AEPD (Spain) - EXP202204515

AEPD - ps-00362-2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(a) GDPR Article 21, Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales
Type:	Complaint
Outcome:	Upheld
Started:	29.03.2022
Decided:	26.07.2022
Published:
Fine:	5000 EUR
Parties:	n/a
National Case Number/Name:	ps-00362-2022
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	j.john

The Spanish DPA fined a telecommunications provider €3,000 for sending out marketing correspondence despite the data subject's repeated objections.

English Summary

Facts

The data subject received non-consensual correspondence in the form of calls, which were presumed to be from Xfera Móviles S.A., also known as YOIGO (the controller), a telecommunications provider that the data subject was a customer of.

The data subject contacted the Data Protection Officer of the company via email, and informed them that he did not wish to receive such correspondence. The data subject was informed that not all the calls originated from the controller or its agencies, and that, relating to the one call that was, his number would be placed on the controller's opt-out marketing list to prevent any further correspondence.

Commercial text messages from the controller were then sent to the data subject, leading to the data subject once again emailing and being reassured that he would be placed on the opt-out list, only for him to receive more text messages, and resulting in another email being sent to the controller by the data subject.

The data subject submitted a complaint to the Spanish DPA, providing copies of the text messages as evidence.

The controller responded to the complaint, stating that the data subject had been included in the opt-out databases; however, it was in the opt-out database for non-customers, not for customers. They also confirmed that the call he had received had been from the controller's customer phone line. Finally, the controller stated that it updated the customer database to reflect the data subject’s preference.

Holding

The DPA held that although there was a contractual relationship between the data subject and the controller, the data subject had continued to receive marketing correspondence even after his request for it to cease. The DPA referred to Article 21 LSSI, the national law on information society services. This provision prohibits the sending of advertising or promotional communications by e-mail or other equivalent electronic means of communication that has not previously been requested or expressly authorized by the recipients.

Therefore, the DPA fined the controller €5,000, which, due to their voluntary payment rather than engaging in litigation, was reduced to €3,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

