AEPD (Spain) - PS/00273/2021: Difference between revisions

Latest revision as of 14:29, 24 November 2022

AEPD (Spain) - PS/00273/2021

Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 48(1)(b) LGT Article 23 LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	17.08.2021
Published:	19.08.2021
Fine:	20,000 EUR
Parties:	OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L.
National Case Number/Name:	PS/00273/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Carmen Villarroel

The Spanish DPA fined a controller acting on behalf of Vodafone €20,000 for making unsolicited commercial calls to a data subject. The controller failed to adequately check phone numbers against a list of users who did not wish to receive calls.

English Summary

Facts

A data subject filed a complaint with the Spanish DPA (AEPD) for receiving unsolicited commercial calls on behalf of Vodafone. The complainant was registered on the Robinson list, an advertising exclusion system regulated in Article 23 of the Spanish Data Protection Act (LOPDGDD).

The calls were carried out by the subcontractor Oasip on behalf of Vodafone. The agreement between both companies included the obligation of filtering the list of numbers against the Robinson list, to avoid making calls to the people registered.

Holding

The AEPD hold that Oasip is a controller and considered them aware of the problem with filtering the phone-numbers, since it happened seven times in two months without them implementing necessary measures to prevent it from happening again.

The DPA concluded that the company acted for their own benefit, and held them responsible of the infringement. Therefore, and since sending unsolicited commercial communications is forbidden by Article 48(1)(b) of the Spanish Telecommunications Act (LGT) the DPA fined the controller €20,000.

The DPA also noted that it would initiate a different investigation into Vodafone in relation to the same events, in order to determine whether Vodafone had acted appropriately.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/25

 Procedure No. PS / 00273/2021

RESOLUTION OF SANCTIONING PROCEDURE

Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following

BACKGROUND

FIRST: A.A.A. (hereinafter, the claimant), dated July 29, 2020,
filed a claim with the Spanish Data Protection Agency (number of
check-in 026921/2020) for the reception of commercial calls not
desired on behalf of VODAFONE ESPAÑA, S.A.U. (hereinafter, claimed), in

the following terms:

- The telephone number where calls are received, *** TELEPHONE 1, is
is registered in the advertising exclusion system responsibility of the
Spanish Association of the Digital Economy (hereinafter Robinson list).

- On June 19, 2020, he received two calls, at 1:53 p.m. and 3:21 p.m.
hours, from the telephone number *** TELEPHONE. 2. On the same date,
at 2:22 p.m., he received another call from the phone number
*** PHONE. 3.

- On July 21, 2020, he received a call, at 3:49 p.m.,
from the telephone number *** TELEPHONE. 2. On the same date, at
18:38 hours, received another call from the phone number
*** PHONE. 3.

- On June 20, 2020, he received two calls, at 3:21 p.m. and 6:58 p.m.
hours, from the telephone number *** TELEPHONE. 2.

- On July 15, 2020, he received two calls, at 3:53 p.m. and 4:40 p.m.
hours, from the telephone number *** TELEPHONE. 2.

- On July 21, 2020, he received a call, at 3:49 p.m.,
from the telephone number *** TELEPHONE. 2.

Relevant documentation provided by the claimant:

- "Contract form for Orange market services
Residential ”dated October 2, 2012 in which it is linked to the
claimant's phone number *** PHONE. 1.

- Certificate dated June 22, 2020 in which "the List Service

Robinson ”states, among other issues, that the telephone number
*** TELEPHONE. 1 assigned to the claimant is registered in the section
corresponding to the telephone channel since January 16, 2020.

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 2/25

SECOND: In view of the facts denounced in the claim and the
documents provided by the claimant / of the facts and documents of which he has
this Agency, the Subdirectorate General for Data Inspection, has come to know

proceeded to carry out preliminary investigation actions for the
clarification of the facts in question, by virtue of the powers of investigation
granted to the control authorities in article 57.1 of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter RGPD), and of
in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of

digital rights (hereinafter LOPDGDD).

As a result of the investigative actions carried out, it is verified that the
responsible for the treatment is the claimed one.

BACKGROUND

Claim entry date: July 29, 2020.

Claimant: A.A.A.

Claimed: VODAFONE ESPAÑA, S.A.U.

Facts according to the claims of the claimant:

The antecedents that appear in the information systems are the following:

In the framework of procedure E / 06811/2020, dated September 7, 2020, the
AEPD, by virtue of article 65.4 of Organic Law 3/2018, of December 5, of
Protection of Personal Data and guarantee of digital rights, gave transfer of the
claim to the defendant. This one, in response of October 9, 2020 (number of

entry record in the AEPD O00007128e2000005586) stated, with respect to the
Claimant's telephone line that “[…] was listed on the official Robinson list
ADigital since June 19, 2018. However, it has been verified that
was not registered on Vodafone's internal Robinson list, having been registered
on September 9, 2020, as a result of the entry of this claim. ”.

In addition, in relation to the calling numbers, it states that “we have verified that
some of the lines of origin of the received calls are
associated with the following collaborator: Casmar […] this collaborator does not discuss the bases of
data provided by Vodafone, but use their own databases ”.

He adds that this situation "has led them to immediately begin to consider
solutions and measures to be applied in relation to this collaborator, in order to avoid
unwanted calls continue to occur. […] Have been implemented since
January 2020 the following actions:

- Force all collaborators door to door by contract to emit
calls from Vodafone numbers through a Voice IP operator
made available to you by Vodafone. In this way, through the system of
dialing, you can filter with Robinson lists the databases of

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 3/25

campaign recipients. This is so because the databases used for
acquisition are owned by the collaborator and since Vodafone does not provide them with
databases, we understand that it is the best solution to ensure filtering.

We attach as a single document the communication sent to our
door to door collaborators reiterating their data protection obligations
and privacy and urging them to review their data processing processes at
name of Vodafone in order that they comply with all the
requirements of current regulations on the protection of personal data, such and

as regulated in the contract signed with Vodafone and in the processes and
current working procedures between both entities.

- Since all sales made by these door to door collaborators
door are audited by a supplier outside these collaborators, it has been

worked on carrying out a development so that sales can be compared in the
systems, rejecting those that have not been made through the operator
of Voice and therefore there is no certainty that it meets the requirements of
filtered out. In this way, it could not be the case that sales arrived for
load into our systems, which come from calls that have not been made
from the Vodafone numbers. This way it can be ensured that all traffic

is controlled and complies with the requirements dictated by Vodafone,
discouraging the use of numbers not authorized by Vodafone and, for
Therefore, the previous non-filtering with the advertising exclusion lists.

