AEPD (Spain) - PS/00255/2021

AEPD (Spain) - PS/00255/2021
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Ley de servicios de la sociedad de la información y de comercio electrónico (LSSI)
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	16.11.2021
Fine:	15.000 EUR
Parties:	Telefónica de España, S.A.U.
National Case Number/Name:	PS/00255/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	CSO

The Spanish DPA (AEPD) fined Telefónica €15,000 for failing to respond to a customer's objection under Article 21 GDPR, who asked several times to stop receiving advertising e-mails.

English Summary

Facts

The complainant was a Telefónica customer and received advertising e-mails from the company. The complainant had not given his consent to receive this type of communication, but Telefónica was entitled to send them according to the Spanish law on electronic communications (LSSI) because there was a prior contractual relationship between the two. However, the complainant had the right to object to receiving this type of communication, which he tried to do several times by clicking on the "unsubscribe" option from the commercial communications received. The e-mails continued to arrive, so the complainant again exercised his right to object via the DPO's e-mail address, but the company continued to send commercial communications to the customer.

Holding

The complainant had the right to object to his data being processed for the purpose of sending him electronic commercial communications. Under Spanish law on electronic communications, Telefónica is required to provide an easy way to object from the communication itself and, if a customer makes use of this option, the communications must stop. However, Telefónica continued to send communications, even though the complainant had also exercised his right to object to the company's DPO. Finally, the AEPD imposed a fine of €15,000 in accordance with the penalty system set out in the LSSI, which takes precedence over the GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                                 1/9










     Procedure No. PS / 00255/2021



                RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following:



                                   BACKGROUND

FIRST: D. A.A.A. (hereinafter, the claimant) dated February 20, 2021

filed a claim with the Spanish Data Protection Agency. The
claim is directed against Telefónica de España, S.A.U. with CIF A82018474 (in
forward, the claimed one).

The claimant states that his right to object to the sending of
commercial and advertising communications.

He adds that he is a Movistar customer and that he has not given their consent for the

sending commercial communications, despite this it has been receiving in its
electronic mail address: *** EMAIL.1, numerous commercial communications.
You have unsubscribed from them through the link that is included in their own
unsuccessful communications as it has continued to receive them.

Faced with the impossibility of unsubscribing, the claimant has exercised his right to
opposition via email addressed to: DPO_Movistar@telefonica.com, the

January 20 and 26, 2021. On February 10, 2021, you receive an acknowledgment of your mail
exercising the opposition and requesting (despite being a client of the entity and having
of this document) copy of your ID. You have continued to receive communications
commercial and at the time of filing this claim had not been
your right to object has been taken care of.

Provide the following documentation:


    - First mail: Screen print of the mail received on November 18
       of 2020 from Movistar Likes *** EMAIL.2 at the address *** EMAIL.1 with

       Commercial information. In the link in the email footer, they send you an email from
       confirmation of non-receipt of advertising mailings "Click on the button
       To accept. You will stop receiving communications from Movistar at this address
       email ”, they send you a confirmation email to unsubscribe and
       confirm.

    - Second mail: Screen print of the mail received on the 25th of
       November 2020 from Movistar Likes *** EMAIL. 2 at the address
       *** EMAIL.1 with commercial information. In the link in the mail footer, they send you

       a confirmation email of non-receipt of advertising mailings "Click on
       the OK button. You will stop receiving communications from Movistar in this


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/9








        email address ”they send you an email confirming that you
        unsubscribe and confirm.

    - Third mail: Screen print of the mail received on December 2
        of 2020 from Movistar Likes *** EMAIL.2 at the address *** EMAIL.1 with
        Commercial information. In the link in the email footer, they send you an email from
        confirmation of non-receipt of advertising mailings "Click on the button
        To accept. You will stop receiving communications from Movistar at this address

        email ”and confirm. Answer the account
        comunicacion@movistar.es indicated as the address for answers. Receives
        Notice of returned mail not delivered.

    - Fourth mail: Screen print of mail received on December 9
        of 2020 from Movistar Likes *** EMAIL.2 at the address *** EMAIL.1 with
        Commercial information. In the link in the email footer, they send you an email from
        confirmation of non-receipt of advertising mailings "Click on the button
        To accept. You will stop receiving communications from Movistar at this address
        email ”they send you a confirmation email to unsubscribe and

        confirm.
    - Fifth mail: Screen print of mail received on December 23

        of 2020 from Movistar Likes *** EMAIL.2 at the address *** EMAIL.1 with
        Commercial information. In the link in the email footer, they send you an email from
        confirmation of non-receipt of advertising mailings "Click on the button
        To accept. You will stop receiving communications from Movistar at this address
        email ”they send you a confirmation email to unsubscribe and
        confirm.