File No.: EXP202204515
RESOLUTION OF TERMINATION OF THE PROCEDURE FOR PAYMENT
VOLUNTEER
Of the procedure instructed by the Spanish Agency for Data Protection and based on
to the following
BACKGROUND
FIRST: On July 26, 2022, the Director of the Spanish Agency for
Data Protection agreed to start a sanctioning procedure against XFERA MÓVILES,
S.A. (hereinafter, the claimed party), through the transcribed Agreement:
<<
File No.: EXP202204515
AGREEMENT TO START THE SANCTION PROCEDURE
Of the actions carried out by the Spanish Data Protection Agency and in
based on the following
FACTS
FIRST: On March 29, 2022, A.A.A. (hereinafter, the claiming party)
filed a claim with the Spanish Data Protection Agency.
The claim is directed against XFERA MÓVILES, S.A. with NIF A82528548 (in
below, the claimed party).
The reasons on which the claim is based are the following:
Submit a claim for receiving commercial calls and SMS on your mobile line
***TELEPHONE 1.
During the months of November and December 2021, he received commercial calls.
On 12/03/2021, he sent an opposition request to the YOIGO DPO by email
Email addressed to ***EMAIL.1.
On 12/10/2021, he answered that the calling lines ***TELEPHONE.2, ***TELEPHONE.3
and ***PHONE.4 do not belong to or correspond to any of our
agencies.
In addition, they inform you that, after carrying out the appropriate checks, the number of
telephone ***PHONE.1 is not being contacted by your entity and that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
2/7
has included your telephone number in the internal records of non-receipt of
commercial communications.
On 12/17/2021 the claimant reiterates his opposition request to the address ***EMAIL.2,
by receiving commercial SMS.
On 01/17/2022 they reply that they have proceeded to request the deletion of the number
indicated from their advertising databases. Management to be completed within a period
between 7-10 days.
On 03/17/2021, he reiterates his opposition request for receiving a new commercial SMS
and they reply on 03/29/2021 again that they will proceed to request the elimination of the
number/mail indicated from your advertising databases.
Provide a copy of 4 commercial SMS received on 12/10/2021, 12/17/2021 and
03/15/2021. The issuer is identified as YOIGO.
SECOND: In accordance with article 65.4 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
forward LOPDGDD), on April 21, 2022, said claim was transferred to the
claimed party, to proceed with its analysis and inform this Agency in the
period of one month, of the actions carried out to adapt to the requirements
provided for in the data protection regulations.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of
October 1, of the Common Administrative Procedure of the Administrations
Public (hereinafter, LPACAP), was collected on April 22, 2022 as
It appears in the acknowledgment of receipt that is in the file.
On May 25, 2022, this Agency received a written response
indicating that the number of the interested party has been included in the files of
advertising exclusion of recruitment as a result of the exercise of your right.
The line object of this disciplinary procedure, ***TELEPHONE.1, is a line of
a client, and what happened is that the right of the interested party was followed, but not by
the appropriate procedure taking into account that he is a client, but that he was included
in the advertising exclusion files of non-customers.
The respondent entity states that the preferences have already been modified
of privacy of the interested party, dated May 5, 2022.
THIRD: On June 29, 2022, in accordance with article 65 of the
LOPDGDD, the claim presented by the claimant party was admitted for processing.
FUNDAMENTALS OF LAW
Yo
It is competent to initiate and resolve this Disciplinary Procedure, the Director of
the Spanish Data Protection Agency, in accordance with the provisions of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
3/7
art. 43.1, second paragraph, of Law 34/2002, of July 11, on Services of the
Information Society and Electronic Commerce (LSSI).
II
In this case, the claimant and the respondent have a contractual relationship.
It is stated that despite the fact that the complaining party has communicated repeatedly,
on December 3 and 17, 2021 and March 17, 2022, your wish not to receive SMS
of the requested entity, you have continued to receive commercial SMS on your
mobile line ***PHONE.1.
In this sense, article 21 of the LSSI provides the following:
"1. The sending of advertising or promotional communications by
email or other equivalent means of electronic communication that
previously had not been requested or expressly authorized by the
recipients thereof.
2. The provisions of the previous section shall not apply when there is a
prior contractual relationship, provided that the provider had legally obtained
the recipient's contact details and will use them to send communications
commercials referring to products or services of your own company that are
similar to those initially contracted with the client.
In any case, the provider must offer the recipient the possibility of opposing the
processing of your data for promotional purposes through a simple procedure
and free of charge, both at the time of data collection and in each of the
commercial communications that you direct.
When the communications have been sent by email, said
means must necessarily consist of the inclusion of an email address
email or other valid email address where this right can be exercised,
It is prohibited to send communications that do not include said address.”
Therefore, according to the evidence available at this time,
and without prejudice to what results from the investigation, the facts exposed could
suppose the violation of article 21 of the LSSI, by the claimed entity, by
send advertising emails without the consent of the recipient.
The aforementioned offense is classified as "minor" in art. 38.4.d) of said
rule, which qualifies as such, "The sending of commercial communications by mail
electronic or other equivalent electronic means of communication when in said
shipments do not meet the requirements established in article 21 and do not constitute
Serious offense".
Pursuant to the provisions of article 39.1.c) of the LSSI, minor offenses
may be sanctioned with a fine of up to €30,000, establishing the criteria for its
graduation in article 40 of the same standard as after the evidence obtained, and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
4/7
without prejudice to what results from the instruction, the following are considered: that in
This assumption acts as mitigations:
- The existence of intentionality, an expression that must be interpreted as equivalent
to degree of guilt according to the Judgment of the Hearing
National of 12/11/07 relapse in the Appeal no. 351/2006, corresponding to
the entity the determination of a system of exercise of the right of opposition
that conforms to the mandate of the LSSI. Situation that in the present case has not
existed.
- The period of time during which the offense has been committed according to
article 40.b of the LSSI, since he received SMS over several months
In accordance with said criteria, it is deemed appropriate to impose a penalty of 5,000
euros (five thousand euros) for the violation of article 21 of the LSSI, regarding the shipment
of advertising emails without the mandatory consent of the recipient.
Therefore, in accordance with the foregoing, by the Director of the Agency
Spanish Data Protection,
HE REMEMBERS:
FIRST: INITIATE disciplinary proceedings against the entity XFERA MÓVILES, S.A.,
with NIF A82528548, for the alleged violation of article 21) of the LSSI, punishable
in accordance with the provisions of art. 39) and 40) of the aforementioned Law, regarding the sending of the
email without the required consent.
SECOND: APPOINT: as Instructor Mrs. B.B.B. and Secretary, where appropriate, Mr.