Likewise, on September 17, 2019 we met in person with the

responsible for three distributors of the door to door channel: Casmar, Three Quartets and
Solivesa, to reiterate the obligations that correspond to them when they perform
pick-up calls in the name of Vodafone, even if the databases are yours.
In addition, the objective of said meeting was to obtain commitments for their part of improvement
of its controls and processes to ensure that cases such as those that constitute this

complaint will not happen again in the future. "

The defendant has attached to the letter a copy of an email sent on 30
July 2019 to collaborators in which he urges them to review their processes,
transfer the obligations to your staff and verify that the data processing
performed on behalf of the claimed person "complies with current regulations,

with the contract signed between both parties, and with the processes and procedures of
current work between our companies ”. The statement specifies the following:

"On this occasion and with this statement we want to make special focus on the possible
calls that they may be making to potential clients for the purpose of

recruitment and remind you of the obligations that must be strictly adhered to in your
execution:

A) In the event that they process databases of potential customers that Vodafone
facilitates directly must:

- Use them during the stipulated time and exclusively for the campaign
indicated. These databases are previously filtered by Vodafone both with the
internal Robinson database as well as the Robinson database of

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 4/25

ADigital in order to ensure that none of the potential clients have
communicated your wish not to receive commercial calls or messages. Yes
later these databases are used in future campaigns, these
they may be out of date and pose a high risk of penalties.

B) On the other hand, if they make calls using their own databases
data, not provided by Vodafone, you must ensure that:

- That they have the prior and express approval of Vodafone to carry out
said calls.

- That they have the data in a lawful way, informing and obtaining the
consent of the holders to be able to carry out commercial actions in
Vodafone name. We remind you that the use of databases is prohibited.
data for capture purposes on behalf of Vodafone that do not comply with this
requirement.

- Filter your databases with public Robinson lists, for example, the
managed by ADigital, prior to the start of the campaign.

- Do not use means of communication that have not been consented to by the
campaign recipients.

In both scenarios, it is essential that the collaborator:

- Provide a simple means for any recipient of the
campaign can communicate their willingness not to continue receiving calls or
commercial messages on behalf of Vodafone.

- Immediately transfer the data of those recipients to Vodafone
that they have been informed that they do not wish to receive further communications
commercials and ensure that they do not contact them again in future
emissions.

- In the case of telephone contact, scrupulously comply with the
current regulations on consumer rights, and in particular,
make calls:

 within the legally permitted hours (Monday to Friday working days,

from 9:00 a.m. to 9:00 p.m.).
 from an identifiable number.
 identifying the call as commercial in nature.

Additionally, we remind you that you must comply with each and every one of the

obligations that correspond to you as processors according to the
European Regulation 2016/679 (RGPD) and that have been transferred to you by Vodafone
contractually.

Finally, it is important that you provide us, if you have not already done so, in a

immediate all the numbers through which they make calls to customers and
C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 5/25

potential clients since from Vodafone we are creating a database
identifying each collaborator with the telephone numbers associated with it.

Vodafone cannot maintain its contractual relationship with those collaborators who
do not strictly comply with these obligations, so we also

We reserve the possibility of auditing, at any time, the performance of the
data processing activities that collaborators carry out on their behalf, in order to
to verify strict compliance with these requirements. Likewise, Vodafone
reserves the right to take any legal actions that correspond to it in the case
receiving any type of sanction from the Spanish Agency for the Protection of
Data or direct claims of the recipients if they cause the

breach of the obligations of a Vodafone collaborator ”.

PARTICIPANTS

In addition to complaining and complaining, the following have intervened in these proceedings:

- CASMAR TELECOM S.L. (hereinafter Casmar)
- COLT TECHNOLOGY SERVICES S.A. (hereinafter Colt)
- OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L. (onwards
Oasip)
- INSURANCE BROKER COMPARATOR RASTREATOR (hereinafter

Tracker)
- RYV CALL CONECTION E.I.R.L. (hereinafter Ryv)
- THREE-QUARTERS FULL S.L. (hereinafter ThreeQ)

RESULT OF RESEARCH ACTIONS

According to the information obtained from the Registry of Numbering and Operators of
Telecommunications of the National Commission of Markets and Competition
Calling phone numbers *** PHONE.2 and *** PHONE.3 are found
assigned to the telecommunications operator Colt.

In relation to the originating telephone number *** TELEPHONE.2 and the calls subject to

claim, the following information has been obtained:

- Colt informs, dated March 11, 2021 (written with number of
entry record in the AEPD O00007128e2100011184), of the following:

 The ownership of the telephone number *** TELEPHONE. 2

corresponds to Oasip.
 Confirms the completion, on June 20, 2020, of four
phone calls from *** PHONE. 2 to *** PHONE. 1 between
7:00 p.m. and 7:02 p.m.

 Confirms the completion, on July 15, 2020, of a
phone call from *** PHONE. 2 to *** PHONE. 1 at
15:50 hours.
 Indicates that there are no calls from the number
*** TELEPHONE.2 to *** TELEPHONE.1 on June 9 and July 21,

2020.
C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 6/25

- Oasip informs, dated March 16, 2021 (written with number of
entry record in the AEPD O00007128e2100011983), of the following:

 Oasip is a provider of telephone lines to clients.

Oasip's professional activities do not include that of
carry out "telephone promotion campaigns or similar services".
 On February 6, 2010, Oasip signed an assignment contract and
transfer of telephone lines and virtual switchboard with the client with

Casmar.
 Between the telephone lines assigned and assigned to Casmar as part
of the contract you will find the telephone number *** TELEPHONE. 2.
 Indicates that there are no calls from the number *** TELEPHONE. 2 to
*** PHONE. 1 on June 9, 2020.

 Confirms the realization, on June 19, 2020, of a call
from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:21 p.m. 62
seconds long.
 Confirms the realization, on July 15, 2020, of two calls
from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:23 p.m. and 4:40 p.m.

9-second hours.
 Confirm the realization, on July 21, 2020, of a call
from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:49 PM 48
seconds long.

- Casmar informs, dated May 4, 2021 (written with number of
entry record in the AEPD O00007128e2100020301) of the following:

 It states that "In our files there is no data or record
of calls made to the telephone number *** TELEPHONE.1 ”. Attached

the document “ANNEX I.- Screenshot of the voice ip CRM” in the
no results listed as a result of the call search
made from the number *** TELEPHONE.2 to *** TELEPHONE.1 between
on June 1 and July 31, 2020.
 It also describes the following procedure:

“As a result of the procedure with File number No.: E / 08519/2019,
Vodafone implemented the following measures:

• Force all collaborators to make calls from
VODAFONE numberings, to be able to filter with the Robinson lists
the databases of campaign recipients.

• Carry out a development so that the supplier can check
prior to loading the sale into the systems, that there has been a
Call from an authorized agency number to the potential client. From
this way, it cannot be the case that sales are loaded
that come from calls that have not been made since

VODAFONE numberings. Thus it can be ensured that all
traffic is controlled and meets the requirements dictated by
VODAFONE.

