AEPD (Spain) - PS/00259/2020

AEPD (Spain) - PS/00259/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(f) GDPR Article 22(1) GDPR Article 5(3) Directive 2002/58/EC Article 22(1) LSSI
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	06.07.2021
Published:	09.07.2021
Fine:	50000 EUR
Parties:	BANKIA, S.A.
National Case Number/Name:	PS/00259/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA fined a bank €50,000 for sending commercial communications on the envelope of a letter to a client that had exercised their right to object.

English Summary

Facts

A data subject exercised their right to object to receiving commercial communications against a bank (Bankia/Caixabank), after what whose DPO confirmed that the right had been correctly exercised.

However, two years after that, the data subject received a letter from the bank which envelope contained a commercial communication, promoting and informing about the bank's services. The data subject lodged a complaint with the Spanish DPA (AEPD).

The bank alleged that it was not a commercial communication but a mere standard envelope like the banners and signs that they display at their offices, that include information about the bank's services, and that the letter inside was just information sent to the client regarding the services that they had contracted. The bank also stated that it was not a direct marketing action, as it did not include any profiling or made use of individual preferences, but was general information sent to their clients. They alleged that they were relying on a legitimate interest for this.

The bank also alleged that they had not processed their client's data for marketing purposes, since the processing was done to send the letter, and the envelope containing the commercial message was just accidental to it, but the data was not processed for that purpose.

Holding

The Spanish DPA determined that the actions performed by the bank were nevertheless commercial communications with a marketing purpose, and that the controller did not have a legal basis for doing so, as the bank could not rely on a legitimate interest since the data subject had exercised their right to object, in accordance to Article 21 GDPR. The Spanish DPA also made reference to Recitals 69 and 70.

The AEPD also noted that the privacy policy of the bank declared that commercial communications were based on consent, contrary to what the controller alleged during the procedure.

Therefore, the AEPD concluded that there had been a violation of Article 6(1)(f) and fined the controller €50,000, compelling it to implement the necessary measures to prevent the sending of commercial communications to data subjects that have objected to them.

The Spanish DPA took into account the lack of diligence, the scope of the infringing behaviour (even if in this case there was an only claimant, the lack of measures to prevent it may make it happen regarding other clients), the link between the controller's activity and the infringement, and the recidivism of the controller; and the fact that the entity was assimilated by another entity, so the infringement could be attributed to the latter entity, as a mitigating factor.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                              1/48








     Procedure No.: PS / 00259/2020

               RESOLUTION OF SANCTIONING PROCEDURE


Of the procedure instructed by the Spanish Agency for Data Protection and with
based on the following:

                                  BACKGROUND

FIRST: D. A.A.A., with NIF *** NIF.1 (hereinafter, the claimant), files

claim before the Spanish Data Protection Agency (AEPD) dated
04/06/2020. The claim is directed against BANKIA, S.A., with NIF A14010342 (as
successive, the claimed). The reason on which you base your claim is the receipt of
commercial advertising that the respondent sent via postal mail after
that he had objected to the processing of his data for advertising purposes and that the
claimed, of whom he is a client, responded that he was attending to his right and proceeded to

adopt the necessary measures for its compliance.

Provide these documents with your claim:

    to. The one that contains the commercial communication (annex 2), integrated in turn by
       two documents. In the first of them, in the lower right part, they appear

       the personal data of the claimant -name, two surnames and postal address
       full- and below a barcode. The position in which they are located
       in the document the personal data coincides with the one that occupies the
       a type of envelope commonly used in postal mail that allows
       see the recipient's information printed inside the envelope. In the

       upper right corner of the document is the anagram of the claimed
       with his name. In the lower right corner the indication “11.02.2020”. In the
       The body of the document has this legend: “It costs a lot to find the house
       of your dreams. Therefore, WE REMOVE THE COMMISSIONS FROM YOUR NEW
       MORTGAGE. Just for having your payroll domiciled and nothing else. We take away the
       commissions of: ”Next, in two parallel columns, figure:

       "OPENING"; "EARLY AMORTIZATION"; "CANCELLATION
       IN ADVANCE ”; "POST COSTS". Immediately below it is indicated:
       “So that dreaming costs less. * Check conditions at Bankia branches or
       bankia.es ”.
       The second document that makes up Annex 2 of the claim is
       identical to the first with this particularity: the recipient's personal data

       do not match those of the claimant - the postal address is the same but not the
       name and surname, in this case B.B.B.- nor the date of shipment, in this case
       case on 02/24/2020.

    to. The letter, dated 11/28/2018, that the respondent sent to the claimant in which
       acknowledges receipt of your request not to receive information of a commercial nature or

       publicity of the entity and that your data were not communicated to other
       entities, affiliates of the Bankia group or collaborators with the
       commercial (Annex 1). In it, the respondent informs the claimant that she has
       responded to your request and has proceeded to adopt the necessary measures for your
       compliance.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/48









       The following excerpt from the letter sent to the claimant is reproduced in
       response to your request not to receive commercial information:

       “In relation to your request for which you [the claimant], with D.N.I. [the one of
       claimant], you inform us of your desire not to receive information of a
       commercial or advertising of this Entity, as well as that your data is not
       communicated to other entities or investees of the Bankia group or
       collaborators, we inform you that we have complied with your request

       and we have proceeded to adopt the necessary measures for its compliance. "
       (The underlining is ours)

       The claimant also provided the AEPD together with the reply letter that
       received from the defendant a seven-page document with the anagram of the

       entity that has the heading "Personal Data Processing" "Information
       on the conditions for the processing of personal data (updated) ”.
       In the document they appear first, under the heading "Data of
       Customer identification ”, the personal data of the claimant. Later
       it is stated that "The personal data requested by [the complainant] will be processed
       in accordance with the following basic data protection information. " The

       "Basic report on data protection" is divided into several sections
       dedicated to the "Responsible"; "Purposes"; "Legitimation"; "Recipients";
       "Rights" and "Additional Information". In the "Purposes" section, it mentions,
       among others, the “Sending of commercial campaigns, communication of offers of
       products, services and promotions of both the [claimed] and third parties ”.

       In the “Legitimation” section, “the execution of the contract, the
       compliance with a legal obligation, consent of the interested party and the
       legitimate interest ”. Further on there is a section called “Sending of
       personalized commercial communications ”. Point 1.1. refers to
       “Personalized commercial communications through any channel (...)

       about products, services, promotions [...] based on your profile, prepared by
       from your personal data, the products you have contracted, as well as
       from the operations, movements, transactions associated with their
       products ”and is broken down into points 1.1.1, 1.1.2 and 1.1.3. In all of them
       appears as option "No".


SECOND: In view of the facts set forth in the claim, the Sub-Directorate
General Data Inspection, in accordance with the provisions of article 65 of the
Organic Law 3/2018, on Data Protection and Guarantees of Digital Rights
(LOPDGDD), in order to assess the admissibility of the claim, within the framework of the
File E / 3708/2020 and by means of a document signed on 06/03/2020, transmitting the

claim to the respondent so that within a month they provide an explanation of
the facts denounced, detail the measures adopted to avoid that in the future
continue to produce similar situations and proceed to communicate your decision to the
claimant.


The writing was notified to the claimed electronically. The certificate issued by the
Electronic Notifications and Authorized Electronic Address Service of the
FNMT-RCM (hereinafter, FNMT), which is in the file, records the
made available at the electronic headquarters on 06/03/2020 and the acceptance of the
notification on 06/06/2020.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/48









The respondent responds to the information request on 07/03/2020 and submits a report with
the actions carried out by the office of the data protection officer (DPD).

It states, first, that it has been verified that the claimant did not make a statement before the
claimed - neither before its management office, nor before the SAC nor before the DPD - any
claim for the reason on which the claim submitted to the AEPD is based.

Secondly, it affirms that the claimant exercised "the right to object" to the
receipt of commercial communications from the complained party on 11/04/2018,

by email addressed to the address protecciondatos@bankia.com,
the request being processed and answered on 11/21/2018 in writing that coincides with the
that the claimant attached as Annex 1 to his claim. It also indicates that the
Claimant has alleged that on 02/11/2020 "he received a communication" about the mortgage
without commissions and that you have provided a copy of said communication.


Regarding the nature of the "communication" that the complainant sent to the
claimant and the legality of the data processing carried out, makes these
considerations:

- “As can be seen from the documents provided by Mr. [complainant],

what the claimant refers to with "communication" is to send the cover page of
correspondence that the entity uses to send information by
physical correspondence to customers about their products (statements, movements,
commissions ...), which as can be seen from the two covers provided is the same
in its graphics for all customers with the only difference that it collects the data

of correspondence specific to each client. "

- “It is not, therefore, a personalized commercial communication or directed to the
claimant for his profile but for a generic and common cover for all clients,
similar to the posters that are exposed in the offices or their facades, and

general for all customers who receive their correspondence physically in format
paper."
- “And therefore, it must be understood that it is a shipment covered in the interest
legitimate of [?] as reported in the entity's privacy policy, at
be referred in a general way to products or services marketed by the
entity and similar to the products contracted by its clients (products

financial). " (The underlining is ours)

The defendant concludes with this statement: “no
personalized commercial communication by having exercised his right to
opposition to receiving this type of commercial communications ”. (The underline is

our)

The respondent sends the AEPD with her response a copy of the letter she sent to the
claimant, communicating the decision adopted in view of the facts reported in
your claim.


The Director of the AEPD, in accordance with the provisions of article 65 of the
LOPDGDD, on 07/13/2020 agrees to accept this claim for processing.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/48








The agreement for admission to processing was notified to the claimant by post the same
day of its signature and it is received on 07/21/2020.


THIRD: On 10/07/2020 the Director of the AEPD agrees to open a
sanctioning procedure to the claimed in accordance with the provisions of articles
63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure
of the Public Administrations (hereinafter, LPACAP), for the alleged infringement of the
Article 6.1.f) of Regulation (EU) 2016/679, of April 27, of the European Parliament and
of the Council, regarding the protection of natural persons with regard to

processing of personal data and the free circulation of these data and by which
repeals Directive 95/46 / EC (RGPD), typified in article 83.5.a) of the RGPD.

FOURTH: Notified the initiation agreement, the claimed one, by means of a document presented on
10/19/2020, requests that, in accordance with article 53.1.a) of the LPACAP, a

copy of the documents that make up the administrative file, and that,
In accordance with article 32.1 of the aforementioned LPACAP, the term is extended by five days
initially granted to formulate allegations.

FIFTH: In writing dated 10/23/2020 it is agreed to extend the term to formulate
allegations for the maximum legally allowed and the copy is sent to the claimed

of the electronic file.

That letter, together with the copy of the file, was notified to the defendant by means of
electronic being the date of availability on 10/23/2020 and the date of
acceptance on 10/26/2020. This is stated in the document "Confirmation of receipt

notification ”of the Citizen Folder application.

SIXTH: On 11/03/2020, the respondent presents her allegations to the agreement of
opening of the sanctioning procedure in which it requests that the nullity of
full law of the procedure for the reasons detailed in the first allegation

of your writing. Alternatively, it requests that the filing of the procedure be agreed
due to non-existence of infringement of the regulations on the protection of character data
personal. And, in the alternative with respect to the previous claims, which is
agree to warn the claimed (article 58.2.b, RGPD) or, failing that, reduce
significantly the amount of the fine provided for in the agreement to open the
procedure, in attention to what was stated in its fourth claim.


In defense of their respective claims, they adduce the following arguments:

The first allegation of his writing has the rubric “From the defenselessness produced to [the
claimed] as a result of setting the amount of the penalty in the agreement

Of start".

In short, it states that the opening agreement is invalid due to the
defenselessness generated by the fact that the amount of the penalty has been set in the agreement
initially, instead of expressing only the limits of the possible sanction; because they have not

motivated the aggravating factors and because through the initiation agreement a
assessment of their guilt without having had the opportunity to pronounce on it.
It adds that the initiation agreement exceeds the content provided for in Article 68 of the
LOPDGDD and that, having established the decision-making body the amount of the sanction in the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/48








agreement to open the procedure compromises the impartiality of the body
instructor, which determines in his opinion a “clear break with the principle of
separation of the investigation and sanction phase ”. Affirms that the rules of article 85 of

the LPACAP are not applicable to the present case but to the cases in which the
sanctioning norm imposes a fine of a fixed and objective nature and that the application
that has been made in the initiation agreement does not respect its literal wording, according to which the
amount of the pecuniary penalty may be determined "initiated the procedure
sanctioner ”,


In the second allegation, “Of the concurrent circumstances in the present case”, the
claimed makes a list of the facts of the file. In particular it relates the
following:

-On date 11/04/2018 the claimant directs a communication to the claimed

in which you exercise the right of opposition and request that they not be “used for
commercial communications of any kind "the data relating to your email,
telephone number and postal mail.
- On 11/21/2018 the respondent responds to the request to exercise the right to
opposition and informs you that in relation to “your desire not to receive information from
commercial or advertising nature of this Entity, as well as that your data is not

communicated to other entities or affiliates of the Bankia group or collaborators with
commercial purpose ”,“ your request has been complied with and [has] proceeded to
adopt the necessary measures for its compliance ”. (The underlining is ours)
-On 02/11/2020 the claimant receives a letter in his name from the claimed “in whose
cover page refers to certain credit products offered by [the

claimed] "
- The documentation provided by the claimant includes “another letter”, dated
02/24/2020, addressed to a person other than the claimant, "with similar graphics in
the cover of the envelope [...] ”.
- On 06/03/2020, the AEPD asks you to report the claim submitted.

He points out that the AEPD did not send him the claim but only the documents
attached to it. The respondent responds on 07/03/2020.

The third allegation of the brief of allegations has the heading “Of the inexistence of
any infringement of article 6.1. of the RGPD ”and in it he sets out the arguments
central defense.


It indicates that the AEPD attributes an infringement of article 6.1.f of the RGPD "for having
proceeded, in his opinion, to a data processing for marketing purposes without having
Sufficient legal basis for this, as the treatment cannot be protected in the interest
legitimate ”of the entity” (The underlining is ours)


Next, it warns that such an accusation is based on an error by the AEPD. Thus, it states
that the opening agreement makes a mistake by confusing the "existence of publicity
of [the claimed] on the cover included in the envelope addressed to the claimant "with" the
carrying out a treatment for direct marketing purposes ”.


He reiterates the same idea in the course of his third claim. He says, for example, that
AEPD confuses "direct marketing" with "data processing for the purposes of
direct marketing "," being so that they are two realities completely

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/48








differentiated "Or that" The AEPD incurs in an evident contradiction by confusing [...]
the existence of advertising with the performance of data processing with that
purpose ”, to specify below that, only in this second case,

The regulations governing the fundamental right to the protection of
personal data and the AEPD could exercise the powers that as an authority
control is entrusted.