    - Sixth mail: Screen print dated January 20, 2021 answers the
        *** EMAIL.3 account indicated as DPO address. Receive confirmation of
        reception.

    - Seventh mail: Screen print dated January 26, 2021, reply
        indicating that he will go to the AEPD ”.

    - Eighth mail: Screen print of mail received on January 27,
        2021 from Movistar Likes *** EMAIL.2 at address *** EMAIL.1 with
        Commercial information. In the link in the email footer, they send you an email from

        confirmation of non-receipt of advertising mailings "Click on the button
        To accept. You will stop receiving communications from Movistar at this address
        email ”and confirm.

    - Ninth mail: Screen print of mail received on February 3,
        2021 from Movistar Likes *** EMAIL.2 at address *** EMAIL.1 with
        Commercial information. In the link in the email footer, they send you an email from
        confirmation of non-receipt of advertising mailings "Click on the button
        To accept. You will stop receiving communications from Movistar at this address

        email ”and confirm.
    - Screen print dated February 10, 2021 receives a reply from the
        account TE_datos@movistar.es. They ask me for a photocopy of the national document

        Identity or Resident Card in Spain If the procedure is for a
        company, we need CIF and deeds to be provided where the
        administrator of the same and ID of the administrator to unsubscribe.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/9








    - Tenth mail: Screen print of mail received on February 17,
       2021 from Movistar Likes *** EMAIL.2 at address *** EMAIL.1 with
       Commercial information. In the link in the email footer, they send you an email from

       confirmation of non-receipt of advertising mailings "Click on the button
       To accept. You will stop receiving communications from Movistar at this address
       email ”and confirm.


SECOND: Prior to the admission for processing of this claim, a
transferred the defendant on March 30, 2021, in accordance with the provisions

in article 65.4 of the Organic Law 3/2018, of December 5, on Data Protection
Personal and guarantee of digital rights (hereinafter, LOPDGDD), in the
actions with reference E / 03507/2021. The notification is made electronically,
and figure delivered on April 5, 2021 and responds to the request on April 6,
May of the same year.

Subsequently, on May 7, 2021, additional information is requested from the

claimed, responding to the request on May 14, 2021.

THIRD: On May 6 and 14, 2021, the defendant states that: “in
In this sense, a letter has been sent to the claimant in response to the
claim that has given rise to this procedure, to the email address
electronic file provided by the Agency attached as annex document No. 1.

Upon learning of the claimant's request, it was answered with the letter of

Response that appears in the claim and that is attached as annex document No.
2. The claimant claims that he had requested the withdrawal of Movistar Likes, to stop
receive communications about prizes or raffles, and that the
herself. I have to report that no incident has occurred, since, when
the claimant's request was known, the sending of the

mentioned communications to your email address.

It is interesting to highlight that a response was provided to the exercise of the right of opposition
exercised by the claimant through the request addressed to the DPO, requesting the
documentation necessary to be in a position to identify the interested party, such as
as stated in the documentation provided. Regarding the unsubscribe from the newsletter of
movistar likes, consisting of the receipt of communications referring to awards or

raffles, it was processed at the time of having knowledge of the request of the
claimant.

In this sense, the necessary documentation was requested to be in conditions of
identify the interested party, under the provisions of article 12.2 of the RGPD, who
he exercised his right to object by means of a communication addressed to the DPO ”.

FOURTH: In accordance with the provisions of article 65.2 of the Organic Law

3/2018, on Data Protection and Guarantee of Digital Rights (LOPDGDD), in
On May 19, 2021, the agreement of admission for processing of the
claim.

FIFTH: On July 12, 2021, the Director of the Spanish Agency for
Data Protection agreed to initiate a sanctioning procedure for the claimed party, with
in accordance with the provisions of articles 63 and 64 of Law 39/2015, of October 1, of the

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/9








Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of Article 21.1 of the LSSI, typified in the
Article 38.4.d) of the LSSI.


SIXTH: The aforementioned start-up agreement has been notified, and the granting of the extension of the
term presented a brief of allegations in which, in summary, it stated: that the
claimed responded to the exercise of the right of opposition requested by the
claimant, dated February 10, 2021, requesting a copy of the document of
identity, in order to identify the interested party, pursuant to article 12.2 of the

GDPR. A copy of the request to exercise the right and the answer is attached.
mentioned.

That the situation presented by the claimant is due to confusion in relation to his
subscription to newsletters or informative bulletin about raffles and prizes, regarding
the one who supposedly requested the discharge.

They also allege the presumption of innocence and absence of guilt.

SEVENTH: On September 17, 2021, the instructor of the procedure
agreed to open a test practice period, considering incorporated
the preliminary investigation actions, E / 03507/2021, as well as the documents

provided by the claimed.