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 7/25

For this, VODAFONE obliges all collaborators who have the
consideration of the Call Center to sign a contract with the company,
referred to in the previous point, OASIP SERVICIO INTEGRAL DE
COMUNICACIONES S.L (also known simply as OASIP)
that supplies the [sic] Voice Ip solutions and filtering through the

advertising exclusion files. Without such a contract the company
Telefónica does not authorize the subcontracting of the treatment of
teleshopping.
Through this procedure VODAFONE ensures that calls
that are carried out are legal and are not carried out to any number [sic] that is
find it in advertising exclusion lists, it also allows you to

a traceability of the calls made. "

In relation to the originating telephone number *** TELEPHONE.3 and the calls subject to
claim, the following information has been obtained:

- Colt informs, dated March 11, 2021 (written with number of
entry record in the AEPD O00007128e2100011184), of the following:

 The ownership of the telephone number *** TELEPHONE.3 corresponds to
Rastreator.
 Confirms the making, on June 20, 2020, of two calls

phone numbers from *** PHONE. 3 to *** PHONE. 1 at 19:02
hours.
 Indicates that there are no calls from the number *** TELEPHONE. 3 to
*** PHONE. 1 on June 19, 2020.

- Rastreator informs, dated March 15, 2021 (written with number
entry registration in the AEPD O00007128e2100011901) that the number
*** TELEPHONE.3 “does not correspond to any telephone line owned or
assigned to Rastreator on the date the calls were made. " Add that
Rastreator has contracted with Oasip the telephone traffic service from

October 2018 and attaches a certificate signed on March 15, 2021 by
Oasip in which it states:

 “That the line corresponding to the telephone number *** TELEPHONE.3
is assigned to another OASIP client, different from

RASTREATOR, before June 20, 2020 "
 “That when the telephone line corresponding to the number
*** TELEPHONE. 3 assigned to another client, RASTREATOR has not been able to
make any outgoing calls from this phone number, in
date June 20, 2020. "

- Oasip informs, dated March 18, 2021 (written with number of
entry record in the AEPD O00007128e2100012613), of the following:

 Oasip is a provider of telephone lines to clients.
Oasip's professional activities do not include that of

carry out "telephone promotion campaigns or similar services".

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 8/25

 On November 14, 2019, Oasip signed an assignment contract and
transfer of telephone lines and virtual switchboard with the client with
ThreeQ.
 Between the telephone lines assigned and assigned to ThreeQ as part

of the contract you will find the telephone number *** TELEPHONE. 3.
 Confirms the realization, on June 19, 2020, of a call
from *** PHONE. 3 to *** PHONE. 1 at 2:22 p.m. from 32
seconds long.
 Confirms the realization, on June 20, 2020, of a call

from *** TELEPHONE.3 to *** TELEPHONE.1 at 18:38 hours 66
seconds long.
 Confirm the realization, on June 26, 2020, of a call
from *** TELEPHONE.3 to *** TELEPHONE.1 at 3:20 p.m. 43

seconds long.

- ThreeQ reports, dated March 30, 2021 (written with number
entry registration in the AEPD O00007128e2100014452), of the following:

 Attached, annex document number 4, a copy of an email

Sent on March 18, 2021 by a department employee
commercial of Oasip in which the existence of a
66-second call on June 20, 2020 at
18:38 hours from *** TELEPHONE.3 to *** TELEPHONE.1.
 The reason why the phone calls were made from the

*** TELEPHONE.3 to *** TELEPHONE.1 was “the acquisition of customers
new for Vodafone ”.
 ThreeQ has not processed the personal data of the number holder
*** TELEPHONE.1, but it is your “collaborator who acquires the Base
of data".

 Attached, annex document number 3, a copy of the contract signed on
July 29, 2019 between ThreeQ and Ryv (the latter would have been the
"Collaborator" referred to above and who would have dealt with the
phone number *** PHONE. 1). It includes the following (the
reference to "the agent" is to be understood as ThreeQ; the reference to “the

collaborator ”is to be understood as Ryv):

“[…] THE AGENT carries out its commercial activity in the sector of the
telecommunications, commercial distribution and landline telephony and
mobile phone and complementary products, network connection,
communication and its accessories […] "

“[…] THE COLLABORATOR, develops his professional activity of
distribution on own account, in the different sectors of commerce,
its general content being the promotion and conclusion of operations
sales that have been entrusted to him […] "

"For the action of subagents, the express authorization will be required
of THE AGENT, responding THE COLLABORATOR of the management
performed by the designated person. "

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 9/25

"The duration of this contract is for a specified time, with
extinction on December 31, 2019. It will be extended for periods of
one year if either party has not expressed its Intention to
cancel it by giving two months' notice. "

“THE AGENT provides in this act the product catalogs and
services and commercial prices, to carry out sales, all of this
must be returned by the commercial agency at the end of the
present contractual relationship. "

"Commissions will accrue monthly,

calculated on the set of clients that have contracted and
Installed any of the Services during the period Immediately
preceding."
"The parties undertake to respect the legislation at all times
in force regarding the protection of personal data, in the

context of this contract. "

 ThreeQ, “as indicated by Vodafone”, what it does is “facilitate the
minutes trunk that takes the Robinson filter to the collaborator so that
all your calls go through there ”. In this regard, he adds that “what
we do is to facilitate the minutes with the OASIP company which has

Robinson filter. When trying to make calls with it, if the
client was on said Robinson list the call cannot be
make."

 Attached, annex document number 2, a copy of the “CONTRACT OF

PRESENTIAL CHANNEL SERVICE PROVISION ”between the
claimed and ThreeQ for the period (as stated in the third clause
of the same) from June 1, 2020 to March 31, 2021.

The clause of the contract specifies the following (such as
"COLLABORATOR" for the purposes of the following text should be understood

ThreeQ):

"The object of this contract is commercial promotion, both
telephone as well as in person, from the VODAFONE Services to the
COLLABORATOR's portfolio, so that they are hired by the

Customers and consumers on a recurring and consolidated basis. "

“[…] The COLLABORATOR will have its own databases of
potential clients who must comply with the established requirements
by the applicable regulations on data protection and to those who
will offer VODAFONE services in the event that they

show your interest. Therefore, the CONTRIBUTOR must present
to such potential clients on their own behalf, such as
responsible for their treatment, complying with the
applicable regulations regarding the protection of personal data. "

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 10/25

“At the beginning of this contract, the EMPLOYEE has
with the third collaborators listed in Annex II of this
contract."