The defendant says that "the remission of said envelope with the advertising inserted" is not the
“Result of data processing for advertising purposes. In the same way,

It would not be possible to consider that we would be faced with a data processing with
such purposes if only the name of the envelope had appeared on the face of the envelope.
commercial name of my client, even when the AEPD, forcing the concept
contained in the Initiation Agreement could come to consider the mere representation
of that logo as advertising. "


For the claimed, the personal data of the claimant was treated exclusively,
in order to inform you about the products that you had contracted with her.
In this regard, it indicates that the only treatment it has carried out in relation to the
claimant's personal data “has been the impression, on the same cover of the envelope
sent to all of its clients, of the Claimant's data, with the sole and

exclusive purpose of referring to the same information about the status of the products
and services contracted by the same with [the claimed entity] ”.

Also add:
“As can be seen, [the respondent] clearly distinguishes the treatments of

data necessary for the maintenance of the contractual relationship that links you with the
client, among which is the submission of documentation related to the
evolution of the products and services contracted (for example, an extract of
account, the situation of a contracted savings or credit product, etc.), protected
clearly in article 6.1 b) of the RGPD, and the sending of commercial communications

of own products or services or of third parties, covered, when carried out by
postal means in the legitimate interest of the Entity (article 6.1 f) of the RGPD). " (Folios
11 and 12 of the brief)

"In other words, [the complainant] did not process any of the data of the interested party with
the purpose of sending you information about its products, but only with the

to provide information related to those hired by the former, without the fact
that the cover of the envelope in which the information was sent implies treatment
any of your data for the purpose intended by the AEPD.
And it is that, in this sense, it does not deny [the claimed] that the information included in the
cover page can be considered advertising for the purposes provided in the rules that

mentions the Initiation Agreement, what cannot be considered is that the fact that
that information is included on the cover page implies data processing for the purposes of
direct marketing, which is what my client is charged with. " (Folio 12 of the brief of
allegations) (Emphasis added)


The respondent states that she is fully aware of the scope of the right
contemplated in article 21.2 of the RGPD and that it represents a counterweight to the
application of the rule of legitimate interest for the processing of data for the purposes of


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/48








direct marketing, but considers that this precept does not apply to the
present matter since the aforementioned treatment has not taken place.


It affirms, “in view of what is invoked by the AEPD in its Initiation Agreement, that it has not
carried out a data processing of the Claimant whose "reason for being", "objective"
or “ultimate intention” consists of carrying out direct marketing activities. He says
that “has proceeded to the treatment of the Claimant's data with the sole and exclusive
purpose of sending to it the information related to the evolution and situation of
the products and services contracted by the former, under the exclusive protection of the provisions

in article 6.1 b) of the RGPD, as this communication is necessary for the adequate
management and development of the contractual relationship that binds [the claimed] with its
customers. And it is that, as anticipated, the fact that the envelope in which this
information may imply the existence of publicity, common on the other hand to the
all the clients of [the complainant], but not a treatment of the data of those

clients with the "objective", "reason for being" or "ultimate intention" to carry out actions of
direct marketing." (The underlining is ours)

The document on privacy policy that the complainant has provided with her
allegations to the initiation agreement, informs in the section dedicated to the "conditions
of privacy ”in relation to the personal data of its clients that, without prejudice

of the special conditions established in relation to each product
hired by those, will be treated for six determined and specific purposes,
namely:

"1. Attend, manage and answer the queries, questions and requests made by

users through the channels of attention or communication enabled by
Bankia (Legitimation of the treatment: user consent).
2. Maintain, comply with and control the contractual and pre-contractual relationship between the
users and Bankia (Legitimation of the treatment: Execution of a contract).
3. Improve the web pages or tools owned by Bankia, as well as its

products and services, in order to offer better quality and service to the user,
develop new products / services or improve the internal processes of the entity
(Legitimation of the treatment: User consent (cookies) and Legitimate interest).
4. Send commercial communications about products and services, own or of
third parties (Legitimation of the treatment: User consent).
5. Carry out studies for statistical purposes that may be of interest to Bankia or

third parties (Legitimation of the treatment: Legitimate interest).
6. Comply with Bankia's legal obligations (Legitimation of the treatment:
Compliance with a legal obligation). " (The underlining is ours)

The fourth allegation of the brief of allegations deals with the circumstances

appreciated by the AEPD for the quantification of the sanction.

The defendant argues that the AEPD has violated the principle of proportionality in the
determination of the sanction, since the amount of the administrative fine established
in the initial agreement “it does not adjust to the assessment of mitigating and aggravating

that the agreement itself takes into consideration. "

In this regard, he explains that the initial agreement appreciated the concurrence of two
aggravating and mitigating and set a fine of 50,000 euros when, it says

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/48








that is the amount that the AEPD usually imposes as a penalty for violation
of article 6.1 RGPD in cases that “do not deserve a sanctioning reproach
especially high ”and when, unlike what happens in this case, the

Resolutions imposing a fine of such an amount usually appreciate the
concurrence of multiple aggravating factors and do not usually appreciate the concurrence of any
extenuating.

The respondent makes a comparison between the modifying circumstances of the
responsibility that the AEPD appreciated in the resolution issued in PS / 00076/2020,

also followed against her, and those that appear in the agreement to open the
procedure, and notices two differences: That the resolution of PS / 00076/2020 does not
the circumstance was taken into consideration, which is seen in this case as
aggravating, of the link of the activity that the entity carries out with the treatment of
Personal data. That the aforementioned resolution clarified that the lack of

diligence of the claimed was "significant", which, he explains, is not indicated in the
present case. We anticipate since, as can be seen with the reading of the
agreement to initiate the file, the expression “The serious lack of diligence
[...] ”.

It also argues that, given that in this case the concurrence of

a mitigating factor, it is striking that the penalty is the same -50,000 euros- as in the
PS / 0076/2020. Considerations that in his opinion are an exponent of the one invoked
violation of the principle of proportionality.

SEVENTH: The agreement to initiate the procedure, in point 3 of the operative part,

agreed to “INCORPORATE to the sanctioning file, for evidentiary purposes, the
claim filed by the claimant and its attached documentation, as well as the
documents obtained and generated by the General Sub-Directorate of Inspection of
Data during the phase prior to the admission for processing of the claim. "


Through diligence of the instructor dated 06/14/2021, a record was made for the purposes of
proof that, by virtue of what was agreed by the Director of the AEPD in the agreement
of the opening of the procedure, the claim
submitted and its attached documentation, as well as the documentation generated and
obtained by the General Subdirectorate for Data Inspection within the framework of the
E / 03708/2020, in the information application process prior to admission for processing of the

claim.

EIGHTH: The resolution proposal is signed by the instructor of the procedure in
date 06/16/2021 and on that same date it is notified electronically by contacting
disposition of the claimed. The notification was accepted on 06/15/2021. Both of them

extremes are accredited through the certificate of the FNMT that works in the
proceedings.

The resolution proposal was formulated in the following terms:


<< FIRST: That the Director of the Spanish Data Protection Agency
sanction BANKIA, S.A., with NIF A14010342, for a violation of article 6.1.f)
of the RGPD, typified in article 83.5.a of the RGPD, with an administrative fine of
€ 50,000 (fifty thousand euros)

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/48








SECOND: That the Director of the Spanish Agency for Data Protection
order BANKIA, S.A., with NIF A14010342, for a violation of article 6.1.f) of the
RGPD, typified in article 83.5.a of the RGPD, which it adopts, within the maximum period of

one month, the measures necessary to adjust your treatment operations to the
provisions of the GDPR; in such a way as to put an end to data processing
personal data for direct marketing purposes with respect to those customers who
would have opposed the processing of their data for this purpose. >>

NINTH: On 06/25/2021 a letter from

CAIXABANK, S.A., in which you communicate the subrogation, in this procedure
sanctioner, in the legal position of BANKIA, S.A., by virtue of the merger by
absorption agreed between it, as the absorbing company, and BANKIA, S.A., in its capacity
of absorbed company.


In the same letter, he requests that it be extended, by the maximum legally allowed, 5 days,
the period initially granted to formulate allegations to the resolution proposal.
The letter sent by the respondent was accessible in the computer application on
Monday 06/28/2021, last day of the period initially granted to present
allegations to the proposed resolution. In writing of the same date addressed to the
claimed, the request for extension of the allegations period is denied.


TENTH: The complained party -before BANKIA, S.A., now CAIXABANK, S.A.- presents its
allegations to the proposed resolution on 06/28/2021. Request in them that
declare the nullity of full law of the sanctioning procedure for the reasons
which you describe in your first claim. Alternatively, it requests that the

file of the procedure “as it did not constitute the conduct of BANKIA (currently
CAIXABANK) any infringement of the personal data protection regulations. " Y,
subsidiarily with respect to the previous requests, that it be warned in accordance with the
article 58.2.b) of the RGPD, or, failing that, the amount is significantly reduced
of the sanction of an administrative fine in response to the arguments presented in its

fourth claim.

Adduces the following reasoning in defense of their respective claims:

-As a preliminary, in addition to verifying that on 06/14/2021 you were notified
the resolution proposal, reiterates the statements made in its brief of

allegations to the commencement agreement, presented on 11/03/2020, “since, to our
It seems that the content of the Proposed Resolution does not in any way refute what
indicated in the aforementioned allegations ”.

-The first claim has the heading "On setting the amount of the penalty in

the initiation agreement. "

This allegation is, in essence, identical to that made in the pleadings brief to the
agreement to initiate the procedure. In it he reiterates the "manifest defenselessness" that
has generated as a consequence of the AEPD having set the amount of the

sanction in the agreement to open the file.

The defenselessness that he claims to have suffered is based, in his opinion, on the fact that the AEPD “has
proceeded to assess the degree of guilt of my client and the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/48








circumstances that affect it, [...] in audita parte, without my client having
had the possibility of making any allegation or making the slightest proof in
defense of their right, thus seriously impairing their right to

defense ”and that such assessment was made by the competent body to resolve,
which supposes an interference of the sanctioning body in the inspection action and
"A dilution between the investigation and resolution phases of this proceeding
sanctioner, with the consequent damage to my client. "

The defendant maintains that the "manifest defenselessness" suffered occurs when

“Dispense with the guarantees granted by the regulations governing the procedure
sanctioner ”and the bankruptcy of the“ right to effective judicial protection ”, all of which provokes
a defect of absolute nullity of article 47.1.a) of the LPACAP by having injured the
rights and freedoms subject to constitutional protection


He then proceeds to make the following comments that he makes in relation to
some of the statements contained in the proposed resolution:
It affirms that the proposal indicates “that the evaluation in audita part of the circumstances
concurrent in the case and, consequently, the determination by the body
competent to sanction the amount of the sanction proceeding prior to the
instruction of the matter derived directly and immediately from what was established in the

Article 64 of Law 39/2015 [...], although, below, there is a manifest
contradiction, by stating, as is done in the Resolution, that the action of the
AEPD "goes beyond" what is provided in the standard. "
That “the AEPD indicates in the Proposal that the setting of the amount of the sanction that
would proceed to impose the insert is a requirement of the provisions of the Law, but at the

At the same time, it considers that it is not, since it seems to indicate that, in a
completely gratifying and beneficial for the insert, the AEPD has decided to "go more
over there ”of what is established in the norm, granting a kind of benefit to the managed,
even when this is at the cost of undermining the rights enshrined in article
24 of the Constitution. "


Likewise, based on the particular interpretation that the complainant has been making
of article 85 of the LPACAP, affirms that "the literality of the norm" does not imply a
empowerment of the sanctioning body to prejudge the case, proposing ab initio the
amount of the sanction, “since with this the most elementary
principles of the sanctioning procedure ”.


It insists that article 85.1 of the LPACAP “does not require a prior determination of the
sanction, since it refers to the “imposition of the appropriate sanction”; that the norm is
applicable, in any case, "the procedure started." It adds that article 85.3. foresees
that the reductions should be adopted on the “proposed” sanction, of which

concludes that it is necessary to have determined what that amount is within the
procedure, after hearing the company, since the initiation agreement “is not the
an ideal place to “propose” the imposition of a penalty ”.

Taking as a starting point the considerations that were made in the proposal

of resolution about what could be the circumstance of article 47.1. of the
LPACAP in which the defendant intended to substantiate the nullity of the procedure
invoked, makes the following comments that, due to their importance -every time


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/48








differ substantially from what this Agency stated in the proposal for
resolution-, deserve to be reproduced:
"[...] from the foregoing it can be inferred that the legislator has not appreciated the

administrative sanctioning procedure the necessary separation of the phases of
instruction and resolution and the necessary intervention in them by two bodies
different, without the sanctioning body being able to intervene or "direct", as it has
happened in this case, the independent action of the investigating body.
 "And to greater surprise, the Proposal for Resolution not only considers that the aforementioned
The principle of separation of the phases of investigation and resolution is not predicable

sanctioning procedure, thus contradicting what is expressly established in the
LPACAP and recalled by very reiterated jurisprudence of the Constitutional Court (for
all in STC 9/2018, of February 5), but also affirms without any qualms
that the principle “according to which the instructing person does not resolve, is not applicable to
administrative procedure ”, based on an alleged jurisprudence

constitutional law that has nothing to do with such a conclusion. "

Regarding the aforementioned SSTC it says: “Without wishing to expand on this point,
It is enough to make a mere reference to the jurisprudence invoked to determine without the
slightest hint of doubt, its utter irrelevance:
“In effect, STC 175/2005 that invokes the Proposal does not even relate to

any with the fundamental right enshrined in article 24 of the Constitution,
but with the principle of equality enshrined in its article 14. "
“For its part, STC 74/2004 does refer to the right to effective judicial protection,
but as for the non-application to the administrative procedure of the right to the judge
standard predetermined by law, which is also not related to what

analyzed in this procedure. "

-The second claim has the heading "Of the legality of the conduct of Bankia
(currently Caixabank) and the non-existence of infringement of article 6.1 of the RGPD ”.


The defendant reaches the conclusion, announced in the title of this section, that in
In the matter that concerns us, there has been no processing of personal data for the
direct marketing for which “it is useless to go to article 6.1 of the RGPD
to assess whether said non-treatment has a sufficient legal basis, and therefore
In order to appreciate that there has been a violation of any of the sections of
the rule".