EIGHTH: On October 6, 2021, the Instructor of the Procedure issued
the Proposed Resolution requesting that the entity be sanctioned
Telefónica de España, S.A.U. with CIF A82018474, for a violation of Article 21.1
of the LSSI, classified as mild in Article 38.4.d) of the LSSI, with a fine of 15,000

euros (fifteen thousand euros).

NINTH: On October 26, 2021, a letter from the
claimed, in which he formulates allegations to the proposed resolution stating that
it is reaffirmed in the totality of what was stated in its previous allegations.


    - A response was given to the exercise of the right of opposition requested by the
        claimant on February 10, 2021, requesting a copy of the document of
        identity.
    - Regarding the cancellation of newsletters or communications, they point out that in the

        procedure there is no supporting documentation confirming the request
        low.
    - They state the absence of the infringement, of the responsibility and the absence of
        intentionality.

TENTH Of the actions carried out in the present procedure, the

accredited the following

                                 PROVEN FACTS

FIRST - The claimant declares on February 20, 2021 that the

The complainant has not attended to his right to object to the sending of communications
commercial and advertising.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/9








SECOND- That he is a client of the claimed party, but he has not given them his consent to
sending commercial communications, despite this it has been receiving in its
electronic mail address: *** EMAIL.1, numerous commercial communications.

You have unsubscribed from them through the link that is included in their own
unsuccessful communications as it has continued to receive them.

THIRD- Faced with the impossibility of unsubscribing, the claimant has exercised his
right of opposition via email addressed to:
DPO_Movistar@telefonica.com, on January 20 and 26, 2021. On February 10
of 2021, you receive an acknowledgment of your mail exercising the opposition and requesting (despite

be a client of the entity and have this document) a copy of your ID. He has continued
receiving commercial communications and at the time of filing this
claim his right to object had not been honored.

FOURTH- From at least the date of November 18, 2020, the claimed, is
aware of the will to cancel the receipt of shipments in the account of
*** EMAIL.1 stating the receipt of emails with commercial content

on the dates of 11/18/2020, 11/25/2020, 12/2/2020, 12/9/2020, 12/23/2020, 01/20/2021,
01/27/2021, 02/03/2021 and 02/17/2021.

FIFTH- It is established that in the sending of commercial communications they send you a
email confirming non-receipt of advertising mailings "Click on the button

To accept. You will stop receiving communications from Movistar at this email address
electronic ”and the claimant confirms and despite this he continues to receive the messages.



                               FOUNDATIONS OF LAW


                                            I

The competence to sanction the commission of the offenses typified in the
Articles 38.3 c), d) and i) and 38.4 d), g) and h) of the LSSI, corresponds to the Agency

Spanish Data Protection, according to article 43.1 of said Law.

                                            II

The defendant is charged with the commission of an infraction for violation of 21.1 of the
LSSI. The literal tenor of this article is as follows:


"1. The sending of advertising or promotional communications by
email or other equivalent electronic means of communication that
had not previously been requested or expressly authorized by the

recipients of the same.

"2. The provisions of the previous section will not apply when there is a
prior contractual relationship, provided that the provider had obtained lawfully
the recipient's contact details and will use them to send communications
commercial related to products or services of your own company that are
similar to those that were initially contracted with the client.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/9








"In any case, the provider must offer the recipient the possibility of opposing the
processing of your data for promotional purposes through a simple procedure
and free, both at the time of data collection and at each of the

commercial communications that you direct.

"When the communications had been sent by email, said
means must necessarily consist of the inclusion of an email address
email or other valid email address where this right can be exercised,
it is forbidden to send communications that do not include said address. "


The offense is typified in article 34.4 of the aforementioned rule, which provides:

4. The following are minor offenses:

[…] D) Sending commercial communications by email or other means of
equivalent electronic communication when such shipments do not comply with the
requirements established in Article 21 and does not constitute a serious offense. "


This offense can be sanctioned with a fine of up to € 30,000, in accordance with the
Article 39.1.c) of the LSSI.

For the purposes of the statute of limitations for infractions, the infraction indicated in the
The preceding paragraph prescribes after 6 months, in accordance with article 45 of the LSSI.

                                             III

Article 21.1 of the LSSI expressly prohibits commercial communications

aimed at the direct or indirect promotion of the goods or services of a company,
organization or person that carries out a commercial, industrial, artisanal or
professional, without the express consent of the recipient, although this prohibition
finds its exception in the second paragraph of the aforementioned article. This prohibition as well
referred to, part of a commercial communication concept that is classified as

service of the information society and to define these concepts, it will be
It is necessary to go to the annexes of the LSSI itself.