"The COLLABORATOR must expressly communicate to VODAFONE

the new incorporations of third-party collaborators that must be
expressly authorized by VODAFONE in accordance with the clause
6.1. Likewise, the COLLABORATOR must send VODAFONE with
quarterly the relationship of third-party collaborators with whom in
that moment counts. "
"The COLLABORATOR may not use third party collaborators,

advertisers, referrers as well as any other figure for the
development of the services provided under this contract
Except for prior, express and written authorization from VODAFONE. If
that the EMPLOYEE subcontracts the services to sub
collaborators of any kind who must access personal data

VODAFONE Clients or VODAFONE systems, the same
must be previously authorized by VODAFONE as indicated
in Annex IV of this contract, having to sign a contract
by means of which the same subcontractors are transferred
obligations regarding the protection of personal data that the
imposed by VODAFONE. The COLLABORATOR, within thirty

(30) days from the effective date of this contract,
must issue and deliver to VODAFONE certification or declaration
responsible in which it manifests and declares:

(i) that he has subscribed with his sub-collaborators the corresponding
contracts regarding the protection of personal data in the

that all the obligations required by
VODAFONE in accordance with the provisions of clause 13
and Annex IV of this contract, as well as
(ii) that he has transferred to his sub-collaborators the obligations
established in Annex III of this contract regarding
Anti-Corruption Policy, Economic Sanctions and Security

Corporate Likewise, the COLLABORATOR must deliver without
undue delays, all evidence of compliance
that are requested by VODAFONE at any time.

The authorization of the sub-processors of the treatment by VODAFONE
is conditional on delivery by the COLLABORATOR to

VODAFONE of the certification or responsible statement referred to in the
maximum term of thirty (30) days. VODAFONE authorization
will be automatically revoked in relation to that / those
sub-manager / s that the CONTRIBUTOR does not include in the aforementioned
certification or responsible declaration.

For the incorporation of new treatment sub-managers during
the validity of the contract, it will be an essential requirement that the
COLLABORATOR deliver the certification or declaration to VODAFONE
responsible person referred at the same time of requesting authorization

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 11/25

so that it can expressly authorize and in writing, where appropriate,
the subcontracting of services to third-party collaborators for the
development of the services that are the object of this contract. "

"VODAFONE will accept how many new Clients in Services that are
have been carried out through the COLLABORATOR in accordance with the
Client validation procedure, the minimums of which are described
in this contract. In any case, the CONTRIBUTOR must
check and fill in the Customer's data in the contract to

proceed to contract the Services, without any doubt
reasonable about your personality, ability and accreditation to
hire."

"The COLLABORATOR must inform VODAFONE at all times

of all those phone numbers that both the COLLABORATOR
as their third-party collaborators use to contact Clients or
Potential VODAFONE Clients in the development of the target activity
of this contract. In this sense, the use of numbers of
phone not previously informed to VODAFONE will be understood
as a breach of contract.

VODAFONE reserves the right to verify that sales
carried out are carried out through marking systems that
guarantee compliance with the data protection regulations of
all calls made by the EMPLOYEE to their bases of

data, excluding those that have not been made through these
systems of the right to obtain the corresponding economic incentive
as established in the economic conditions agreed between
the parts."

"In any case, the COLLABORATOR undertakes to observe the
how many provisions are applicable to the activity carried out and
to the resources it uses for it, and in particular it is obliged to
comply, as an essential obligation, the regulations, the
VODAFONE and other procedures detailed in the clause
6.1, Annexes III and Annex IV of this contract, committing to the

strict compliance with VODAFONE's anti-corruption policy as
of the current regulations on data protection and
consumers that he obliges himself, as well as all his
employees, collaborators and / or subcontractors, where appropriate, to comply with the
highest legal and ethical standards in the realization of the object of the

this contract. "

"Without prejudice to the provisions of clause 5.1. of this contract and,
as a consequence of the provision of the services that constitute the
object of this contract, the COLLABORATOR at the time of

to carry out the contracting of the VODAFONE Services,
will proceed to collect certain personal data from people
that, through you or your collaborators, in accordance with the
Clause 6.1 of this contract, contract the Services of

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 12/25

VODAFONE. To do this, you can access the VODAFONE systems
in order to manage the Clients registered. For this reason
and in accordance with current regulations, the COLLABORATOR will have
the consideration of data processor for the management of the
Customer registration in VODAFONE systems, having to formalize

for this purpose the standard data treatment agreement that is attached
as Annex IV, through which its obligations are included in this
matter. In the event that the EMPLOYEE subcontracts the
services to sub-collaborators of any kind who must access
personal data of VODAFONE Clients or to systems of
VODAFONE, they must be previously authorized by

VODAFONE must comply with the COLLABORATOR strictly with the
established in clause 6.1 and Annex IV of this contract. "

"THE COLLABORATOR shall hold VODAFONE harmless from any
damage derived from non-compliance by the COLLABORATOR or

of its third-party collaborators, of any of the obligations
provided for in this clause or in the annexes of this contract,
and in particular for any sanction imposed by the Spanish Agency
of Data Protection. "

Annex II of the contract, entitled "THIRD EMPLOYEES", no

includes no collaborator (“No collaborators”).

Annex IV refers to the "DATA PROCESSING AGREEMENT
PERSONAL DE VODAFONE ”between the defendant and ThreeQ de
application to the processing of personal data whose purpose is the Registration
of Vodafone products and services.

- ThreeQ performs, dated May 24, 2021 (written with number of
registration in the AEPD O00007128e2100023277), the following
statements in relation to this case:

 “As a result of the procedure with File number No.:

E / 08519/2019, Vodafone implemented the following measures:

 Force all collaborators to make calls from
VODAFONE numberings, to be able to filter with the lists

Robinson's campaign recipient databases.

- Carry out a development so that the supplier can check before the
load of the sale in the systems, that there has been a call from a number
authorized from the agency to the potential client. In this way, the
case sales are charged that come from calls that have not been

made from the VODAFONE numberings. This way it can be ensured that everything
traffic is controlled and complies with the requirements dictated by
VODAFONE.

To do this, VODAFONE forced us to sign a contract with the company OASIP
SERVICIO INTEGRAL DE COMUNICACIONES S.L, is attached as Annex I (in

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 13/25

ahead OASIP) which is the provider of the [sic] Ip Voice solutions and
Filtered through the advertising exclusion files. Without such a contract the
telephone company does not authorize the subcontracting of the treatment of

teleshopping.

On the other hand, VODAFONE itself established a mechanism added to the
described above for querying numberings that should not be performed
a so-called “DrTool” which started working in October 2020.
This tool obliges all collaborators to previously upload the list of

potential calls to be made to exclude those numbers that the own
company has listed on an advertising exclusion list. When the
information has already been consulted, a list with the numbers is returned
accepted to make the call through the provided ip voice system
by the company OASIP.

Through this procedure, VODAFONE ensures that calls made
carried out are legal and are not carried out to any number [sic] found in
advertising exclusion lists or numbers that have expressed directly to
VODAFONE who do not want to receive more publicity.

A copy of the e-mails where the details of the
start of the procedures described, as well as different instructions indicated
by VODAFONE for the use of the same.

On the other hand, a copy of the contract with RYV CALL is attached as Annex III

CONECTION, EIRL where their obligations as managers of the
treatment.

[…] It should be noted that our entity has terminated the contract for the provision of
services with VODAFONE so today it does not have any

current subcontracting.