In short, the complained party considers that the data processing carried out was carried out
within the framework of the contractual relationship that bound the claimant and claimed whose
The purpose was to provide you with information related to the status of the products.
contracted, for which he maintains that “the fact that the cover of the envelope in which

produces the aforementioned referral, include information regarding marketed products
by the entity, without having carried out treatment activity linked to the
Determination of the content of said document cannot in any case imply the
existence of a specific treatment aimed at carrying out actions of
direct marketing, but the mere adoption of a business decision about the

format of the envelopes addressed to the entity's clients ”. (The underlining is from
AEPD)



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/48








In the course of the second allegation, the defendant details the various elements on
those who build their conclusion.


It begins by stating that the proposed resolution considers that it “has led to
carry out a treatment of the Claimant's data for direct marketing purposes ”and
that, the proposal also considers that "the mere fact of printing the data
Claimant's contact details on the face of an envelope that, in a predefined format
incorporates information about my client's products, implies the use and
data processing for the aforementioned purpose. "


He insists that the proposal considers that, the mere fact that the cover contains
the information on the aforementioned product is sufficient to appreciate the existence of "a
personalized delivery "to the claimant" in order to promote the acquisition of the
mentioned product of the entity ”; although “[...] it did not involve carrying out a

previous action by Bankia to determine whether said advertising
it may or may not correspond to the preferences of the interested party ”.

It also states that the "proposal considers" that the fact of having sent it the letter
to the claimant, which contains the contact information to which it is addressed “implies the
carrying out two processing of personal data: one related to the development

of the contractual relationship and the other derived from the pure and simple fact that the cover
of the envelope incorporates the aforementioned information ”. As a counterpoint he exposes what his
position: that there was and carried out “a single data processing and with the only and
exclusive purpose of sending the claimant the extracts of the contracted products,
treatment protected therefore in article 6.1.b, of the RGPD. "


It endorses this last statement by saying that under no circumstances could it be qualified
of data processing of the interested party, in the terms in which it is defined in the article
4.2 of the RGPD (precept that transcribes in its brief of allegations), the fact of
have incorporated in the cover of the envelope “information about the entity and even

of the products and services that it commercializes ”.

In order to argue that there was no data processing for marketing purposes
direct exposes the following:
That, even on the hypothesis that he admitted that “the inclusion on the cover of a
about the aforementioned information could be considered direct marketing ”- which

on the other hand, it flatly denies-, which "in no way can prove ... the AEPD
is that a treatment of the data of the related interested party has been carried out
in order to send you advertising, neither general nor specific. " (The
underlined is ours)


That, as it stated in its allegations to the opening agreement, “it does not deny that the
information contained in the cover of the envelope may be considered advertising of the
entity, but what it does deny and reiterate is that there has been data processing
for direct marketing purposes carried out without having a legal basis for it
as a consequence of the exercise by the interested party of their right of opposition ”.


He adds that “The decision about the format of the envelopes in which an entity
private incorporates its documentation is a mere business decision, which in
Some may involve a processing of personal data, since it does not imply the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/48








performance of any of the operations included in the aforementioned
concept."


“[...] as also indicated in the allegations of my client to the Agreement of
Start, the inclusion of information about a certain product of my client
On the cover of the envelope to which the aforementioned communication is addressed, you can
be considered an advertising activity, but not a direct marketing action
[...] "And he goes on to say:" That action [of direct marketing] would occur if the
content, that not the "container" of the communication sent to the interested party contained

information related to a product of the entity, but not in those cases where
which is the envelope, which will be accessible by an indeterminate plurality of people
Throughout the process of processing and forwarding the communication, it contains said
information."


“[...] for the AEPD it seems that only the recipient of the communication will have
an effective knowledge of the advertising message contained in the cover of the envelope
sent, and, consequently, will be the sole recipient of the aforementioned message,
the envelope remaining hidden from the other operators, which makes its
referral in a direct marketing action. " And he adds that, “even in the denied
assuming that it is considered that only the recipient will have access to the

aforementioned message ”, this does not imply that a treatment has been carried out for the purpose of
direct marketing because it will not have been carried out with the personal data of the
interested in any of the processing operations referred to in the article
4.2 of the GDPR. "


The defendant also states that the AEPD, having appreciated an infringement of the
RGPD in the facts that are the object of the claim, has “artificially expanded its
competences "" to the point of considering subject to their supervision "" decisions
companies not involved in any data processing ”.


It also mentions Law 34/2002, of July 11, on services of the society of
information and electronic commerce (LSSI) and the concept of communication
commercial that the law offers to, then, raise a factual assumption: that,
Within the framework of the activity regulated by the LSSI, a banner would have been included in the
to be informed of a new product. Whereupon he says the following:
"Well, following the reasoning of the AEPD, the mere inclusion of a banner

generic and undirected, after carrying out a segmentation or profiling activity,
to each client of the entity would suppose a data treatment of each and every one of
clients with access to the private area in order to direct them a communication
commercial, consisting of the advertising of the mentioned product ”. "In this way,
any entity would be obliged or to implement complex processes of

delimitation of clients in whose personal area the aforementioned
banner or to establish two or more personal areas differences (with or without banner)
[...] ”(Emphasis is ours)

-Third argument, “On the application of the measure contained in article 58.2.d)

of the RGPD ”.

The respondent states that the corrective measure proposed in the second device
of the proposed resolution “it is impossible to apply, since the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/48








extinction of the personality of the entity against which the AEPD intends to direct
measure". It adds that such a measure "would no longer be applicable", since as
consequence of the disappearance of the legal entity (BANKIA) has ceased in the

all the processing of personal data.

- Fourth argument: "On the circumstances appreciated by the AEPD in the conduct
of BANKIA ”.

The defendant denounces “the irrelevance of the circumstances for the AEPD

concurrent in a specific case, as well as the predetermination of the sanction for
part of it that does not result from the application of the aforementioned circumstances. " Add
that the Agency, in determining the amount of the penalty, proceeds “with a
sort of automatism that generally leads to imposing sanctions of
identical amount in cases that cannot be related to each other, always

that considers that the seriousness of the event reaches a predetermined threshold ... "

Regarding the aggravating factor, appreciated in the proposed resolution, of article 83.2.a)
RGPD, criticizes that it was qualified as mitigating in the initial agreement and that in the
motion for a resolution occurs such a change.


Regarding the aggravating circumstance of article 83.2.b) draws attention to the
fact that the proposed resolution refers, to support this circumstance
aggravating, because “it can be presumed that in their activity the treatment of
data for direct marketing purposes and the cases in which customers are
they oppose for that purpose ”. It affirms that we are facing a presumption lacking

supporting evidence that violates the right to the presumption of innocence.

Regarding the aggravating circumstance of article 83.2.e) RGPD, it criticizes, on the one hand, that
appraise on the basis of the citation a single sanctioning procedure directed against the
claimed and related to facts that are not related to those that are

object of the current sanctioning file, with the aggravating circumstance that the mention of the
PS / 0076/2020 has been included in the motion for a resolution as a result of the fact that it had
quoted the claimed in the exercise of her right of defense in her brief of
allegations to the initiation agreement. On the other hand, it affirms that the AEPD acts in a
arbitrary, since, in general, it does not make use of this
aggravating circumstance, except when the entity has been “sanctioned in a

repeated and habitual ”and mentions as an example the procedure PS / 00030/2021.
Thus, it considers that, when assessing this circumstance, a
situation of prejudice and discrimination for the entity, especially when the resolution to
the one referred to (PS / 00076/2020) in the motion for a resolution is the only one issued
against the one claimed since the entry into force of the RGPD.


Regarding the mitigating effect of article 83.2.k) RGDP in relation to article 76.2. and)
of the LOPDGDD, considers it irrelevant since its application has not led
to modify the amount of the fine sanction provided for in the proposal regarding the
which was set in the initiation agreement. All of which leads him to reiterate his opinion about

the "absolute arbitrariness in the assessment of the circumstances of the case."

Within this fourth allegation, a section is dedicated to justifying the origin of
that an economic sanction (administrative fine) is not imposed. Start your

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 15/48








pleading saying that already in the initial agreement he recalled that the AEPD has, in accordance with
of article 58.2 of the RGPD, “of a great plurality of powers other than the
imposition of an economic sanction ”. Criticizes that the proposed resolution, in the face of

his claim that a warning be imposed, has limited himself to transcribing the
Recital 148 of the RGPD since the aforementioned recital takes into consideration
only two elements: that we are faced with a minor infraction and that the
The fine that should be imposed would constitute a disproportionate burden on the
natural person, for which, says the claimed, although the latter is not applicable
condition, if in his opinion the condition of the lightness of the infraction of which

you are held accountable. Add to this effect that the lightness to which the RGPD refers
It has nothing to do with the classification that the LOPDGDD makes of the infractions in
mild, serious and very serious - because this rule that is after the RGDPD-. Thus, it indicates
that “When recital 148 refers to the seriousness or lightness of the
sanction refers to the cases in which a commitment has or has not been made

particularly relevant to the fundamental right to data protection [...] ”.
For this purpose, it mentions document WP253 of the Article 29 Working Group,
“Guidelines on the application and setting of administrative fines for the purposes of
Regulation 2016/679 ”from which it transcribes the following:

      “In recital 148 the notion of 'minor infringements' is introduced. Said

      Violations may constitute violations of one or more provisions of the
      Regulation cited in article 83, paragraphs 4 or 5. However, the
      evaluation of the criteria provided for in article 83, paragraph 2, may give
      place to which the supervisory authority considers, for example, that in the circumstances
      specific circumstances of the case, the violation does not pose a significant risk to

      rights of the interested parties and does not affect the essence of the obligation in
      question. In such cases, the fine may be replaced (although not always) by
      a warning. "
      (The underlining is ours)


He completes his argument by pointing out that in this case “there is only one
singular claim ”. "That is, only one person among those who have opposed the
processing of your data for direct marketing purposes has reached the
conclusion, which that Agency seems to share, that the adoption of a
standard cover of the envelope in which the information on the evolution of the
the products contracted with my client supposes an additional treatment of their

personal data for direct marketing purposes. " And that "the damage that could
cause such conduct to the recipients of the shipments, we reiterate that only
related to the evolution of the contracted products is simply
non-existent".



In view of all the actions, by the Spanish Agency for Data Protection
the following are considered proven in this procedure

                                       FACTS


1. The claimant, client of the claimed claim, received by mail
postcard, a letter with information about your accounts that also included information
entity's business.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 16/48









2. The document with commercial information received by the claimant, which provides
a copy, bears the date “11.02.2020” in its lower right corner and has these

features:
At the bottom right are the personal data of the claimant -name, two
surname and full postal address - and below a barcode. The position in the
that the personal data are located in that document coincides with the one that occupies
the window or transparent space of a type of envelope that is commonly used in
the postal mail and that allows you to see the recipient's data printed inside the envelope.

In the upper right corner of the document is the anagram of the claimed with
your name. This legend appears in the body of the document:

 “It takes a lot to find the house of your dreams. Therefore, WE REMOVE YOUR
COMMISSIONS FROM YOUR NEW MORTGAGE. Just by having your payroll domiciled and

nothing more. We take away the commissions from: ”Next, in two columns
parallel, figure: "OPENING"; "EARLY AMORTIZATION"; "CANCELLATION
IN ADVANCE ”; "POST COSTS". Immediately below it is indicated: “So that
dreaming costs less. * Check conditions at Bankia or bankia.es branches ”.

3. On 11/04/2018 the claimant sent an email addressed to

protecciondedatos@bankia.es, in which he communicated to the respondent his wish to "no
receive information of a commercial or advertising nature ”. This is recognized by the entity
claimed in its allegations to the initiation agreement.

The respondent responded to her request by means of a letter dated 11/21/2018 -which works

in the file - in which he replied:
“In relation to your request for which you [the claimant], with D.N.I. [the one of
claimant], you inform us of your desire not to receive information of a commercial or
advertising of this Entity, as well as that your data is not communicated to other
entities or investees of the Bankia group or collaborators, we inform you that we have

Fully attended to your request and we have proceeded to adopt the measures
necessary for its fulfillment. " (The underlining is ours)

4. The DPD of the respondent responded to the request for information from the Sub-Directorate
General of Data Inspection, prior to the admission for processing of the claim, which
“No personalized commercial communication has been addressed to the claimant at

have exercised his right of opposition to receive this type of
communications. " (The underlining is ours)

5. Regarding the commercial information sent to the complainant, the DPD responded to the

informative request from the Subdirectorate General for Data Inspection that "I do not know
It is a [...] personalized commercial communication or directed to the claimant by
your profile but a generic and common cover for all customers, [...]. "

 6. Regarding the legal basis for this treatment, the DPD responded to the request

information made by the General Subdirectorate of Data Inspection:
"It must be understood that it is a shipment protected in the legitimate interest of [?] Such
and as reported in the entity's privacy policy, being referred to with
general character to products or services marketed by the entity and similar to


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 17/48








the products contracted by its clients (financial products). " (The underline is
our)


7. The respondent has stated in her brief of allegations (folios 11 and 12 of the
written):

 “As can be seen, [the respondent] clearly distinguishes the treatments of
data necessary for the maintenance of the contractual relationship that links you with the
client, among which is the submission of documentation related to the

evolution of the products and services contracted (for example, an extract of
account, the situation of a contracted savings or credit product, etc.), protected
clearly in article 6.1 b) of the RGPD, and the sending of commercial communications
of own products or services or of third parties, covered, when carried out by
postal means in the legitimate interest of the Entity (article 6.1 f) of the RGPD). " (The

underlined is ours)

8. The privacy policy of the complained party that appears in the document attached to the
allegations to the initiation agreement informs that the personal data of the clients is
will treat, without prejudice to the special conditions established in relation to
with each product contracted by them, for six determined purposes and

specific and, for each of them, specify what is the legal basis of the treatment:

"1. Attend, manage and answer the queries, questions and requests made by
users through the channels of attention or communication enabled by
Bankia (Legitimation of the treatment: user consent).

2. Maintain, comply with and control the contractual and pre-contractual relationship between the
users and Bankia (Legitimation of the treatment: Execution of a contract).
3. Improve the web pages or tools owned by Bankia, as well as its
products and services, in order to offer better quality and service to the user,
develop new products / services or improve the internal processes of the entity

(Legitimation of the treatment: User consent (cookies) and Legitimate interest).
4. Send commercial communications about products and services, own or of
third parties (Legitimation of the treatment: User consent).
5. Carry out studies for statistical purposes that may be of interest to Bankia or
third parties (Legitimation of the treatment: Legitimate interest).
6. Comply with Bankia's legal obligations (Legitimation of the treatment:

Compliance with a legal obligation). " (The underlining is ours)


                            FOUNDATIONS OF LAW


                                             I

The Director of the Spanish Agency is competent to resolve this procedure
of Data Protection, in accordance with the provisions of article 58.2 of the RGPD
and in articles 47 and 48.1 of the LOPDGDD.


