of access fees, IBERDROLA sends the contract holders
of ATR an information letter to inform of the situation and to keep-
is the same, the WATIUM client who has paid the access fees to the
trading company may suffer the consequences of a suspension
of supply. Also the object of the letter is that the holder of the ATR contract
carry out the actions it deems appropriate and, where appropriate, accredit
IBERDROLA, which has already paid these access fees to the trading company
dora, assumption in which the client would avoid having the su-
electrical minister.
k) That the information letter is essential to protect the rights of the
users and that have been subject to review by the regulatory body, the Commission
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 23
23/37
National Market and Competition sion and that comply with the regulations
is in force.
l) That they have been forced to send 1462 information letters to date.
m) That the legal basis for the processing of personal data of
WATIUM's clients is: Contractual. WATIUM customer has subscribed
with IBERDROLA, ATR contract. That the trading company does not have
the condition of part, but of mere representative. Consent of the holder of
the data. That the ATR contract gives express authorization of the clients of
WATIUM for the processing of personal data. What is authorized
tion and express expression of consent is imposed by the regulations
is in force. Legal. What is the legal obligation to process data by the company?
sa distributor for the management of the contract. That such management includes the obligation
tion to inform the ATR holders of the possibility that
supply is suspended. d. Legitimate interest. The one to be able to comply
to its legal and regulatory obligations such as informing the holders of
ATR laws of the incidents that affect your contract, the management of this and
the collection of access tariffs for the National Electric System.
n) They conclude that the only solution to this dispute is that WATIUM
comply with your obligations as this situation is causing important
damages to its customers, the distributor and the National Electric System.
8.- For its part, the CNMC states, regarding the allegations made by the entity
claimed:
a) That IBERDROLA (I-DE) has not addressed the CNMC before sending the
clients of WATIUM, SL the aforementioned letters.
b) That the CNMC has not reported either favorably or unfavorably the rea-
lization of such shipments.
c) That on 01/22/18 a written complaint from WATIUM was received at the CNMC,
SL for the reasons indicated above.
d) That, after analyzing the complaint, the Competition Directorate of the CNMC
considered that it could not be concluded that IBERDROLA (I-DE), incurred in
fraction of art. 3 of Law 15/2007, of July 3, on the Defense of Competition
cia for carrying out acts of unfair competition.
e) That the information was transferred to the Energy Directorate
for the assessment of the possible breach on the part of WATIUM, SL of the
applicable regulations regarding payment of the network access toll.
FOUNDATIONS OF LAW
I- Competition.
The Director of the Spanish Agency is competent to resolve this procedure
of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR in
the art. 47 of LOPDGDD.
II- Answer to the allegations to the Proposal for Resolution.
The joint assessment of the documentary evidence in the procedure brings to
knowledge of the AEPD, a vision of the denounced action that has been
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 24
24/37
strapped in the facts declared proven above related. However, on the
allegations presented by the claimed entity must indicate:
- On the non-existence in the conduct of I-DE of violation of the regulations of
protection of personal data, (first and second points of the allegations)
nes):
The electric power trading companies (the complaining entities), have
nen subscribed with the electric power distribution entity, (the claimed entity),
an access contract to the network (ATR), by means of which, it exercises mandate functions
river or substitute for end customers, as indicated in articles 3.2 and 3.3 of the Real
Decree 1435/2002, of December 27, which regulates the basic conditions
of contracts for the acquisition of energy and access to low voltage networks. In
said contract, there is the following clause:
"The undersigned, acting as agent and substitute for the client for the purposes of the
art. 3.2 and 3.3 of the RD. 1435/2002 of December 27, contracts with IBERDROLA DIS-
TRIBUCIÓN ELECTRICA, SAU access to the network for electricity supply in the
supply point outlined, being obliged to keep the documentation that
accredits as agent and substitute for the client and to make it available to the only one
distributor if it is required, both parties being obliged to comply with the Conditions
Specific, Special and General purposes included in this policy. All of them
in accordance with current legal prescriptions, signed on the day of the date
in duplicate and with a single effect ”.
The signatories of the contract are, on the one hand, the trading company and, on the one hand,
part of the supplying company, the contract administrator and the Head of Distribution
zone tion.
In article 3.2 of RD 1435/2002, cited in the contract, it is established, on the finalization
of the processing of personal data, the following: “2. (…) The supply contract
between the consumer and the marketer, it must be formalized in writing. In it you must
include an authorization so that the marketer can act as agent
of the consumer, contracting the access fee with the distributor and transferring the
buidor the data necessary for the supply. The collection, treatment and transfer of
These data must at all times observe the provisions established in the norm.
policy on the protection of personal data that may be applicable ”.
Well, according to the principle of "limitation of purpose", contained in article 5 of the
RGPD, personal data will be processed only and exclusively for specific purposes.
defined, explicit and legitimate, and will not be subsequently treated in an incompatible manner.
ble for these purposes.
This principle has two parts, on the one hand, it requires that the data be treated with
one or more specific, explicit and legitimate purposes, that is, the purpose of the
Treatment must be clearly defined, in such a way that allows the interested party
or to the control authorities to know what type of activities are included in it and why
On the other hand, it prohibits the data collected for specific, explicit and lawful purposes
gitimos are subsequently processed in a manner incompatible with those purposes.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 25
25/37
Therefore, it is not possible to process the data initially collected for another purpose than
are not compatible with the first. This means that the GDPR does not prevent
data are processed for purposes other than the one that justified the original treatment.
Rio, what it prohibits is a treatment for purposes not compatible with the initial one.
Article 3.2 of RG 1435/2002 referred to in the contract signed between the commercial entity
cializadora and the distribution entity establishes that the personal data that the entity
marketing company will "transfer" to the "distributor" entity, they will be solely and exclusively
so that it provides the final consumer with the electricity supply: “(…) transfer to the
distributor the data necessary for the supply (…) ”, that is, the data necessary
so that the electric power distribution entity can reach the final point
the electricity supply (identification of the final consumer, supply address,
contracted company, etc. This purpose or another compatible with it, are the only ones for the
that the distribution entity can make a lawful treatment of personal data
that the marketer has provided you.
In the present case, the letters sent by the distribution entity to consumers
final meters said verbatim:
“March 13, 2018.- Dear consumer: By means of this letter I put-
We know that, on February 8, 2018, we were forced to
to be sent to your electric power marketer WATIUM, SL., in accordance with the
current regulations (art. 4.3 and 4.4 of Royal Decree 7764/2007, of October 26), a
reliable demand for payment, given that, once the voluntary payment period has elapsed,
glamentarily established, the amount of the invoice for third-party access to the network
corresponding to the contract and supply point of which you are the owner and that,
Continuation, it is detailed, is unpaid: (….).
Non-payment of third party access fees to the network may give rise, according to
with current regulations (art. 4.4. of Royal Decree 7764/2007, of October 26), to the
suspension of power supply. For all these reasons, we ask you to be urgent-
keep in touch with your marketing company to remedy this situation without
that in no case does this information letter imply a request for payment to
you by this distribution company. Without other particular, sincerely. "
Therefore, it is clear that the processing of personal data carried out by the
distribution company, when sending informational letters of the alleged breaches
contractual agreements of the trading company, to final consumers, in addition to
"Beg" them to contact the marketing entity so that it
"Proceed to correct the problem" is not compatible with the stated purpose
in article 3.2 of RD 1435/2002.
Moreover, this irregular data processing carried out by the distribution entity implies
the breach of what is established in art. 5.1.c) of the RGPD, since the personal data
Final treaties for sending the cited letters are neither adequate nor pertinent,
in relation to the purpose and scope for which they were collected (principle of mini-
data mization). What this principle establishes is that personal data must-
They will be, in any case, limited to the purpose for which they were collected. Purpose
established in the terms and conditions agreed in the signed contract.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 26
26/37
On the other hand, article 3.3 of the aforementioned Royal Decree 1435/2002, establishes that: “In the
case in which the consumer chooses to contract energy and access to the networks through
Through a marketer who acts as a substitute for the consumer, the marketer
The buyer must have sufficient power granted by the consumer in favor of the merchant.
cializer. In this case, the position of the marketer in the access contract sus-
Credit with the distributor will be for all purposes that of the corresponding consumer.
In any case, the distributor will maintain with the final consumer all the obligations
tions relating to the access contract and in the event of termination of the contract between the
merchant and consumer, this will be the holder of the guarantee deposit, as well as
of any other right associated with the installation, without it being enforceable, for
part of the distributor, any update due to the contractual renewal ”.
According to this precept, if the distributor wishes to address the final consumer who has
dealt with the supply of electrical energy through a marketer, it may only di-
abide by it through the marketer, for having constituted itself as agent
of the final consumer acting before the distributor as a " substitute for the consumer ".
The cited article, therefore, does not contemplate direct action between the distributor and
the final consumer, since he has appointed an agent for his relationship with
that, not existing in any case, a direct contractual relationship between the distributor
buyer and the final consumer but through marketing, whose position in the
access subscribed with the distributor is, as established in the aforementioned article: “(…) to all
the effects that of the final consumer ”.
The claimed entity is accepted in article 4.4 of RD 1164/2001, where they are established
the conditions for suspending the electricity supply, as a result of non-payment
of the rates, to have sufficient power to address the final consumer
with a different purpose than that established in article 3.2 of RD 1435/2020, this
is, to send them informational letters with the "request" that they get in touch with
the marketing entity so that it fulfills its contractual obligations.
Well, the cited article establishes the following: “4. The distribution company may
suspend the access fee contract when at least two have elapsed
months since he had reliably required payment to the consumer or its maintenance
date, in accordance with the scope of application of the access fees established in
Article 1, paragraph 1, of this Royal Decree, without it having been made
cho cash. For these purposes, the request will be made by means of a referral, to the address
address that for communication purposes appears in the access fee contract, for
any means that allows proof of receipt by the interested party, as well
as well as the date, identity and content of this, leaving the distribution company
obliged to keep in its possession the accreditation of the notification made. In the su-
post of rejection of the notification, the circumstances of the attempt to
notification and the procedure will be considered completed. Said communication must include the
procedure of disconnection of the consumer from the distribution networks due to non-payment,
Said the date from which the disconnection will take place, if the payment is not made on
above the amounts owed (…) ”.
Well, as this article establishes, when the distribution company is obliged to
to suspend the electricity supply service to the final consumer due to non-payment, it is
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 27
27/37
when it can be directed to the final consumer, but to the sole effect of requirement
of the payment of the electricity tariff, in accordance with the scope of application established in the
Article 1.1 of the aforementioned Royal Decree. In addition, the requirement will be practiced in the
Rection that for communication purposes appears in the signed contract and in it only
It will include: “ the process of disconnection of the consumer from the distribution networks by
non-payment, specifying the date from which the disconnection will take place, if no
the amounts owed must be paid in advance ” .
Therefore, the aforementioned article limits the communications of the distribution entity with the
end customer for the sole purpose of requiring payment of the fee, when this is the
direct debtor, and as the claimed entity indicates in its allegations: “in no way
At one time the consumer has been required to pay said fee which, on the other hand,
you, he has already satisfied the marketer ” , but merely informs him that his
The merchant has not satisfied the payment of the electricity tariff, previously paid by
he in addition to "begging" him to contact the marketing entity
so that it can solve the problem of non-payment.
Therefore, the conclusion reached by the claimed entity cannot be taken in
consideration because it is not correct to apply this article to take over the power
sufficient for the processing of personal data of end consumers and potential
thus, send them informational letters with the “request” to contact the entity.
marketing entity in order for it to comply with its contractual obligations with
the distribution entity, without entering to assess this Agency the other allegations where
the possible consequences of the marketing company not satisfying
to its contractual obligations as these valuations are not the competence of this
Organism.
3.- Regarding the intervention of the CNMC in the present case, the entity now recognizes
claimed, changing its initial argument that: “The CNMC is aware of the
sending these communications, at least as a result of the complaint
formulated by the marketer (…). "
Well, it must be remembered that, on 06/25/19, the claimed entity affirmed to
this Agency verbatim that: “ These letters have already been subject to review by the
Regulatory body, the National Commission of Markets and Competition and
strictly comply with the aforementioned regulations in force (…) ”.
Report requested from the Regulatory Body on the statements made by the
claimed entity, on 02/26/20, the CNMC sent this Agency a report where
these assertions were flatly denied:
"Regarding this letter, the following must be reported according to the data
working in the Directorates of instruction of this Commission: - Iberdrola Distribución
Eléctrica, SAU has not approached the CNMC before sending Watium customers,
SL the letters in question. The CNMC has not reported, either favorable or
unfavorably, the making of said shipments. - On January 22, 2018
received at the CNMC a letter of complaint from Watium, SL due to the letters of
that is (…).
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 28
28/37
As a conclusion to the report issued by the Competition Directorate of the CNMC,
considers that: “(…) it could not be concluded that Iberdrola Distribución Eléctrica, SAU
incurred in violation of article 3 of Law 15/2007, of July 3, on the Defense of the
Competition, due to acts of unfair competition. Attached to
In this regard, communication dated April 19, 2018 sent to the complainant by
of the Directorate of Competition. It remains to clarify that, although the communication of 19
April 2018 mentioned refers at the end to a transfer of the information to the Directorate
of Energy, this is produced for different purposes (valuation of the possible
non-compliance on the part of the trading company Watium, SL of the applicable regulations
regarding payment of the network access toll) ”.
It is striking to see how the claimed entity, to justify the treatment of the data
end customers' personals for sending informative letters, "begging them"
also that they contact the marketing entity, excuse themselves
initially in the approval made by the CNMC, indicating to this Agency that, the
"Letter" conformed to current regulations as it had been endorsed by the Agency
Regulator and that after he denied it by denying knowledge of the
existence of the letters, the claimed entity will change its argumentation by trying
Now, with these new allegations, justify that: (…) The CNMC did know that these
letters were sent to I-DE clients whose marketing company did not pay
the access fees after the end of the voluntary payment period and after having
has been reliably required for this purpose, as expressly provided by law
applicable, in order to avoid the supply being suspended without the knowledge of the
holder of the contract, nor to be able to have it, that his access contract was in the
of non-payment ”.
It is true, as the claimed entity affirms, that the CNMC learned of the existence of the
letters long after they were sent, but it was not through the distribution entity, if
not through the complaint filed by the marketing entity before said
Organism.
In short, it is not true that the CNMC knew of the existence of the letters through
of the distribution entity : “(…) Iberdrola Distribución Eléctrica, SAU has not
addressed to the CNMC before sending Watium, SL clients the letters that are
treats (…) ” . Nor is it true that said Agency reported favorably. Other
Another thing is that said Agency had knowledge of the letters sent
a long time later, through the complaint filed by the entity
trading company before said Body but the fact that later the CNMC
decided to inform the Directorate General of Energy the facts is
an issue that this Agency cannot enter into to assess, as it falls outside the scope of
competition, so it is still impossible to take into account the
repeated allegations presented by the entity claimed in section 3 of the
Point 2.
On the legal basis of the treatment in the present case (section 4 of point 2 of
the allegations).
The claimed entity now welcomes the legitimate interest established in article 6.1 f)
of the RGPD for the sending of the letters, without even justifying the reasons that
lead to this, limiting themselves to indicating that:
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 29
29/37
“(…) In this way, it would be applicable to the assumption, at least, and although
considers sufficient the legal basis of the contractual relationship, the rule of interest
legitimate prevailing established in article 6.1 f) of the RGPD (...) ”, not providing
no legal basis that allows weighing, even minimally, the legality of the
treatment of the data of the end consumers, by sending the letters to
those referred to in this procedure, suffering from an absolute lack of
motivation, since only recital 47 of the RGPD is transcribed at this point
for your defense.
Therefore, if the claimed entity now avails itself of the legitimate interest for the
treatment of personal data of end customers, the rule requires you to carry out
a balancing exercise between said legitimate interest and fundamental rights
of those affected. In this sense, the Judgment of the Court of Justice declared
expressly the direct effect of article 7 f) of Directive 95/46 / EC, according to which:
“ The Member States shall provide that the processing of personal data may only be
be carried out if (...) it is necessary to satisfy the legitimate interest pursued by
the person responsible for the treatment or by the third party or third parties to whom the
data, provided that the interest or fundamental rights and freedoms do not prevail
of the interested party that require protection in accordance with article 1.1 of this
Directive".
Therefore, to determine if the application of the aforementioned precept is appropriate, it will be necessary to
apply the rule of weighting provided in it; that is, it would be necessary
assess whether in the specific case under analysis there will be a legitimate interest
pursued by the data controller (marketing company) or by the
third party or third parties to whom the data is communicated (distribution company), which
prevails over the interest or the fundamental rights and freedoms of the interested party
that require protection in accordance with the provisions of article 1 of the RGPD, or if, for
on the contrary, the fundamental rights or interests of the interested parties to whom
refers to the treatment of the data must prevail over the interest in which the entity
claimed seeks to substantiate the processing of personal data.
Thus, in order to carry out the necessary weighting required, you must
consider whether, taking into account the specific circumstances that occur in the
present case, the interest pursued by the distribution entity by sending the letters
informative and "beg" to end consumers, treating their personal data
It must prevail over the right to data protection of those affected.