However, despite the above, the last complete list of
collaborators referred to VODAFONE as annex IV. Highlight that the
Interlocutor of VODAFONE, B.B.B., is the one who asked us for a copy of the contracts
of the collaborators with whom we work and in no case never stated

that we should stop working with any of the collaborators. What's more,
from OASIP, VODAFONE has access to the call numbers assigned to
each of the collaborators. Therefore, the authorization was always tacit, since
that despite the fact that VODAFONE had evidence of our collaboration network
he never expressed any opposition. "

 Attached, document annex I, copy of the contract signed on
November 2019 between Oasip and ThreeQ. There is no mention in it
the responsibility on the application on the filtering of numberings
based on the Robinson lists provided by Vodafone. As an object of

contract includes the following (understand for these purposes ThreeQ by
"THE CLIENT"):

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 14/25

"By this contract, THE CLIENT, may access the services
that OASIP sells that allows all its telephone traffic to be handled,
as well as the virtual switchboard services described in Annex I. Thus
itself, as they are implemented, the user may
access other additional services under the conditions and prices that

in your case, look at it. "
 Attached, Annex II document, a set of emails
exchanged in connection with the implementation of the measures
that Vodafone would have established. They are briefly summarized to
continuation:

o Email dated October 23, 2019 sent from the
address B.B.B. @ vodafone.com in which you request that, “as
maximum on November 15, the entire commercial structure that
make calls do it through trunks that have

from Vodafone's robinson list filter ”.
o Emails from October 24 and November 18,
2019 sent from address *** EMAIL.1 with subject
“Robinson filtered calendar” in which the commissioning is planned
march of the measures dictated by Vodafone.
o Email dated January 20, 2020 sent by C.C.C.

in which it is indicated that the new Vodafone operation would enter
in force on January 27, 2020. It adds that “Those who are not
within this new operation you will not be able to manage sales in
the Vodafone channel, neither here nor at any other distributor. "

 Attached, annex III document, copy of “ANNEX I - AGREEMENT TO
THE PROCESSING OF PERSONAL DATA ”signed on 29
October 2019 between ThreeQ and Ryv (referred to in the document as
"THE COLLABORATOR"). This document incorporates, among others, the
Next information:

"(A) That in accordance with the provisions of clause 13 of the
Service Provision Contract of which this annex brings cause, in
in relation to clause 13 of the Agreement between THREEQ and Vodafone, the
The person in charge of treatment must comply with the obligations that
set out in this Annex.

(B) That THE COLLABORATOR for the performance of its services
will act under the condition of Treatment Manager, since
will process Personal Data, in the name and on behalf of THREEQ and / or
Vodafone. "

"1.4. THE COLLABORATOR will carry out its activity by committing to:
1.4.1. Use personal data when they are
found in one of the following cases:

a) They appear in any of the sources accessible to the public considered
in the regulations and the interested party has not expressed their refusal or

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 15/25

opposition to your data being processed for the
activities described in this section.

Sources accessible to the public should be understood as the guides of
electronic communications services, under the terms provided by
its specific regulations; and lists of people belonging to
groups of professionals that contain only the data of
name, title, profession, activity, academic degree, address
professional and indication of their membership in the group. The direction

professional may include the details of the full postal address, number
telephone, fax number and email address.

b) Have been provided by the interested parties themselves or obtained with their
consent for specific, explicit and legitimate purposes

related to advertising or commercial prospecting activity,
having informed the interested parties about the specific sectors
and specific activities regarding which you may receive information or
advertising.

c) Are not included in advertising exclusion services of

consumers such as the Robinson List or other services or lists
analogs. "

“1.4.4. To be able to execute the services described in the present
contract, the Collaborator must make all calls through

Ip Voice services provided by the company OASIP. "

"7.1. In the event that the data processing carried out by EL
COLLABORATOR is carried out outside the territory of the European Union,
The latter must formalize the standard international transfer clauses

of data collected in "Appendix 3". "

 Attached, document annex IV, email dated May 28,
2020 listing ThreeQ contributors including
Ryv.

- On May 6, 2021, a request for information is sent to Ryv
in relation to the calls under investigation in this report without
response has been obtained.

THIRD: By Agreement dated June 10, 2021, the Director of the Agency
Spanish Data Protection Agency agreed to initiate a sanctioning procedure at the
claimed for the alleged violation of Article 48.1.b) of the LGT of Law 9/2014,
of May 9, General of Telecommunications (hereinafter LGT). The facts
exposed could imply a violation of Article 48.1.b) of the LGT, typified in the
Article 77.37 of the LGT (serious offense), which may be sanctioned with a fine of

up to 2,000,000 euros, in accordance with article 79.1.c) of the same LGT.

FOURTH: On 7/7/2021, OASIP presented allegations to the agreement to initiate the
sanctioning procedure, in summary, in the following terms:

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 16/25

1) << In the agreement to initiate this sanctioning procedure, there has been no
considering the principle of RESPONSIBILITY or authorship, by not directing the actions

against the perpetrator responsible for the infringement committed, but against a company (the
signatory of this writing) with a collateral intervention to the imputed facts, therefore
that we understand ... that the examining body has acted incorrectly since
The file can only be directed against natural or legal persons who
had committed the offense.

Our disagreement with the initiation of this sanctioning procedure lies in the
disagreement with the imputation of responsibility for the occurrence of some
facts in which our intervention is purely "medial" and, specifically, with the
improper application to our business activity of article 23.4 of the LOPDGDD.
The key to this precept and its relationship with the case brought against OASIP is

at the beginning of its literal tenor: "Those who intend to carry out communications
direct marketing "; this activity is completely unrelated to the one carried out
our company. They are the VODAFONE companies and the so-called collaborators of
VODAFONE, among others, CASMAR TELECOM S.L. (hereinafter Casmar) and THREE-
QUARTERS FULL SL (hereinafter ThreeQ) who carry out this activity and
who profit from the services they offer.

Vodafone forces these two distributors or to "filter" these calls
to prevent them from calling user numbers that are included in the Robinson list,
but those are reluctant to subscribe to the List because it is not free,
so Vodafone signs up for the Robinson List service and forces the

distributors to follow the system of action that we describe: Vodafone delivers
directly or OASIP the Robinson listing or through a "flp" and what our
company was a real-time consultation of the call, so that if the number
destination was on that list, the call did not go out and if the number was not there, it went out.

This 'modus operandi' had the problem that this rise by Vodafone of
the Robinson list had to be daily to be up to date, but that was not the case. From
done. They updated it every 15 days so there were periods of time during
which was not up to date, and finally stopped updating it (the last
update was received on 03/9/2020) and the facts that are imputed are dated June and
July 2020. In order to prove what has been said, various emails are provided between OASIP and

Vodafone, among other documents.

Well, making 7 calls out of a total of 520,371 we can qualify it as
punctual and fortuitous incident and not a lack of diligence in the observance of the
action protocols. The more calls made, the more likely it is to

error >>

2) << Violation of the constitutional principle of presumption of innocence, since the
The burden of proof should fall on the AEPD, not just simple statements
general >>.