                                            II



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 18/48








For reasons of argumentative logic, the questions that
the respondent has stated in her two pleadings and that they are unrelated to the
Merits of the matter on which the sanctioning procedure at hand is concerned.


In its allegations to the proposed resolution, the one claimed, in addition to stating
that "reiterates" in full the allegations that he made against the agreement to open the
procedure, affects again the issues, unrelated to the merits of the matter, which
already raised in his first brief of allegations.


This Agency also reiterates what it stated in the motion for a resolution in
response to the allegations made by the respondent regarding the initial agreement.
Answer that we reproduce:

      << In the opinion of the claimed, the opening agreement is flawed

      nullity due to the defenselessness generated by the fact that the AEPD has
      set in it the amount of the sanction, instead of expressing only the limits of the
      possible sanction; because the aggravating factors have not been motivated and because through
      starting agreement an assessment of the guilt of the claimed is made without
      who has had occasion to pronounce on the matter. He also adds that the
      initiation agreement exceeds the content provided for in article 68 of the

      LOPDGDD and that, having established the decision-making body the amount of the sanction in the
      agreement to open the procedure, the
      impartiality of the investigating body, which thus knows, before starting the
      procedure, the criterion of the body to which the file must be submitted, which
      determines in his opinion a “clear breakdown of the principle of phase separation

      instructor and sanction ”.

      The complainant understands that the rules of article 85 of the LPACAP are not
      applicable to the present case but to the cases in which the norm
      sanctioning entity imposes a fine of a fixed and objective nature and that the application that

      This precept has been made in the initiation agreement does not respect its literal wording,
      according to which the amount of the pecuniary sanction may be determined “beginning on
      sanctioning procedure ”, for which, the entity maintains,“ it would be
      assimilating "" the act of initiation itself with the fact that the procedure is
      find started ”.


      The arguments put forward by the defendant cannot be admitted.

      The opening agreement complies with the provisions of article 68 of the LOPDGDD,
      according to which it will be enough to specify the facts that motivate the opening,
      the person or entity against whom the procedure is directed is identified, the

      infraction that could have been committed and its possible sanction. In the same sense
      Article 64.2 of the LPACAP is expressed, which refers to the minimum content
      of the initiation agreement. According to this precept, among other details, you must
      contain “the facts that motivate the initiation of the procedure, its possible
      legal qualification and the penalties that may correspond, without prejudice to

      what results from the instruction ”. Therefore, in this case, not only the
      requirements mentioned in the cited precepts, but goes further,
      offering reasons that justify the possible legal qualification of the


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 19/48








      facts and the circumstances that may influence the determination are mentioned
      of the sanction.


      It cannot be ignored that article 85 of the LPACAP - which contemplates the
      possibility of applying reductions on the amount of the sanction in the case of
      that the offender recognizes his responsibility and in case of voluntary payment of the
      Sanction- requires determining those reductions in the notification of the
      initiation of the procedure, which necessarily implies that it should be fixed
      said agreement the amount of the sanction corresponding to the imputed facts.

      An extreme that amply justifies that the circumstances refer to it
      modifying responsibility, since these directly affect the
      determination of the amount of the sanction.

      Contrary to the thesis defended by the complainant, article 85 of the LPACAP does not

      Nor does it foresee that the amount of the sanction is determined once the
      process. On the contrary, it is the recognition of responsibility and
      voluntary payment of the penalty, which must occur after that
      moment, but not the fixation of its amount.

      Regarding the opinion of the respondent according to which article 85 LPACAP

      it could only be applied to cases in which the sanctioning norm
      imposes a fine of a fixed and objective nature and that the application that has been made
      of this precept in the commencement agreement does not respect its literal wording, it must be
      indicate that the AEPD has been applying article 85 LPACAP in the same way since
      the entry into force of the aforementioned law without the Litigation Chamber

      Administrative of the National Court, before which there is a contentious appeal
      administrative authority against its resolutions, has never ruled online
      with the criteria that that entity defends.

      Nor can it be admitted that having indicated in the commencement agreement the

      sanctions that could correspond to the one claimed for the infractions
      accused is a determinant of defenselessness or represents a break with the principle
      of separation of the investigation and resolution phases, as this Agency is
      limits to comply with it to one of the requirements set forth in the
      standards outlined. For greater abundance, also articles 68 of the
      LOPDGDD and 64.2 of the LPACAP require as content of the opening agreement

      that the corresponding sanction be fixed.

      Thus, the alleged rupture "of the principle of separation of the instructional phase
      and of sanction ”that the claimed -extreme that this Agency denies- would be,
      if there is, the consequence of the correct application that this Agency comes

      making of a legal precept, article 85 of the LPACAP.

      Regarding what was stated by the respondent that, having established the agreement of
      opening the amount of the sanction and the modifying circumstances of the
      responsibility that could be appreciated, she has not had a chance to

      pronounce itself, we limit ourselves to pointing out that the administrative procedure is
      begins precisely with the opening agreement and it is from then on -no
      before- when article 53 of the LPACAP recognizes the interested party a series of
      rights, including that provided for in article 53.1.e).

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 20/48









      Finally, as regards the vice of nullity of which, in the opinion of the
      claimed, the procedure suffers as a consequence of the defenselessness that

      claims to have suffered, it is worth noting the following: First, the respondent does not
      specifies in which section of article 47.1 of the LPACAP grounds the nullity that
      invokes.

      Second, the invoked nullity of the procedure in no case
      It could be based on section a) of article 47.1. of the LPACAP, in connection

      with the supposed rupture of the separation between the instructional phase and the resolution phase
      Pursuant to article 24.2 of the C.E. This, because according to the SSTC
      74/2004 and 175/2005, the principle enshrined in article 24.2 of the C.E. to tenor
      of which the instructing party does not resolve, it is not applicable to the procedure
      administrative, so that in this area we are not facing a right with

      constitutional rank.

      And finally, thirdly, in the event that it is intended to found the nullity
      of the procedure in the reason included in section e) of article 47.1 of the
      LPACAP seems convenient to bring up STC 78/1999, of April 26,
      that in its Legal Basis 2, it says:

      “Thus, according to reiterated constitutional doctrine that is synthesized in the
      legal basis 3 of STC 62/1998, "the estimate of a resource of
      protection for the existence of infractions of the procedural norms' is not
      simply of the appreciation of the eventual violation of the right by the
      existence of a more or less serious procedural defect, but it is necessary

      certify the effective concurrence of a state of material or real defenselessness'
      (STC 126/1991, 5th legal basis; STC 290/1993, 4th legal basis).
      So that a defenselessness with constitutional relevance can be considered, that
      places the interested party outside any possibility of alleging and defending in the
      process their rights, a merely formal violation is not enough, being

      It is necessary that from this formal infringement a material effect of
      defenselessness, an effective and real impairment of the right of defense (STC
      149/1998, legal basis 3), with the consequent real and effective damage
      for affected stakeholders (SSTC 155/1988, 4th legal basis, and
      112/1989, legal basis 2) ".


      In view of the foregoing, the petitioner's request that the claim be declared
      Invalidity of the administrative sanctioning procedure that concerns us must be
      rejected. >>
      (The underlining is ours)


In view of the allegations to the proposed resolution that the complainant has
presented, it is evident that the response of the AEPD, transcribed above, not only has not
cleared the doubts raised by the application that this organization has been doing
of article 85 of the LPACAP since the entry into force of the aforementioned Law, but has
took advantage of the occasion to distort some of the arguments that were then

exhibited.

The alleged nullity of the administrative procedure that the complainant invokes -that,
as he has seen fit to specify in this brief of allegations to the proposal, it would be

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 21/48








protected in section a) of article 47.1 of the LPACAP- derives in his opinion from the
application that the AEPD makes of article 85 LPACAP, having set the amount of the
sanction in the opening agreement.


From the extensive exposition that he has devoted to issues unrelated to the merits of the matter
that concerns us - first allegation of the brief of allegations to the proposal, which is
reproduces essentially in the tenth Antecedent of this resolution - the most
striking, and which requires making the necessary clarifications, is the attribution to the
AEPD of statements that it has never made and also the attribution to this Agency

conclusions that cannot be drawn from what is stated in the proposal brief.
This peculiar way of exercising the legitimate and sacred right of defense leads to the
paradoxical situation in which the defendant dedicates a large part of its efforts
arguments to refute claims that this Agency never made and to distort
conclusions reached by the respondent on her own, since they cannot be derived from

what is stated in the proposed resolution always, of course, that the reader does not have
a particular interest in distorting what is written there.

The claimed, taking as a starting point the examination made by the
resolution of the consequences of founding the invoked nullity of the procedure in
one or another circumstance of article 47.1 LAPAC -as long as the claimed does not

specified in his allegations to the initial agreement what was in his understanding the vice of
radical nullity that concurred, limiting itself to affirming that the procedure was
vitiated of nullity- makes the following comments that, due to their importance, deserve
be reproduced:


"[...] from the foregoing it can be inferred that the legislator has not appreciated the
administrative sanctioning procedure the necessary separation of the phases of
instruction and resolution and the necessary intervention in them by two bodies
different, without the sanctioning body being able to intervene or "direct", as it has
happened in this case, the independent action of the investigating body.


 "And to greater surprise, the Proposal for Resolution not only considers that the aforementioned
The principle of separation of the phases of investigation and resolution is not predicable
sanctioning procedure, thus contradicting what is expressly established in the
LPACAP and recalled by very reiterated jurisprudence of the Constitutional Court (for
all in STC 9/2018, of February 5), but also affirms without any qualms

that the principle “according to which the instructing person does not resolve, is not applicable to
administrative procedure ”, based on an alleged jurisprudence
constitutional law that has nothing to do with such a conclusion. " (The underline
it's ours)


Regarding the aforementioned SSTC, the complainant adds: “Without wishing to extend
At this point, it is enough to make a mere reference to the jurisprudence invoked to
determine without the slightest hint of doubt, its absolute irrelevance: ”(The underlined
is ours) "In effect, STC 175/2005 invoking the Proposal does not even save
any relationship with the fundamental right enshrined in article 24 of the

Constitution, but with the principle of equality enshrined in its article 14. " "For his
part, STC 74/2004 does refer to the right to effective judicial protection, but
Regarding the non-application to the administrative procedure of the right to the judge


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 22/48








standard predetermined by law, which is also not related to what
analyzed in this procedure. "


Well, these allegations make it essential to reproduce again, even at the risk of
be repetitive, the following excerpts from the motion for a resolution:

      “Finally, as regards the vice of nullity of which, in the opinion of the
      claimed, the procedure suffers as a consequence of the defenselessness that
      claims to have suffered, it is worth noting the following: First, the respondent does not

      specifies in which section of article 47.1 of the LPACAP grounds the nullity that
      invokes.
      Second, the invoked nullity of the procedure in no case
      It could be based on section a) of article 47.1. of the LPACAP, in connection
      with the supposed rupture of the separation between the instructional phase and the resolution phase

      Pursuant to article 24.2 of the C.E. This, because according to the SSTC
      74/2004 and 175/2005, the principle enshrined in article 24.2 of the C.E. to tenor
      of which the instructing party does not resolve, it is not applicable to the procedure
      administrative, so that in this area we are not facing a right with
      constitutional rank. "


It seems clear that what this Agency refers to in that paragraph is that in the
administrative procedure the guarantee of separation between the investigative phase and
resolution does not have constitutional rank, but rather its rank is that of legality
ordinary - guarantee expressly included in article 63.1 of the LPACAP and
indirectly in article 53.2.a, of the LPACAP; Article 134.2 of the repealed Law

30/1992 and 10.1 of the Rules of Procedure of the sanctioning power,
also repealed-.

The argument put forward was that it could hardly be covered by section a) of the
Article 47.1 of the LPACAP, for violation of the principle of phase separation

investigating and resolutory, the nullity of the procedure invoked otherwise because "no
we are facing a right with constitutional rank ”-remember that section a, is
refers to the violation of rights that are subject to constitutional protection- and
no, as the claimed claim likes to imply, that this guarantee does not exist in the
administrative Procedure.


The recognition in the administrative procedure of the constitutional rank of this
right - implicit in article 24.2 of the EC - is a matter debated in the doctrine
administrative and on which the Constitutional Court has been carrying out important
qualifications in their sentences to end with a clear statement against
that such guarantee has constitutional status in this area. We refer to the STC

174/2005, of July 4, which was cited in the motion for a resolution.

Therefore, transferring the doctrine of the High Court regarding the fundamental right to
separation of the investigation and resolution phases and their application to the procedure
administrative penalty, we must also now conclude, in the resolution phase, what

that was affirmed in the proposal: that the nullity of the procedure that the
it claims “in no case could it be based on section a) of article 47.1. of the
LPACAP, in connection with the alleged breakdown of the phase separation


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 23/48








Instructor and the resolution pursuant to article 24.2 of the C.E. ”. In other words, no
could integrate the defect of absolute nullity provided for in article 47.1.a, of the LPACAP.


Article 24.2 of the EC that the complainant understands violated refers to eleven rights
fundamental that constitute in turn a set of procedural guarantees. The
SSTC have been delimiting which of them are applicable and which are not to the
administrative Procedure. Regarding the principle of phase separation
investigating and sanctioning - a principle that has its origin in that the impartiality of the
Judge is incompatible or is compromised by his performance as an instructor

(STC 145/1988, of July 12) - the T.C. has ruled on its application to
administrative sanctioning procedure in the following terms:

In STC of 02/15/1990 (RTC 1990/22) it says that “It is a reiterated doctrine of this Court
that it cannot be claimed that the Instructor in an administrative proceeding

sanctioner, and even less, the body called to resolve the file, enjoy the
same guarantees as judicial bodies; because in this type of procedure the
Instructor is also an accuser as soon as he formulates a motion for a resolution
sanctioning body and, on the other hand, the body called to decide is the same
file and, therefore, it does not cease to be a judge and a party at the same time. " (The underline is
our)


In STC of 04/26/1990 (RTC 1990/76) states that “By the very nature of the
administrative procedures, in no case may a separation be required between
instruction and resolution equivalent to the one that must be given in respect of the Judges
jurisdictional processes. The right to an ordinary judge predetermined by law and

to a process with all the guarantees - among them, the independence and impartiality
of the judge- is a characteristic guarantee of the judicial process that does not extend to the
administrative procedure, since the strict impartiality and independence of the
organs of the judiciary is not, by essence, applicable with the same meaning and in the
same measure to the administrative bodies. " (The underlining is ours)


In the STC of 03/17/1995 the High Court says the following:
“In relation to this fundamental right not to be judged by who has been
previously instructor of the case, this Court has declared that, due to its
The purpose is exclusively to avoid, by the court
in charge of hearing the oral trial and issuing Judgment of certain prejudices

about the guilt of the accused [...] Likewise, and from a point of view
objective, we have also said that, by being framed within the guarantees of the
accusatory criminal process, it is not necessarily extensible to other prosecution processes
similar nature as is the case of the administrative sanctioning procedure
(STC 22/1990 [RTC 1999, 22]

In any case, the accumulation of instructional and sentencing functions does not
can be examined in the abstract, but must be descended to concrete cases and
check whether the impartiality of the judge has been effectively violated (STC
98/1990), having to bear in mind that not every instructional act compromises
said impartiality, but only those who, by assuming the Judge a judgment on the

participation of the accused in the punishable act, may produce in his mind
certain prejudices about the guilt of the accused that disqualify him from
hear about the oral trial phase (SSTC 106/1989; 136/1992, 170 and 320 1993) ”.
(The underlining is ours)

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 24/48









From STC 174/2005, of July 4, which the AEPD made mention in the proposal for
resolution and on which the respondent has affirmed exhaustively that nothing has to

see with this previous question, we reproduce the following fragments:

"1. The purpose of this amparo appeal is to determine, on the one hand, whether in the
administrative sanctioning procedure, which has led to the imposition of the
sanction to the recurring entity, their right to a process with all
guarantees (art. 24.2 CE), as the due separation between the

investigatory body and the sanctioner; [...]

