AEPD (Spain) - PS/00502/2020

AEPD - PS/00502/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 21 GDPR Article 48(1)(b) LGT Article 23(4) LOPDGDD
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	19.02.2021
Published:	24.02.2021
Fine:	12000 EUR
Parties:	Avilon Center 2016, SL
National Case Number/Name:	PS/00502/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	n/a

The Spanish DPA (AEPD) imposed a fine on Avilon Center SL for making a commercial call to a individual registered on the Robinson List in breach of Article 48(1)(b) LGT and Article 21 GDPR in conjunction with Article 23(4) LOPDGDD. Avilon Center SL made an voluntary, early and guilty payment of €12,000.

English Summary

Facts

The complainant filed a complaint against Avilon Center 2016 SL. The complainant received commercial calls from Avilon Center on their private number, despite being listed on the Robinson List (opt-out list of people who do not wish to receive marketing transmissions).

The Spanish DPA (AEPD) investigated these facts. In its investigation, it found that the telephone number which called the claimant was operated by Sewan Comunicaciones SL.

The AEPD also asked Avilon Center about where they go the claimant's telephone number, the object of the call, the legitimacy of the call, and information provided to the claimant about the origin of the claimant's personal data . Avilon Center responded that information on the origin of the data could not be provided to the data subject during the call as the data subject interrupted the call by stating that they were registered on the Robinson List and hung up. Avilon also mentioned that it is registered in Adigital as a provider of services that has access to the Robinson List and that on the data of the call, there was a software error that blocked the table with the persons included on the Robinson List. This error was solved after 30 minutes, but Avilon Cneter has already made the call to the claimant during that time.

Dispute

Does making a commercial call to a data subject registered on the Robinson List violate Article 48(1)(b) LGT and Article 21 GDPR in conjunction with Article 23(4) LOPDGDD?

Holding

The Spanish DPA (AEPD) held that the facts of the case point to the fact that Avilon Center breached Article 48(1)(b) of the Spanish Law on Telecommunications (LGT) as well as Article 21 GDPR in conjunction with Article 23(4) of the Spanish Law on Protection of Personal Data and guarantee of digital rights (LOPDGDD).

The defendant argued that the reason why a call was made to the claimant despite them being on the Robinson List was because Adigital had a software error so the Robinson List was no accessible to be checked by Avilon Center prior to making the call. However, the AEPD stated that an analysis of the risk prior to processing any person data should be performed. Additionally, necessary controls must be put in place to avoid making calls when such system errors occur.

The AEPD stated that strict liability does not apply in the present case, but that the defendant lacked due diligence in the technical and organisational measures that they applied to the processing of personal data linked to telephone lines. As this lead to a violation of the claimant's rights (notably: right to object by registering themselves on the Robinson List), the AEPD concluded that Avilon Center was responsible for the processing of personal data.

The Spanish DPA therefore imposed a fine of €20,000 on Avilon Center. In accordance to Spanish Administrative Law, this fine was reduced to €12,000 as Avilon Center made a voluntary, early and guilty payment of the fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                           1/10








    Procedure No.: PS / 00502/2020


RESOLUTION R / 00134/2021 OF TERMINATION OF THE PROCEDURE FOR PAYMENT
                                  VOLUNTARY

In the sanctioning procedure PS / 00502/2020, instructed by the Spanish Agency for
Protection of Data to AVILON CENTER 2016, S.L., considering the complaint presented by

A.A.A., and based on the following,

                                BACKGROUND

FIRST: On January 25, 2021, the Director of the Spanish Agency for

Data Protection agreed to initiate disciplinary proceedings against AVILON CENTER
2016, S.L. (hereinafter, the claimed), through the Agreement that is transcribed:

<<





Procedure Nº: PS / 00502/2020




           AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE



Of the actions carried out by the Spanish Agency for Data Protection and in

based on the following:



                                     ACTS




FIRST: D. A.A.A. (hereinafter, the claimant) dated August 23, 2019
filed a claim with the Spanish Agency for Data Protection. The

The claim is directed against AVILON CENTER 2016 S.L. with NIF B05254859 (in
forward, the claimed).