3) << Violation of the principle of proportionality in the graduation of the sanction, by
how much objective and subjective circumstances have not been taken into account
concurrent regarding the analysis of the circumstances and facts to take into account >>.

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 17/25

4) << Error in the classification of the offense and error in the consideration of the
Sections c) and g) of art. 80.1 of the LGT as aggravating factors >>.

FIFTH: On 07/08/2021, a Resolution Proposal was notified in the following
terms:

<< That the Director of the Spanish Data Protection Agency sanctions
OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L. with NIF B88183660, with

fine of € 20,000 (twenty thousand euros) for the violation of article 48.1.b) of the LGT, in
relationship with Article 23 of the LOPDGDD, typified in Article 77.37 of the LGT
(serious offense). >>.

SIXTH: On 07/22/2021, OASIP submitted allegations to the Proposal for
Resolution, in summary, in the following terms:

1) The proven fact Third and Fourth of the proposed Resolution are not

accredited. The person responsible for the alleged infringement is Vodafone, as it is the
competent as responsible for the treatment now analyzed (filtered by
robinson listing)

2) Violation of the principle of Responsibility, as Vodafone is responsible

of the imputed facts.

3) Violation of the fundamental right to the presumption of innocence. The AEPD
it has not proven "incontrovertibly who made the calls."

4) Violation of the principle of proportionality and duty to state the amount of
The sanction.

5) Improper application of art 77.37 of the LGT. The offense must be, in all
case, classified as mild according to art. 78.11 of the LGT.

6) Improper application of sections c) and g) of art. 80.1 of the LGT as
aggravating factors. The seven unwanted calls that are imputed involved a
profit of € 0.0083. Wrongful responsibility is inconsistent with
serious typing. In the present case, OASIP meets all the criteria for
attenuation indicated in art. 80.1 of the LGT.

In view of all the actions, by the Spanish Agency for Data Protection
In this proceeding, the following are considered proven facts,

PROVEN FACTS

FIRST: The claimant, dated 07/29/2020, filed a claim with the
Spanish Data Protection Agency (entry registration number

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 18/25

026921/2020) for receiving unwanted commercial calls on behalf of the
VODAFONE ESPAÑA, S.A.U. (VDF).

SECOND: The phone number where the claimant receives calls,
*** TELEPHONE. 1, is registered in the advertising exclusion system
responsibility of the Spanish Association of the Digital Economy (hereinafter listed
Robinson) from the date 01/16/2020.

THIRD: From the calling number *** TELEPHONE. 2, and through the call by

OASIP, the following commercial calls were made to the confirmed claimant.
given by OASIP:

 Confirms the completion, on June 20, 2020, of four tele-
phone calls from *** TELEPHONE.2 to *** TELEPHONE.1 between 19:00 and 19:02

hours.
 Confirms the making, on July 15, 2020, of a telephone call.
ca from *** TELEPHONE.2 to *** TELEPHONE.1 at 3:50 p.m.

FOURTH: From the calling number *** PHONE. 3, and through redirection and
filtering the call by OASIP, the following commercial calls were made to
the claimant confirmed by OASIP:

 Confirms the realization, on June 19, 2020, of a call from

the *** PHONE.3 to *** PHONE.1 at 14:22 hours of 32 seconds duration
tion.
 Confirms the realization, on June 20, 2020, of a call from
the *** PHONE.3 to *** PHONE.1 at 18:38 hours of 66 seconds duration
tion.

 Confirms the realization, on June 26, 2020, of a call from
the *** TELEPHONE.3 to *** TELEPHONE.1 at 15:20 hours of 43 seconds duration
tion.

FIFTH: The aforementioned commercial calls are made in the name and on behalf of

VDF who obliges its treatment managers to redirect all actions
through OASIP in order for this entity to filter the recipients whose
lines are included in advertising exclusion lists (Róbinson or list-
two interns).

SIXTH: The entities in charge of the treatment that act in the name and by account
VDF company for commercial promotions (Casmar and TheeQ), provide a contract with
OASIP by virtue of the obligation acquired with VDF to carry out joint actions
commercial activities on their behalf and in order for said actions to be subject to prior filtering
of the call by OASIP with the advertising exclusion lists (Robinson and Listings
internal VDF).

SEVENTH: VDF has documented the obligation of its treatment managers
(Casmar and TheeQ) to carry out commercial actions on their behalf the contracting
with OASIP to perform pre-filtering of called lines. (Annex I, II and III in
section 1.4.1.c). It consists in allegations by OASIP to the Proposal for Resolution,

that OASIP had knowledge months before (since March) that VDF did not
C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 19/25

updated the list of excluded that it gave him to proceed to the filtering of
calls.

FOUNDATIONS OF LAW

I
In accordance with the provisions of article 84.3) of Law 9/2014, of May 9,

General de Telecomunicaciones (hereinafter, LGT), the competence to initiate and
Resolve this Penalty Procedure corresponds to the Director of the
Spanish Agency for Data Protection.

II

In relation to the allegations presented by OASIP after the initiation agreement, it is
means the following:

1R) First of all, it should be noted that the examining body does not carry out the agreement of
start, but is named precisely in that agreement.

Second, OASIP's factual rating should be viewed as
responsible for the treatment related to the filtering of calls made by the
those in charge of the treatment of Vodafone, concept formulated in the RGPD.

In the present case, OASIP was previously aware of the problems that arose with the

Robinson list provided by Vodafone and continued with the same treatment
on the numbers included in the list, for profit, without correcting the
deficiencies to which he was bound by contract and which continued until July
2020, which has led to the repeated violation (seven times in two months) of
rights and freedoms of the claimant.

Finally, it should be noted that the claimant was included in the Róbinson list since
June 19, 2018, so the successive updates to the date of the events
they did not affect the "modus operandi" of call filtering, since in subsequent
lists provided by Vodafone -updated or not- there was always the line of
the claimant.

Consequently, from the previous inspection actions carried out by this
AEPD is accredited that OASIP is ultimately responsible for the conduct now
analyzed.

2R) In this regard, it should be noted that this AEPD has carried out an exhaustive
prior investigation in order to clarify the responsibilities in the violation of the
rights and freedoms of the claimant and has collected sufficient evidence to
enervate the principle of presumption of innocence. Said investigation and evidence of
position is detailed in the antecedents of this proposal for

resolution.

3R) Regarding the alleged violation of the principle of proportionality, it means
which was already taken into account in the initiation agreement itself, since the sanction

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 20/25

proposal (initial € 30,000) already contemplated the aforementioned principle as
stated in the initiation agreement itself. In fact, the maximum legal penalty is
2,000,000 euros and the current proposal accepting the mitigating measures put forward (20,000

€) is one hundred times less in consideration of the mitigating factors applied at the request of the
responsable.

4R) << Error in the classification of the offense and error in the consideration of the
Sections c) and g) of art. 80.1 of the LGT as aggravating factors >>.