2. The complaint regarding the violation of the right to a trial with all the guarantees
(art. 24.2 CE), from the perspective of the requirement of impartiality, it is necessary to
understand it articulated by way of art. 43 LOTC, since the recurring entity

argues that it would have occurred in the administrative sanctioning procedure for not
respect the proper separation between the administrative body of investigation and the
sanctioning, derived from the fact that the Mayor of the City Council was the instructor of the
procedure and, in addition, president of the Government Commission that imposed the
sanction.


In this regard, it should be remembered that, although this Court has reiterated that, in principle,
the requirements derived from the right to a trial with all guarantees apply
to the administrative sanctioning procedure, however, there has also been
special incidence in that said application must be carried out with the modulations
required to the extent necessary to preserve the essential values that are

found at the base of art. 24.2 CE and the legal security guaranteed by art. 9.3
CE, as long as they are compatible with its own nature (for all, STC 197/2004, of
November 15, FJ 2). More specifically, and with regard specifically to the
guarantee of impartiality, it has been pointed out that it is one of the cases in which
necessary to modulate its projection in the administrative sanctioning procedure, all

Since said guarantee “cannot be predicated of the sanctioning Administration in the
the same sense as with respect to judicial bodies ”(STC 2/2003, of January 16,
FJ 10), therefore, “without prejudice to the prohibition of any arbitrariness and the subsequent
judicial review of the sanction, the strict impartiality and independence of the organs
of the judiciary is not, in essence, predicable to the same extent of an organ
administrative law ”(STC 14/1999, of February 22, FJ 4), concluding that the

independence and impartiality of the judge, as a requirement of the right to a trial
With all guarantees, it is a characteristic guarantee of the judicial process that is not
It extends without further ado to the administrative sanctioning procedure (STC 74/2004, of 22
April, FJ 5).


In view of this, the principle of the sanctioning procedure established in art.
134.2 of Law 30/1992, of November 26, on the legal regime of the
Public administrations and the common administrative procedure, according to which
“The procedures that regulate the exercise of the sanctioning power must
establish the proper separation between the investigation phase and the sanctioning phase,

entrusting them to different bodies ”, is a principle of a legal nature whose protection
corresponds to the judicial bodies through the corresponding resources, without
that the requirement of impartiality of the administrative sanctioning body is, as
the recurring entity intends, a derived guarantee, with the character of right

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 25/48








fundamental, of art. 24.2 CE, whose requirements, regarding judicial impartiality,
They only apply to the judicial body that must decide on the legality of the action
administrative.

In this way, the eventual infraction in an administrative sanctioning procedure

the principle of entrusting to different bodies the instructional phase and the
sanctioning has no constitutional relevance for the purposes of art. 24.2 CE and, [....] "
(The underlining is ours)

STC 74/2004 of April 22 (F.J. 5) - in the proposal was indicated, by mistake, the number
175/2004 - stated the following:


"5. The applicant for amparo also alleges the infringement of the right to a
process with all the guarantees (art. 24.2 CE) [...] alleging that the command that imposed
the sanction, which was the one who practiced the hearing procedure, had been denounced by
the appellant before the General Director of the body for the commission of certain

irregularities.
[...]
In accordance with our doctrine, we must remember that the right [...] to a
process with all the guarantees -among them, the independence and impartiality of the
judge- it is a characteristic guarantee of the judicial process that does not extend to the
administrative procedure, since the strict impartiality and independence of the

organs of the judiciary is not, in essence, predicable with equal meaning and in the
same measure of the administrative bodies (SSTC 22/1990, of February 15, FJ 4,
and 76/1990, of April 26, FJ 8.a; AATC 320/1986, of April 9, FJ 4, and 170/1987, of
February 11, FJ 1). As already expressed in STC 22/1990, of February 15 (FJ 4),
It is not idle to bring up the caution with which it is convenient to operate when
transfer constitutional guarantees extracted from the criminal order to the law

administrative sanction is involved; this delicate operation cannot be done
automatically, because the application of said guarantees to the procedure
administrative is only possible to the extent that they are compatible with your
nature. In this way, on different occasions the Constitutional Court has
held that it cannot be claimed that neither the instructor of a procedure
administrative sanctioning body, let alone the body called to resolve the file,

enjoy the same guarantees as the judicial bodies (STC 14/1999, of 22
February, FJ 4).
Consequently, the interpretation and application of the abstention and
Disqualification of those who make up the administrative bodies belongs to the scope of the
ordinary legality, without being able to use the remedy of amparo to review
that carried out by the Courts, in this case by the military jurisdiction, since the

Amparo appeal does not constitute a third judicial instance in which they can
to discuss problems of mere ordinary legality (ATC 170/1987, of February 11, FJ
two)." (The underlining is ours)

Thus, in the light of the preceding exposition, the one so often invoked by the

claimed “clear breach of the principle of separation of the investigative phase and of
sanction ”that would have affected the impartiality of the investigating body, with the
consequent violation of the essential guarantees of the procedure protected in
the Constitution, “lacks constitutional relevance for the purposes of art. 24.2 CE. "


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 26/48








On the other hand, it is worth highlighting another aspect of the invoked guarantee that does nothing but
further evidence the radical inconsistency of the arguments that the claimed
he uses to support the nullity of the procedure.


Whether we look at the origin of this guarantee of the procedure, recognized in the
judicial scope by article 24.2 of the C.E., as well as its subsequent development by the
T.C., its content is intended to guarantee the impartiality of the judge; well what
the latter seeks that this impartiality is not affected by the fact of having
previously acted as an instructor.


Note that the claimed, what it has been holding since its first
allegations is the alleged contamination or "direction" suffered by the instructor as
consequence of the decision-making body setting the amount of
the sanction, an extreme that has nothing to do with the content of the fundamental right

to which we have been referring.

In short, even if there were not - as there are - clear pronouncements of the
TC that the principle of separation of the investigation and decision phase does not
has constitutional rank in the field of administrative procedure, in no
In this case, this supposed “direction” or “contamination” of the instructor could be embedded in the

violation of a right whose content seeks to protect the impartiality of the
judge avoiding their interference in acts of instruction.

To end the chapter on the alleged radical nullity of the procedure that the
claimed in its defense, the following considerations should be added.


One of them related to the fundamental right to an impartial judge guaranteed in the
Article 24.2 of the C.E. The respondent has referred in her two briefs of
allegations that the actions of the AEPD have determined that it has been "seen
substantially affected the impartiality of the investigating body ”, which is why

We take the opportunity to specify that this alleged impairment of the impartiality of the
The instructor also has no fit in that fundamental right guaranteed by the article
24.2 of the C.E., so it could not base the nullity of the procedure on it either.
under the protection of section a) of article 47.1 of the LPACAP.

Regarding the right to an impartial judge, it should be noted that, for more abundance, it is not

that this guarantee is not transferable to the instructor - who is the one on whom it is claimed
swing the much desired nullity of the procedure - but not even
recognizes this right in the framework of the administrative procedure. STC 76/1990,
legal basis 8, it could not be clearer:
“The right to [...] and to a process with all the guarantees -among them, the independence

and impartiality of the judge- is a characteristic guarantee of the judicial process that does not
extends to the administrative procedure, since strict impartiality and
The independence of the organs of the judiciary is not, in essence, predicable with
the same meaning and to the same extent of the administrative bodies (SSTC
175/1987 and 22/1990 ... ”. (The underlining is ours)


Finally, regarding the minimum content of the opening agreement provided for in the
Article 64 of the LPACAP and the "manifest contradiction" in which, according to the entity,
it would have been incurred when saying that it "goes beyond" that minimum content, it is enough

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 27/48








note that article 64.2 indicates that "it must contain at least", "b) [...]
sanctions that may correspond, without prejudice to what results from the instruction ”.


Thus, as stated at the time, the agreement to open this
The procedure not only complied with the requirements of Article 64.2 LPACAP - it fixed the facts
that motivate the initiation of the procedure, its possible qualification and the sanctions that
could correspond - but "went further" as detailed, among other things,
the modifying circumstances of the responsibility that were appreciated in that phase.


With this, neither is it granted "a kind of benefit to the administered" nor is it "undermined"
"The rights enshrined in article 24 of the Constitution.", As we
reproaches the claimed. Comment that is still striking if we take into account
that one of the arguments put forward by the respondent in her allegations to
opening agreement was the deficient argumentation of the circumstances

modifying the responsibility set forth in the aforementioned agreement.

In short, the guarantees recognized in the administrative procedure
sanctioner and the rules governing the procedure have been respected
scrupulously. The points mentioned by the respondent in her two briefs
of allegations do not imply the violation of any recognized fundamental right

in article 24.2 of the C.E. in which to support the concurrence of the motive of
radical nullity of article 47.1.a) LPACAP.

Regarding the remaining questions raised regarding the nullity of the
procedure, which are nothing but a reiteration of what the respondent alleged before the

agreement to initiate the file, we refer to what was stated in the brief of
proposal, which is reproduced at the beginning of this Rationale.

Due to the foregoing, the claim of the defendant that the claim be declared is rejected.
nullity of the procedure.


                                            III

The RGPD dedicates article 5 to the principles that govern the processing of data
personal and has:


"1. The personal data will be:
a) treated in a lawful, loyal and transparent manner with the interested party (<< legality, loyalty and
transparency >>)
b) collected for specific, explicit and legitimate purposes, and will not be processed
subsequently in a manner incompatible with said purposes; in accordance with article 89,

section 1, the subsequent processing of personal data for archiving purposes in
public interest, scientific and historical research purposes or statistical purposes are not
deemed incompatible with the original purposes ("purpose limitation");
(…)
2. The person responsible for the treatment will be responsible for compliance with the provisions

in section 1 and able to demonstrate it (<< proactive responsibility >>) "

Article 6 of the RGPD, “Legality of the treatment”, specifies in section 1 the
cases in which the processing of third party data is considered lawful:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 28/48









"1. The treatment will only be lawful if it complies with at least one of the following
terms:

a) the interested party gave their consent for the processing of their personal data
for one or more specific purposes;
b) the treatment is necessary for the execution of a contract in which the interested party
is part of or for the application at his request of pre-contractual measures;
c) the treatment is necessary for the fulfillment of a legal obligation applicable to the
responsible for the treatment;

d) the treatment is necessary to protect vital interests of the interested party or another
Physical person.
e) the treatment is necessary for the fulfillment of a mission carried out in the interest
public or in the exercise of public powers conferred on the data controller;
f) the treatment is necessary for the satisfaction of legitimate interests pursued

by the person responsible for the treatment or by a third party, provided that on said
interests do not override the interests or fundamental rights and freedoms of the
interested party who require the protection of personal data, in particular when the
interested is a child.
The provisions of letter f) of the first paragraph will not apply to the treatment
carried out by public authorities in the exercise of their functions. "


Recital 47 of the RGPD states:

“The legitimate interest of a person responsible for the treatment, including that of a person responsible for
that personal data may be communicated, or that of a third party, may constitute a

legal basis for the treatment, provided that the interests or
rights and freedoms of the interested party, taking into account reasonable expectations
of the interested parties based on their relationship with the person in charge. Such legitimate interest
could occur, for example, when there is a relevant and appropriate relationship between the
interested party and the person in charge, as in situations in which the interested party is a client or

is at the service of the person in charge. In any case, the existence of a legitimate interest
would require careful evaluation, even if a stakeholder can foresee accurately
reasonable, at the time and in the context of the collection of personal data, that
treatment may occur for this purpose. In particular, the interests and rights
fundamental interests of the interested party could prevail over the interests of the person in charge
of the treatment when the personal data is processed in

circumstances in which the interested party does not reasonably expect that a
further treatment. Since it corresponds to the legislator to establish by law the basis
legal for the processing of personal data by public authorities,
this legal basis should not apply to the treatment carried out by the authorities
public in the exercise of their functions. The processing of personal data

strictly necessary for the prevention of fraud is also an interest
legitimate authority of the person responsible for the treatment in question. Data processing
personal data for direct marketing purposes may be considered to be done by
legitimate interest. " (The underlining is ours)


                                            IV

An infraction is attributed to the defendant in the present sanctioning procedure
of article 6.1.f) of the RGPD materialized in having sent by postal mail a

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 29/48








commercial communication to the claimant, his client, almost two years after
he would have stated that he did not wish to receive commercial communications or
advertising and that the respondent replied that she had adopted the measures

necessary to meet your request.

1. In general, notwithstanding the necessary weighting judgment that the
responsible for the treatment must do and "provided that the interests
or the rights and freedoms of the interested party ”, their legitimate interest may constitute the basis
legal of the processing of personal data for direct marketing purposes

with respect to those who are his clients, taking into account that it is considered that
there is a reasonable expectation of such customers to receive advertising, based on the
commercial relationship that unites them with the person responsible for the treatment. This is inferred from
Article 6.1.f) of the RGPD in connection with Article 21.3 and Recitals 47, 69 and
70 of the GDPR,


Article 21 of the RGPD regulates the right of opposition in the following terms:

"1. The interested party will have the right to object at any time, for reasons
related to your particular situation, what personal data concerning you
are subject to a treatment based on the provisions of Article 6 (1),

letters e) or f), including profiling based on these provisions.
The data controller will stop processing personal data, unless
prove compelling legitimate reasons for the treatment that prevail over the
interests, rights and freedoms of the interested party, or for the formulation, the
exercise or defense of claims.