In the present case, from the reading of the letter sent to the final consumers,
It follows that the purpose pursued by the distribution entity is, firstly,
inform the end consumer of a presumed contractual breach of their entity
marketer with the distribution entity to then "beg" the consumer
final contact with the marketer with the ultimate goal of
he pays what is allegedly owed, otherwise the continuity of
electrical supply to your home may be in danger, observing a possible
intimidating background towards the final consumer, although the distribution entity
keep in stating that said letter is not, at all, a request for payment to the
final consumer as he recognizes that he meets his obligation to pay
billing of electricity consumption to the marketing entity.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 30
30/37
Therefore, it is evident that the ultimate interest, which moves the distribution entity to
send the letters to the final consumers is that the marketer pays them the
owed, even though, from the reading of the letter, the final consumers may
feel "pressured" to contact the marketing entity, under the
"Threat" of suspending the electricity supply if the marketing entity does not
pay what is owed.
Therefore, it is not possible to consider the processing of data as a legitimate interest
personal data of the final consumers by the distribution entity to
send them informational letters of the breaches of the marketing entity and
"Begging" you to get in touch with it to remedy the problem, as
in this case, the rights and freedoms must undoubtedly prevail
fundamentals of the interested party.
However, it is entirely correct that the distribution company has the right to
"Recover some amounts that it has been forced to enter for the electrical system
despite not having collected them ”, by the legal means it deems appropriate, but
the claimed entity should not confuse this right with the presumed "interest
legitimate ”which is used for the illicit treatment of the personal data of the
final consumers
- Regarding the setting of the amount of the sanction in the commencement agreement, (point three-
ro of the allegations).
Indicate, once again, that Law 39/2015, of October 1, on the Procedure
Common Administration of Public Administrations, (LPACAP), establishes, in its
article 53.2:
"In addition to the rights provided in the previous section, in the case of
administrative procedures of a sanctioning nature, the alleged
Responsible parties will have the following rights: a) To be notified of the facts that
are charged, of the infractions that such facts may constitute and of the
sanctions that, if applicable, could be imposed (…) ”.
For its part, article 64 of the aforementioned LPACAP establishes, with respect to the
Agreement to initiate procedures of a sanctioning nature, which:
1. The initiation agreement will be communicated to the instructor of the procedure, with transfer
of how many actions exist in this regard, and the interested parties will be notified,
understanding in any case the accused as such. Likewise, the initiation will be communicated
to the complainant when the rules governing the procedure so provide. 2. The
initiation agreement must contain at least: a) Identification of the person or
persons allegedly responsible. b) The facts that motivate the initiation of the
procedure, its possible qualification and the penalties that may correspond, without
detriment of what results from the instruction
Therefore, that the sanctioning body anticipates the amount of the sanction that would proceed
impose, and always depending on what ultimately results from the procedure and that, in the
Proposed Resolution, is proposed, an amount identical to that indicated by the body
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 31
31/37
sanctioner in the Initiation Agreement, has nothing in particular, nor does it attempt against
no established norm, so it is not appropriate to consider what is alleged by the entity
claimed at this point, even more so when it only records the fact,
without even supporting in the least the reasons that lead him to put in between
said the legality of the sanctioning procedure carried out.
On the other hand, it is not true, as the claimed entity affirms that: “(…) the body
sanctioner is not limited to remembering which is the applicable sanctioning norm, but
assesses effectively, without paying attention at any time to what the
inserted, what concrete sanction, within the limits established by the norm,
it is appropriate to impose (…) ” because in the document initiating the sanctioning proceedings,
You can read verbatim, in your "agreement": " WHAT: for the purposes provided for in art. 64.2
b) of Law 39/2015, of October 1, on the Common Administrative Procedure of the
Public Administrations, the corresponding sanction would be a fine of
200,000 euros (two hundred thousand euros), without prejudice to what results from the instruction ”,
and therefore, the sanction to be imposed becomes conditional on the result of the instruction of the
process. The fact of indicating a specific numerical data of the sanction in the
commencement agreement is simply in application of the provisions of article 64.1.b) of
LPACAP cited above and in application of the provisions of article 68 of the
LOPDGDD, according to which it will be enough to specify the facts that motivate the
opening, identify the person or entity against which the procedure is directed, the
infraction that could have been committed and its possible sanction.
Therefore, the statement made by the entity cannot be taken into account
claimed when it indicates that the possible sanction that may correspond to the
imputed infractions is a determining factor of defenselessness or that implies a rupture
of the principle of separation of the investigation and resolution phases. On the contrary, with
This is in compliance with one of the requirements set forth in the standards outlined.
For its part, article 85 of the LPACAP contemplates the possibility of applying
reductions on the amount of the penalty if the offender acknowledges his responsibility
and in the event of voluntary payment of the penalty. This precept establishes the obligation to
determine those reductions in the notice of initiation of the procedure, which
entails the need to set the amount of the penalty corresponding to the facts
accused and it is not true, as stated by the claimed entity that this article
establish that the amount of the sanction is determined once the
procedure, since the recognition of responsibility and voluntary payment of the
sanction what has to occur after that moment, and not the fixation of the
amount of the penalty.
If this acknowledgment of responsibility or voluntary payment does not occur, which
would determine the termination of the procedure, it is instructed and dictates
later the resolution proposal, in which they have to be fixed in a reasoned way
the facts that are considered proven and their exact legal qualification,
will determine the infringement that, where appropriate, those constitute, the person or persons
responsible and the sanction that is proposed, the evaluation of the tests carried out,
especially those that constitute the basic foundations of the decision. This
must be notified to the interested party, granting him a period to formulate
allegations and present the documents and information deemed pertinent.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 32
32/37
In no case will a resolution be adopted without the interested party having the opportunity to
manifest itself on all the extremes considered.
Therefore, it is not true that the claimed entity has seen its rights and
it cannot be said that the determination of the amount of the fine in the
opening does not imply any reduction in said guarantees causing helplessness.
Nor does this circumstance break the impartiality of the investigating body, which provides
of all the powers conferred by the regulations in question and full freedom to
dictate your motion for a resolution. You just have to go to the Agency's website, in the
that all resolutions issued in sanctioning procedures are published,
to check the large number of them ending with a file resolution of
actions, following the proposal issued by the instructor of the procedure, as well
such as those in which said proposal increased or decreased the amount of the
sanction set in the opening agreement or even proposed the application of a power of attorney
corrective other than the sanction of a fine.
- On the application in the present case of the principle of proportionality and the
modifying circumstances of the concurrent responsibility in the same
(fourth point of the allegations):
a) .- Regarding the number of letters sent to clients, indicate that, for this Agency
there is the same rejection of an illicit treatment of 2,598 personal data as a
illicit treatment of 1,462 personal data, so it is not appropriate to reconsider the
aggravating point a) of article 83.2 of the RGPD.
b) .- On the statement made by the claimed entity when it alleges that:
“(…) Understands this part that the AEPD cannot take as true or assume in
In no way a representation that not only is not in any case accredited,
but also refuses, since Watium always claims to act on his own
Name. Therefore, there is no doubt that this entity holds the status of
interested party for the purposes provided in the data protection regulations, is
the application of such an aggravating circumstance is completely inadmissible ”,
It should be remembered that, for example, in the claim itself presented by the entity
Watium SL., In this Agency, it was indicated verbatim:
“A claim is filed against Iberdrola Distribución Eléctrica, SAU (company
electricity distribution company) by sending a series of letters (we have
proof of 2598 letters) to the clients of Watium, SL (trading company
of electrical energy) distracting the purpose for which the data were transferred from
the marketer to the distributor (purpose: supply) lacking legal basis
to get in touch with the clients of Watium, SL
c) .- On the statement made by the claimed entity when it indicates that: “3. He says,
thirdly, the AEPD, that I-DE acted “knowing that there were different
complaints filed and reports issued by different public bodies
who rejected said action, the entity continued to send information letters to the
end customers, and, therefore, could constitute an illegal act ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 33
33/37
My client cannot but reiterate that he does not know what those reports are and
resolutions that she was supposed to know when she carried out the treatment
of the data. Indeed, since obviously they cannot be what they are
object of this procedure there are only two possibilities: that the AEPD refers to the
complaint filed by Watium with the CNMC or that it is the requested report
by that entity to the Legal Office of the AEPD.
Well, as a first consideration, both the complaint and the request for a report
were after treatment, so it could hardly be done after
knowing the "resolution" issued or the report issued (...).
Well, as stated in the sanctioning file, there is a certificate issued by the
Electronic Notification Service and Electronic Address, dated
acceptance 05/23/19 and being the receiver *** NIF. 1 AAA in representing
IBERDROLA DISTRIBUCIÓN ELÉCTRICA SA, with NIF A95075578, this Agency
sent to the claimed entity the complaint filed with this Agency by the entity
Watium SL, including: - Model network access contract signed between the two
entities. - Sample letter sent by Iberdrola to WATIUM SL clients. - Letter
sent to the Markets and Competition Commission on 01/22/18. - Written
sent to Iberdrola on 01/23/18. - Request for a legal report to the AEPD, dated
02/19/18. - Response of the legal office of the AEPD, dated 07/24/18 - Request
from the DPD of WATIUM SL to the DPD of IBERDROLA, dated 10/24/18. - Burofax a
IBERDROLA, to stop sending the letters, 10/24/18. - Service response
IBERDROLA legal, dated 11/02/18. - Examples of letters sent by
IBERDROLA, Q1 2018, Q3 2018 and Q1 2019.
However, the foregoing, knowing that there were different claims
filed and reports issued by different public bodies that put into
doubt said action, dated 09/05/19, (3 months later), the claimed entity
sends customers of the trading company ENERGÍA Y SERVICIOS ABY, SL the
The same letters that I sent some time before to the clients of the marketer
WATIUM SL.
Therefore, it is not true, as the claimed entity tries to justify that it was unaware
the reports and resolutions that questioned the processing of personal data of
end customers, thereby evidencing the negligence of the entity's conduct
claimed, since its action was carried out without the due level of due diligence.
d) .- On the alleged seriousness derived from the treatment of categories of data
limited only to those of a merely identifying nature, remember that the
Article 1.2 of the RGPD establishes that: “This Regulation protects the rights and
fundamental freedoms of natural persons and, in particular, their right to freedom
protection of personal data ”, defining in its article 4.1, the“ personal data ”
as: “all information about an identified or identifiable natural person, whose
identity can be determined, directly or indirectly, in particular by means of a
identifier, such as a name, an identification number, etc. ”, and by
Therefore, in this case, when the claimed entity makes an illicit use of the name,
surname or address, is sufficiently clear evidence of an illicit use of data
personal protected by the RGPD and therefore, object of aggravation in application of the
section g) of article 83.2 of the RGPD.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 34
34/37
d) .- Regarding the alleged illegal use of the data to avoid losses to I-DE, indicate that,
From the letters sent to the end customers, it is clear that the objective
The end of the claimed entity, as argued above, was to avoid
the losses that the contractual breach of the marketers was
producing in the distributor, so it is not appropriate to consider the allegations
made at this point.
e) .- Regarding the connection between I-DE and data processing, indicate that it is notorious
that an entity like I-DE, handles personal data of more than 6 million
direct and indirect customers, through marketers, in addition to having a
staff of more than 35,000 employees, so that, an entity like her, is owed
require a maximum level of due diligence in the processing of personal data and
its management, both of the personal data of direct customers and the data
personal data that the marketers provide you with in order to send them
power supply.
Therefore, the interpretation made by this Agency of the aggravating factors established in the
RGPD and the LOPDGDD is totally in accordance with the infractions committed by the
claimed entity.
III
Thus, the known facts constitute an infringement, attributable to the
claimed entity, for violation of the articles:
- Art. 6.1.b) of the RGPD, which establishes that: “the processing of data will only be lawful
to if it is necessary for the execution of a contract in which the interested party is
part or for the application at his request of pre-contractual measures ”.
- Art. 5.1.b) of the RGPD which establishes that: “personal data will be collected
for specific, explicit and legitimate purposes and will not be further processed
in a manner incompatible with said purposes, (purpose limitation).
- Art. 5.1.c) of the RGPD, which establishes that: “Personal data will be the ade-
appropriate, relevant and limited to what is necessary in relation to the purposes for which
that are treated, (data minimization).
For its part, article 72.1.a and b) of the LOPDGDD considers as "very serious",
Prescription purposes, the processing of personal data if, " violates the
principles and guarantees established in article 5 of the RGPD "and if it is carried out," without
any of the conditions of legality established in article 6 of the RGPD concur ”,
respectively.
IV
These infractions can be sanctioned with a fine of € 20,000,000 maximum
or, in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for the
of a higher amount, in accordance with article 83.5.a) of the RGPD.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 35
35/37
In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In this case, it is considered that the sanction to be imposed should be adjusted according to
with the following aggravating criteria, established in article 83.2 of the RGPD:
- The nature, severity and duration of the offense, taking into account the nature
nature, scope or purpose of the treatment operation in question, as well as
such as the number of interested parties affected and the level of damages
who have suffered, when carrying out an improper treatment of personal data,
(section a).
- The intentionality or negligence in the infringement. In the present case we are
before negligent action, because even having knowledge of the filing
of claims before different public bodies, by the company
Watium, Iberdrola continues to send letters to the clients of the claimed entities
mantes, (section b).
- The categories of personal data affected by the infringement, already
that the data processed, in this case, are customer identification data
end of the marketing entities and their location, (section g).
- The way in which the supervisory authority learned of the infringement, since
that the AEPD became aware of the infringement through the claim of the
interested party, (section h).
- The losses avoided, directly or indirectly, through the infringement, in
In this case, trying to use the mediation of the clients of the co-
mercializadoras, with the illicit treatment of your personal data to obtain
guide that the trading entities pay the debt contracted with the company.
distribution company, (section k).
It is also considered that the sanction to be imposed should be adjusted in accordance with the
following aggravating criteria, established in article 76.2 of the LOPDGDD:
- The linking of the activity of the offender with the performance of treatment of
personal data, (section b).
The balance of the circumstances contemplated in article 83.2 of the RGPD, with
regarding the offense committed by violating the provisions of its articles 5.1.b and c) and
6.1.b) allows setting a penalty of 200,000 euros (two hundred thousand euros), considered
as “very serious”, for the purposes of this prescription, in article 71.1.a and b)
respectively, of the LOPDGDD.
In view of the above, the following is issued:
RESOLVES :
FIRST: IMPOSE on the entity, I-DE REDES ELECTRICAS INTELLIGENTES,
SAU (I-DE), formerly known as IBERDROLA SA, with CIF: A95075578 a
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 36
36/37
sanción de 200.000 euros (doscientos mil euros), por infracción de los artículos, 5.1.b)
y c) y artículo 6.1.b) del RGPD.
SEGUNDO: NOTIFICAR la presente resolución a la entidad I-DE REDES ELÉCTRI-
CAS INTELIGENTES, S.A.U e INFORMAR a los reclamantes sobre el resultado de la
reclamación.
TERCERO: Advertir al sancionado que la sanción impuesta deberá hacerla efectiva
una vez sea ejecutiva la presente resolución, de conformidad con lo dispuesto en el ar-
tículo 98.1.b) de la ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Co-
mún de las Administraciones Públicas (LPACAP), en el plazo de pago voluntario que
señala el artículo 68 del Reglamento General de Recaudación, aprobado por Real De-
creto 939/2005, de 29 de julio, en relación con el art. 62 de la Ley 58/2003, de 17 de
diciembre, mediante su ingreso en la cuenta restringida nº ES00 0000 0000 0000 0000
0000, abierta a nombre de la Agencia Española de Protección de Datos en el Banco
CAIXABANK, S.A. o en caso contrario, se procederá a su recaudación en período eje-
cutivo.
Recibida la notificación y una vez ejecutiva, si la fecha de ejecutividad se encuentra
entre los días 1 y 15 de cada mes, ambos inclusive, el plazo para efectuar el pago vo-
luntario será hasta el día 20 del mes siguiente o inmediato hábil posterior, y si se en-
cuentra entre los días 16 y último de cada mes, ambos inclusive, el plazo del pago
será hasta el 5 del segundo mes siguiente o inmediato hábil posterior.
De conformidad con lo establecido el artículo 82 de la Ley 62/2003, de 30 de diciem-
bre, de medidas fiscales, administrativas y del orden social, la presente Resolución se
hará pública, una vez haya sido notificada a los interesados. La publicación se realiza-
rá conforme a lo previsto en la Instrucción 1/2004, de 22 de diciembre, de la Agencia
Española de Protección de Datos sobre publicación de sus Resoluciones.
Contra esta resolución, que pone fin a la vía administrativa, y de conformidad con lo
establecido en los artículos 112 y 123 de la LPACAP, los interesados podrán interpo-
ner, potestativamente, recurso de reposición ante la Directora de la Agencia Española
de Protección de Datos en el plazo de un mes a contar desde el día siguiente a la noti-
ficación de esta resolución, o, directamente recurso contencioso administrativo ante la
Sala de lo Contencioso-administrativo de la Audiencia Nacional, con arreglo a lo dis-
puesto en el artículo 25 y en el apartado 5 de la disposición adicional cuarta de la Ley
29/1998, de 13/07, reguladora de la Jurisdicción Contencioso-administrativa, en el pla-
zo de dos meses a contar desde el día siguiente a la notificación de este acto, según
lo previsto en el artículo 46.1 del referido texto legal.
Finalmente, se señala que conforme a lo previsto en el art. 90.3 a) de la LPACAP, se
podrá suspender cautelarmente la resolución firme en vía administrativa si el interesa-
do manifiesta su intención de interponer recurso contencioso-administrativo. De ser
éste el caso, el interesado deberá comunicar formalmente este hecho mediante escrito
dirigido a la Agencia Española de Protección de Datos, presentándolo a través del Re-
gistro Electrónico de la Agencia [https://sedeagpd.gob.es/sede-electronicaweb/], o a
través de alguno de los restantes registros previstos en el art. 16.4 de la citada Ley
39/2015, de 1 de octubre. También deberá trasladar a la Agencia la documentación
que acredite la interposición efectiva del recurso contencioso-administrativo. Si la
Agencia no tuviese conocimiento de la interposición del recurso contencioso-adminis-
trativo en el plazo de dos meses desde el día siguiente a la notificación de la presente
resolución, daría por finalizada la suspensión cautelar.
C/ Jorge Juan, 6
www.aepd.es
28001 – Madrid
sedeagpd.gob.es
Page 37
37/37
Mar España Martí
Directora de la Agencia Española de Protección de Datos
C/ Jorge Juan, 6
www.aepd.es
28001 – Madrid
sedeagpd.gob.es
</pre>
</pre>