Regarding aggravating 80.1.c) of the LGT, it affects what was said in the initiation agreement.
In addition, regarding the absence of benefits, what is relevant is that the
OASIP's performance was motivated by the search for economic benefit, by
what the fact that it was insignificant or did not finally come to be obtained
cannot serve as a basis for an attenuation of guilt or unlawfulness of

their conduct.

Regarding aggravating 80.1.g) of the LGT, in addition to what has already been said in the
beginning, it is proven that OASIP improperly called the claimant in seven
occasions despite being included in the advertising exclusion list
Róbinson since 2018, and being responsible for avoiding such calls. The error

alleged could be taken into account if he were invincible, but in the circumstances now
analyzed (seven calls in two months) cannot be described as invincible but as
an action, at least, of culpable responsibility.

Consequently, the claims to the Initiation Agreement must be rejected.

III
In relation to the allegations presented on 07/22/2021 by OASIP after the

Resolution Proposal, reiterate those already alleged in the Initiation Agreement. However, at
Next, the answer to the allegations in the
following terms:

1R) The proven fact Third and Fourth of the proposed Resolution are not
accredited. The person responsible for the alleged infringement is Vodafone, as it is the

competent as responsible for the treatment now analyzed.

Regarding the first of the allegations presented, note that the facts
proven are fully accredited in the Background after the
investigations carried out by the Inspection of this AEPD in the proceedings

previous. In addition, the OASIP itself confirms the materialization of the calls
made to the claimant on seven occasions, even though her telephone line was registered
in the advertising exclusion list since 2020.

2R) Violation of the principle of Responsibility, as Vodafone is responsible for

the imputed facts.

Regarding the second of the allegations to the Proposal for Resolution, it should be noted that
the owner of the calling line is OASIP. In addition, OASIP was in charge of carrying out

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 21/25

the filtering of numberings included in the advertising exclusion lists in the
actions carried out by Vodafone. In addition, they are already debugged in
separate procedure initiated by this AEPD the responsibilities in which it has

incurred Vodafone. In this sense, it should be noted that the responsibilities in the facts
imputed by both entities are of a different nature, although both are
complementary, which is why different procedures have been initiated.

3R) Violation of the fundamental right to the presumption of innocence. The AEPD does not
has proven "incontrovertibly who made the calls."

It has already been indicated that the alleged facts have been investigated in the proceedings
previous research carried out by this AEPD, and have distorted the aforementioned
alleged principle. In fact, it is stated in previous actions that it was OASIP who
made through a numbering assigned to her the seven improper calls to the

claimant.

4R) Violation of the principle of proportionality and duty to state the amount of the
sanction.

In this sense, as stated in the Proposal for Resolution, the sanction has been

reduced to less than half of the maximum amount of the offenses typified
as mild. Finally, it should be emphasized that OASIP was aware of the dysfunctionality of the
crossover procedure with ad exclusion listings and continued to allow the
making calls even knowing that Vodafone is not regularized
the advertising exclusion listings from 03/9/2020, when calls

improper actions were carried out during the months of June and July 2020 (as confirmed by
OASIP in the allegations).

5R) Improper application of art 77.37 of the LGT. The offense must be, in any case,
classified as mild, in accordance with art. 78.11 of the LGT.

It has already been pointed out that OASIP materialized the offending act on seven occasions
repeatedly violating the rights of the claimant, which makes it possible to classify
how serious the offense.

6R) Improper application of sections c) and g) of art. 80.1 of the LGT as

aggravating factors. The seven unwanted calls that are imputed represented a benefit of
€ 0.0083. The wrongful responsibility is inconsistent with the serious classification. At
In this case, OASIP meets all the mitigation criteria indicated in the
art. 80.1 of the LGT.

Already answered extensively and motivated in the allegations to the Initiation Agreement
(4R).

Consequently, the allegations to the Motion for Resolution must be
rejected.

IV
The art. 23 of the LOPDGDD, states the following:

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 22/25

<< Article 23. Advertising exclusion systems.

1. The processing of personal data that is intended to prevent the sending of

commercial communications to those who have expressed their refusal or opposition
to receive them. For this purpose, information systems, general or
sectoral, in which only the data essential to identify the
affected. These systems may also include preferred services, through
which those affected limit the reception of commercial communications to the
from certain companies.

2. The entities responsible for the advertising exclusion systems will notify
the competent control authority its creation, its general or sectoral nature, as well
as the way in which those affected can join them and, where appropriate,
assert your preferences. The competent control authority will make public in its

electronic headquarters a list of the systems of this nature that were
communicated, incorporating the information mentioned in the previous paragraph. To such
In effect, the competent control authority to which the creation has been communicated
of the system will make it known to the other control authorities for their
publication by all of them.

3. When an affected party expresses to a person in charge his wish that his data not
are processed for the referral of commercial communications, it must inform you
of the existing advertising exclusion systems, being able to refer to the
information published by the competent control authority.

4. Those who intend to make direct marketing communications must
previously consult the advertising exclusion systems that could affect your
action, excluding from the treatment the data of those affected who had
expressed their opposition or refusal to it. For these purposes, to consider
Once the above obligation has been fulfilled, consulting the exclusion systems will suffice

included in the list published by the competent control authority.

It will not be necessary to carry out the query referred to in the previous paragraph when the
affected would have provided, in accordance with the provisions of this organic law, its
consent to receive the communication to whoever intends to make it >>.

In the present case, it is established that the claimant's line number was
included in the Adigital Robinson exclusion list since 01/16/2020 and the
Advertising calls in the name and on behalf of VDF were made from one line
whose owner is OASIP in June and July 2020. Likewise, it is proven that it was
OASIP who did not previously filter the call with the advertising exclusion list

Robinson of Adigital, when it was his responsibility to do so by imperative of the person in charge
advertising actions, repeating the calls seven times.

V
The known facts are constitutive of an infraction, attributable to the defendant, for

violation of article 48.1.b) of the LGT, included in its Title III, which indicates the
following:

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 23/25

"Article 48. Right to the protection of personal data and privacy in relation to
with unsolicited communications, with traffic and location data and with
subscriber guides.

1. Regarding the protection of personal data and privacy in relation to

unsolicited communications end users of communications services
electronic companies will have the following rights:
(…)

b) To oppose receiving unwanted calls for commercial communication purposes
that are carried out through systems other than those established in the previous letter and to

be informed of this right. "

The offense is classified as serious in article 77.37 of said rule, which considers
as such: "The serious violation of the rights of consumers and users
final, as established in Title III of the Law and its implementing regulations ”. On

the present case, and in relation to the provisions of art. 78.11 of the LGT (infractions
minor), the existence of aggravated liability should be noted upon being accredited
the reiteration on seven occasions of the imputed fact, which allows its classification
as serious.

This serious offense can be sanctioned with a fine of up to 2,000,000 euros, of

in accordance with article 79.1.c) of the aforementioned LGT.