2. When the purpose of the processing of personal data is marketing
direct, the interested party will have the right to object at any time to the treatment of
personal data concerning you, including profiling in the
insofar as it is related to the aforementioned marketing.
3. When the interested party opposes the treatment for direct marketing purposes,

personal data will no longer be processed for these purposes.
4. At the latest at the time of the first communication with the interested party, the
right indicated in sections 1 and 2 will be explicitly mentioned to the interested party
and it will be presented clearly and apart from any other information.
5. In the context of the use of information society services, and not
Notwithstanding the provisions of Directive 2002/58 / EC, the interested party may exercise his

right to object by automated means that apply specifications
techniques.
(...) ". (The underlining is ours)

On the other hand, Recitals 69 and 70 of the RGPD say:


(69) In cases where personal data can be processed lawfully because
[...] or for reasons of legitimate interests of the person in charge or of a third party, the interested party
You must, however, have the right to object to the processing of any data
personal information regarding your particular situation. The person responsible must be the one who demonstrates

that your overriding legitimate interests prevail over the interests or rights
and fundamental freedoms of the interested party. (The underlining is ours)



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 30/48








(70) If personal data is processed for direct marketing purposes, the
interested party must have the right to object to said treatment, including the
profiling insofar as it is related to such marketing
direct, either with respect to an initial or subsequent treatment, and this in any
moment and at no cost. Said right must be explicitly communicated to the

interested and present clearly and apart from any other information. " (The
underlined is ours)

Regarding the right of opposition provided for in article 21.3 of the RGPD, it is brought to
collation of what was stated in document Wp217 of the Article 29 Working Group,
Opinion 6/2014, on the concept of legitimate interest of the person responsible for the

data processing pursuant to article 7 of Directive 95/46 / EC. Starting from
the provisions of article 14.b) of the Directive - “to oppose, upon request and without charge,
to the processing of personal data that concerns you with respect to the
which the person in charge foresees a treatment destined to prospecting; [...] ”- and with the
purpose of illustrating in which cases an opt-out clause could be used

In relation to Article 14.a) of Directive 95/46 / EC, the Opinion reads as follows:

      “To illustrate [....] the example of prospecting is useful, in relation to which
      there has traditionally been a specific opt-out provision
      included in Article 14, letter b), of the Directive. In order to deal with the
      new technological advances, this provision has been supplemented after

      through specific provisions in the Privacy Directive and
      electronic communications.
      Under Article 13 of the Privacy and Communications Directive
      electronic, for certain, more intrusive types of business activities
      prospecting (such as email marketing and
      automated calling systems) consent is the norm. What

      exception, in existing relationships with clients in which the person responsible for the
      treatment advertises its own "similar" products or services, it is sufficient
      offer an (unconditional) possibility of 'opt-out' without justification.
      The evolution of technology has required similar solutions, relatively
      simple and that follow a similar logic, for the new practices of
      marketing.

      First of all, the way the delivery material is delivered has evolved.
      marketing: instead of simple emails reaching customers
      mailboxes, currently appears on the screens of telephones
      smart and computer-based targeted advertising
      behaviour. In the near future, advertising may also be included
      on smart devices connected to the Internet of Things.

      Second, advertising is increasingly targeted
      specific: instead of relying on simple customer profiles, with more
      The activities of consumers and consumers are frequently tracked.
      data is stored online and offline, and analyzed with methods
      more sophisticated automated systems.

      As a result of this evolution, the object of the balancing test has
      varied: the issue is no longer the right to freedom of commercial expression, but
      mainly the economic interest of business organizations in
      get to know your customers by tracking and supervising their activities
      online and offline, which will need to be weighed in relation to the rights

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 31/48








      (fundamental) to the privacy and the protection of the personal data of these
      people and their interest in not being unduly supervised.
      This change in dominant business models and the increase in the value of

      personal data as an asset for business organizations explains
      the recent consent requirement in this context, in accordance with the
      Article 5 (3) and Article 13 of the Directive on privacy and
      electronic communications.

      There are, therefore, different specific rules that depend on the form of

      marketing, namely:
      - the unconditional right to object to prospecting (conceived in the
      context of traditional postal mail for product marketing
      similar) under Article 14 (b) of the Directive; Article 7, letter f),
      it could be the legal basis in that case;

      - the consent requirement under Article 13 of the Directive on
      privacy and electronic communications for automated calling systems,
      marketing via email, fax and text messages (subject to
      exceptions) and the de facto application of Article 7 (a) of the Directive on
      Data Protection.
      - the consent requirement under Article 5 (3) of the

      Directive on privacy and electronic communications (and article 7, letter a),
      of the Data Protection Directive) in the case of behavioral advertising
      based on tracking techniques such as cookies that store
      information in the user's terminal. " (The underlining is ours)


2. Given the above, it is necessary to refer to the advertising communication about their
mortgages that the claimant sent to the claimant by mail and to the
determination of its nature, since discrepancies have arisen about it.

The respondent states that the commercial communication sent to the claimant does not

constitutes a direct marketing assumption. Second, the respondent denies
that, even in the hypothesis of admitting that this commercial communication may
qualify as direct marketing, there would have been a treatment "for the purpose" of
direct marketing and maintains that there was only a treatment with a purpose
specific, to provide the claimant with information about their products, treatment that
It is covered by article 6.1.b) of the RGPD. He adds that there has been no

"Additional" "data processing" that could fit into the definition of
treatment that includes article 4 of the RGPD and that, even if such
treatment this Agency has no way of proving that "its purpose" was to
direct marketing.


The position defended by the claimed through her DPD first and her briefs of
allegations to the opening and proposal agreement is the following:

The DPD considered, regarding the commercial advertising printed in the document
sent to the claimant that it was not a “personalized commercial communication”, and that

the claimant was not addressed by his profile. For the DPD the communication received by the
claimant was, only, “a generic and common cover for all clients, similar to
the posters that are exposed in the offices or their facades, and general
for all customers who receive their correspondence physically in paper format. "

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 32/48









In its allegations to the initiation agreement, the respondent affirms that the Agency has
incurred in an error when confusing the “existence of publicity of [the claimed] in the

cover page included in the envelope addressed to the claimant ”with“ the completion of a
treatment for direct marketing purposes ”. An idea that he reiterates when he says that the AEPD
confuses "direct marketing" with "data processing for marketing purposes
direct "," being so that they are two completely different realities "OR
that “The AEPD incurs an obvious contradiction by confusing [...] the existence of
advertising with the performance of data processing for that purpose ”.


It also adds in those allegations that "the remission of said envelope with the advertising
inserta "is not the" result of data processing for advertising purposes.
In the same way, it would not be possible to consider that we would be facing a
data processing for such purposes in the event that on the cover of the envelope

only the commercial name of my client would have appeared, even if the
AEPD, forcing the concept contained in the Initiation Agreement could reach
consider the mere representation of that logo as advertising. "

 It also states: “In other words, [the complainant] did not process any of the data
of the interested party in order to send you information about their products, but

only to provide information related to those hired by
the former, without the fact that the cover of the envelope in which the information was sent
imply any treatment of your data for the purpose intended by the AEPD.
that, in this sense, [the claimed] does not deny that the information included on the cover
may be considered advertising for the purposes provided in the regulations mentioned

the Initiation Agreement, what cannot be considered is that the fact that this
information is included on the cover page implies data processing for the purposes of
direct marketing, which is what my client is charged with. " (Folio 12 of the brief of
allegations)
(The underlining is ours)


 In the allegations to the proposed resolution, the respondent has stated that
following:
“The fact that the cover of the envelope in which the aforementioned referral takes place incorporates
information referring to products marketed by the entity, without having carried out
carry out processing activity linked to the determination of the content of said

document cannot in any case imply the existence of a treatment
specific aimed at carrying out direct marketing actions, but rather
the mere adoption of a business decision about the format of the envelopes
aimed at the entity's clients ”. (The underlining is ours)


He insists that the proposal considers that, the mere fact that the cover contains
the information on the aforementioned product is sufficient to appreciate the existence of "a
personalized delivery "to the claimant" in order to promote the acquisition of the
mentioned product of the entity ”; although “[...] it did not involve carrying out a
previous action by Bankia to determine whether said advertising

it may or may not correspond to the preferences of the interested party ”.

It also states that the "proposal considers" that, the fact of having sent the
letter to the claimant, containing the contact details to which it is addressed

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 33/48








"It involves the performance of two personal data processing: one related to the
development of the contractual relationship and the other derived from the pure and simple fact that
the cover of the envelope incorporates the aforementioned information ”. And as a counterpoint he exposes which

is its position: that there was and carried out “a single data processing and with the only and
exclusive purpose of sending the claimant the extracts of the contracted products,
treatment protected therefore in article 6.1.b, of the RGPD. "

Well, given that in its allegations to the proposal the claimed
denies that a previous activity had been carried out “to determine whether said

advertising may or may not correspond to the preferences of the interested party "
-Comment similar to the refusal expressed by the DPD in its response to
would have sent the claimant personalized advertising- and that both cases
seem to refer to the non-existence of data profiling, the first point
What has to be done is that, as already noted in the motion for a resolution, this

The Agency has never argued, directly or indirectly, that the
commercial communication that the complainant sent to the complainant implied or was the result
from a previous data profiling. If there has been data profiling -defined in the
Article 4.4 of the RGPD- the legal basis of the treatment would not be Article 6.1.f) of the
RGPD, but it would be necessary to have the express consent of the owner of the
data.


We anticipate since, something different from data profiling is that in the activity of
marketing would have selected a group from the target audience
Potentially recipient of the advertising: the one made up of the entity's clients
financial Aspect on which no doubt can be raised since the respondent has

insisted on multiple occasions that the content of the communication regarding the
mortgages was included in the cover of the envelope used for all its clients with
opportunity to provide information about the contracted products, treatment this
The last one covered by article 6.1.b) of the RGPD.


(i) The respondent denies that the commercial communication sent to the claimant may
qualify as direct marketing.

 Law 34/1988, of November 11, General Advertising (LGP) defines the
advertising as “any form of communication made by a natural person or
legal, public or private, in the exercise of a commercial, industrial,

craft or professional, in order to promote directly or indirectly the
contracting of movable or immovable property, services, rights and obligations "
(Article 2).

For its part, Order EHA / 1718/2010, of June 11, regulating and controlling the

advertising of banking services and products - in force when the
facts that concern us- established in article 2, paragraph 1 that, for the purposes of
established in this order, “any form of
communication offering banking products or services, or disclosing
information about them, whatever the means of dissemination used: press,

radio, television, email, Internet or other electronic media, posters
interiors or exteriors, billboards, flyers, circulars and letters that are part of a
outreach campaign, phone calls, home visits or any other system
Of disclosure.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 34/48








Likewise, advertising activities will be considered those communications
intended to draw the public's attention to management or other services,
provided by entities additionally or in relation to other products or

banking services, which do not have the status of investment services.
2. They are not considered advertising activities and, therefore, are excluded from this
order:
a) Corporate advertising campaigns, understood as those that contain
exclusively generic information about an entity or its corporate purpose that is
intended to be known to the public.

b) Any informative content that appears on the entity's own pages
on the Internet, or in another means of dissemination, that are necessary to carry out the
hiring an operation.
c) The information on the specific characteristics of the operations
appear in the operational pages of the entity on the Internet in which they are carried

cape." (The underlining is ours)

Advertising is an instrument that marketing uses. Therefore, advertising
it is always marketing, but marketing is not always advertising. Marketing
study and plan and advertising acts accordingly. Marketing focuses on
create a concrete image for the company and understand the market and the

Potential customers.

Regarding direct marketing Philip Kotler - considered the father of marketing
modern- defines it in his book ‘Marketing Fundamentals’, as “the connections
direct with individual consumers carefully selected to obtain

an immediate response and to cultivate lasting relationships with clients ”.

Unlike the mass advertising that is sent to all types of consumers, the
Direct marketing is ideally for those of whom it is believed (based on the
information collected about them) who have an interest in one of the products or

services on offer. Among the advantages attributed to direct marketing
the message is found to be personal, making the client feel that it is only
for him or her; that it is possible to do a better segmentation and it is more profitable because
an attempt is made to sell to individuals who have already been identified as potential
buyers.


The American Direct Marketing Association and the European Direct Marketing
Association define direct marketing as "an interactive marketing system
that uses one or more advertising media to achieve a measurable response and / or
a transaction at a certain point. This concept encompasses all those
media intended to create an interactive relationship with a retailer

individual, a company, client, end consumer or a contributor to a cause
determined. "

In the opinion of this Agency, the commercial communication that the claimant received from the
claimed and that has given rise to the present sanctioning procedure constitutes a

direct marketing example. The commercial communication was sent to the claimant by
your status as a client of the entity, as well as all clients - such and as the
claimed has been affirming from the beginning-, so it would be framed in a
direct marketing activity of the financial institution. We are not facing a

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 35/48








mass commercial communication in which the recipient had not been
individualized.


The particularity presented in this case by the commercial information sent to the
claimant and the rest of the clients of the claimant is that it was not included in a
separate document, but was included - which is undoubtedly more
economic - in the same documentary support on which the data appears
identification of the recipient of the postal shipment, as the envelope used was one of the
called window in which the recipient's data is printed

inside him. The document that simultaneously supported the information
commercial and to the data of the recipient of the letter - to whom the claimed one refers
as "cover of the envelope" - it is described in Proven Fact 2 of the resolution, which
we refer. The commercial communication in this case reported the
main characteristics of the product marketed by the entity and invited the

client, to obtain more information, to consult the website or to go to their office
bank.

It is irrelevant for the purposes of the advertising communication sent being
considered direct marketing that would have been printed on the same document as
It served as a support for the data of the recipient of the letter or cover of the envelope. It

Relevant is that the respondent directed the commercial information to a client of hers, since
was included in the envelope with other information sent to the claimant as it was
client; that was used for all the entity's clients and that was addressed, in the case
of the claimant and of the rest of the clients, to people who were perfectly
individualized and identified.


As said at the time, it is a personalized communication; not in the sense
which appears to have been used by the entity's DPD, linked to data profiling
- a matter to which we have already referred in previous paragraphs - but because it is
included in an envelope that was addressed to the claimant identifying him in a

unequivocal for your personal data.

(ii) The respondent denies that the claimant's personal data had been processed
for direct marketing purposes.

The commercial communication about the mortgages that was sent to the claimant by his

condition of client of the entity - since, as the claimed one has affirmed
insistently, he used it without any discrimination for all his clients - and that to
This Agency is an example of the direct marketing activity of the
claimed, it was included in an envelope addressed to the claimant (in his name and address)
together with the information related to the financial products that it had contracted with

her.