The reasons on which you base the claim are that you receive commercial calls from
claimed on your mobile phone *** PHONE. 1 that is inscribed on the Robinson list

since last September 24, 2018, and that the last call was received on
last August 21, 2019 at 7:08 p.m. from the calling line
*** PHONE. 2.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/10








Documentation provided by the claimant:

- Certificate of ADIGITAL of the inscription in the Robinson list of the telephone in which
they receive the calls.



SECOND: In view of the facts reported in the claim and the

documents provided by the claimant and the facts and documents of which he has
this Agency, the Subdirectorate General for Data Inspection

proceeded to carry out preliminary investigation actions for the
clarification of the facts in question, by virtue of the powers of investigation
granted to the control authorities in article 57.1 of the Regulation (EU)

2016/679 (General Data Protection Regulation, hereinafter RGPD), and
in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of

digital rights (hereinafter LOPDGDD).



As a result of the investigative actions carried out, it is verified that the

responsible for the treatment is the one claimed.



Likewise, the following points are found:




Transfer the claim to ORANGE, owner of the Jazztel trademark, with
date of October 23, 2019 is received at this Agency, with registration number

050582/2019, brief of allegations sent by this entity stating, between
other aspects, which have been able to verify that the numbering *** TELEPHONE. 2 from
the one that indicates having received advertising calls does not belong to that company, nor

It is associated with any ORANGE distribution channel. They communicate to
claimant using burofax this end. They add indicating that this number of
phone is operated by Sewan Comunicaciones S.L. (hereinafter SEWAN)

Information requested on the owner of the telephone number from which the

call indicated in the claim to SEWAN, operator of this number, with
date of June 11, 2020 is received at this Agency, with registration number
019517/2020, answering letter indicating that the holder of this number is the

reclaimed.

Information requested from AVILON on the origin of the claimant's telephone number, the object
of this call, legitimacy to receive this type of calls, and the information
provided to the claimant about the origin of their personal data, dated 16 de

July 2020 is received at this Agency, with registration numbers 021697/2020 and
025226/2020, written response stating the following aspects:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/10








- Regarding the information provided by this entity to the claimant about the origin of
their data, declare that after initiating the agent who called on behalf of Jazztel, the

claimant interrupted him stating that he was registered on the Robinson list and that
would make a claim. He then interrupted the communication, which is why

the agent was unable to provide further information to the claimant.

- AVILON adds that it is registered in ADIGITAL as a provider of
services so you have access to the Robinson list whose data is updated
in their systems monthly. However, on the aforementioned date, it indicates that

produced an error in the software used, momentarily blocking the
table in which all the numbers included in the Robinson File are registered.
This incident was solved in 30 minutes, this call was produced in the

table lock period.





                            FOUNDATIONS OF LAW




                                             I




        In accordance with the provisions of article 84.3) of Law 9/2014, of 9
May, General of Telecommunications (LGT), the competition to resolve the
This Penalty Procedure corresponds to the Director of the Agency

Spanish Data Protection.




                                             II






        In the present case, it has been proven that the claimant is included in the
Robinson List.




In accordance with the evidence available at the present time of
agreement to initiate the sanctioning procedure, and without prejudice to what results from the
instruction, it is considered that the defendant has contravened article 48.1 b) of the

LGT, in relation to article 21 of the RGPD, and article 23.4 of the LOPDGDD, already
that the claimant received on August 21, 2019 at 7:08 p.m. from

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/10








the calling line *** PHONE. 2. business call on your personal mobile phone
from one of the claimed telesales collaborators, such as

recognizes the claimed in his statements to this Agency on July 16 last, "in
the referred date, indicates that there was an error in the software used, leaving
the table in which all numbers are registered is momentarily locked

included in the Robinson File. This incident was resolved in 30 minutes,
this call taking place in the table lock period ”.



       In the present case, the defendant argues that the call to the
claimant for marketing purposes, when the line was included

previously in Adigital's Robinson Listing, was caused by an error in the
software used when the pre-check was momentarily inoperative
with the Robinson Listing.