In accordance with the available evidence, it is considered that
graduate the sanction to be imposed according to the following criteria established by the
Article 80 of the LGT:

As aggravating factors:

c) The benefit that has been reported to the offender by the fact that is the subject of the offense. The
promotional actions are aimed at obtaining profits
business, both directly and indirectly and constitutes a company
directly linked to the advertising sector.

g) The cessation of the infringing activity, previously or during the processing of the
sanctioning file. There is no evidence of the cessation of the infringing activity by OASIP or that
has established appropriate measures to guarantee in the communications facilitated
to your customers through your virtual switchboard the correct filtering of numbering
Callers with Adigital's Robinson Advertising Exclusion List.

As mitigating factors:

 There are no previous infractions in the information system of this AEPD.

 OASIP is classified as a micro-enterprise, has 2 employees and invoices per year
€ 890,000.

In the present case, OASIP must respond to the inappropriate calls made to the
claimant on seven occasions during two months, by not filtering the calls

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 24/25

advertising with the advertising exclusion list, which has resulted in OASIP
will materialize the calls to numbers previously included in the lists of
advertising exclusion Robinson de Adigital and internal VDF.

Taking into account the above-mentioned factors of graduation of the offense
classified as serious, it is considered proportional to quantify the penalty at € 20,000.

Considering the aforementioned precepts and others of general application, the Director of the Agency
Spanish Data Protection RESOLVES:

FIRST: IMPOSE OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L.
with NIF B88183660, for the violation of art. 48.1.b) of the LGT, in relation to art.
23 of the LOPDGDD, classified as serious in art. 77.37 of the LGT, the sanction of
€ 20,000 (twenty thousand euros)

SECOND: NOTIFY this resolution to the claimant and OASIP SERVICIO
INTEGRAL DE COMUNICACIONES S.L ..

THIRD: Warn the sanctioned person that the sanction imposed must be effective
once this resolution is enforceable, in accordance with the provisions of the

Article 98.1.b) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, within the voluntary payment period indicated in the
Article 68 of the General Collection Regulations, approved by Royal Decree
939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17
December, by entering the restricted account number ES00 0000 0000 0000 0000

0000, opened in the name of the Spanish Agency for Data Protection in the entity
banking CAIXABANK, S.A. or otherwise, it will be collected in
executive period.

Received the notification and once executive, if the date of execution is found

Between the 1st and the 15th of each month, both inclusive, the deadline for making the payment
volunteer will be until the 20th of the following or immediately subsequent business month, and if
between the 16th and the last day of each month, both inclusive, the payment term
It will be until the 5th of the second following or immediate business month.

In accordance with the provisions of article 50 of the LOPDGDD, this

Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to administrative proceedings (article 48.6 of the
LOPDGDD), and in accordance with the provisions of articles 112 and 123 of the Law
39/2015, of October 1, of the Common Administrative Procedure of the

Public Administrations, the interested parties may file, optionally,
appeal for reconsideration before the Director of the Spanish Agency for Data Protection
within a month from the day following notification of this
resolution or directly administrative contentious appeal before the Chamber of
Contentious-administrative of the National Court, in accordance with the provisions of the

Article 25 and in section 5 of the fourth additional provision of Law 29/1998, of
July 13, regulator of the Contentious-Administrative Jurisdiction, within the period of
two months from the day following the notification of this act, as
provided for in article 46.1 of the aforementioned legal text.

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es 25/25

Finally, it is pointed out that in accordance with the provisions of art. 90.3 a) of Law 39/2015,
of October 1, of the Common Administrative Procedure of the Administrations

Public, the final resolution may be suspended provisionally through administrative channels if
the interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact through
writing addressed to the Spanish Agency for Data Protection, presenting it through

of the Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web /], or through any of the other records provided for in art. 16.4 of the
cited Law 39/2015, of October 1. You must also transfer to the Agency the
documentation that proves the effective filing of the contentious appeal-

administrative. If the Agency is not aware of the filing of the appeal
contentious-administrative within a period of two months from the day following the
notification of this resolution would terminate the precautionary suspension.

815-141020
Mar Spain Martí
Director of the Spanish Agency for Data Protection

C / Jorge Juan, 6 www.agpd.es
28001 - Madrid sedeagpd.gob.es

@@ Line 20: / Line 20: @@
 |Date_Published=19.08.2021
 |Year=2021
-|Fine=20000
+|Fine=20,000
 |Currency=EUR
@@ Line 46: / Line 46: @@
 |Appeal_To_Link=
-|Initial_Contributor=Carmen Villarroel
+|Initial_Contributor=[https://gdprhub.eu/index.php?title=User:Carmen.villarroel Carmen Villarroel]
 |
 }}
-The Spanish DPA fined a controller that was acting on behalf of Vodafone €20,000 for making unsolicited commercial calls to a data subject.
+The Spanish DPA fined a controller acting on behalf of Vodafone €20,000 for making unsolicited commercial calls to a data subject. The controller failed to adequately check phone numbers against a list of users who did not wish to receive calls.
 == English Summary ==
 === Facts ===
-A data subject filed a complaint with the Spanish DPA (AEPD) since they were receiving unsolicited commercial calls on behalf of Vodafone. The complainant was registered on the Robinson list, a an advertising exclusion system regulated in Article 23 of the Spanish Data Protection Act (LOPDGDD).
+A data subject filed a complaint with the Spanish DPA (AEPD) for receiving unsolicited commercial calls on behalf of Vodafone. The complainant was registered on the Robinson list, an advertising exclusion system regulated in Article 23 of the Spanish Data Protection Act (LOPDGDD).
-The calls were carried out by a company subcontracted by Vodafone (Oasip) to act on their behalf. The agreement between them included the obligation of filtering the list of numbers against the Robinson list, so no calls are made to the people registered.
-=== Dispute ===
+The calls were carried out by the subcontractor Oasip on behalf of Vodafone. The agreement between both companies included the obligation of filtering the list of numbers against the Robinson list, to avoid making calls to the people registered.
 === Holding ===
-The AEPD considered that Oasip was a controller, and that they were aware of the problems while filtering the numbers, since it happened seven times in two months, but that they had not implemented the necessary measures to solve that.
+The AEPD hold that Oasip is a controller and considered them aware of the problem with filtering the phone-numbers, since it happened seven times in two months without them implementing necessary measures to prevent it from happening again.
-Sending unsolicited commercial communications is forbidden by the Spanish Telecommunications Act (LGT) in its Article 48(1)(b).
+The DPA concluded that the company acted for their own benefit, and held them responsible of the infringement. Therefore, and since sending unsolicited commercial communications is forbidden by Article 48(1)(b) of the Spanish Telecommunications Act (LGT) the DPA fined the controller €20,000.
-The DPA considered that the company had acted pursuing their own benefit, and that they were responsible of the infringement since they were aware of the problem but did not act to solve it. Therefore, the DPA fined the controller €20,000.
+The DPA also noted that it would initiate a different investigation into Vodafone in relation to the same events, in order to determine whether Vodafone had acted appropriately.
 == Comment ==