Therefore, as stated in the motion for a resolution, it is estimated that the data
Claimant's personal data were treated with a dual purpose: On the one hand, the
claimed processed the data of the claimant in order to provide information

regarding the contracted services. The legal basis of the treatment carried out with such
end is article 6.1.b. RGPD, as this treatment is necessary for the execution of the
contract that bound the claimant and the claimed. In addition, the data of the
claimant were subject to treatment for a purpose other than the previous one:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 36/48








get you publicity about your mortgages. Advertising sent to customers of
the entity in this way - printed on the cover of the envelope - is not as the
claimed fruit almost by chance since while admitting that it is a

Advertising communication denies that it responds to a specific marketing purpose.

In the case examined, the treatment of the claimant's data pursued,
in addition to the original purpose, related to the reason for collecting the data
-the conclusion of a contract between the claimed and the claimant- a purpose other than
that. What that purpose is is clear from the content of the

advertising communication and the circumstance that the complainant has recognized in
every time that same communication was included on the cover of the envelope that was
sent to all his clients. This ulterior purpose - direct marketing - of the
Treatment of the claimant's data requires a specific legal basis that legitimizes
the treatment that is different from that referred to in article 6.1.b) of the RGPD.


At this point, it seems advisable to reproduce what was stated by the claimed
in their allegations to the initial agreement on “what was the interpretation that had to
be given to the concept of treatment and to the purpose, in accordance with the supported criteria
by the Article 29 Working Group and ratified by the European Committee on
Data Protection.":

      [...] it should be remembered that although the defunct Article 29 Working Group (in
      hereinafter, "GT29") or the European Data Protection Committee (hereinafter,
      for its acronym in English, “EDPB”) have not analyzed in any document the
      legal notion of "Purpose" from the point of view of the application of the
      data protection regulations, they have had the opportunity to refer to this

      concept in some of its opinions and documents.

      Thus, in its Opinion 03/2013 on the limitation of purpose, adopted on 2
      April 2013 (hereinafter, the “Document WP203”) equates the concepts of
      purpose and objective of the treatment ("purpose" and "aim" in the English version, only

      available from it). Thus, in section II.2.1, WP29 states that “The article
      6. 1 b) of the Directive requires that personal data is only collected for purposes
      "specific, explicit and legitimate". Data is collected for certain
      objectives; These objectives are the "raison d'être" of the operations of
      treatment". It follows that the purpose should be understood as the
      "Objective" or "reason for being" of the treatment. For this reason, the

      aforementioned opinion, “[c] as a prerequisite for other quality requirements
      of the data, the specification of the purpose will determine the relevant data
      to be collected, retention periods and all other aspects
      key of how personal data will be treated for the chosen purposes ”.


      For its part, the WG29 also pointed out in section III.3.1. of its Opinion
      06/2014 [...] (hereinafter, the “Document WP217”), that “[i] n terms of
      data protection, purpose is the specific reason why the
      data: the purpose or intention of the data processing ”.


      And, as Document WP103 also indicates at the beginning of its section II.2
      “[T] he specification of the purpose is an essential condition for the treatment
      of personal data and a prerequisite for applying other quality requirements
      of data. The specification of the purpose and the concept of compatible use

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 37/48








      contribute to transparency, legal certainty and predictability; its
      The objective is to protect the data subject by setting limits on how the
      those responsible can use your data and reinforce loyalty in the treatment ”.


      Well, applying the delimitation of the concept of "purpose" deduced from the
      mentioned documents of the WG29, my client considers, in light of what
      invoked by the AEPD in its Initiation Agreement, that it has not led to
      carry out a data processing of the Claimant whose “reason for being”, “objective” or
      "Ultimate intention" consists of carrying out direct marketing activities. "


The textual citations obtained from the documents of the WG29 to which the
claimed are perfectly consistent with the thesis of this AEPD. It couldn't be from
otherwise, since the RGPD provides with total clarity in its article 5.1.b), a sensu
On the contrary, -a precept almost identical to article 6.1.b) of Directive 95/46 / EC- that the

Personal data may be processed for purposes other than the "determined,
explicit and legitimate ”for which they were collected, provided that such subsequent treatment
is not incompatible with the original treatment. To this end, article 6.4 of the RGPD
offers a series of criteria to be taken into consideration to determine whether the
processing for another purpose is compatible with the purpose for which the data were collected
initially.


Article 6.4 of the RGPD, provides:

"4. When the treatment for a purpose other than that for which the data were collected
personal data is not based on the consent of the interested party or on the Law

of the Union or of the Member States that constitutes a necessary measure and
proportional in a democratic society to safeguard the stated objectives
in article 23, paragraph 1, the data controller, in order to determine
if the treatment for another purpose is compatible with the purpose for which they were collected
initially personal data, will take into account, among other things:

a) any relationship between the purposes for which the data was collected
personal and the purposes of the planned further processing;
b) the context in which the personal data was collected, in particular for what
Regarding the relationship between the interested parties and the person responsible for the treatment;
c) the nature of the personal data, specifically when categories are processed
special personal data, in accordance with article 9, or personal data

relating to convictions and criminal offenses, in accordance with article 10;
d) the possible consequences for the data subjects of the planned further processing;
e) the existence of adequate guarantees, which may include encryption or
pseudonymization. "


3. The treatment of the personal data of the claimant carried out with a purpose
specific direct marketing, different from the purpose of the initial treatment that
determined the collection of the data, it must be based on a specific legal basis.

As has been stated, when the purpose of the subsequent treatment is the

communications for direct marketing purposes addressed to those who have a relationship
with the person responsible for the treatment, as a prior contractual relationship, which generates
a reasonable expectation in the interested party of the subsequent use of their data with that


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 38/48








purpose, the legal basis of the treatment may be the circumstance described in the
Article 6.1.f) of the RGPD.


In this sense, it should be remembered that both the DPD, in its informative response to the
Subdirectorate of Data Inspection, prior to the admission for processing of the claim,
as the representative of the respondent in their allegations to the commencement agreement, have
stated that the legal basis for the processing of personal data of the
clients that the entity carries out for commercial purposes is the legitimate interest that
it is held in accordance with article 6.1.f RGPD.


The DPD of the complained party, in its response to the information request of the Sub-Directorate
of Inspection, declared that the legal basis for the treatment of the claimant's data
for commercial purposes it was the legitimate interest (article 6.1.f. RGPD) He then stated:
 "And therefore, it must be understood that it is a shipment protected in the interest

legitimate of [?] as reported in the entity's privacy policy, at
be referred in a general way to products or services marketed by the
entity and similar to the products contracted by its clients (products
financial). "
(The underlining is from the AEPD)


For its part, the respondent, in the processing of allegations to the initiation agreement, provided a
privacy policy document that indicated that the personal data of the
clients would be treated, without prejudice to the special conditions established
in relation to each product contracted by them, for six purposes
determined and in which it was specified, with respect to each of these purposes

treatment, what was its correlative legal basis. Points 3 and 4 say
following:
"3. Improve the web pages or tools owned by Bankia, as well as its
products and services, in order to offer better quality and service to the user,
develop new products / services or improve the internal processes of the entity

(Legitimation of the treatment: User consent (cookies) and Legitimate interest).

4. Send commercial communications about products and services, own or of
third parties (Legitimation of the treatment: User consent). " (The underline is
our)


As can be seen, point 4 of the privacy policy document of the
entity indicates that the legal basis of the treatment, when the purpose is "to send
commercial communications about products and services, own or of third parties "-without
make any additional precision that limits the very general category of
commercial communications - is the consent. And in section 3 it says that the

legitimate interest operates as the basis of the treatment -with the exception of the
cookies, whose basis is consent - consisting of "improving the pages or
web tools owned by Bankia, as well as its products and services, as long as
offer better quality and service to the user, develop new products / services
or improve the internal processes of the entity ”.


The apparent contradiction between what was stated by the DPD in its response to the
request for information - which argued that the legal basis for the treatment of
customer data for commercial purposes was the legitimate interest - and point 4 of the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 39/48








privacy policy document provided by the complained party, it is resolved by the
claimed that comes to state in its allegations to the initial agreement, with total
rotundity, which is protected by the legitimate interest of the entity (article 6.1.f) of the

RGPD) “the sending of commercial communications of own products or services or
of third parties, [...], when it is carried out by postal means ... ”(The underlining is
our)

Well, as has been stated, for this Agency, the commercial communication that the
claimant received from the defendant and that has given rise to the present proceeding

sanctioner is an example of direct marketing. In the present case, the
treatment carried out by the complained party, in principle, since obviously no
there is consent of the interested party, it could only be protected in the concurrence
of the circumstance of article 6.1.f) of the RGPD.


However, it has been proven in the file that the claimant, a client of the
claimed, he addressed her on 11/04/2018 through the channel enabled for such
purpose and communicated his wish not to receive commercial information or communications
advertising (Proven fact 3) Likewise, it is proven in the file that the
The complainant responded to the complainant in writing dated 11/21/2018 that he had attended
"Fully" your request not to receive information of a commercial nature or

advertising of the entity. (Proven fact 3)

At the same time, it is proven that almost two years later, on 02/11/2020, the
The claimant received a letter from the claimant through the postal mail with which he
sent, in addition to information about the products that had contracted with her -in

compliance with the obligations arising from the contractual relationship between
Both- information of a commercial nature about the mortgages it sells. Is
commercial information was, therefore, included within the envelope addressed
personally to the claimant; to your name and surname and to your address.


Thus, as a result of the response to the claimant of 11/21/2018, and in accordance with article
21.3 of the RGPD, the respondent lacked legitimacy to process personal data
of the claimant for direct marketing purposes.

In short, the treatment of the claimant's personal data carried out by the
claimed at a later date, February 2020, for direct marketing purposes, not

It could be based on the circumstance of article 6.1.f of the RGPD.

4. In sanctioning matters, the principle of guilt governs in our Law. The
presence of the subjective element as an essential condition to demand responsibility
sanctioning has been recognized by the Constitutional Court, among others, in STC

76/1999, in which it states that administrative sanctions participate in the same
nature than criminal law, being one of the manifestations of the ius puniendi of the
State, and that, as a requirement derived from the principles of legal security and
criminal law enshrined in articles 9.3 and 25.1 of the EC, it is essential to
existence to impose them.


 In turn, Law 40/2015, of October 1, on the Legal Regime of the Public Sector
provides in article 28.1: “They may only be sanctioned for acts constituting a
administrative offense the natural and legal persons, [...], which are

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 40/48








responsible for them by way of fraud or fault. " In light of this precept the
Punitive responsibility can be demanded by way of fraud or fault, being
In the latter case, the mere non-observance of the duty of care is sufficient.


If it is taken into consideration that the respondent has not been able to qualify adequately,
as a direct marketing assumption, the treatment you have carried out with that
purpose of your customers' data, with the consequence of not having respected the
right of opposition exercised by the defendant, the lack of diligence demonstrated is
very serious.


Regarding the degree of diligence that the person responsible for the treatment is obliged to
deploy in compliance with the obligations imposed by the regulations of
data protection, the SAN of 10/17/2007 (rec. 63/2006), after referring to
the entities in which the development of their activity involves a continuous treatment

of customer and third party data must observe an adequate level of diligence,
stated that “… .the Supreme Court has understood that there is recklessness
whenever a legal duty of care is disregarded, that is, when the offender does not
behaves with due diligence. And in the assessment of the degree of diligence,
The professionalism or not of the subject should be specially weighed, and there is no doubt that,
In the case now examined, when the activity of the appellant is constant and

abundant handling of personal data must insist on the rigor and the
Exquisite care to comply with the legal precautions in this regard ”. (The underline
is from the AEPD)

Especially significant is also the SAN of 04/29/2010 which in its Foundation

The sixth legal officer indicated: “The question is not to determine whether the appellant processed the
personal character of the complainant without her consent, such as whether or not she used a
reasonable diligence in trying to identify the person with whom you signed
contract".


In attention to the foregoing, the treatment carried out by the claimed of the data of the
claimant with a direct marketing purpose violated the principle of legality in
relationship with article 6.1.f) of the RGPD, infraction subsumed in the sanctioning type
of article 83.5 RGPD, which states:

"Violations of the following provisions will be sanctioned, in accordance with the

section 2, with administrative fines of a maximum of 20,000,000 Eur or, in the case of
of a company, of an amount equivalent to a maximum of 4% of the volume of
total annual global business of the previous financial year, opting for the one with the highest
amount:
a) The basic principles for the treatment, including the conditions for the

consent in accordance with articles 5,6,7 and 9. "

In turn, the LOPDGDD in its article 72.1.b), for the purposes of prescription, qualifies as
very serious infringement "The processing of personal data without the concurrence of any of
the conditions of legality of the treatment established in article 6 of the Regulation

(EU) 2016/679. "

                                            V


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 41/48








Article 58 of the RGPD, under the heading "Powers", establishes in its section 2 that
“Each supervisory authority shall have all the following corrective powers
listed below:

a) send a warning to any data controller or processor when the
planned treatment operations may infringe the provisions of this Re-
regulation;

b) direct a warning to any person in charge or in charge of the treatment when the
treatment operations have infringed the provisions of this Regulation;

c) order the controller or processor to respond to requests for
exercise of the rights of the interested party under this Regulation;

d) order the person in charge of the treatment that the processing operations
in accordance with the provisions of this Regulation, where appropriate,
in a certain way and within a specified time;

e) order the data controller to notify the interested party of the violations

the security of personal data;
f) impose a temporary or definitive limitation of the treatment, including its prohibition;

g) order the rectification or deletion of personal data or the limitation of processing

pursuant to Articles 16, 17 and 18 and the notification of said measures to the dis-
recipients to whom personal data has been communicated in accordance with article
17, paragraph 2, and article 19;

h) withdraw a certification or order the certification body to withdraw a certificate
certification issued in accordance with articles 42 and 43, or order the certification body
not to issue a certification if the requirements are not met or no longer met.
sites for certification;

i) impose an administrative fine in accordance with article 83, in addition to or instead of the

measures mentioned in this section, according to the circumstances of each case
particular;

j) order the suspension of data flows to a recipient located in a third
cer country or to an international organization. " (The underlining is from the AEPD)


1. Substitution of the fine for a warning.
The respondent has requested in her two pleadings that, in substitution of
the administrative fine provided for in the initiation agreement, the AEPD will direct a

warning and, alternatively, that the amount of the fine be reduced
set in the opening agreement at 50,000 euros. About the first of his
claims we refer to Recital 148 of the RGPD.