       However, this deficiency should have been taken into account in the analysis of
risks prior to any processing of personal data and having incorporated the

controls necessary to avoid that in the event of a system error such as the one now analyzed
calls are prevented while the incident lasts.




       Although strict liability is not applicable to the case, if it is true that
there was a lack of due diligence on the part of the respondent in the organization and
technical means applied to the processing of personal data linked to the

receiving telephone lines that have caused the commission of the offense now
charged when the rights of the affected party were violated, even when he had
previously expressed their right to object by incorporating their line into the

Róbinson advertising exclusion. Consequently, the claimed entity is
responsible for the treatment.




       The facts presented (the violation of the right to object) could
suppose the commission by the claimed party of an infraction of article 48.1.b) of

the LGT Law, contained in its Title III, which states that: “Regarding the protection of
personal data and privacy in relation to subscriber directories, users
end of electronic communications services will have the following

rights: (…) b) To oppose receiving unwanted calls for the purposes of
commercial communication carried out through systems other than those
established in the previous letter and to be informed of this right ”,


       Although the aforementioned article does not configure such a right, so we must go to
the data protection regulations in which the right of opposition is regulated:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/10








Article 21 of the RGPD, (Regulation (EU) 2016/679, of the European Parliament and of the

Council, of 04/27/2016, regarding the Protection of Individuals in what
Regarding the Processing of Personal Data and the Free Circulation of this Data) and
Article 23 of the LOPDGDD (Organic Law 3/2018, of December 5, on Protection

of Personal Data and Guarantee of Digital Rights).




        This offense is classified as "minor", in article 78.11) of
said norm, which considers as such: “The breach of the obligations of
public service, public obligations and violation of the

rights of consumers and end users as established in Title III
of the Law and its implementing regulations ”, which may be sanctioned with a fine of up to

€ 50,000, in accordance with article 79.1.d) of the aforementioned LGT.



                                              III




        In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in

In the present case, it is considered that the sanction to be imposed should be adjusted according to
with the following criteria established in article 80.1) and 2) of the LGT:




   - The consideration of the economic situation of the offender, (point 2).




    After the evidence obtained in the preliminary investigation phase, it is considered
that the penalty to be imposed should be graduated in the amount of € 20,000 (twenty thousand euros).




        Therefore, based on the foregoing,



        By the Director of the Spanish Agency for Data Protection,










C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/10








       HE REMEMBERS:




FIRST: INITIATE SANCTIONING PROCEDURE for AVILON CENTER 2016
S.L. with NIF B05254859, for the alleged violation of article 48.1.b) of the LGT Law

classified as “mild” in article 78.11) of the aforementioned LGT Law in relation to
article 21 of the RGPD, and article 23.4 of the LOPDGDD.




SECOND: APPOINT D. R.R.R. as instructor. and, as secretary, Ms. S.S.S.,
indicating that any of them may be challenged, if applicable, in accordance with the
established in articles 23 and 24 of Law 40/2015, of October 1, on the Regime

Public Sector Legal (LRJSP).



THIRD: INCORPORATE to the sanctioning file, for evidentiary purposes, the

claim filed by the claimant and his documentation, the documents
obtained and generated, which are part of the file.




FOURTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1
October, of the Common Administrative Procedure of Public Administrations, the

The corresponding penalty would be € 20,000 (twenty thousand euros), without prejudice to
what results from the instruction.




FIFTH: NOTIFY this agreement to AVILON CENTER 2016 S.L. with NIF
B05254859, granting a hearing period of ten business days to formulate
the allegations and present the evidence that it deems appropriate. In his writing of

allegations, you must provide your NIF and the procedure number that appears in the
heading of this document.




       If, within the stipulated period, no allegations are made to this initiation agreement, the
It may be considered a resolution proposal, as established in the
Article 64.2.f) of Law 39/2015, of October 1, on Administrative Procedure

Common of Public Administrations (hereinafter, LPACAP).



       In accordance with the provisions of article 85 of the LPACAP, in the event of

that the sanction to impose was a fine, you may recognize your responsibility within

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/10








of the term granted for the formulation of allegations to this initiation agreement; it
which will entail a reduction of 20% of the sanction to be imposed in

this procedure. With the application of this reduction, the sanction would be
established at € 16,000 (sixteen thousand euros), resolving the procedure with the

imposition of this sanction.