Revision as of 14:49, 5 March 2021

AEPD - PS/00197/2020
LogoES.jpg
Authority: AEPD (Spain)
Jurisdiction: Spain
Relevant Law: Article 5(1)(b) GDPR
Article 5(1)(c) GDPR
Article 6(1)(f) GDPR
Article 6(1)(b) GDPR
Article 58(2) GDPR
Article 3(2) Royal Decree 1435/2002
Article 3(3) Royal Decree 1435/2002
Article 4(4) Royal Decree 1164/2001
Article 47 LOPDGDD
Type: Complaint
Outcome: Upheld
Started:
Decided: 12.02.2021
Published: 01.03.2021
Fine: 200000 EUR
Parties: Energia y Servicios Aby 2018 SL
I-DE, Redes Eléctricas Inteligentes SAU
Watium SL
National Case Number/Name: PS/00197/2020
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Spanish
Original Source: AEPD (in ES)
Initial Contributor: n/a

The Spanish DPA (AEPD) imposed a fine of €200,000 on the energy supplier, I-DE, Redes Eléctricas Inteligentes SAU. I-DE had sent a letter to end consumers requiring them to get in touch with regards to unpaid invoices despite a contractual arrangement providing for an intermediary to communicate with end users (breach of Articles 6(1)(b), 5(1)(b) and 5(1)(c) GDPR).

English Summary

Facts

Energia y Servicios Aby 2018 SL (ESA 2018) and Watium SL filed a complaint against I-DE, Redes Eléctricas Inteligentes SAU (I-DE, previously Iberdrola Distribución Eléctrica) before the Spanish DPA (AEPD).

Watium is an electric power trading company which is subscribed with the energy distribution company I-DE by way of a network access contract (ATR). This contract is refers to Articles 3(2) and 3(3) of the Royal Decree 1435/2002. The contract included the identification and contact of the end consumer, the logo of Iberdrola Distribución Eléctrica (now i-DE) and the identification of Watium. Although signed by the two entities, there is no place for the end consumer's signature in the contract.

In the letters sent by Iberdrola/I-DE to Watium end consumers in 2018, Iberdrola/I-DE stated that the were forced to send Watium (according to the law) a request for payment for unpaid invoices. They requires that the end consumer get in contact with their provider company.

Watium informed these facts to the Spanish Competition Authority (Comisión Nacional de los Mercados y la Competencia - CNMC) and the Spanish DPA (AEPD) in January 2018.

At the time, the AEPD issued a report stating that it could be concluded that processing of personal data carried out by I-DE violated data protection law (legal basis and data protection principles). The report highlighted that the appropriate legal basis would have been contractual necessity (Article 6(1)(c)) but the processing of personal data of the consumer (who acts by way of an intermediary) is not necessary for the fulfillment of that contract as the intermediary is precisely there to deal with the communication with these types of communications. The AEPD at the time added that I-DE violated the principles of purpose limitation and data minimisation (Article 5(1)(b) and (c)).

In January 2020, Energia y Servicios Aby 2018 SL (ESA 2018), another electric power trading company subscribed to I-DE complained to the AEPD about identical letters of non-payment sent directly to end consumers.

The CNMC outlined that it could not be concluded that I-DE had not acted anti-competitively in breach of Competition Law.

Dispute

Did sending a letter to require an end consumer of an energy distributor to get in touch with regards to a unpaid invoice when an intermediary was set up communicate with the end user breach Articles 6(1)(b), 5(1)(b) and 5(1)(c) GDPR?

Holding

The Spanish DPA (AEPD) deemed itself competent under Article 58(2) GDPR in conjunction with Article 47 of the Spanish Data Protection Law (LOPDGDD) despite the Competition Law aspect of the case.

The DPA went on to outline that the contract between the two complainants and I-DE were network access contracts (ATR) which refer to Articles 3(2) and 3(3) of the Royal Decree 1435/2002 (which regulates the conditions for contract for the acquisition of energy and access to low voltage network). The DPA analysed the wording of the contract against Article 3(2) Royal Decree 1435/2002 and outlined that this provision refers to data protection law in relation to processing of personal data. The DPA specified that the principle of purpose limitation (Article 5(1)(b) GDPR) was relevant. In this ATR contract, reference to Article 3(2) of the Royal Decree established that the purpose for transferring personal data to I-DE would be exclusively so it provides the end consumer with electricity. Therefore, the letters of non-payment that I-DE sent to end consumers directly breached the contract terms and were incompatible with the purpose stated in Article 3(2) of the Royal Decree. Similarly, the principle of data minimisation (Article 5(1)(c) GDPR) was infringed as a result.

In relation to the reference to Article 3(3) of the Royal Decree, the Spanish DPA outlined that this meant that if the distributor (I-DE) wishes to address the end consumer, it should only do so through the "marketer" acting as an intermediary (i.e. Watium or ESA 2018). Therefore, the distributor should not directly communicate with the end consumer since there is an intermediary for this.

The DPA conceded that Article 4(4) of the Royal Decree 1164/2001 provides that the distributor can suspend the electricity supply as a result of non-payment and can contact the end user with the sole aim of requiring payment. Therefore, communication between the distributor and the end consumer is limited. However, the Spanish DPA held that in this context, I-DE sent an informational letter, to request them to get in touch to comply with the contractual obligations. Therefore it cannot be said that I-DE's action fell within the permission granted under with Article 4(4) of the Royal Decree 1164/2001.

The DPA went on to address the intervention of the Spanish Competition Authority. It clarified that the Competition Authority notified the Spanish DPA that it did not consider I-DE's actions to be anti-competitive in breach of competition law. It also accepted the fact that the Competition Authority had been aware that I-DE sent letters. However, it was not information received from I-DE directly.

In relation to the legal basis for processing data, the Spanish DPA clarified that I-DE claimed to rely on Article 6(1)(f) GDPR. However, the DPA held that I-DE provided no reasoning nor evidence of balancing the interests at stake. There was therefore nearly no justifications for relying on Article 6(1)(f) in ID-E's submissions. The DPA outlined that I-DE would have had to demonstrate, after a balancing of factors, that there was a legitimate interest pursued by the distributor or marketer that outweigh the end consumer's rights and freedoms. According to the DPA, the nature of the letter by I-DE appeared almost like a threat or pressure to contact the distributor. Therefore, it did not count as a legitimate interest that outweighed the rights and freedoms of the end consumer even if the ultimate end interest for the distributor was getting the payment owed. The DPA concluded that the distributor would have a right to recover the money owed, but this should not be confused with an illegal processing of personal data.

As such, the Spanish DPA imposed a fine of € 200000 on I-DE for the violation of Article 6(1)(b), Articles 5(1)(b) and Article 5(1)(c) GDPR.

Comment

This decision is interesting given the ongoing discussion on cooperation between national data protection authorities and national competition authorities. It is clear that the two legal fields are increasingly interacting with one another.

It is interesting that there was interactions between the Spanish DPA and Spanish Competition Authority in the assessment of facts.

Additionally, the DPA investigated the wording of the legislation on network access contracts in light of data protection law.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details. 