The LSSI, in its annex a), defines as an Information Society Service, “all
service normally provided for consideration, remotely, electronically and via
individual request of the recipient.

The concept of information society service also includes the

services not remunerated by their recipients, insofar as they constitute a
economic activity for the service provider.

They are services of the information society, among others and provided that they represent
an economic activity, the following:



[…]

4th The sending of commercial communications


[…] ”.
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/9








And later, in Annex f) it defines the concept of commercial communication of the
Following way:


"F) Commercial communication": any form of communication aimed at promoting,
direct or indirect, of the image or of the goods or services of a company,
organization or person that carries out a commercial, industrial, artisanal or
professional.

For the purposes of this Law, the
data that allow direct access to the activity of a person, company or

organization, such as domain name or email address, or
communications regarding the goods, services or image offered
when they are prepared by a third party and without economic consideration ”.

As can be seen, it will be in those cases in which the communication
commercial does not meet the requirements required by the concept of Company Services

of the Information, when it loses the character of commercial communication. On the one hand,
the data that allow direct access to the activity of a person, company or
organization, such as domain name or email address, and,
on the other, communications relating to the goods, services or image that are
offer when they are prepared by a third party and without economic consideration.

                                           IV


The joint assessment of the documentary evidence in the procedure brings to
knowledge of the AEPD, a vision of the denounced action that has been
reflected in the facts declared proven above related.

However, in response to the allegations presented by the claimed entity,

should note the following:

Regarding the emails sent to the claimant without standing to do so,
that is, the first email sent on November 18, 2020 without the
legitimation necessary for this and the tenth email sent to the claimant,

on February 17, 2021, after having received your request for opposition to receive more
advertising emails, article 21 of the LSSI must be applied, before
mentioned.

In this regard, it is recalled that article 22.1 of the LSSI establishes that: “The

Recipient may revoke at any time the consent given to the
receipt of commercial communications with the simple notification of your will to the
sender."

                                            V

For the purposes of setting the sanction to impose on the claimed party, it is considered that
graduate the sanction to be imposed in accordance with the criteria established in article 40

of the LSSI.

The following aggravating circumstances are considered to be present.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/9








 The existence of intentionality (article 40, letter a), inasmuch as there has been a
lack of diligence on the part of the claimed entity when sending emails to the
claimant without stating the express consent for the sending of communications

commercial.

Likewise, the following mitigating circumstance is considered to occur:

 The nature and amount of the damages caused (article 40, letter d): there is no
evidence of other damages suffered by the claimant, apart from the receipt no
requested of the communication.

Based on the foregoing, it is considered that the penalty to be imposed is of
fifteen thousand euros (€ 15,000).


Therefore, in accordance with the applicable legislation and assessed the criteria of
graduation of the sanctions whose existence has been accredited, the Director of the
Spanish Agency for Data Protection RESOLVES:


FIRST: IMPOSE TELEFÓNICA DE ESPAÑA, S.A.U. with CIF A82018474, for
an infringement of article 21.1 of the LSSI, classified as minor in article 38.4.d) of

the LSSI, a fine of € 15,000 (fifteen thousand euros), in accordance with the provisions
in articles 39.1.c) and 40 of the aforementioned LSSI.

SECOND: NOTIFY this resolution to TELEFÓNICA DE ESPAÑA, S.A.U.
with CIF A82018474.


THIRD: Warn the sanctioned person that the sanction imposed must be effective
once this resolution is enforceable, in accordance with the provisions of the
Article 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, within the voluntary payment period indicated in the
Article 68 of the General Collection Regulations, approved by Royal Decree

939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by entering the restricted account number ES00 0000 0000 0000 0000
0000, opened in the name of the Spanish Data Protection Agency at the Bank
CAIXABANK, S.A. or otherwise, it will be collected in a period
executive.

Received the notification and once executive, if the date of execution is found
Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment

volunteer will be until the 20th of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediate business month.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure (article 48.2 of the LOPD),
and in accordance with the provisions of articles 112 and 123 of Law 39/2015, of 1
October, of the Common Administrative Procedure of Public Administrations,
The interested parties may file, optionally, an appeal for reconsideration before the
Director of the Spanish Agency for Data Protection within a month to

counting from the day after the notification of this resolution or directly
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/9








contentious-administrative appeal before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of

the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-administrative jurisdiction, within two months from the
day following notification of this act, as provided in article 46.1 of the
referred legal text.

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of Law 39/2015,
of October 1, of the Common Administrative Procedure of the Administrations

Public, the final resolution may be suspended provisionally through administrative channels if
the interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through
of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-

web /], or through any of the other records provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal-
administrative. If the Agency was not aware of the filing of the appeal

contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.

Mar Spain Martí
Director of the Spanish Agency for Data Protection



































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es