       In the same way, you may, at any time prior to the resolution of the

present procedure, carry out the voluntary payment of the proposed sanction,
which will mean a reduction of 20% of its amount. With the application of this
reduction, the penalty would be established € 16,000 (sixteen thousand euros), and its payment

will imply the termination of the procedure.



       The reduction for the voluntary payment of the penalty is cumulative to that

corresponds to apply for the recognition of responsibility, provided that this
acknowledgment of responsibility is revealed within the term

granted to formulate allegations at the opening of the procedure. The pay
Voluntary amount of the amount referred to in the previous paragraph may be done at any
time before resolution. In this case, if applicable, apply both

reductions, the amount of the penalty would be set at € 12,000 (twelve thousand
euros).




       In any case, the effectiveness of either of the two mentioned reductions
It will be conditioned to the withdrawal or resignation of any action or remedy in progress.
administrative against the sanction.




       In the event that you choose to proceed to the voluntary payment of any of the

amounts indicated above (16,000 or 12,000 euros), you must make it effective
by entering the account number ES00 0000 0000 0000 0000 0000 open to
name of the Spanish Data Protection Agency in Banco CAIXABANK,

S.A., indicating in the concept the reference number of the procedure that appears in
the heading of this document and the cause of reduction of the amount to which
welcomes.




       Likewise, you must send proof of admission to the Subdirectorate General of
Inspection to continue the procedure according to the quantity

entered.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/10










       The procedure will have a maximum duration of nine months from

the date of the initiation agreement or, where appropriate, the draft initiation agreement.
After this period, its expiration will occur and, consequently, the file of

performances; in accordance with the provisions of article 64 of the LOPDGDD.



       Finally, it is pointed out that in accordance with the provisions of article 112.1 of the

LPACAP, against this act there is no administrative appeal.



Mar Spain Martí


Director of the Spanish Agency for Data Protection










>>


SECOND: On February 17, 2021, the defendant has proceeded to pay the
sanction in the amount of 12,000 euros making use of the two planned reductions
in the Initiation Agreement transcribed above, which implies the recognition of the
responsibility.


THIRD: The payment made, within the period granted to formulate allegations to
the opening of the procedure, entails the waiver of any action or appeal in the process
administrative against the sanction and the recognition of responsibility in relation to
the facts to which the Initiation Agreement refers.


                            FOUNDATIONS OF LAW

                                             I


By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in art. 47 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in
hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said

Regulation; infractions of article 48 of Law 9/2014, of May 9, General
of Telecommunications (hereinafter LGT), in accordance with the provisions of the
article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/10








38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.


                                            II

Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter, LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:

"1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility,
the procedure may be resolved with the imposition of the appropriate sanction.

2. When the sanction is solely of a pecuniary nature or it is possible to impose a
pecuniary sanction and other non-pecuniary sanction, but the

inadmissibility of the second, the voluntary payment by the presumed responsible, in
any time prior to the resolution, will imply the termination of the procedure,
except in relation to the replacement of the altered situation or the determination of the
compensation for damages caused by the commission of the offense.

3. In both cases, when the sanction is solely of a pecuniary nature, the

competent body to resolve the procedure will apply reductions of, at least,
20% of the amount of the proposed penalty, these being cumulative among themselves.
The aforementioned reductions must be determined in the notice of initiation
of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of
any action or appeal in administrative proceedings against the sanction.


The percentage of reduction foreseen in this section may be increased
regulations.

In accordance with the above, the Director of the Spanish Agency for the Protection of

Data RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00502/2020, of
in accordance with the provisions of article 85 of the LPACAP.

SECOND: NOTIFY this resolution to AVILON CENTER 2016, S.L ..


In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which puts an end to the administrative procedure as prescribed by

the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the
National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the

Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the
referred Law.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/10












                                                                                                   936-031219
Mar Spain Martí

Director of the Spanish Agency for Data Protection








































































C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es