Page 1
1/37
 Procedure No.: PS / 00197/2020
938-0419
RESOLUTION OF SANCTIONING PROCEDURE
In the sanctioning procedure PS / 00197/2020, instructed by the Spanish Agency for
Data Protection, to the entity, I-DE REDES ELÉCTRICAS INTELIGENTES, SAU
(I-DE), previously known as IBERDROLA SA, with CIF: A95075578, (hereinafter
above, “the claimed entity”), by virtue of the complaints filed by the entity
WATIUM, SL, with CIF .: B86459260 and by the entity ENERGIA Y SERVICIOS ABY
2018, SL, with CIF .: B85114098, (hereinafter, “the complaining entities”), and in
based on the following:
BACKGROUND
FIRST: On 03/11/19, you had a written entry in this Agency, presented by
the complaining entity, WATIUM SL, in which he filed a claim against the entity
I-DE, for, among others, the sending of a series of letters to its clients by the
claimed entity distracting the purpose for which the data was transferred and
lacking the legal basis to contact them, in breach of formal
reiterated the principles of limitation of the purpose and the principle of minimization of
data. Said complaint is fully reproduced, both in the opening brief
of file, dated 07/24/20, as well as in the draft resolution proposal, of
date 11/25/20.
SECOND: In view of the facts set forth in the claim and the documents
provided by the claimant, the Subdirectorate General for Data Inspection proceeded
to carry out actions for its clarification, under the powers of investigation
granted to the control authorities in article 57.1 of the Regulation (EU)
2016/679 (RGPD). Thus, dated 06/25/19, informative requirements were addressed to the
claimed entity.
THIRD: On 06/25/19, the claimed entity sent this Agency a written
of allegations to the complaint presented by the complaining entity, reproduced, both
in the brief initiating the file, dated 07/24/20, as well as in the
Resolution, dated 11/25/20.
FOURTH: On 01/08/20, he entered this Agency, written by the entity
ENERGÍA Y SERVICIOS ABY 2018, SL., In which he filed a claim against the
entity I-DE, for, among others, the illicit remittance of a series of letters to its clients
by the claimed entity. Said complaint is fully reproduced, as-
to in the brief of initiation of the file, dated 07/24/20, as in the brief of
motion for a resolution, dated 11/25/20.
FIFTH: On 02/20/20, and in view of the facts presented in the allegations
submitted by the claimed entity, a request for a report is addressed to the COMMISSION
NATIONAL OF MARKETS AND COMPETITION, (CNMC), Subdirectorate of
Regulation of Electronic Communications.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 2
2/37
SIXTH: On 03/10/20, the CNMC sent an explanatory report to this Agency, including
fully reproduced, both in the brief of initiation of the file, dated
07/24/20, as in the draft resolution proposal, dated 11/25/20.
SEVENTH: In view of the denounced facts, of the documentation provided by
the parties and in accordance with the evidence available, the Director of the
Spanish Data Protection Agency, on 07/24/20, agreed to initiate procedures
sanctioning the entity claimed, by virtue of the powers established, by
alleged breach of the provisions of articles 5.1.b) and c) and 6.1.b) of the RGPD,
punishable in accordance with the provisions of art. 58.2 of the aforementioned RGPD, proposing a
initial penalty of 200,000 euros (two hundred thousand euros), without prejudice to what results
I know of the instruction of the sanctioning procedure.
EIGHTH: On 08/17/20, the claimed entity filed before this Agency in writing
to of allegations at the initiation of the sanctioning file, reproduced in the brief
resolution proposal, dated 11/25/20.
NINTH: On 10/21/20, the test practice period began, agreeing-
it is in the same: a) .- to consider reproduced for evidentiary purposes the complaint filed
by the complainant and its documentation, the documents obtained and generated that
are part of file E / 03624/2019 and b) .- consider reproduced for probable purposes.
tories, the allegations to the agreement to initiate PS / 00197/2020, presented by the entity
claimed dad.
TENTH: On 11/25/20, the claimed entity is notified of the proposed resolution
solution in which it was proposed that, by the Director of the Spanish Protection Agency
tion of Data the claimed entity is sanctioned, for infringement of the articles
5.1.b) and c) and 6.1.b) of the RGPD, with a fine of 200,000 euros (two hundred thousand euros),
in accordance with the provisions of article 58.2) of the aforementioned RGPD.
ELEVENTH: After notification of the proposed resolution, dated 12/18/20, the
claimed entity submitted a brief of allegations to the proposed resolution, in the
which indicated the following:
“As a preliminary question, this part considers it necessary to show that the same
ma can only reiterate the totality of what was indicated in its brief of allegations to the
Initiation Agreement relapsed in this file, since, in our opinion,
the content of the Proposed Resolution hardly contains different arguments or
additional to those expressed in the aforementioned Initiation Agreement.
And it is that even when the Proposal for Resolution appears to lead to
carry out a legal analysis of the question raised in the present proceeding, such a
This is purely apparent, for nearly thirty of his forty-eight parents
gines are limited to reproduce in their entirety the allegations made by this party
to the Initiation Agreement.
In turn, with regard to the fundamentals of law, under the guise of a
alleged refutation of the arguments supported by this part, the Proposal for Re-
solution does not even substantiate the reasons that lead to the rejection of the totality of
the allegations made by my client in the Initiation Agreement, limiting itself to
contradict what this party alleged in said brief through arguments that include
are partially reproduced, and not in their entirety, the applicable legal provisions
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 3
3/37
with the sole purpose of reinforcing the sanctioning sense of the decision adopted even
when the quotation of the precept on which they are apparently based is partial.
In this way, in the opinion of my client, the Proposal for a Resolution even includes:
Regarding the Initiation Agreement, less legal bases that allow this party to
You adequately defend the legality of the treatment of your clients' data carried out
carried out by sending the letters referred to in this procedure.
suffering, despite his appearance, from a complete lack of motivation that
prevents my client from making adequate use of his right to defense.
All of this implies, in our opinion, a violation by the Proposed Resolution
tion of the principle of legal certainty, as well as their right to judicial protection
effective, enshrined respectively by articles 9.3 and 24 of the Constitution.
Having made the above considerations, and even when this implies a certain reiteration
Regarding the allegations already made by my client, they will try to expose,
In short, the arguments that, in the opinion of my client, justify without any
No doubt, the complete lawfulness of his conduct. To do this, even altering the systematic
ca followed by the Proposal for Resolution, first reference will be made to the
substantive issue that is the subject of this proceeding, that is, to the
absolute legality of the conduct of my client in this case, to analyze later-
the serious formal defects in which, in the opinion of my principal, the
present procedure and, finally, the inadequate assessment made by the AEPD
of the circumstances that concur in the case and that, in his opinion, aggravate the responsibility
bility of I-DE.
SECOND.- NON-EXISTENCE IN THE CONDUCT OF I-DE VIOLATION OF THE
PERSONAL DATA PROTECTION REGULATIONS
1. On the full compliance of the action carried out by my client with the
Civil Code and the regulatory regulations of the electricity sector
My client, in the second of his allegations to the Initiation Agreement, fully
produced in the Proposal for Resolution, explained in detail the legality of the treatment
data collection carried out by the same as necessary for the proper performance
return of the contractual relationship that links you with the final energy consumer
with which you sign the corresponding network access contract (in addition,
above, “ATR”), with the marketer acting as a mere representative representative of the
representative of said consumer.
Given the length of the aforementioned allegation and that, on the other hand, it has not
been object of an effective contradiction in the Proposed Resolution, understands this
part that now only proceeds to reiterate the summary of the aforementioned arguments
which was included in section 7 of the aforementioned second claim, in the following terms:
minos:
"1. Consumers of electricity must sign, together with the supply contract,
with a marketer, a contract for access to networks, with the distributor holding
of the existing network in its geographic area (in this case I-DE), being parts of di-
cho contract the distribution company and the final consumer. 2. The consumer may enter-
commend the signing of said contract to the marketer with whom they had contracted
supply, being able to sign the access contract with the distributor, but in
in any case as agent or substitute for the consumer and acting in any case in
name and on behalf of the former and by virtue of sufficient power of attorney. 3. In no
In this case, they will apply to the contract entered into by the marketer as a mandate.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 4
4/37
the client's rules of the non-representative mandate, maintaining the relationship
contractual, in any case, between the distributor and the customer who owns the supply point.
another. 4. Consequently, there would not be properly an assignment to the distributor of the data.
the consumer by the marketer, since these data would be obtained by the
distributor primarily, by referring to the party with whom it has a relationship
contractual, signed by a mere agent. 5. Within the different obligations
contractual of the access contract is the payment of the access tolls,
of which the mandatory marketer and the client would jointly and severally respond. He in-
fulfillment of this obligation two months after the request for
Payment of these tolls enables the distribution company to suspend supply
electric. 6. In the present case, even though the clients had satisfied the co-
marketing company the amount of access tolls, it had not paid I-DE the
amount of these, for which my client required payment to the marketer, directed
Giving the request to your home, as stated in the contract and in compliance with
compliance with current legislation. 7. After the legally established period has elapsed without the
request was attended, and thus showing my client the right to suspend the
supply, I-DE communicates to its customers this circumstance and the consequences that
This may be accompanied, expressly stating that said writing
In no way does it imply a request for payment to customers. 8. Therefore, my man-
dante is limited to communicate in the normal development of its contractual relationship with
his clients, highlighting the breach by his agent of the obligations
actions derived from the contract in order for the clients to adopt the measures
that it deems appropriate. 9. The CNMC is aware of the sending of these communications
nes, at least as a result of the complaint made by the marketer.
However, said Commission agrees not to proceed with any proceeding against me.
but to transfer the antecedents to the Directorate of Energy so that they can investigate
tigue the possible violation of the sectoral regulations by the marketer. "
2. Regarding the legality of sending the communications as a consequence of the non-compliance
payment of fees and suspension of supply that may lead to
corporal I-DE
The Proposal for a Resolution limits itself to stating that, even though it seems to be recognized
expressly the existence of an ATR contract between my client and the consumers
final authorities, only the acts of communication between the parties of this that
are expressly included in the law, being forbidden any communication
tion related to the contract itself that is not the subject of this express legal reflection.
Indeed, the Proposal focuses the entirety of its argumentation on considering that,
As indicated on page 43, after citing the acts of communication between the parties to the
contract that are included in the electrical legislation, "between the detailed relationship
exposed, no point is found or written about the sending of infor-
explanations explaining to the final consumer, among other things, the alleged non-compliance
contractual relationship between the marketing company and the distribution company, such as
is the case that concerns us ”, adding later that“ the sending of infor-
control to final consumers of the alleged contractual breaches of
the marketer with the distributor does not fall within the range of communications
tions necessary and pertinent for the performance of the contract by the entity
distribution authority ”, since, it seems, these communications should be carried out
carried out “only and exclusively through a marketer, as the latter has constituted
do as a consumer agent before the distributor ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 5
5/37
Thus, the Proposal seems to consider that even when there is a relationship
contractual agreement between the distribution company and the final consumer, even if the
cializer signs the ATR contract as agent (with express power, that is, without
act on their own behalf) of the consumer, the development of said relationship only
allows limited communication between the parties, and it is not possible for them to
are related not even for such an essential aspect within the framework of the relation
such as the suspension of the provision of one of the parties as a conse-
of the contractual breach attributable to the other, even though said non-compliance
compliance is committed by his agent, since the consumer responds solicitously
daily with the marketer of the payment of the fees.
And it is that, regarding the cause that, ultimately, justifies the remission of the communications
tions that, in the opinion of the AEPD determines the illegality of the conduct of my client,
The Proposed Resolution on pages 44 and 45 states the following:
“If we enter into the content of the letters sent by the claimed entity to the
final consumers (point 5 of the allegations), we must indicate that the article
52.3 of the LSE, refers to the possible suspension of the supply contract
when it is the final consumer who defaults and this is established in the referred
Article: “3.- (…) the supply of electricity to consumers may be suspended.
meters under voluntary prices for the small consumer or last-minute rates
appeal when at least two months have elapsed since they had been
reliably required payment without it having been made effective. (…) "
but in the present case, this does not happen, since, in the absence of evidence to the contrary, the
final consumer if he complies with his obligation to pay the cost of the invoice when trading
and apparently, it is he who fails to comply with his obligation vis-à-vis the distributor.
dor: "
Apart from the confusing wording of the paragraph reproduced, it causes at least per-
plejidad to my client the fact that the Proposal for Resolution omits, in the
production of article 52.3 of Law 24/2013, of December 26, on the Electricity Sector.
co (hereinafter, “LSE”) the referral made expressly in its first subsection, se-
according to which the possibility of suspension of supply will take place “[s] without prejudice to
what is established in the fourth section of this article, under the conditions
glamentarily determined ”.
And said omission is essential in the present case, since article 4.4 of the
Royal Decree 1164/2001, of October 26, which establishes access fees
to the electricity transmission and distribution networks (hereinafter, “RD
1164/2001 ”), which is the one that determines the conditions to which the aforementioned article refers.
Assignment 53.2, establishes the following:
“The distribution company may suspend the access fee contract when it has-
and at least two months have elapsed since he had reliably required the
payment to the consumer or his agent, in accordance with the scope of the
access raffles established in article 1, section 1, of this Royal Decree, without
that it had become effective. For these purposes, the requirement is practiced
It will be by referral, to the address that for communication purposes appears in the counter-
access fee, by any means that allows proof of reception.
tion by the interested party, as well as the date, identity and content of this, being
the distribution company obliged to keep in its possession the accreditation of the notification
cation made. In the event of rejection of the notification, the
circumstances of the attempt to notify and the process will be considered completed. Bliss
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 6
6/37
Communication must include the process of disconnection of the consumer from the networks of
distribution for non-payment, specifying the date from which the dis-
connection, if the amounts owed are not paid on a prior date. "
That is, article 4.4 of RD 1164/2001, which is the one that establishes the conditions in
that the suspension of the electricity supply may take place as a result of the
non-payment of the ATR contract rates, does not limit the communications of my client
with the client, but only the possibility of requesting the same directly the
payment of the fee (despite your status as a debtor and the joint and several liability that
proclaims in the same normative body). And indeed, my client at no time
ment has required the consumer to pay said fee which, on the other hand, he already
has satisfied the marketer, but is limited to showing him that this
marketer has not paid the fee, previously paid by him, and
that this may entail for that consumer the consequence, which evidently
It directly affects the suspension of the electricity supply.
Because the consequence of the marketing company not paying the amount
of said rates to the distributor, regardless of her condition as agent of the
consumer at the signing of the contract, it will be the suspension of the electricity supply to said
consumer. For this purpose, it is irrelevant with regard to the application of article 52.3 of the
LSE that the consumer has or has not paid said rates to the marketer, given
that the consequence in either case will be the aforementioned suspension, no matter how much
The AEPD intends through the resolution that could fall into this procedure
I wish to alter the effect derived from this default.
And based on this indisputable conclusion, which is that in case of neglect of the
complaint by the marketer may proceed to the suspension of supply
electricity to the final consumer, my client understands that it is necessary for the
When maintenance and development of the contract that it holds with its client, the
end consumer, warn him of said suspension so that at least he can have co-
anticipation of a suspension of supply that I-DE may, in accordance with
I comply with the provisions of the legislation, carry out once two months have elapsed from the
realization of the requirement to the consumer himself or to the marketer.
In this sense, it is necessary to show that this behavior has occurred in all
case in relation to the Claimant, Watium, SL, to the extent that my mandate
as expressly communicated to WATIUM in burofax with a certificate of
content of November 2, 2018 (which appears on folios 49 to 52 and is reproduced
again on folios 87 to 89 of the administrative file), it has been forced,
only in the period between the months of January and October 2018, according to the
request Watium according to the aforementioned article 4.4 of RD 1164/2001 the payment of fees
access on FOUR HUNDRED TWENTY-NINE (429) occasions. Each of those
429 requirements refer to remittances of unpaid invoices from many million
of customers, with respect to whose supply contracts the procedure of
suspension of supply.
Finally, in 2018, my client had to reliably request
the mercantile Watium on FIVE HUNDRED THIRTY-SIX (536) occasions, in the fiscal year
2019 on FIVE HUNDRED THIRTEEN OCCASIONS (513) and so far this year
2020 on ONE HUNDRED TWELVE (112) occasions, having initiated the procedure of sus-
supply pension for tens of thousands of electricity supply contracts.
Well, the AEPD understands that this communication cannot take place, even when
where there is a contractual relationship between I-DE and the consumer, as it does not appear expressly
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 7
7/37
mind set in any standard. That is, according to the AEPD reason, my client does not
it cannot only inform the consumer of the suspension of the electricity supply due to
payment of ATR fees, but is obliged not to inform you, owing in all
case proceed to the suspension of supply without prior notice to the consumer, as another
This is a violation of the personal data protection regulations. The
The consumer must thus see his supply suspended without prior notice and even after knowing
diligently fulfilled its obligations derived from the ATR contract, given that in
If this warning is carried out, the AEPD would deploy against the distributor
all its coercive powers.
In this sense, it is still clarifying that the claim that gave rise to the
This procedure does not come from any of the I-DE clients, who are the
lares of the fundamental right to the protection of your personal data, but of Wa-
tium, and we also understand that this is not based on a will of said mercantile
to protect the rights of the interested parties, but solely and exclusively to prevent
my principal adopt the measures that may reveal the illegality of his
pious conduct. That is to say, in this context it might be asked whether, in view of the facts
concurrent, it is not surprising to the AEPD that no I-DE client considers
violated their right, not having made a single claim before it.
tion on the part of these and that, however, claims are only filed by
part of those who put the proper development of supply contracts at risk.
other of your customers.
In the opinion of my client, the conclusions contained in the Proposal for Resolution are not
may but be considered, at best, contrary to logic and sense.
common practice, since contrary to them is not being able to warn the consumer of
electrical energy from a possible suspension of supply.
Moreover, following the reasoning contained in the Proposal for Resolution, it is possible to
I would conclude, in the opinion of my principal, completely irrational, that
consumers who have the status of natural persons would see their position adversely affected
in the ATR contract, since I-DE could warn of the possible suspension of the
supply to its clients legal entities, since in that case it would not be applicable
tion of the personal data protection regulations, but such possibility would be prohibited
in relation to their clients natural persons under penalty, in the opinion of the AEPD, of violating
said regulation.
Such a glaring conclusion could only lead to the filing of the present proceedings.
inasmuch as, as indicated by the Advocate General of the Court of Justice,
of the European Union, Mr. Michael Bobek, in §99 of his conclusions referring to the
Case C-13/16 (Rīgas satiksme case), filed on January 26, 2017:
"In summary, common sense is not a source of law, but, of course,
it should serve as a guide for its interpretation. It would be most regrettable if
protection of personal data will be degraded in the obstruction of personal data-
them."
In the present case, said conclusion could not be more evident, since the sub-
protection of the consumer's personal data, to which the Pro-
Implementation of Resolution leads in practice to an obstruction of these that can
lead to a suspension, entirely surprising to the consumer, of the