The respondent has criticized in the hearing process that the response of the AEPD to her
claim has limited itself to transcribing Recital 148 of the RGPD since it says that
This recital only values two elements: that the fine that could
imposed constitutes a disproportionate burden on the natural person - element
that is not applicable to the case- or that the infraction is minor. He states that in the
present assumption the infraction is slight; indicates that the lightness at which the GDPR is

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 42/48








referred to has nothing to do with the classification that the LOPDGDD makes of the
minor, serious and very serious infractions and that when Recital 148 refers to
the seriousness or lightness of the sanction refers to the cases in which it has been

produced or not a commitment that is particularly relevant to fundamental right
to data protection.

In defense of its position, the complainant mentions document WP253 of the Group of
Article 29, "Guidelines on the application and setting of fines
administrative for the purposes of Regulation 2016/679 ”from which this excerpt transcribes:


      “In recital 148 the notion of 'minor infringements' is introduced. Said
      Violations may constitute violations of one or more provisions of the
      Regulation cited in article 83, paragraphs 4 or 5. However, the
      evaluation of the criteria provided for in article 83, paragraph 2, may give

      place to which the supervisory authority considers, for example, that in the circumstances
      specific circumstances of the case, the violation does not pose a significant risk to
      rights of the interested parties and does not affect the essence of the obligation in
      question. In such cases, the fine may be replaced (although not always) by
      a warning. "
      (The underlining is ours)


This Agency, however, does not consider that the infringement for which it is responsible
the one claimed is slight and even less so that the substitution of the fine imposed is appropriate
for a warning.


In contrast to the factors that the respondent has highlighted, it is worth noting other
especially relevant: It is appreciated that the conduct of the claimed "yes" involves a
serious risk for the rights of the interested parties, in particular for their clients before
the evident lack of protection in which they find themselves in front of a responsible
processes your data for direct marketing purposes despite having exercised

the interested party the right to object to said treatment. There is a serious lack of
diligence of the entity that, by incorrectly qualifying the data processing that
carries out, is unable to respect the rights that the RGPD grants to the holders
of the data. And we are before an entity (both the absorbed entity and its
successor) of great importance from the point of view of the volume of customers and, therefore,
Consequently, of personal data object of treatment.


2. Additional corrective measures to the fine.
Article 83.2 of the RGPD expressly authorizes the control authority to impose,
“In addition” to the administrative fine, the corrective measures provided for in the
Article 58.2 of the RGPD.


The proposed resolution provided that the AEPD would order the complained party, by the
infringement of article 6.1.f) of the RGPD, typified in article 83.5.a of the RGPD, which
adopt "within a maximum period of one month, the necessary measures to adjust its
treatment operations to the provisions of the RGPD; in such a way that it puts

end to the processing of personal data for direct marketing purposes regarding
those clients who have objected to the processing of their data with such
purpose. "


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 43/48








In its allegations to the motion for a resolution, the respondent says (allegation third
of your writing) that such a requirement is impossible to comply with due to the
the extinction of the entity against which the AEPD intends to direct this measure. And adds

that the disappearance of BANKIA from legal traffic means that it cannot carry out
no processing of personal data.

Faced with what was stated by the complained party, it must be indicated that demand that the successor of
BANKIA, in whose legal position it has been subrogated, adopt the “necessary measures
to adjust its processing operations to the provisions of the RGPD; such

a way that ends the processing of personal data for marketing purposes
direct with respect to those clients who have objected to the treatment of their
data for this purpose. " it is from every point of perfect compliance by the current
claimed in the event that at the present time he was carrying out
Data processing analogous to the one that is the subject of this sanctioning file.


In any case, it is recalled that article 83.6. Of the RGPD expressly sanctions the
non-compliance with the resolutions of the supervisory authority.

                                            SAW


In consideration of what is indicated in the previous Basis, for the violation of article
6.1.f, of the RGPD typified in article 83.5.a, of the RGPD, it is deemed appropriate
adopt the following corrective measures against the claimed:

1. In accordance with article 58.2.d) RGPD, order the respondent that, in the

term of one month, counted from the moment this resolution is executive, adopt
the measures that are necessary to adjust its processing operations to the
provisions of the GDPR; in such a way as to put an end to data processing
personal data for direct marketing purposes with respect to those customers who
would have opposed the processing of their data for this purpose.


2. In accordance with article 58.2.i) of the RGPD, impose a fine.
administrative.

The defendant requested in the allegations to the initial agreement that the
amount of the fine and stated that, in determining its amount in

the agreement to initiate the procedure, the principle of proportionality was violated
since the amount of the administrative fine established in it “does not adjust to the assessment of
mitigating and aggravating factors that the agreement itself takes into consideration. "

The respondent argued in this sense that the resolution of PS / 00076/2020 did not
took into consideration the circumstance, which was appreciated in this case as
aggravating, of the link of the activity that the entity carries out with the treatment of

personal data and that in the aforementioned resolution it was clarified that the lack of
The defendant's diligence was "significant", which, it says, is not indicated in the present
case.

Well, in the initiation agreement, when graduating the amount of the fine, the
warned that the circumstances were appreciated "in an initial assessment," and it was

reference not to a significant lack of diligence but to a “serious lack of
diligence". On the other hand, the principle of proportionality requires that there be a
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 44/48








correspondence between the seriousness of a conduct and the sanctioning consequence
attributed to it, so the violation of said principle will occur when such
correspondence does not exist, which does not occur in this case in view of the behavior

offending party and the fine and agreed measure.


3. Determination of the amount of the fine penalty.

In determining the fine to be imposed on the one claimed for the offense
of the RGPD for which you are responsible, article 6.1.f) RGPD, typified in article
83.5.a RGPD, the provisions of articles 83.1 and 83.2 of the
RGPD, precepts that indicate:

"Each control authority will guarantee that the imposition of administrative fines

in accordance with this article for infringements of this Regulation
indicated in sections 4, 9 and 6 are effective in each individual case,
proportionate and dissuasive. "

"Administrative fines will be imposed, depending on the circumstances of each

individual case, as an additional or substitute for the measures contemplated in the
Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine
administrative and its amount in each individual case will be duly taken into account:

a) the nature, severity and duration of the offense, taking into account the

nature, scope or purpose of the treatment operation in question, as well as
such as the number of interested parties affected and the level of damages that
have suffered;

b) intentionality or negligence in the infringement;


c) any measure taken by the controller or processor to
mitigate the damages and losses suffered by the interested parties;

d) the degree of responsibility of the person in charge or the person in charge of the treatment,
taking into account the technical or organizational measures that have been applied by virtue of

of articles 25 and 32;

e) any previous infringement committed by the person in charge or the person in charge of the treatment;

f) the degree of cooperation with the supervisory authority in order to remedy the

infringement and mitigate the possible adverse effects of the infringement;

g) the categories of personal data affected by the infringement;

h) the way in which the supervisory authority learned of the infringement, in
in particular if the person in charge or the person in charge notified the infringement and, if so, in what

measure;

i) when the measures indicated in article 58, paragraph 2, have been ordered
previously against the person in charge or the person in charge in relation to the
same issue, compliance with said measures;

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 45/48









j) adherence to codes of conduct under Article 40 or to mechanisms of

certification approved in accordance with Article 42, and

k) any other aggravating or mitigating factor applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, direct or
indirectly, through the offense. "


Regarding section k) of article 83.2 of the RGPD, the LOPDGDD, article 76,
"Sanctions and corrective measures", establishes:

"two. In accordance with the provisions of article 83.2.k) of Regulation (EU) 2016/679

The following may also be taken into account:

a) The continuing nature of the offense.

b) The linking of the activity of the offender with the performance of treatment of

personal information.

c) The benefits obtained as a result of the commission of the offense.

d) The possibility that the affected person's conduct could have induced the commission

of the offense.

e) The existence of a merger by absorption process after the commission of the
infringement, which cannot be attributed to the absorbing entity.


f) Affecting the rights of minors.

g) Have, when not mandatory, a data protection officer.

h) The submission by the person in charge or in charge, on a voluntary basis, to

alternative dispute resolution mechanisms, in those cases in which
there are controversies between those and any interested party. "

In the assumption analyzed, the concurrence of the following factors that
operate by aggravating the liability due to the entity insofar as they evidence a

greater unlawfulness of their conduct or greater culpability:

-Article 83.2.a) of the RGPD: “the nature, seriousness and duration of the offense
taking into account the nature, scope or purpose of the processing operation,
as well as the number of interested parties affected and the level of damages suffered ”.


The conduct in which the offense attributed to the complained party is specified affects a
basic principle regarding data protection, the legality of the treatment. The
The complainant considers that the commercial communications it sends to its customers
whose content is printed on the same document that supports the data

of the recipient of the letter -document that the claimed identifies as the cover of the
about- do not involve a treatment for the purpose of direct marketing. Taking into account
that according to what he declares they have been sent to all his clients, he has not discriminated

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 46/48








previously if they have opposed the processing of their data for this purpose. What's more,
This extreme forces us to take into consideration the scope of the treatment contrary to the
RGPD made by the complained party, which goes beyond the processing of data from

a single person (the claimant). Along with this consideration included in the proposal
resolution, it was then specified that such extremes prevented this circumstance from
could be applied in an extenuating capacity, as had been applied in the
commencement on the basis that there was no record of damages suffered by the person of the
claimant.


-Article 83.2.b) the intentionality or negligence of the offense;

In the proposed resolution it was stated, regarding this aggravating circumstance, that “
appreciates a serious lack of diligence in the action of the claimed, therefore, attending
to the volume of its activity and the volume of customers, it can be presumed that in its activity

the processing of data for direct marketing purposes is frequent and the assumptions in
those that clients oppose the processing of their data for that purpose. " In the
hearing process, the respondent has stated that we are facing a presumption
lacking probative support that violates the right to the presumption of innocence.

Although, in principle, the reasoning used in the proposal could be

inappropriate for the reasons indicated, this is not an obstacle to appreciate such
circumstance on the basis of the considerations regarding the guilt of the
entity and, in particular, of its very serious lack of diligence, have been made in the
Foundation IV, last section.


It is also highly debatable whether it implies an infringement of the presumption of
innocence the claim that it can be presumed, taking into account the volume of activity
and the volume of clients, which is not uncommon for the complainant to have made
treatments for direct marketing purposes or that had been exercised by someone else
client other than the claimant the right to object to these treatments.

Let us remember that notorious facts do not need to be proven and have that
condition the economic size and the millionaire number of clients of the entity
claimed.

- The evident link between the business activity of the claimed and the
processing of personal data (article 83.2.k, of the RGPD in relation to article

76.2.b, of the LOPDGDD) The activity of the complained party requires that numerous
personal data of their clients so, given the very important volume
business of the claimed financial institution when the events occur, the
The significance of their offending conduct is undeniable.


-Any previous infringement committed by the person in charge or in charge of treatment
(Article 83.2.e of the RGPD)

It is worth mentioning for this purpose, in addition the sanctioning resolution relapsed in the
PS / 00076/2020 for violation of article 5.1.b) of the RGPD, signed on 08/26/2020,

sanctioning resolutions relapsed in procedures PS / 00199/2018, due to
violation of article 6.1. of Organic Law 15/1999, on data protection of
personal character (LOPD) and signed on 06/11/2018 and in PS / 00525/2017, by
infringement of article 64.3 of the LOPD, signed on 04/26/2018.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 47/48









The respondent has criticized in the hearing process the application of this aggravation and
indicates that the facts for which the entity was sanctioned in PS / 00076/2020 nothing

they have to do with those that are the object of assessment in the present case. To that end
We must remember that the provision of article 83.2.e) of the RGPD has a content
other than article 29.3.d) of Law 40/2015.

It operates as a circumstance that mitigates the seriousness of the offense:


-Article 83.2.k, RGPD, in relation to article 76.2.e) of the LOPDGDD: “The
existence of a merger by absorption process after the commission of the
infringement, which cannot be attributed to the absorbing entity. "

On 03/26/2021 - therefore, after the commission of the offense -

registered in the Mercantile Registry the public deed with the merger agreement by
absorption between the claimed (as absorbed entity) and CAIXABANK, S.A., (as
absorbing entity).

Thus, considering the circumstances provided for in article 83.2 of the RGPD,
sections. a), b), e) and k), the latter in relation to article 76.2.b) LOPDGDD, in

aggravating quality of the conduct examined, and the mitigating effect provided in article
83.2.k) RGPD in relation to article 76.2.e) of the LOPDGDD, it is estimated
appropriate to sanction the claimed for the violation of article 6.1.f of the RGPD,
typified in article 83.5.a RGPD, with an administrative fine of 50,000 euros.



Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:


FIRST: TO IMPOSE CAIXABANK, S.A., with NIF A08663619 -before BANKIA, S.A.-,
for an infringement of article 6.1.f) of the RGPD, typified in article 83.5.a of the
RGPD, an administrative fine (article 58.2.i RGPD) for an amount of
€ 50,000 (fifty thousand euros)


SECOND: ORDER CAIXABANK, S.A., with NIF A08663619 -before BANKIA,
S.A. - that, according to article 58.2.d) of the RGPD, within a maximum period of one month from
that the resolution is enforceable, adopt the necessary measures to adapt the
treatment operations carried out in accordance with the provisions of the RGPD, so that
put an end to the treatment for direct marketing purposes of the character data

personal of those clients who have objected to the processing of their data with
that purpose.

THIRD: NOTIFY this resolution to CAIXABANK, S.A., with NIF
A08663619.


FOURTH: Warn the sanctioned person that the sanction imposed by a
Once this resolution is enforceable, in accordance with the provisions of the
Article 98.1.b) of Law 39/2015, of the LPACAP, within the voluntary payment period

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 48/48








established in article 68 of the General Collection Regulations, approved by
Royal Decree 939/2005, of July 29, in relation to article 62 of Law 58/2003,

of December 17, by means of their entry, indicating the NIF of the sanctioned person and the number
procedure that appears in the heading of this document, in the account
restricted number ES00 0000 0000 0000 0000 0000, opened in the name of the Agency
Spanish Data Protection in the banking entity CAIXABANK, S.A .. In case
Otherwise, it will be collected in the executive period.


Received the notification and once executive, if the date of execution is found
Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment
volunteer will be until the 20th of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term

It will be until the 5th of the second following or immediate business month.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure in accordance with article 48.6
of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, the
Interested parties may optionally file an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to
counting from the day after the notification of this resolution or directly

contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.

Finally, it is pointed out that in accordance with the provisions of article 90.3 a) of the LPACAP,
The final resolution may be suspended provisionally through administrative channels if the
interested party expresses his intention to file contentious-administrative appeal.

If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in article 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the

documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency is not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.

                                                                                  938-131120
Mar Spain Martí

Director of the Spanish Agency for Data Protection







C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es