C.C.C., indicating that any of them may be challenged, if applicable, in accordance with
the provisions of articles 23 and 24 of Law 40/2015, of October 1, on the Regime
Legal Department of the Public Sector (LRJSP).
THIRD: INCLUDE: to the disciplinary file, for evidentiary purposes, the
claim filed by the claimant and its documentation, the documents
obtained and generated by the General Sub-directorate of Data Inspection during the
investigation phase, all of them part of this administrative file.
FOURTH: THAT: for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1,
of the Common Administrative Procedure of Public Administrations, the
sanction that could correspond would be 5,000 euros (five thousand euros), for the infraction
of article 21 of the LSSI.
FIFTH: NOTIFY: the present agreement to initiate a disciplinary file against the
entity XFERA MÓVILES, S.A., granting it a hearing period of ten business days
to formulate the allegations and present the evidence it deems appropriate.
If, within the stipulated period, he does not make allegations to this initial agreement, the same
may be considered a resolution proposal, as established in article
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
5/7
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP).
In accordance with the provisions of article 85 of the LPACAP, in the event that the
sanction to be imposed other than a fine, may acknowledge its responsibility within the term
granted for the formulation of allegations to this initiation agreement; what
will entail a reduction of 20% of the sanction that should be imposed in the
present procedure, equivalent in this case to 1000 euros. With the application of
this reduction, the sanction would be established at 4000 euros, resolving the procedure
with the imposition of this sanction.
In the same way, it may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which will mean
a reduction of 20% of the amount of this, equivalent in this case to 1000 euros.
With the application of this reduction, the sanction would be established at 4,000 euros
and its payment will imply the termination of the procedure.
The reduction for the voluntary payment of the penalty is cumulative to the corresponding
apply for acknowledgment of responsibility, provided that this acknowledgment
of the responsibility is revealed within the period granted to formulate
allegations at the opening of the procedure. Voluntary payment of the referred amount
in the previous paragraph may be done at any time prior to the resolution. In
In this case, if both reductions were to be applied, the amount of the penalty would remain
established at 3,000 euros (three thousand euros).
In any case, the effectiveness of any of the two aforementioned reductions will be
conditioned to the withdrawal or waiver of any action or appeal in administrative proceedings
against the sanction.
If you choose to proceed to the voluntary payment of any of the amounts indicated
above, you must make it effective by depositing it into account No. ES00
0000 0000 0000 0000 0000 open in the name of the Spanish Agency for the Protection of
Data at Banco CAIXABANK, S.A., indicating the reference number in the concept
of the procedure that appears in the heading of this document and the cause
of reduction of the amount to which it receives.
Likewise, you must send proof of income to the Sub-directorate General of Inspection
to continue with the procedure according to the amount entered.
The procedure will have a maximum duration of nine months from the date
of the initiation agreement or, where applicable, of the draft initiation agreement. elapsed
this period will expire and, consequently, the file of actions;
in accordance with the provisions of article 64 of the LOPDGDD.
Finally, it is noted that in accordance with the provisions of article 112.1 of the LPACAP,
There is no administrative appeal against this act.
166-110422
Mar Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
6/7
>>
SECOND: On August 9, 2022, the claimed party has proceeded to pay
of the sanction in the amount of 3000 euros making use of the two reductions
provided for in the initiation Agreement transcribed above, which implies the
recognition of responsibility.
THIRD: The payment made, within the period granted to formulate allegations to
the opening of the procedure, entails the waiver of any action or appeal via
against the sanction and acknowledgment of responsibility in relation to
the facts referred to in the Commencement Agreement.
FUNDAMENTALS OF LAW
Yo
In accordance with the provisions of article 43.1 of Law 34/2002, of July 11, on
services of the information society and electronic commerce (hereinafter
LSSI) and as established in articles 47, 48.1, 64.2 and 68.1 of the Organic Law
3/2018, of December 5, Protection of Personal Data and guarantee of the
digital rights (hereinafter, LOPDGDD), is competent to initiate and resolve
this procedure the Director of the Spanish Data Protection Agency.
Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
in Regulation (EU) 2016/679, in this organic law, by the provisions
regulations dictated in its development and, insofar as they do not contradict them, with character
subsidiary, by the general rules on administrative procedures."
Finally, the fourth additional provision "Procedure in relation to the
Powers attributed to the Spanish Agency for Data Protection by other
laws" establishes that: "The provisions of Title VIII and its implementing regulations
will apply to the procedures that the Spanish Agency for the Protection of
Data should be processed in the exercise of the powers attributed to it by
other laws."
II
Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common for Public Administrations (hereinafter, LPACAP), under the heading
"Termination in disciplinary proceedings" provides the following:
"1. Initiated a disciplinary procedure, if the offender acknowledges his responsibility,
The procedure may be resolved with the imposition of the appropriate sanction.
2. When the sanction has only a pecuniary nature or it is possible to impose a
pecuniary sanction and another of a non-pecuniary nature but the
inadmissibility of the second, the voluntary payment by the presumed perpetrator, in
any moment prior to the resolution, will imply the termination of the procedure,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
7/7
except in relation to the replacement of the altered situation or the determination of the
compensation for damages caused by the commission of the offence.
3. In both cases, when the sanction is solely pecuniary in nature, the
The competent body to resolve the procedure will apply reductions of at least
20% of the amount of the proposed penalty, these being cumulative among themselves.
The aforementioned reductions must be determined in the notification of initiation
of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of
any administrative action or resource against the sanction.
The percentage reduction provided for in this section may be increased
according to regulations."
According to what has been stated,
the Director of the Spanish Data Protection Agency RESOLVES:
FIRST: DECLARE the termination of procedure EXP202204515, in
in accordance with the provisions of article 85 of the LPACAP.
SECOND: NOTIFY this resolution to XFERA MÓVILES, S.A..
In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once the interested parties have been notified.
Against this resolution, which puts an end to the administrative process as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Administrative Litigation Chamber of the
National Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following the notification of this act, as provided for in article 46.1 of the
referred Law.
936-040822
Mar Spain Marti
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es