electricity supply, with the important damages, losses and other consequences that
from this to be derived for the consumer. To this must also be added the fact that
not a single I-DE client has considered my client's violent behavior in
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 8
8/37
in any way your right to the protection of personal data and that, paradoxically,
the application of the rule would imply a more favorable treatment to clients who have the
condition of legal persons, as these are not holders of the fundamental right.
In short, there is a contractual relationship between my client and the consumers
recipients of the letters sent in which a situation may arise that
it is detrimental to them as a result of a breach
by its agent, so that the normal and proper development of the contractual relationship
This justifies my client making all the necessary efforts to implement
knowledge of the principal of the breaches carried out by the agent in order to
take the consequences that will only harm the consumer.
3. Regarding the intervention of the CNMC in the present case
The Motion for a Resolution considers that the statement contained in the allegations
of my principal to the Initiation Agreement, according to which it was indicated that the Commission
National Markets and Competition (hereinafter, "CNMC" or "the Commission")
was aware of the letters sent by the former to consumers.
expressly stated by the aforementioned Commission, summarily concluding that:
“It follows, therefore, that the distributor did NOT send the CNMC any letter to
their prior review, sending the informative letters to the final consumers without "the
review ”of the CNMC, and, therefore, being totally impossible,“ (…) ratify the legality
of the conduct of my principal (…) ”by the CNMC, as stated by the entity
claimed dad. "
However, it is enough to contrast the content of the response provided by the CNMC to
that AEPD to verify that the statement contained in the Proposal for Resolution
does not sympathize with the reality of the facts
Thus, in the first place, as already indicated in the allegations of my client to the Agreement
Inception, the CNMC indicates with absolute clarity that it has full knowledge of the
letters to which the request for information refers, despite the fact that the AEPD does not send
that one copy some of the same even when they work in the administrative file
tive. Thus, the third paragraph of the CNMC's response literally states:
“Although the request received from the Spanish Data Protection Agency does not
Attached sample of the information letter referred to, according to the data
that are provided, it can be considered that it is a certain letter that would be
I am aware of the existence of non-payment of network access tolls. "
That is, although the AEPD does not provide a copy of the letter, its content was more than
known to the CNMC. And it is that as it was already warned in the letter of Ale-
In addition to the Initiation Agreement, my client informed the CNMC of the
delo of letter that had made for these assumptions. It doesn't seem very difficult to
understand that my client is not going to request authorization to send the letters
every time a situation like the one we are dealing with occurs, as this would mean so much
such as making it impossible for the CNMC to carry out any other action other than
curl these types of letters.
It should be remembered that, as already indicated, only in the case of the company WA-
TIUM, my client has had to carry out since 2018 ONE THOUSAND ONE HUNDRED SE-
SIXTY-TWO (1162) reliable payment requirements for the same number of income
compliance with the obligation to pay access fees in. In this way, if
the reasoning of the AEPD is followed, my client should have requested the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 9
9/37
CNMC on 1162 occasions the authorization to send the letters to the mercantile
Watium.
The CNMC replied that what it did not know was the specific letter sent to customers
of Watium, but that, nevertheless, he did know that these letters were sent to the
I-DE clients whose marketing company did not pay access fees after
have completed the voluntary payment period and after having been reliably required-
To this end, as expressly provided by the applicable legislation, in avoidance of
that the supply was suspended without the knowledge of the contract holder, or
der have it, that his access contract was in default.
Moreover, made by Watium a complaint against my client on the occasion of the letter to
their clients, as expressly stated in the response offered by the CNMC
(folio 132 of the administrative file), the aforementioned Commission not only considered sending
of the same perfectly lawful and in accordance with the sectoral regulations, compared to what
now seems to consider the AEPD, but also specifically agreed to give “tras-
side of the information to the Directorate of Energy […] for different purposes (assessing
tion of the possible breach by the marketer Watium, SL of the regulations
applicable policy regarding the payment of the network access toll) ”.
In conclusion: the CNMC was not only perfectly aware of the existence of the letters,
Rather, when he became aware of them (years before that AEPD and with
reason for a complaint such as the one at hand), his decision was, as
it appears in the administrative file, analyze the possible initiation of a file
sanctioning company Watium for breach of its legal obligations.
laws and regulations and in defense, among others, of the rights of customers affected by
tados.
4. On the legal basis of the treatment in the present case.
It has already been amply analyzed in section 2 of this allegation that my command
proceeded to the processing of the personal data of its clients for the sending of the
mentioned letters as said sending is necessary for the normal development of
the contractual relationship that binds both parties, since it can only consider-
it is, according to all logic, necessary to warn customers of the suspension of the supply
as a consequence of non-payment of ATR rates instead of proceeding to suspend
hang it without notice.
However, for the denied assumption that this AEPD, against the criterion supported
even by the energy regulator, the CNMC, consider that the legal basis of the treatment
ment cannot be considered the adequate development of the contractual relationship,
There is no doubt that the communication to I-DE clients that said sus-
pension is going to take place will be, at least, in their interest, who may
adopt the measures they deem appropriate to avoid said suspension. Of this
Thus, it would be applicable to the assumption, at least, and although the
legal basis of the contractual relationship, the rule of the prevailing legitimate interest established
cited in article 6.1 f) of the RGPD.
It should be remembered that the first paragraph of recital 47 of the RGPD states that:
“The legitimate interest of a person responsible for the treatment, including that of a person responsible for
that personal data may be communicated, or that of a third party, may constitute a
legal basis for the treatment, provided that the interests or rights do not prevail.
rights and freedoms of the interested party, taking into account the reasonable expectations of
the interested parties based on their relationship with the controller. Such legitimate interest could
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 10
10/37
occur, for example, when there is a relevant and appropriate relationship between the
and the person in charge, as in situations in which the interested party is a
at the service of the person in charge. "
Note that the RGPD considers that the prevalence of legitimate interest can be seen
reinforced in cases such as the one analyzed, given that the information provided to the
sado would refer to the suspension of the contract concluded by him with my command.
tea. In other words, there would not only be a legitimate interest for I-DE to put this
knowledge of their customers, but even a legitimate interest of them in not seeing
supply was suspended, to a greater extent, when said customers would have
made the payment of the amount corresponding to said access toll to the
distribution. And it should be emphasized that the aforementioned suspension may take place independently of
pendency of the person who has materially signed the ATR contract, as
expressly follows from article 4.4 of RD 1164/2001, which develops the provisions
to in article 52.3 of the LSE and to which it refers literally.
Even though the two legitimating bases referred to with
previously, they could be considered, in light of what was indicated by my client, insufficient
tes for the purposes of enabling and legitimizing the processing of personal data to which
referred to in the present file, it should be remembered lastly that the origin of the mentioned
cited letters is found in the fact that the trading companies do not
have paid I-DE the amount of the ATR tariffs, that is, of the so-called pea-
jes.
At this point, it should be remembered that the payment to I-DE of the aforementioned rates will not be
puts an income for it, but its mere collection as system income
electricity, we reiterate not yours, with said funds being allocated to the maintenance and
maintenance of said system in the terms established in the electrical legislation.
In this sense, article 13.1 of the LSE provides that:
"The actions of the Public Administrations and other subjects included in
The scope of this law will be subject to the principle of economic sustainability.
mica and financial of the electrical system. Economic sustainability and fi-
financial system of the electricity system the ability to meet all the costs of
this, in accordance with the provisions of this law and its implementing regulations. "
And article 13.2 a) expressly establishes that “[t] he costs of the system will be finan-
generated by the income from the electricity system that will comprise […] [t] he tolls
access to transmission and distribution networks satisfied by consumers and
producers and agents for energy exports to non-EU countries.
rivers, destined to cover the remuneration of transport and distribution ”.
In turn, as provided in article 18 of the LSE:
Article 18. Collection and settlement of tolls, charges, prices and regulatory remuneration.
you give.
"The access tolls to the transmission and distribution networks and the prices or charges
for other regulated services destined to the supply of electrical energy will be
issued by the distribution companies and, where appropriate, by the system operator,
having to give to the amounts entered the application that proceeds in accordance with the
general liquidation procedure provided for in this law and its regulations
developmental. For these purposes, the income from tolls or charges will be those that would have
due to be invoiced by application of the regulations that establish them, regardless of
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 11
11/37
dence of its effective billing and collection by the subjects obliged to its re-
caudation. "
Legal obligation to collect that is reiterated in article 40.1. j) of the LSE when stating what
following:
“Article 40. Obligations and rights of the distribution companies. 1. The distributors
Owners, as owners of the distribution networks, will have the following obligations:
“J) Apply, invoice and collect the access tolls to the transport and distribution networks
to marketers or consumers, as appropriate and where appropriate,
ductors connected to their networks by breaking down the billing to the user in
the form determined by regulation "
And finally, article 14.1 establishes the following:
“The activities destined to the supply of electrical energy will be rewarded in the
form provided in the present law charged to the income of the electrical system defined
nested in article 13, to those derived from the participation in the product market.
tion, as well as the income from the application of the provisions of the
Se law and its implementing regulations. The income from the electricity system will be
to pay exclusively their own remuneration for activities aimed at
electricity supply and the rest of the system costs defined in article 13, without
that can be used for other purposes. "
Therefore, the collection of access fees is a legal obligation that is imposed
use distribution companies as a way to obtain the necessary income to
defray the costs of the electrical system and thus allow users to
electricity supply can have access to this service of economic interest ge-
general.
And to such an extent the collection of these access fees is so transcendental to
the effects described, which is imposed on the distribution companies not only the obligation to
to collect them but also to enter the electricity system tariffs.
access that they bill, regardless of whether or not they are charged by those obliged to
payment, ultimately, the holders of electricity supply contracts. For
As a result, non-payment of access fees causes patrimonial damage to the company
distributor, which has to enter the invoiced rates, even if they are not paid.
To compensate for the pass-through of commercial risk of a tax collection activity
legally put to someone who is not the beneficiary of the amounts collected, the LSE and
its implementing regulations establish:
a) In the event that the customer has contracted the supply through the company
trading company (which acts against the distribution company as agent of the
client, case that concerns us), the obligation to pay the access fees in
men of solidarity by the contract holder and the marketing company, to whom
Indistinctly, the distribution company can request and claim payment, solidarity
that can only be broken by the holder of the supply contract with prior accreditation of
to be up to date with the payment with the marketing company Arts. 40.2. j), 44.2.b) and 46
1.d) of the LSE and 4.2. of RD 1164/2001.
b) The possibility of suspending the electricity supply in the event of non-payment of rates
of access (regardless of whether the payment of these has been accredited by the
of the contract to the trading companies). Arts. 52 of the LSE and 4.4 of the RD
1164/2001.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 12
12/37
c) The classification of the breach of the obligation to pay the access fees
by the marketing company as a very serious, serious or minor infraction according to
amount of non-payment (in this case very serious), which may also give rise to the
disqualification of the marketing company for the exercise of the activity Arts. 47,
64.4., 65.3 and 66.1 of the LSE.
For the aforementioned reasons, the collection of access fees, as soon as it has
for the purpose of obtaining the amounts of said rates for their contribution to maintaining
maintenance and proper operation of the electrical system is directly related
with the fulfillment of a mission of public interest, which is also imposed on the
distribution companies by legal mandate, which would even allow to substantiate the
treatment in the provisions of article 6.1 e) of the RGPD.
In conclusion, as indicated in this document, there is no doubt that I-
DE is fully entitled to process data for the purpose
to carry out the aforementioned communications to its clients as a consequence
of the development of the contractual relationship maintained with them. But even in the
denied assuming that said legal basis was again discarded by the
AEPD, the treatment would also be based on the legitimate interest of the con-
electrical sinks to maintain the contracted electricity supply and in the public interest
derived from the fact that the income from the payment of the ATR tariffs is nothing but
an act of collecting said income for its contribution to the maintenance of the
electric system. And ultimately, the legitimate interest of
the distribution company, legally obliged to carry out this collection activity and
bear the risks of non-payment, in recovering amounts that it has been forced to
enter for the electrical system despite not having charged them.
Being sufficient the concurrence of a legitimizing base to determine the conformity
to the right of a treatment, it turns out that, in the present case, there are elements
enough to be able to assess the fit of the treatment carried out by my
dante in four of the legal bases established in article 6.1 of the RGPD, therefore
It is certainly surprising that Wade's complaint has not been shelved.
tium.
THIRD.- ON THE SETTING OF THE AMOUNT OF THE PENALTY IN THE AGREEMENT
DO OF START
My client already revealed in the first of his allegations to the Agreement of
Initiation of this disciplinary proceedings that it incurred a substantive vice
nullity, as the sanctioning body has established in audita part the im-
size of the sanction to be imposed on I-DE. With this, the guarantees are broken
of the sanctioning process and the right of my client to allege what his right
proceeded prior to said determination, with the consequent causation to
the same of a blatant defenselessness.
In the same way, the obvious confusion between the phases of ins-
resolution and resolution, by anticipating the sanctioning body the amount of the sanction that
I would proceed to impose on my client. Something that in the present procedure has been
made clear, when looking at the Proposal for Resolution by the order
The instructor won an amount identical to the one that the sanctioning body had already proposed to him.
nador in the Initiation Agreement.
The Proposal for Resolution is limited to indicating that what was alleged by my client
it can be taken for granted. However, and even when, as anticipated, it is practical
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 13
13/37
It is completely indecipherable to know for sure which are the arguments in which the
Proposal bases such affirmation, my client understands it is necessary to make determinations.
give considerations, delving into what was already indicated in their allegations to the Agreement
Of start:
1. In the first place, contrary to what the Proposal for a Resol-
tion, neither Article 64 nor Article 85 of the LPACAP establishes that in the
At the beginning, the specific amount of the penalty to be applied must be expressly determined.
da to impose the interested party in order, as it seems to be deduced from the Proposed Resolution
tion, that the applicant can make use of the benefit of the reduction of the amount of
the sanction for their acknowledgment of guilt or prompt payment.
And it is that, contrary to what this part that the Proposal intends to indicate
Resolution, the provisions of article 64.2 of the LPACAP do not imply any inno-
variation of the legal system with respect to the norms that had been in force in the past.
prior to its entry into force the administrative sanctioning procedure and, in particular,
cular, the sanctioning procedure included in the data protection regulations
personal.
Indeed, this part fails to find the novel aspect of the aforementioned forecast
legal regarding the sanctioning regime contained in Law 30/1992, of June 26, the
Regulation of the Procedure for the Exercise of Sanctioning Power, approving
by Royal Decree 1398/1993, of August 4 (hereinafter, “REPEPOS”) and the Regulation
development of Organic Law 15/1999, of December 13, on the Protection of
personal data, approved Royal Decree 1720/2007, of December 21 (in
hereinafter, "RLOPD"), under which the AEPD did not establish the aforementioned amount
in your startup agreements.
In all these norms it was indicated that the Agreement to initiate the sanctioning procedure
nador had to incorporate “the sanctions that may correspond, without prejudice to
what results from the instruction ”. This was stated in article 13.1 b) of REPEPOS and
it was reiterated by article 127.1 b) of the RLOPD. However, the AEPD considered
that this did not mean more than indicating the maximum and minimum limits of the sanction that
it would be appropriate to impose, if the actual commission of the aforementioned offense is appreciated,
mentioned in the agreement without carrying out in the Initiation Agreement any valuation of
the concurrent circumstances in the case or the mitigating or aggravating circumstances that
should be taken into consideration to determine the final amount of the sanction to
impose.
The difference between the action just mentioned and the one carried out
carried out in the present procedure is evident, since in the first case the act of
situation of the sanctioning body when agreeing to start the file did not imply the realization of
zation for its part of valuation activity any of the concurrent circumstances
in the specific case, nor did he anticipate the examining body what was, in his opinion, the way
in which the former had to act in setting the amount of the penalty within the limits
legally established, which was limited to remembering by a direct application and without
any statement of the rule regulating the sanction.
However, in the present procedure, without modifying one iota, it is necessary to
We reiterate it, the regulatory regime of the procedure, the sanctioning body is not
not to remember which is the applicable sanctioning norm, but effectively assesses
you, without paying attention at any time to what the insert could invoke, how concrete
sanction, within the limits established by the norm, should be imposed. That is, the
objectivity of the sanctioning body at the time of initiating the procedure remains
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 14
14/37
questioned by its assessment, in audita part, of the facts and circumstances and
more necessarily influences the performance of the examining body, since it tends to
It will be necessary to send him a proposal for a resolution that meets this pre-established criterion.
do.
2. Secondly, reference should be made to what, despite its more than confusing
wording seems to want to indicate the Proposed Resolution when on pages 41
and 42 of the same, the following is stated:
“It is therefore not true, as the claimed entity affirms, that Article 85 establishes-
ca: “(…) For this purpose, it should be recalled that, according to Article 85, the amount of the penalty
pecuniary may be determined "initiated the sanctioning procedure (...)"
ral of said article refers to the recognition of the responsibility of the offender and
no to the decision of the amount of the sanction as it is literally established that: “1.-
Initiated a sanctioning procedure, if the offender acknowledges his responsibility,
may resolve the procedure with the imposition of the appropriate sanction ”and thus,
must interpret, that is, according to the proper sense of the words, and not the discretion of
the part. (…)
Regarding the statement made by the claimed entity when indicating that, “in the present
In this case, said amount is set in the act of initiation of said procedure and not
when this is already "started", it could not be considered true, because in the
"Agreement" to initiate the file is expressly indicated that, "for the purposes of the
seen in art. 64.2 b) of the LPACAP, the corresponding sanction would be
a fine of 200,000 euros (two hundred thousand euros), without prejudice to what results from the
instruction","
Despite the less complex wording reproduced, he intuits this part that is
wants to refute by the same what has already been alleged by my client in the sense of remembering
that article 85.1 of the LPACAP provides that “[i] initiated a sanctioning procedure-
dor, if the offender acknowledges his responsibility, the procedure may be resolved with
the imposition of the appropriate sanction ”(the underlining is ours) and that the first
ciso of article 85.3 of the LPACAP adds that “[i] n both cases, when the sanction
is solely of a pecuniary nature, the competent body to resolve the procedure
ment will apply reductions of at least 20% on the amount of the penalty provided
put, these being cumulative with each other ”(emphasis added)
As can be seen, from the literality of the precept to which the Pro-
Resolution does not follow, as it seems to indicate, that the benefits
seen in the same require the quantification of the sanction in the Initiation Agreement, for
how much:
 First, Article 85.1 of the LPACAP does not require such a prior determination,
since it does not refer to a pre-established sanction, but to the imposition of the sanction.
tion as appropriate. That is, the norm, which in any case is applicable “initiated the proce-
procedure ”, provides for the possible acknowledgment of responsibility that may determine the
imposition of the sanction "that proceeds", so that this fixation seems to be foreseen with
after the acknowledgment of responsibility itself.
 Second, Article 85.3 provides that reductions must be adopted on the basis of
on the “proposed” sanction, which requires that it has actually been determined in
procedure what is that amount, and the diction of the precept itself seems effective-
refer to the motion for a resolution as the ideal place to determine the
tion of said amount.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 15
15/37
 In any case, as already indicated, the application of the precept, which supposes a
Benefit for the accused cannot in any case imply a bankruptcy of his
rights under the excuse of granting the aforementioned benefit.
In short, the fact that the acknowledgment of guilt can be
produce “once the procedure has started” (something that is obvious, given that the
The accused cannot have prior knowledge of the existence of the accused.
tion) in no way implies that the Initiation Agreement is the place where it should determine
undermine the amount of the specific penalty "appropriate" to impose, so that
sanction should be determined at a later time, that article 85.3 seems
assimilate to the proposed resolution, since the sanctioning body could not,
In accordance with the principles of the administrative sanctioning procedure, "propose" that
sanction, as such power corresponds to the investigating body.
And this conclusion is not contradicted by the fact that the initial agreement is the
place where, according to the final paragraph of article 85.3 of the LPACAP, the
of manifest to the insert the discounts that in his case would proceed to impose in case
recognition of responsibility and advance payment of the penalty, whenever
that both are benefits granted to the same who must know from the moment
the very beginning of the procedure, even though the sanction cannot be found when
tified, as said insert could not be heard in the processing of the file,
that has not been started.
It only remains to reiterate in this place that the very processing of this procedure
This statement merely demonstrates the effects that the decision adopted by the
sanctioner has produced in the performance of the investigating body, which mimetically
reproduces in its Proposal for Resolution what was argued by the sanctioning body
in its Initiation Agreement both in the quantification of the sanction and in the enumeration
tion of the concurrent circumstances in the present case.
3. Third, the Proposed Resolution, again in terms that in the opinion
from this part are respectfully completely confused, it seems to give
tend that the setting of the amount of the sanction in the Initiation Agreement is clearly
adequate, inasmuch as my client has had the opportunity to express himself about the
concurrent circumstances in the case both before and after
at the initiation of the sanctioning procedure.
Thus, in relation to the activity prior to the aforementioned Agreement, the Proposal for Re-
solution (the underlining is ours):
"On the statement made by the claimed entity of:" IDE has not had occasion in
no time to reveal to the aforementioned body which could be the
circumstances that could be applicable in the present case ”, it should be remembered
that, on 05/23/19, this Agency notified the claimed entity,
the complaint presented by the complaining entity, in the reference file
E / 3624/2020, requiring the entity, at that time called, IBERDROLA
DISTRIBUCIÓN ELÉCTRICA, SAU, to proceed with its analysis, respond and
submit to this Agency, within a period of one month from its notification,
all the information deemed appropriate for this purpose. Information that the entity collects
Claimed filed on 06/24/19, one day after the deadline granted for this purpose, through
through the electronic registry of the General State Administration "
The aforementioned transfer, under the heading "transfer of claim and request for information",
was carried out, according to the document itself (folio 69 of the administrative file
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 16
16/37
vo) “[d] e in accordance with article 65.4 of Organic Law 3/2018, of December 5,
on, Protection of Personal Data and guarantee of digital rights ”(in addition,
lante, “LOPDGDD”), which refers to article 37.2 of the regulation itself in which it is
state the following:
“When the affected party files a claim with the Spanish Protection Agency
tion of Data or, where appropriate, before the regional data protection authorities,
They may refer the claim to the data protection officer so that
this responds within a month. If after this period the delegate of
data protection would not have communicated to the competent data protection authority
tente the answer given to the claim, said authority will continue the procedure
in accordance with the provisions of Title VIII of this organic law and its regulations for
developing."
From the provisions of said rule it is unequivocally inferred that the transfer carried out
In the first place, it has a completely optional character, being carried out in
In any case, prior to the processing of the procedure and without its purpose being,
on the other hand, the making of any allegation as to the modified circumstances
ficative of the responsibility of the entity to which it is addressed, since such responsibility
bility has in no way been determined by opening the proceeding
sanctioner.
Regarding the fact, subsequently invoked in the Motion for Resolution that
my client has had the opportunity to contest what was stated in the Initiation Agreement, by
be granted a period for the issuance of allegations, which will effectively
mind made at the appropriate procedural moment, such a circumstance in a high way
One can remedy the helplessness caused to it as a consequence of the
assessment carried out in audita part of the concurrent circumstances in the assumption or
supposes an enervation of vice consisting of the confusion of the phases of instruction
tion and resolution and the consequent "contamination" of the former as
of the content of the initiation agreement.
All this supposes a breach of the inspiring principles of the sanctioning law
that cannot be corrected by the mere fact that it has been required by
that AEPD to report the facts contained in the claim not because my
The principal holds the right, as it could not be otherwise in accordance with the
cido in article 53.1 e) of the LPACAP, to formulate allegations.
Therefore, my client considers that by determining the amount of
the sanction and establishment of aggravating and mitigating circumstances in the Agreement of
Inception, their right to defense has been violated, with the consequent cause of inde-
fension, proscribed by article 24 of the Constitution, also breaking the
principle of impartiality of the sanctioning body. All this must derive the necessary-
mind in the nullity of full right of the present procedure.
FOURTH.- APPLICATION IN THE PRESENT CASE OF THE PRINCIPLE OF PROPORTION
TIONALITY AND MODIFICATION CIRCUMSTANCES OF LIABILITY
DAD CONCURRENT IN THE SAME
Although reference has already been made to the absolute lack of motivation of the Proposal for
Resolution, in which hardly any different or additional arguments are offered to the
had in the Initiation Agreement compared to what was stated by my representative in his
allegations to it, this lack is evidenced even more clearly when
The Proposal appears to clarify what was indicated by my principal in relation to the
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 17
17/37
concurrent circumstances in this case. In effect, the Proposal for a Resolution repro-
at this point, in an almost mimetic way, what is stated in the Initiation Agreement without
carry out a minimum exercise of analysis of what is alleged by this party.
This would justify a mere reference to said arguments, with the legitimate expectation
that they are effectively analyzed by the Control Authority. Not obs-
Therefore, in order to facilitate this task, reference will be made again, even in summary, in
this writing, to the reasons why my client understands that he does not concur in this
In the event of not a single aggravating circumstance mentioned by the AEPD in the Proposal:
1. Regarding the volume of the letters sent, the AEPD seems to continue without evaluating
really if they refer to natural or legal persons, since it does not seem to be
In another sense, the reference to the total number of letters sent to Wa-
tium, even though it is recognized that in reality it would only be referring to
It refers to just over half of those included in the Initiation Agreement.
However, this circumstance seems irrelevant for the AEPD, given that the reduction
The number of cards from 2,598 to 1,462 has no effect on the determination of
tion of the degree to which the conduct would be aggravated, since the sanction continues
being the same as that included in the Initiation Agreement.
For this, the AEPD seems to hide behind the fact that “in addition, the other complaining entity,
ENERGÍA Y SERVICIOS ABY 2018, SL., Reports that all its clients have received
the informative letters of the complaining entity ”. Yet nowhere is it
refers to what the aforementioned total amount may be or if said customers are personal
physical or legal rights, being the AEPD which would be responsible for accrediting
how many shipments could have taken place, which does not appear to have taken place given
that nowhere in the Proposed Resolution, apart from in the room
transferors of the same and in its sixth fact, reference is made to these shipments, which without
However, they are taken into account to aggravate the sanctioning reproach to my client.
In this sense, it is relevant to take into account that neither the inspection actions carried out
listed (folios 187 to 189 of the administrative file), nor the request for information to
the CNMC or any of the reasoning in the Initiation Agreement or the Proposal for Re-
solution make any mention of Energía y Servicios ABY, SL, except for this mention
concise aimed at maintaining the aggravation of the behavior of my client without
provide any accreditation related to such shipments.
2. The AEPD affirms that in the present case the facts have been denounced by the
interested parties, noting that “the claimed entity, by making an illicit use of the data
personal data of the clients of the marketing entities, this Agency has had
knowledge of the alleged infringement through the agents of the interested parties
(sic.)".
Although it is difficult to understand the actual content of such a statement, given the
that the recipients are clients not only of the marketers, as seems to be indicated
the AEPD, but also the distributors, the truth is that not even in its written
claim or in the query made at the time to the Legal Office of the AEPD
Nor in the complaint made at the time before the CNMC, Watium claims to act in
representation of its clients (which are also my client), but only and ex-
exclusively in his own name.
And understand this part that the AEPD cannot take as true or assume in any way
some a representation that not only is not accredited in any case, but also
furthermore, he refuses, since Watium always claims to act on his own behalf. For
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 18
18/37
Therefore, there is no doubt that this entity holds the status of interested party for the purposes of
the provisions of the data protection regulations, it is completely inadmissible to
application of such an aggravating circumstance.
3. Thirdly, the AEPD says that I-DE acted “knowing that there were different
complaints filed and reports issued by different public bodies
who rejected said action, the entity continued to send information letters to the
end customers, and, therefore, could constitute an illegal act ”.
My client cannot but reiterate that he does not know what those reports are and that he
tions that she was supposed to know when she carried out the treatment of the
data. Indeed, since obviously they cannot be the ones that are the object
of this procedure there are only two possibilities: that the AEPD refers to the
Announcement filed by Watium with the CNMC or that it is the report requested by
that entity to the Legal Office of the AEPD.
Well, as a first consideration, both the complaint and the request for a report
were after treatment, so it could hardly be done after
knowing the "resolution" issued or the report issued.
In addition, with respect to the claims made mentioned in the Proposal for
Resolution, it is necessary to show that the complaint made by Watium
before the CNMC (the only one to which reference could be made) was inadmissible for processing
mite, as stated in the administrative file, starting on the contrary
an investigation of Watium herself. Therefore, there was no reproach from the
CNMC to the behavior of my client.
It is true that this reproach is contained in the report of the Legal Cabinet in respect of
put to the query raised by Watium, but it is that my client has not had
knowledge of said report until the Agreement to initiate this procedure
made mention of this. All this, without prejudice to the fact that, as we understand that
given sufficiently accredited, said report lacks an admissible legal basis
in right.
That is, and paraphrasing what was stated in the Proposal, my client issued the letters
without knowing that a claim would be made later that was inadmissible and
would issue by that AEPD (not by different agencies) a single report, not communicating
do to I-DE, who rejected said action.
All this without prejudice to the fact that, as was carefully analyzed in the allegations to
the Proposal for Resolution and it has been insisted in this writing, the criterion supported
made by the Legal Cabinet in the aforementioned report not only is not coherent
with the personal data protection regulations, but even contravenes the
criteria that in relation to the interpretation of the precepts that it carries out
adopted by the National Energy Commission.
In any case, as can be contrasted, what is stated in the Proposal for a Resolution
tion and the reality of the case as regards the intentionality of my principal or
they keep the slightest relationship.
4. Regarding the categories of data being processed, the Proposed Resolution
tion points out, in our view quite surprisingly, that “in this
case, when the claimed entity makes use of the name, surname, address, etc., of
the clients illegally, it is clear use of data protected by the RGPD and, by
therefore, subject to aggravation in application of section g) of article 83.2 of the RGPD ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 19
19/37
In the first place, my client only tried to send the communications the name
name, surname and address of your customers, so it is unknown what the
Proposal with the inclusion of the term "etc.".
But it is that, in addition, from what is literally stated in the Proposal it follows that
The use of "data protected by the RGPD" necessarily implies the aggravation of the
sanction. Well, if the data is not protected by the RGPD, it is not that it does not proceed.
gives the aggravation of the sanction, is that the conduct would not be subject to the RGPD, as
it is manifest and evident. Thus, what the Proposal indicates, and let us
To say that this causes enormous perplexity to this part is that the use of personal data
sonal, subject to the RGPD implies the aggravation of the sanction by application of the
Article 83.2 g) of the RGPD, referring to the categories of data affected by the alleged
infringement, since all categories of data are protected by the aforementioned text
to legal.
5. In relation to the supposed economic benefit, the Proposal for Resolution is
mite to reiterate what is indicated in the Initiation Agreement. Suffice it at this point to add that,
As stated in section 4 of the third claim of this writing, the in-
The revenues referred to in the Proposal are not typical of I-DE, but are collected
by it for the maintenance and support of the electrical system, in accordance with the
Articles 13, 14 and 18 of the LSE, so my client does not know what benefit was obtained
vo with the sending of the communications.
6. And finally, regarding my client's relationship with the realization of treatment-
data, the Proposal is limited to indicating the volume of customers and employees
I-DE to indicate that such a relationship exists.
We must first point out that, now, it seems that finally the AEPD,
even with the intention of aggravating the sanction imposed, it recognizes that
The clients to whom the communication was directed are, in effect, clients of I-DE and
that it maintains a contractual relationship with them.
But having said this, my client understands that the treatment object of this proceeding
Marketing is not an essential part of their activity, which is none other than electrical distribution.
trica in the terms established in the LSE and its implementing regulations.
And it should be reiterated here that in the opinion of my client, the AEPD carries out an interpretation
completely maximalist treatment of the aggravating factors established in the RGPD and the
LOPDGDD, every time, as we already said in the allegations to the Initiation Agreement, “se-
According to its criteria the treatment of any data, even if it is merely identifying,
constitutes, by itself, an aggravating factor and, on the other hand, any entity that has
As stable clients to individuals, their activity will be linked to the treatment
to the personal data ”. Suffice it at this point to add that this conclusion applies
equally to any entity that had employees.
By virtue of all of which,
REQUESTS THE SPANISH DATA PROTECTION AGENCY that, having
By presenting this writing, please admit it, consider the allegations to
the Proposal for a Resolution in Procedure PS / 00197/2020 and, after the formalities
legally established, issue a resolution declaring the nullity of full right of the
procedure for the reasons described in the second argument of this brief
or, failing that, on the merits of what is manifested in the body thereof, the ar-
goad of the aforementioned procedure or, failing that, the imposition of a warning
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 20
20/37
notice or warning or a significant reduction in the amount established in the
Initiation Agreement, in view of the numerous attenuating circumstances
tes in the case of fact prosecuted.
Of the actions carried out in this procedure, of the information and documents
documentation presented by the parties, the following facts have been accredited
chos:
PROVEN FACTS
1.- WATIUM, SL, an electric power trading company, has subscribed with the
energy distribution company, I-DE REDES ELÉCTRICAS INTELIGENTES, SAU
(I-DE), a network access contract (ATR), through which, it exercises functions of
agent or substitute for end customers, as established in articles 3.2 and
3.3 of Royal Decree 1435/2002, of December 27, which regulates the
basic conditions of contracts for the acquisition of energy and access to the
low voltage networks.
2.- The entity WATIUM SL provides a copy of the "Network Access Contract" model
between the trading company (WATIUM SL.) and the supplying company (I-DE).
This contract includes, among other information, the identification and contact of the client
end, the logo of (Iberdrola Distribución Eléctrica, current I-DE) and the identification of
the company WATIUM, SL
The contract is signed by, on the one hand, the trading entity, and on the other, the entity
distributor. There is no place for the signature of the final consumer. Stands out in the text
of the contract the following:
"The undersigned acting as agent and substitute for the client for the purposes of the
art. 3.2 and 3 of RD 1435/2002 of December 27, contracts with IBERDROLA
DISTRIBUCIÓN ELÉCTRICA, SAU access to the network for the electricity supply in
the supply point outlined, being obliged to keep the documentation that
accredits him as agent and substitute for the client and to make it available to the
distribution company if required, both parties being obliged to comply with the
Specific, Special and General Conditions included in this policy,
all of them in accordance with the legal prescriptions in force, being signed on the day
of the date in duplicate and for a single effect. " In the "Payment Term" section
It states: "The Client or his agent will pay this company the amounts of the
electric power supplies within 30 days from the issuance of the
bill."
3.- According to the complaint, in mid-January 2018, WATIUM, SL had
knowledge of the referral, by I-DE, of a series of letters (more than 2,500,
according to complaint), to the clients of WATIUM, SL These letters were of a
informative and exposed the contractual breaches committed by WATIUM SL
regarding I-DE, and invited them to contact WATIUM SL,
to urge you to pay the amount of the contract for access to the distribution network,
further indicating that the lack of payment by WATIUM, SL, to I-DE, could
lead to the suspension of the power supply.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 21
21/37
3.- In the letters sent by IBERDROLA (current I-DE), to WATIUM clients
SL, you can read the following text:
"Dear Consumer: By means of this letter we inform you
that, on February 8, 2018, we were forced to send your
electric power marketer WATIUM, SL., in accordance with the regulations
in force (art. 4.3 and 4.4 of Royal Decree 7764/2007, of October 26), a
reliable request for payment, given that, after the voluntary payment period
established by law, the amount of the invoice for third-party access to the
network corresponding to the contract and supply point of which you are the owner that,
It is detailed below, it is unpaid: (…)
Non-payment of third party access fees to the network may give rise, according to
with current regulations (art. 4.4. of RD 7764/2007, of October 26), to the
suspension of power supply.
For all these reasons, we ask that you urgently contact your company
marketing company to remedy this situation without this letter
informative suppose a request of payment towards you by this company
distributor. Without any other particular, sincerely ”.
4.- As indicated by the entity WATIUM SL, on 01/22/18, informs, through
of a complaint, the facts before the National Markets Commission and the
Competition (CNMC) and before this Data Protection Agency, on 02/19/18.
5.- In the legal report issued by this AEPD, dated 07/23/18- N / REF
059338/2018, includes, among others, the following:
"Consequently, without it corresponding to this AEPD to rule on these
legal aspects that may emerge from the letter, it could be concluded that the
processing of personal data carried out by the distribution company object of
the query has violated data protection regulations both what it does
reference to the legal basis of the treatment as in relation to the principles
relating to treatment. Regarding the first, the appropriate legal basis for the
treatment of these personal data of consumers would be the one that allows
the execution of a contract in which the interested party is a party (art. 6.1. c) RGPD), but
We will already have stated above that the treatment of the personal data of the
Consumers acting through an agent are not necessary for
fulfillment of said contract, since precisely the existence of the agent
makes it necessary to address communications regarding compliance with the
contract.
Regarding the principles relating to the treatment, consequently, it could be concluded that the
processing of said personal data would have been carried out in a manner
incompatible with the determined, explicit and legitimate purposes, for which they were
collected (limitation of the purpose), which, as has also been stated, was for
the supply of electrical energy to the supply point for which the
access. This also implies that the provisions of art.
5.1 letter c) RGPD. inasmuch as or said personal data processed are neither adequate
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 22
22/37
nor relevant in relation to the purposes for which they are processed (principle of
data minimization ”.
6.- On 01/08/20, the entity ENERGIA Y SERVICIOS ABY 2018, SL,
marketer of the electric energy supplied by IBERDROLA (I-DE),
reported to this Agency the sending of identical letters, by IBERDROLA (I-
DE), to their clients, informing them of the non-payment by the marketer, and
inviting them to contact it to proceed with the correction
of said problem.
7º.- For its part, the claimed entity, at the request of this Agency, reported what
following points:
a) That the access fees are charged by the distributors, but they are not in-
own income, but rather the national electricity system.
b) That the WATIUM client is the holder of the ATR contract signed with IBER-
DROLA.
c) That the client, as the holder of the ATR contract, is obliged to
Narrow the access rates to the distribution company.
d) That the distribution company issues the access invoices to the trading company
cializadora who passes them on to customers in their supply invoices. What
the customer must pay these invoices.
e) That the distribution company cannot demand the payment of the direct access toll
straight to the consumer.
f) That both the client and the marketing company are obliged
two jointly and severally to the payment of access fees to the distribution company.
g) That the marketing company must pay the distribution company the
access fees, even if these have not been satisfied by your client.
h) That in the event that access fees are not paid within the deadlines
established in current regulations, the distribution company may initiate the
supply suspension procedure. (art. 52 LSE, 4.4 RD 1164/2001,
art 85 RD 1955/2000.).
i) That the causes that have motivated the incident are a consequence of non-compliance
service by WATIUM within the payment period for each invoice remittance
of ATR, for which they are forced to reliably require the payment of
these rates, warning of the start of the procedure for suspending supplies
tr electric.
j) That since WATIUM collects these access fees from its customers, it trans-
After certain days from the issuance of the reliable request by
non-payment of access fees, IBERDROLA sends the contract holders
of ATR an information letter to inform of the situation and to keep-
is the same, the WATIUM client who has paid the access fees to the
trading company may suffer the consequences of a suspension
of supply. Also the object of the letter is that the holder of the ATR contract
carry out the actions it deems appropriate and, where appropriate, accredit
IBERDROLA, which has already paid these access fees to the trading company
dora, assumption in which the client would avoid having the su-
electrical minister.
k) That the information letter is essential to protect the rights of the
users and that have been subject to review by the regulatory body, the Commission
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 23
23/37
National Market and Competition sion and that comply with the regulations
is in force.
l) That they have been forced to send 1462 information letters to date.
m) That the legal basis for the processing of personal data of
WATIUM's clients is: Contractual. WATIUM customer has subscribed
with IBERDROLA, ATR contract. That the trading company does not have
the condition of part, but of mere representative. Consent of the holder of
the data. That the ATR contract gives express authorization of the clients of
WATIUM for the processing of personal data. What is authorized
tion and express expression of consent is imposed by the regulations
is in force. Legal. What is the legal obligation to process data by the company?
sa distributor for the management of the contract. That such management includes the obligation
tion to inform the ATR holders of the possibility that
supply is suspended. d. Legitimate interest. The one to be able to comply
to its legal and regulatory obligations such as informing the holders of
ATR laws of the incidents that affect your contract, the management of this and
the collection of access tariffs for the National Electric System.
n) They conclude that the only solution to this dispute is that WATIUM
comply with your obligations as this situation is causing important
damages to its customers, the distributor and the National Electric System.
8.- For its part, the CNMC states, regarding the allegations made by the entity
claimed:
a) That IBERDROLA (I-DE) has not addressed the CNMC before sending the
clients of WATIUM, SL the aforementioned letters.
b) That the CNMC has not reported either favorably or unfavorably the rea-
lization of such shipments.
c) That on 01/22/18 a written complaint from WATIUM was received at the CNMC,
SL for the reasons indicated above.
d) That, after analyzing the complaint, the Competition Directorate of the CNMC
considered that it could not be concluded that IBERDROLA (I-DE), incurred in
fraction of art. 3 of Law 15/2007, of July 3, on the Defense of Competition
cia for carrying out acts of unfair competition.
e) That the information was transferred to the Energy Directorate
for the assessment of the possible breach on the part of WATIUM, SL of the
applicable regulations regarding payment of the network access toll.
FOUNDATIONS OF LAW
I- Competition.
The Director of the Spanish Agency is competent to resolve this procedure
of Data Protection, in accordance with the provisions of art. 58.2 of the GDPR in
the art. 47 of LOPDGDD.
II- Answer to the allegations to the Proposal for Resolution.
The joint assessment of the documentary evidence in the procedure brings to
knowledge of the AEPD, a vision of the denounced action that has been
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 24
24/37
strapped in the facts declared proven above related. However, on the
allegations presented by the claimed entity must indicate:
- On the non-existence in the conduct of I-DE of violation of the regulations of
protection of personal data, (first and second points of the allegations)
nes):
The electric power trading companies (the complaining entities), have
nen subscribed with the electric power distribution entity, (the claimed entity),
an access contract to the network (ATR), by means of which, it exercises mandate functions
river or substitute for end customers, as indicated in articles 3.2 and 3.3 of the Real
Decree 1435/2002, of December 27, which regulates the basic conditions
of contracts for the acquisition of energy and access to low voltage networks. In
said contract, there is the following clause:
"The undersigned, acting as agent and substitute for the client for the purposes of the
art. 3.2 and 3.3 of the RD. 1435/2002 of December 27, contracts with IBERDROLA DIS-
TRIBUCIÓN ELECTRICA, SAU access to the network for electricity supply in the
supply point outlined, being obliged to keep the documentation that
accredits as agent and substitute for the client and to make it available to the only one
distributor if it is required, both parties being obliged to comply with the Conditions
Specific, Special and General purposes included in this policy. All of them
in accordance with current legal prescriptions, signed on the day of the date
in duplicate and with a single effect ”.
The signatories of the contract are, on the one hand, the trading company and, on the one hand,
part of the supplying company, the contract administrator and the Head of Distribution
zone tion.
In article 3.2 of RD 1435/2002, cited in the contract, it is established, on the finalization
of the processing of personal data, the following: “2. (…) The supply contract
between the consumer and the marketer, it must be formalized in writing. In it you must
include an authorization so that the marketer can act as agent
of the consumer, contracting the access fee with the distributor and transferring the
buidor the data necessary for the supply. The collection, treatment and transfer of
These data must at all times observe the provisions established in the norm.
policy on the protection of personal data that may be applicable ”.
Well, according to the principle of "limitation of purpose", contained in article 5 of the
RGPD, personal data will be processed only and exclusively for specific purposes.
defined, explicit and legitimate, and will not be subsequently treated in an incompatible manner.
ble for these purposes.
This principle has two parts, on the one hand, it requires that the data be treated with
one or more specific, explicit and legitimate purposes, that is, the purpose of the
Treatment must be clearly defined, in such a way that allows the interested party
or to the control authorities to know what type of activities are included in it and why
On the other hand, it prohibits the data collected for specific, explicit and lawful purposes
gitimos are subsequently processed in a manner incompatible with those purposes.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 25
25/37
Therefore, it is not possible to process the data initially collected for another purpose than
are not compatible with the first. This means that the GDPR does not prevent
data are processed for purposes other than the one that justified the original treatment.
Rio, what it prohibits is a treatment for purposes not compatible with the initial one.
Article 3.2 of RG 1435/2002 referred to in the contract signed between the commercial entity
cializadora and the distribution entity establishes that the personal data that the entity
marketing company will "transfer" to the "distributor" entity, they will be solely and exclusively
so that it provides the final consumer with the electricity supply: “(…) transfer to the
distributor the data necessary for the supply (…) ”, that is, the data necessary
so that the electric power distribution entity can reach the final point
the electricity supply (identification of the final consumer, supply address,
contracted company, etc. This purpose or another compatible with it, are the only ones for the
that the distribution entity can make a lawful treatment of personal data
that the marketer has provided you.
In the present case, the letters sent by the distribution entity to consumers
final meters said verbatim:
“March 13, 2018.- Dear consumer: By means of this letter I put-
We know that, on February 8, 2018, we were forced to
to be sent to your electric power marketer WATIUM, SL., in accordance with the
current regulations (art. 4.3 and 4.4 of Royal Decree 7764/2007, of October 26), a
reliable demand for payment, given that, once the voluntary payment period has elapsed,
glamentarily established, the amount of the invoice for third-party access to the network
corresponding to the contract and supply point of which you are the owner and that,
Continuation, it is detailed, is unpaid: (….).
Non-payment of third party access fees to the network may give rise, according to
with current regulations (art. 4.4. of Royal Decree 7764/2007, of October 26), to the
suspension of power supply. For all these reasons, we ask you to be urgent-
keep in touch with your marketing company to remedy this situation without
that in no case does this information letter imply a request for payment to
you by this distribution company. Without other particular, sincerely. "
Therefore, it is clear that the processing of personal data carried out by the
distribution company, when sending informational letters of the alleged breaches
contractual agreements of the trading company, to final consumers, in addition to
"Beg" them to contact the marketing entity so that it
"Proceed to correct the problem" is not compatible with the stated purpose
in article 3.2 of RD 1435/2002.
Moreover, this irregular data processing carried out by the distribution entity implies
the breach of what is established in art. 5.1.c) of the RGPD, since the personal data
Final treaties for sending the cited letters are neither adequate nor pertinent,
in relation to the purpose and scope for which they were collected (principle of mini-
data mization). What this principle establishes is that personal data must-
They will be, in any case, limited to the purpose for which they were collected. Purpose
established in the terms and conditions agreed in the signed contract.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 26
26/37
On the other hand, article 3.3 of the aforementioned Royal Decree 1435/2002, establishes that: “In the
case in which the consumer chooses to contract energy and access to the networks through
Through a marketer who acts as a substitute for the consumer, the marketer
The buyer must have sufficient power granted by the consumer in favor of the merchant.
cializer. In this case, the position of the marketer in the access contract sus-
Credit with the distributor will be for all purposes that of the corresponding consumer.
In any case, the distributor will maintain with the final consumer all the obligations
tions relating to the access contract and in the event of termination of the contract between the
merchant and consumer, this will be the holder of the guarantee deposit, as well as
of any other right associated with the installation, without it being enforceable, for
part of the distributor, any update due to the contractual renewal ”.
According to this precept, if the distributor wishes to address the final consumer who has
dealt with the supply of electrical energy through a marketer, it may only di-
abide by it through the marketer, for having constituted itself as agent
of the final consumer acting before the distributor as a " substitute for the consumer ".
The cited article, therefore, does not contemplate direct action between the distributor and
the final consumer, since he has appointed an agent for his relationship with
that, not existing in any case, a direct contractual relationship between the distributor
buyer and the final consumer but through marketing, whose position in the
access subscribed with the distributor is, as established in the aforementioned article: “(…) to all
the effects that of the final consumer ”.
The claimed entity is accepted in article 4.4 of RD 1164/2001, where they are established
the conditions for suspending the electricity supply, as a result of non-payment
of the rates, to have sufficient power to address the final consumer
with a different purpose than that established in article 3.2 of RD 1435/2020, this
is, to send them informational letters with the "request" that they get in touch with
the marketing entity so that it fulfills its contractual obligations.
Well, the cited article establishes the following: “4. The distribution company may
suspend the access fee contract when at least two have elapsed
months since he had reliably required payment to the consumer or its maintenance
date, in accordance with the scope of application of the access fees established in
Article 1, paragraph 1, of this Royal Decree, without it having been made
cho cash. For these purposes, the request will be made by means of a referral, to the address
address that for communication purposes appears in the access fee contract, for
any means that allows proof of receipt by the interested party, as well
as well as the date, identity and content of this, leaving the distribution company
obliged to keep in its possession the accreditation of the notification made. In the su-
post of rejection of the notification, the circumstances of the attempt to
notification and the procedure will be considered completed. Said communication must include the
procedure of disconnection of the consumer from the distribution networks due to non-payment,
Said the date from which the disconnection will take place, if the payment is not made on
above the amounts owed (…) ”.
Well, as this article establishes, when the distribution company is obliged to
to suspend the electricity supply service to the final consumer due to non-payment, it is
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 27
27/37
when it can be directed to the final consumer, but to the sole effect of requirement
of the payment of the electricity tariff, in accordance with the scope of application established in the
Article 1.1 of the aforementioned Royal Decree. In addition, the requirement will be practiced in the
Rection that for communication purposes appears in the signed contract and in it only
It will include: “ the process of disconnection of the consumer from the distribution networks by
non-payment, specifying the date from which the disconnection will take place, if no
the amounts owed must be paid in advance ” .
Therefore, the aforementioned article limits the communications of the distribution entity with the
end customer for the sole purpose of requiring payment of the fee, when this is the
direct debtor, and as the claimed entity indicates in its allegations: “in no way
At one time the consumer has been required to pay said fee which, on the other hand,
you, he has already satisfied the marketer ” , but merely informs him that his
The merchant has not satisfied the payment of the electricity tariff, previously paid by
he in addition to "begging" him to contact the marketing entity
so that it can solve the problem of non-payment.
Therefore, the conclusion reached by the claimed entity cannot be taken in
consideration because it is not correct to apply this article to take over the power
sufficient for the processing of personal data of end consumers and potential
thus, send them informational letters with the “request” to contact the entity.
marketing entity in order for it to comply with its contractual obligations with
the distribution entity, without entering to assess this Agency the other allegations where
the possible consequences of the marketing company not satisfying
to its contractual obligations as these valuations are not the competence of this
Organism.
3.- Regarding the intervention of the CNMC in the present case, the entity now recognizes
claimed, changing its initial argument that: “The CNMC is aware of the
sending these communications, at least as a result of the complaint
formulated by the marketer (…). "
Well, it must be remembered that, on 06/25/19, the claimed entity affirmed to
this Agency verbatim that: “ These letters have already been subject to review by the
Regulatory body, the National Commission of Markets and Competition and
strictly comply with the aforementioned regulations in force (…) ”.
Report requested from the Regulatory Body on the statements made by the
claimed entity, on 02/26/20, the CNMC sent this Agency a report where
these assertions were flatly denied:
"Regarding this letter, the following must be reported according to the data
working in the Directorates of instruction of this Commission: - Iberdrola Distribución
Eléctrica, SAU has not approached the CNMC before sending Watium customers,
SL the letters in question. The CNMC has not reported, either favorable or
unfavorably, the making of said shipments. - On January 22, 2018
received at the CNMC a letter of complaint from Watium, SL due to the letters of
that is (…).
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 28
28/37
As a conclusion to the report issued by the Competition Directorate of the CNMC,
considers that: “(…) it could not be concluded that Iberdrola Distribución Eléctrica, SAU
incurred in violation of article 3 of Law 15/2007, of July 3, on the Defense of the
Competition, due to acts of unfair competition. Attached to
In this regard, communication dated April 19, 2018 sent to the complainant by
of the Directorate of Competition. It remains to clarify that, although the communication of 19
April 2018 mentioned refers at the end to a transfer of the information to the Directorate
of Energy, this is produced for different purposes (valuation of the possible
non-compliance on the part of the trading company Watium, SL of the applicable regulations
regarding payment of the network access toll) ”.
It is striking to see how the claimed entity, to justify the treatment of the data
end customers' personals for sending informative letters, "begging them"
also that they contact the marketing entity, excuse themselves
initially in the approval made by the CNMC, indicating to this Agency that, the
"Letter" conformed to current regulations as it had been endorsed by the Agency
Regulator and that after he denied it by denying knowledge of the
existence of the letters, the claimed entity will change its argumentation by trying
Now, with these new allegations, justify that: (…) The CNMC did know that these
letters were sent to I-DE clients whose marketing company did not pay
the access fees after the end of the voluntary payment period and after having
has been reliably required for this purpose, as expressly provided by law
applicable, in order to avoid the supply being suspended without the knowledge of the
holder of the contract, nor to be able to have it, that his access contract was in the
of non-payment ”.
It is true, as the claimed entity affirms, that the CNMC learned of the existence of the
letters long after they were sent, but it was not through the distribution entity, if
not through the complaint filed by the marketing entity before said
Organism.
In short, it is not true that the CNMC knew of the existence of the letters through
of the distribution entity : “(…) Iberdrola Distribución Eléctrica, SAU has not
addressed to the CNMC before sending Watium, SL clients the letters that are
treats (…) ” . Nor is it true that said Agency reported favorably. Other
Another thing is that said Agency had knowledge of the letters sent
a long time later, through the complaint filed by the entity
trading company before said Body but the fact that later the CNMC
decided to inform the Directorate General of Energy the facts is
an issue that this Agency cannot enter into to assess, as it falls outside the scope of
competition, so it is still impossible to take into account the
repeated allegations presented by the entity claimed in section 3 of the
Point 2.
On the legal basis of the treatment in the present case (section 4 of point 2 of
the allegations).
The claimed entity now welcomes the legitimate interest established in article 6.1 f)
of the RGPD for the sending of the letters, without even justifying the reasons that
lead to this, limiting themselves to indicating that:
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 29
29/37
“(…) In this way, it would be applicable to the assumption, at least, and although
considers sufficient the legal basis of the contractual relationship, the rule of interest
legitimate prevailing established in article 6.1 f) of the RGPD (...) ”, not providing
no legal basis that allows weighing, even minimally, the legality of the
treatment of the data of the end consumers, by sending the letters to
those referred to in this procedure, suffering from an absolute lack of
motivation, since only recital 47 of the RGPD is transcribed at this point
for your defense.
Therefore, if the claimed entity now avails itself of the legitimate interest for the
treatment of personal data of end customers, the rule requires you to carry out
a balancing exercise between said legitimate interest and fundamental rights
of those affected. In this sense, the Judgment of the Court of Justice declared
expressly the direct effect of article 7 f) of Directive 95/46 / EC, according to which:
“ The Member States shall provide that the processing of personal data may only be
be carried out if (...) it is necessary to satisfy the legitimate interest pursued by
the person responsible for the treatment or by the third party or third parties to whom the
data, provided that the interest or fundamental rights and freedoms do not prevail
of the interested party that require protection in accordance with article 1.1 of this
Directive".
Therefore, to determine if the application of the aforementioned precept is appropriate, it will be necessary to
apply the rule of weighting provided in it; that is, it would be necessary
assess whether in the specific case under analysis there will be a legitimate interest
pursued by the data controller (marketing company) or by the
third party or third parties to whom the data is communicated (distribution company), which
prevails over the interest or the fundamental rights and freedoms of the interested party
that require protection in accordance with the provisions of article 1 of the RGPD, or if, for
on the contrary, the fundamental rights or interests of the interested parties to whom
refers to the treatment of the data must prevail over the interest in which the entity
claimed seeks to substantiate the processing of personal data.
Thus, in order to carry out the necessary weighting required, you must
consider whether, taking into account the specific circumstances that occur in the
present case, the interest pursued by the distribution entity by sending the letters
informative and "beg" to end consumers, treating their personal data
It must prevail over the right to data protection of those affected.
In the present case, from the reading of the letter sent to the final consumers,
It follows that the purpose pursued by the distribution entity is, firstly,
inform the end consumer of a presumed contractual breach of their entity
marketer with the distribution entity to then "beg" the consumer
final contact with the marketer with the ultimate goal of
he pays what is allegedly owed, otherwise the continuity of
electrical supply to your home may be in danger, observing a possible
intimidating background towards the final consumer, although the distribution entity
keep in stating that said letter is not, at all, a request for payment to the
final consumer as he recognizes that he meets his obligation to pay
billing of electricity consumption to the marketing entity.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 30
30/37
Therefore, it is evident that the ultimate interest, which moves the distribution entity to
send the letters to the final consumers is that the marketer pays them the
owed, even though, from the reading of the letter, the final consumers may
feel "pressured" to contact the marketing entity, under the
"Threat" of suspending the electricity supply if the marketing entity does not
pay what is owed.
Therefore, it is not possible to consider the processing of data as a legitimate interest
personal data of the final consumers by the distribution entity to
send them informational letters of the breaches of the marketing entity and
"Begging" you to get in touch with it to remedy the problem, as
in this case, the rights and freedoms must undoubtedly prevail
fundamentals of the interested party.
However, it is entirely correct that the distribution company has the right to
"Recover some amounts that it has been forced to enter for the electrical system
despite not having collected them ”, by the legal means it deems appropriate, but
the claimed entity should not confuse this right with the presumed "interest
legitimate ”which is used for the illicit treatment of the personal data of the
final consumers
- Regarding the setting of the amount of the sanction in the commencement agreement, (point three-
ro of the allegations).
Indicate, once again, that Law 39/2015, of October 1, on the Procedure
Common Administration of Public Administrations, (LPACAP), establishes, in its
article 53.2:
"In addition to the rights provided in the previous section, in the case of
administrative procedures of a sanctioning nature, the alleged
Responsible parties will have the following rights: a) To be notified of the facts that
are charged, of the infractions that such facts may constitute and of the
sanctions that, if applicable, could be imposed (…) ”.
For its part, article 64 of the aforementioned LPACAP establishes, with respect to the
Agreement to initiate procedures of a sanctioning nature, which:
1. The initiation agreement will be communicated to the instructor of the procedure, with transfer
of how many actions exist in this regard, and the interested parties will be notified,
understanding in any case the accused as such. Likewise, the initiation will be communicated
to the complainant when the rules governing the procedure so provide. 2. The
initiation agreement must contain at least: a) Identification of the person or
persons allegedly responsible. b) The facts that motivate the initiation of the
procedure, its possible qualification and the penalties that may correspond, without
detriment of what results from the instruction
Therefore, that the sanctioning body anticipates the amount of the sanction that would proceed
impose, and always depending on what ultimately results from the procedure and that, in the
Proposed Resolution, is proposed, an amount identical to that indicated by the body
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 31
31/37
sanctioner in the Initiation Agreement, has nothing in particular, nor does it attempt against
no established norm, so it is not appropriate to consider what is alleged by the entity
claimed at this point, even more so when it only records the fact,
without even supporting in the least the reasons that lead him to put in between
said the legality of the sanctioning procedure carried out.
On the other hand, it is not true, as the claimed entity affirms that: “(…) the body
sanctioner is not limited to remembering which is the applicable sanctioning norm, but
assesses effectively, without paying attention at any time to what the
inserted, what concrete sanction, within the limits established by the norm,
it is appropriate to impose (…) ” because in the document initiating the sanctioning proceedings,
You can read verbatim, in your "agreement": " WHAT: for the purposes provided for in art. 64.2
b) of Law 39/2015, of October 1, on the Common Administrative Procedure of the
Public Administrations, the corresponding sanction would be a fine of
200,000 euros (two hundred thousand euros), without prejudice to what results from the instruction ”,
and therefore, the sanction to be imposed becomes conditional on the result of the instruction of the
process. The fact of indicating a specific numerical data of the sanction in the
commencement agreement is simply in application of the provisions of article 64.1.b) of
LPACAP cited above and in application of the provisions of article 68 of the
LOPDGDD, according to which it will be enough to specify the facts that motivate the
opening, identify the person or entity against which the procedure is directed, the
infraction that could have been committed and its possible sanction.
Therefore, the statement made by the entity cannot be taken into account
claimed when it indicates that the possible sanction that may correspond to the
imputed infractions is a determining factor of defenselessness or that implies a rupture
of the principle of separation of the investigation and resolution phases. On the contrary, with
This is in compliance with one of the requirements set forth in the standards outlined.
For its part, article 85 of the LPACAP contemplates the possibility of applying
reductions on the amount of the penalty if the offender acknowledges his responsibility
and in the event of voluntary payment of the penalty. This precept establishes the obligation to
determine those reductions in the notice of initiation of the procedure, which
entails the need to set the amount of the penalty corresponding to the facts
accused and it is not true, as stated by the claimed entity that this article
establish that the amount of the sanction is determined once the
procedure, since the recognition of responsibility and voluntary payment of the
sanction what has to occur after that moment, and not the fixation of the
amount of the penalty.
If this acknowledgment of responsibility or voluntary payment does not occur, which
would determine the termination of the procedure, it is instructed and dictates
later the resolution proposal, in which they have to be fixed in a reasoned way
the facts that are considered proven and their exact legal qualification,
will determine the infringement that, where appropriate, those constitute, the person or persons
responsible and the sanction that is proposed, the evaluation of the tests carried out,
especially those that constitute the basic foundations of the decision. This
must be notified to the interested party, granting him a period to formulate
allegations and present the documents and information deemed pertinent.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 32
32/37
In no case will a resolution be adopted without the interested party having the opportunity to
manifest itself on all the extremes considered.
Therefore, it is not true that the claimed entity has seen its rights and
it cannot be said that the determination of the amount of the fine in the
opening does not imply any reduction in said guarantees causing helplessness.
Nor does this circumstance break the impartiality of the investigating body, which provides
of all the powers conferred by the regulations in question and full freedom to
dictate your motion for a resolution. You just have to go to the Agency's website, in the
that all resolutions issued in sanctioning procedures are published,
to check the large number of them ending with a file resolution of
actions, following the proposal issued by the instructor of the procedure, as well
such as those in which said proposal increased or decreased the amount of the
sanction set in the opening agreement or even proposed the application of a power of attorney
corrective other than the sanction of a fine.
- On the application in the present case of the principle of proportionality and the
modifying circumstances of the concurrent responsibility in the same
(fourth point of the allegations):
a) .- Regarding the number of letters sent to clients, indicate that, for this Agency
there is the same rejection of an illicit treatment of 2,598 personal data as a
illicit treatment of 1,462 personal data, so it is not appropriate to reconsider the
aggravating point a) of article 83.2 of the RGPD.
b) .- On the statement made by the claimed entity when it alleges that:
“(…) Understands this part that the AEPD cannot take as true or assume in
In no way a representation that not only is not in any case accredited,
but also refuses, since Watium always claims to act on his own
Name. Therefore, there is no doubt that this entity holds the status of
interested party for the purposes provided in the data protection regulations, is
the application of such an aggravating circumstance is completely inadmissible ”,
It should be remembered that, for example, in the claim itself presented by the entity
Watium SL., In this Agency, it was indicated verbatim:
“A claim is filed against Iberdrola Distribución Eléctrica, SAU (company
electricity distribution company) by sending a series of letters (we have
proof of 2598 letters) to the clients of Watium, SL (trading company
of electrical energy) distracting the purpose for which the data were transferred from
the marketer to the distributor (purpose: supply) lacking legal basis
to get in touch with the clients of Watium, SL
c) .- On the statement made by the claimed entity when it indicates that: “3. He says,
thirdly, the AEPD, that I-DE acted “knowing that there were different
complaints filed and reports issued by different public bodies
who rejected said action, the entity continued to send information letters to the
end customers, and, therefore, could constitute an illegal act ”.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 33
33/37
My client cannot but reiterate that he does not know what those reports are and
resolutions that she was supposed to know when she carried out the treatment
of the data. Indeed, since obviously they cannot be what they are
object of this procedure there are only two possibilities: that the AEPD refers to the
complaint filed by Watium with the CNMC or that it is the requested report
by that entity to the Legal Office of the AEPD.
Well, as a first consideration, both the complaint and the request for a report
were after treatment, so it could hardly be done after
knowing the "resolution" issued or the report issued (...).
Well, as stated in the sanctioning file, there is a certificate issued by the
Electronic Notification Service and Electronic Address, dated
acceptance 05/23/19 and being the receiver *** NIF. 1 AAA in representing
IBERDROLA DISTRIBUCIÓN ELÉCTRICA SA, with NIF A95075578, this Agency
sent to the claimed entity the complaint filed with this Agency by the entity
Watium SL, including: - Model network access contract signed between the two
entities. - Sample letter sent by Iberdrola to WATIUM SL clients. - Letter
sent to the Markets and Competition Commission on 01/22/18. - Written
sent to Iberdrola on 01/23/18. - Request for a legal report to the AEPD, dated
02/19/18. - Response of the legal office of the AEPD, dated 07/24/18 - Request
from the DPD of WATIUM SL to the DPD of IBERDROLA, dated 10/24/18. - Burofax a
IBERDROLA, to stop sending the letters, 10/24/18. - Service response
IBERDROLA legal, dated 11/02/18. - Examples of letters sent by
IBERDROLA, Q1 2018, Q3 2018 and Q1 2019.
However, the foregoing, knowing that there were different claims
filed and reports issued by different public bodies that put into
doubt said action, dated 09/05/19, (3 months later), the claimed entity
sends customers of the trading company ENERGÍA Y SERVICIOS ABY, SL the
The same letters that I sent some time before to the clients of the marketer
WATIUM SL.
Therefore, it is not true, as the claimed entity tries to justify that it was unaware
the reports and resolutions that questioned the processing of personal data of
end customers, thereby evidencing the negligence of the entity's conduct
claimed, since its action was carried out without the due level of due diligence.
d) .- On the alleged seriousness derived from the treatment of categories of data
limited only to those of a merely identifying nature, remember that the
Article 1.2 of the RGPD establishes that: “This Regulation protects the rights and
fundamental freedoms of natural persons and, in particular, their right to freedom
protection of personal data ”, defining in its article 4.1, the“ personal data ”
as: “all information about an identified or identifiable natural person, whose
identity can be determined, directly or indirectly, in particular by means of a
identifier, such as a name, an identification number, etc. ”, and by
Therefore, in this case, when the claimed entity makes an illicit use of the name,
surname or address, is sufficiently clear evidence of an illicit use of data
personal protected by the RGPD and therefore, object of aggravation in application of the
section g) of article 83.2 of the RGPD.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 34
34/37
d) .- Regarding the alleged illegal use of the data to avoid losses to I-DE, indicate that,
From the letters sent to the end customers, it is clear that the objective
The end of the claimed entity, as argued above, was to avoid
the losses that the contractual breach of the marketers was
producing in the distributor, so it is not appropriate to consider the allegations
made at this point.
e) .- Regarding the connection between I-DE and data processing, indicate that it is notorious
that an entity like I-DE, handles personal data of more than 6 million
direct and indirect customers, through marketers, in addition to having a
staff of more than 35,000 employees, so that, an entity like her, is owed
require a maximum level of due diligence in the processing of personal data and
its management, both of the personal data of direct customers and the data
personal data that the marketers provide you with in order to send them
power supply.
Therefore, the interpretation made by this Agency of the aggravating factors established in the
RGPD and the LOPDGDD is totally in accordance with the infractions committed by the
claimed entity.
III
Thus, the known facts constitute an infringement, attributable to the
claimed entity, for violation of the articles:
- Art. 6.1.b) of the RGPD, which establishes that: “the processing of data will only be lawful
to if it is necessary for the execution of a contract in which the interested party is
part or for the application at his request of pre-contractual measures ”.
- Art. 5.1.b) of the RGPD which establishes that: “personal data will be collected
for specific, explicit and legitimate purposes and will not be further processed
in a manner incompatible with said purposes, (purpose limitation).
- Art. 5.1.c) of the RGPD, which establishes that: “Personal data will be the ade-
appropriate, relevant and limited to what is necessary in relation to the purposes for which
that are treated, (data minimization).
For its part, article 72.1.a and b) of the LOPDGDD considers as "very serious",
Prescription purposes, the processing of personal data if, " violates the
principles and guarantees established in article 5 of the RGPD "and if it is carried out," without
any of the conditions of legality established in article 6 of the RGPD concur ”,
respectively.
IV
These infractions can be sanctioned with a fine of € 20,000,000 maximum
or, in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for the
of a higher amount, in accordance with article 83.5.a) of the RGPD.
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 35
35/37
In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In this case, it is considered that the sanction to be imposed should be adjusted according to
with the following aggravating criteria, established in article 83.2 of the RGPD:
- The nature, severity and duration of the offense, taking into account the nature
nature, scope or purpose of the treatment operation in question, as well as
such as the number of interested parties affected and the level of damages
who have suffered, when carrying out an improper treatment of personal data,
(section a).
- The intentionality or negligence in the infringement. In the present case we are
before negligent action, because even having knowledge of the filing
of claims before different public bodies, by the company
Watium, Iberdrola continues to send letters to the clients of the claimed entities
mantes, (section b).
- The categories of personal data affected by the infringement, already
that the data processed, in this case, are customer identification data
end of the marketing entities and their location, (section g).
- The way in which the supervisory authority learned of the infringement, since
that the AEPD became aware of the infringement through the claim of the
interested party, (section h).
- The losses avoided, directly or indirectly, through the infringement, in
In this case, trying to use the mediation of the clients of the co-
mercializadoras, with the illicit treatment of your personal data to obtain
guide that the trading entities pay the debt contracted with the company.
distribution company, (section k).
It is also considered that the sanction to be imposed should be adjusted in accordance with the
following aggravating criteria, established in article 76.2 of the LOPDGDD:
- The linking of the activity of the offender with the performance of treatment of
personal data, (section b).
The balance of the circumstances contemplated in article 83.2 of the RGPD, with
regarding the offense committed by violating the provisions of its articles 5.1.b and c) and
6.1.b) allows setting a penalty of 200,000 euros (two hundred thousand euros), considered
as “very serious”, for the purposes of this prescription, in article 71.1.a and b)
respectively, of the LOPDGDD.
In view of the above, the following is issued:
RESOLVES :
FIRST: IMPOSE on the entity, I-DE REDES ELECTRICAS INTELLIGENTES,
SAU (I-DE), formerly known as IBERDROLA SA, with CIF: A95075578 a
C / Jorge Juan, 6
www.aepd.es
28001 - Madrid
sedeagpd.gob.es
Page 36
36/37
sanción de 200.000 euros (doscientos mil euros), por infracción de los artículos, 5.1.b)
y c) y artículo 6.1.b) del RGPD.
SEGUNDO: NOTIFICAR la presente resolución a la entidad I-DE REDES ELÉCTRI-
CAS INTELIGENTES, S.A.U e INFORMAR a los reclamantes sobre el resultado de la
reclamación.
TERCERO: Advertir al sancionado que la sanción impuesta deberá hacerla efectiva
una vez sea ejecutiva la presente resolución, de conformidad con lo dispuesto en el ar-
tículo 98.1.b) de la ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Co-
mún de las Administraciones Públicas (LPACAP), en el plazo de pago voluntario que
señala el artículo 68 del Reglamento General de Recaudación, aprobado por Real De-
creto 939/2005, de 29 de julio, en relación con el art. 62 de la Ley 58/2003, de 17 de
diciembre, mediante su ingreso en la cuenta restringida nº ES00 0000 0000 0000 0000
0000, abierta a nombre de la Agencia Española de Protección de Datos en el Banco
CAIXABANK, S.A. o en caso contrario, se procederá a su recaudación en período eje-
cutivo.
Recibida la notificación y una vez ejecutiva, si la fecha de ejecutividad se encuentra
entre los días 1 y 15 de cada mes, ambos inclusive, el plazo para efectuar el pago vo-
luntario será hasta el día 20 del mes siguiente o inmediato hábil posterior, y si se en-
cuentra entre los días 16 y último de cada mes, ambos inclusive, el plazo del pago
será hasta el 5 del segundo mes siguiente o inmediato hábil posterior.
De conformidad con lo establecido el artículo 82 de la Ley 62/2003, de 30 de diciem-
bre, de medidas fiscales, administrativas y del orden social, la presente Resolución se
hará pública, una vez haya sido notificada a los interesados. La publicación se realiza-
rá conforme a lo previsto en la Instrucción 1/2004, de 22 de diciembre, de la Agencia
Española de Protección de Datos sobre publicación de sus Resoluciones.
Contra esta resolución, que pone fin a la vía administrativa, y de conformidad con lo
establecido en los artículos 112 y 123 de la LPACAP, los interesados podrán interpo-
ner, potestativamente, recurso de reposición ante la Directora de la Agencia Española
de Protección de Datos en el plazo de un mes a contar desde el día siguiente a la noti-
ficación de esta resolución, o, directamente recurso contencioso administrativo ante la
Sala de lo Contencioso-administrativo de la Audiencia Nacional, con arreglo a lo dis-
puesto en el artículo 25 y en el apartado 5 de la disposición adicional cuarta de la Ley
29/1998, de 13/07, reguladora de la Jurisdicción Contencioso-administrativa, en el pla-
zo de dos meses a contar desde el día siguiente a la notificación de este acto, según
lo previsto en el artículo 46.1 del referido texto legal.
Finalmente, se señala que conforme a lo previsto en el art. 90.3 a) de la LPACAP, se
podrá suspender cautelarmente la resolución firme en vía administrativa si el interesa-
do manifiesta su intención de interponer recurso contencioso-administrativo. De ser
éste el caso, el interesado deberá comunicar formalmente este hecho mediante escrito
dirigido a la Agencia Española de Protección de Datos, presentándolo a través del Re-
gistro Electrónico de la Agencia [https://sedeagpd.gob.es/sede-electronicaweb/], o a
través de alguno de los restantes registros previstos en el art. 16.4 de la citada Ley
39/2015, de 1 de octubre. También deberá trasladar a la Agencia la documentación
que acredite la interposición efectiva del recurso contencioso-administrativo. Si la
Agencia no tuviese conocimiento de la interposición del recurso contencioso-adminis-
trativo en el plazo de dos meses desde el día siguiente a la notificación de la presente
resolución, daría por finalizada la suspensión cautelar.
C/ Jorge Juan, 6
www.aepd.es
28001 – Madrid
sedeagpd.gob.es
Page 37
37/37
Mar España Martí
Directora de la Agencia Española de Protección de Datos
C/ Jorge Juan, 6
www.aepd.es
28001 – Madrid
sedeagpd.gob.es
Retrieved from "https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS/00197/2020&oldid=13906"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki