CNPD (Portugal) - Deliberação 2019/297

CNPD - Deliberação 2019/297
Authority:	CNPD (Portugal)
Jurisdiction:	Portugal
Relevant Law:	Article 28 GDPR Article 13 of the e-Privacy Directive Article 13A of the Portuguese e-Privacy Act Portuguese Data Protection Act (Act 67/98)
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	06.05.2019
Published:
Fine:	107.000 EUR
Parties:	DECO PROTESTE Editores, Lda.
National Case Number/Name:	Deliberação 2019/297
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Portuguese
Original Source:	CNPD Website (in PT)
Initial Contributor:	Jose Belo

The DPA fined a controller €107,000 for repeatedly sending unsolicited marketing communications without the data subject's consent. The controller bore liability even though it was a third-party who sent the communications using their own database.  

English Summary

Facts

A data subject received unsolicited direct marketing emails from Deco Proteste. Deco Proteste was the largest Portuguese Consumer Protection association, operating, in this matter, as Deco Proteste Edições Lda., a limited liability company.

The data subject never provided their personal data to Deco Proteste and, as a result, never consented to receiving direct marketing emails from the organization.

The data subject filed a complaint with the Portuguese DPA (CNPD).

After the investigation, 45 other unsolicited direct marketing emails, between the dates of 11th of October 2011 and 5 of June 2013, were added to the complaint.

Dispute

Deco Proteste claimed that the personal data of the data subject was part of a database owned by a direct marketing company it had subcontracted to provide direct marketing services. As such, the claimed it was the direct marketing company that was the controller, not Deco Proteste.

Holding

The DPA upheld the complaint and imposed a fine of €107,000.

Deco Proteste was assigned a role of a data controller. The DPA did not accept the controller's arguments that the marketing agency who sent the marketing communications was acting as an independent controller.The fact that the controller used a third party to assist in direct marketing of its products did not exclude their status of controller, even if the database used was owned by that third-party. Hence, the marketing company was considered by the DPA as a processor.

Also, the DPA explained the legitimate interest under Article 6(1)(f) GDPR was not the applicable legal basis to use the data subject's contact details for direct marketing purposes. The DPA considered that all direct marketing emails sent referred to products and services offered by controller. It also considered that controller freely, voluntarily and consciously decided to process personal data without any legal basis to promote its products and services, neglecting its legal obligations under the Personal Data Protection Act of 1998, in force at the time of the violations.

Comment

Marketing agencies sending marketing messages on behalf of the controller act as the latter's processor, regardless of the fact that the former are the sole holders of the contact details database used to send the messages.

Further Resources

https://www.dn.pt/pais/comissao-de-protecao-de-dados-aplica-coima-de-107-mil-euros-a-deco-11515689.html

https://www.mondaq.com/data-protection/871388/new-fine-for-unsolicited-marketing-messages-by-portuguese-data-protection-authority

English Machine Translation of the Decision

The decision below is a machine translation of the Portuguese original. Please refer to the Portuguese original for more details.

Case no. 7847/2013 1
DELIBERATION/2019/297
I - Report
The National Data Protection Commission (CNPD) has drawn up a draft resolution
on February 19, 2019, in which the defendant was accused of
the commission of forty-six administrative offenses, p. and p., under
the combined terms of friend 22. with paragraph b) of no. j and no. 4, both of friend
37 of Decree-Law no.O 7/2004, of January 7, amended by Decree-Law no. 62/2009, of
March 10, with a fine of G 2,500.00 to € 50,000.00, increased by one third of the
minimum and maximum limits. COITIO tülTlbém the practice of forty administrative
offenses, p. and p., under the terms of paragraph 1 of paragraph 1 f} and paragraph 5,
both of article 14 of Law no. 41/2004, of August 18, in its current wording, with a fine of
G 5,000.00 to € 5,000,000.00.
The defendant was notified of the content of the aforementioned project and, under the
terms of article 50.o of the General Regime of Administrative Offenses and Fines, to
present its defense:
1. The lack of sufficient proof of the facts imputed to the defendant, since it is not
clear what the specific processing of personal data was, considering also that
there is no evidence in the case file to impute to the defendant any processing of
personal data.
2. Next, the defendant invokes the lack of documentary evidence, having asked the
CNPD that the electronic communications in question be forwarded to it for
analysis and response, a request that was never complied with by the CNPD, thus
refuting the probative value of the private documents.
3. Next, the defendant claims that the email addresses from which the electronic
communications in the case file were sent - site,
- It also believes that the
entities operating these sites are the entities responsible for processing personal
data, since they are the ones who collect personal data and determine the
purpose for such collection, as well as deciding which discounts they will promote
to their customers, and also the offers they send to each of their customers.
ri comi os i i s'- i• ! i 200-f'.S 1 1.1 S ROA [ Ww\x CH PD. PT | Tfi1 -351 213 928 400 } FAX: -3S1 213 976 832
and site
Case No. 7847/2013 1v.
4. The defendant also maintains that the basis of legitimacy for the processing in
question is the pursuit of the legitimate interest of the controller, highlighting once
again the three websites, and that the sending of such communications would thus
be legitimized, without any need for the express consent of the data subject.
5. Finally, the defendant argues that she did not have actual access to the
communications in question, but only to their paper printouts, so she cannot
determine with certainty who sent them, and thus, being deprived of access to a
means of defense, she believes that any accusation against her is null and void.
The defendant presented two documents and did not request the production of any
other evidence, nor did she request the production of any means of obtaining
evidence.
II - Assessment
The CNPD has jurisdiction under the terms of Article 36 and Article 41(2), both of
Decree-Law no.o 7/2004, of January 7, as amended by Decree-Law no.oº 62/2009, de
10 de março, because it was and is the sectoral supervisory authority for the subject
matter of the case, under t h e terms of Article 21(1) and (2)o and Article 22(1)o , both of
Law 67/98, of October 26 (Personal Data Protection Law, hereinafter LPDP).
E also has jurisdiction under Article 13g, in conjunction with Article 15(1), of Law
41/2004 of 18 August, as amended by Law 46/2012 of 29 August.
In view of the written defense presented by the defendant, it is necessary to assess the
arguments of fact and the respective grounds o f law presented.
Starting with the last ground of defense, which is based on the alleged failure to comply
with the defendant's defense guarantees, translated into the lack of access to
electronic communications, which is restricted only to the respective paper printouts, it
is important to proceed with the assessment that is necessarily prior to the analysis of
the merits of the defense, highlighting that the defendant is not right. Otherwise, let's
see.
The evidence supporting the imputation of the facts contained in the draft resolution to
the defendant, in addition to the testimony of the participant and the legal
Case no. 7847/2013 2
NATIONAL DATA
PROTECTION
COMMISSION
the defendant's representative, are also rooted in the electronic communications
received by the defendant.
The General Regime of Administrative Offenses and Fines, as well as the Code of
Criminal Procedure, applicable under Article 41(1) of that law, do not, of course, contain
any rule that gives the administrative authority the freedom to send any evidence or
originals thereof to the procedural subjects.
In addition, it should be noted that the administrative offense procedure is subject to
the principle of legality.
Therefore, the defendant, through her defender, had access to the case file and the
evidence contained therein on at least two occasions, preceded by requests to consult
the case file, which were effectively and fully granted by the CNPD.
oFurthermore, the defendant could have requested the corresponding extracts, copies
and certificates, under the terms of Article 89(1) of the Code of Criminal Procedure, ex
vi Article 41(1) of the General Regime of Administrative Offenses and Fines; however,
she did not do so, siôi fmpHtdt.
In addition, the defendant claims that the indictment is flawed for the reasons set out above.
nullity. However, it does not even indicate a rule that supports the imputation of such an
alleged defect, much less that it is legally sanctioned with such invalidity, which is why
the argument of non-compliance with the guarantees of defense invoked by the
defendant is unfounded.
Having said that, it is important to look at the merits of the case, and to assess the
grounds of the written defense.
As for the argument that there is no sufficient proof of the facts imputed to the
defendant, it is clear from the available evidence that the defendant sent unsolicited
communications for direct marketing and advertising purposes to the participant, without
the participant's prior consent - facts set out in points 7 to 52 of the draft decision - and
without the holder's prior express consent - facts 53 to 92 of the draft decision.
These facts reveal a type of processing of personal data, the sending of electronic
communications with promotional content to natural persons, since they involve the use
of personal data - in this case, the name of the data subject and their e-mail address -
within the meaning of Article 3(a) of the LPDP, since they are information relating to an
identified natural person - in this case , the participant.
Case No. 7847/2013 2v.
Having defined these concepts, it is important to relate them to the defendant's
responsibility for administrative offenses, and the respective terms, anchored in the
specifically applicable sanctioning laws - Decree-Law no. 7/2004, of January 7,
amended by Decree-Law no.o 62/2009, of March 10, and Law no.o 41/2004, of
August 18, amended by Law no.o 46/2012, of August 29.
The application of these laws cannot be carried out without the framework of the
concepts and principles of the Personal Data Protection Law, insofar as it specifies
and complements the LPDP (cf. Articlet 9 1.2).
Accordingly, in the light of Article 3(d)o of the LPDP, the controller is any natural or legal
person who determines the purpose and means of the processing of personal data
and, in accordance with Article 3(e), the processor is the natural or legal person who
processes personal data on behalf of the controller.
These concepts have not been changed in any way by Regulation (EU) 2016/679 of
the European Parliament and of the Council of April 27, 2016 (General Data Protection
Regulation, hereinafter GDPR), as can be seen from points 7) and 8) of the GDPR.
8) of Article 4.
Thus, the data controller may not be the same as the person who sent the unsolicited
communication for promotional purposes, as is the case here. In fact, it is quite common
these days for companies to use external entities to develop marketing campaigns.
However, this does not mean that they do not qualify as data controllers.
In fact, it was the defendant who decided to carry out actions
marketing campaign to attract new customers, thus defining the purpose of the
processing of personal data - marketing campaign aimed at potential customers
(creation of leads) - and established for this purpose the means to carry it out - through
the
hiring to provide an email service
using the company's database.
The fact that the defendant does not have the database in question in her possession
does not mean that she is not responsible for the data processing, which consists of
sending an email with promotional content; what the concept of responsible is
intended to qualify is the subject or entity that determines the means and purposes
of the processing, and not the data controller.
Case No. 7847/2013 3
possessor or holder of the personal data to be processed, precisely so that the scope of
the concept can be extended to cases such as the present one.
Furthermore, the processing of personal data in question is based, in terms of its
lawfulness, on the consent of the data subject, since it is alleged by the participant and
not contested by the defendant, that the former is not and has never been a client or
subscriber of the defendant's products or commercial content, and the reasoning that
points to the legitimate interest (above all) of the subcontractors as legitimizing the
processing is unfounded. This consent must be obtained under the terms of
personal data protection legislation.
In this sense, the defendant's choice was conscious
in using this method to market its services, and may not ignore the legal regime
applicable to the sending of unsolicited electronic communications of a promotional
or direct marketing nature.
In fact, this is a very strict regime, the main aim of the European legislator being to
significantly reduce unsolicited electronic communications (aka spam), which account
for more than 90 percent of the world's communications and pose a high risk to the
security of communications infrastructures. To that extent, the regime is particularly
demanding in making the sending of the communication dependent on consent,
which must be express and, under the terms of Article 3(h) of the LPDP, also free,
informed and specific. In other words, generic consent to the use of personal data
"ema//' to send marketing communications in the abstract is not admissible.
In order to be able to send on behalf of the defendant
several electronic communications advertising the services or
products of the latter, the participant should have specifically consented
in the sending of marketing by the defendant, which would have been very difficult without the
intervention or knowledge of this company.
The defendant cannot, therefore, claim to be exempt
from its responsibility by using a subcontractor who acts on its instructions and on its
behalf to promote its products, without taking care to comply scrupulously with the
legal framework in force. This results from the combined provisions of Article 3(e)o ,
Article 14(3) and Article 16 of the LPDP,
Case No. 7847/2013 3v.
which establish that the subcontractor's actions are the result of instructions from the
controller, which are covered by a contract.
oAlso noteworthy is the text of Article 14(2) of the LPDP, which states that the
responsible party, in this case , has the obligation to
choose a subcontractor who offers sufficient guarantees regarding the technical
security measures and the organization of the processing to be carried out, and
must ensure that these measures are complied with.
Therefore, when choosing a subcontractor, the defendant should have ensured that
the marketing actions carried out by the subcontractor complied with
all the legal obligations in terms of
data protection and, at the same time, verified this compliance in practice, which
obviously did not happen.
As such, the defendant's failure to comply with the duties to which she was legally
bound - verification of the existence of the recipient's express prior consent
of the communication to the defendant's marketing enviD
- leads to its liability for administrative offenses, contributing causally and
decisively to the occurrence of the infractions at issue in these proceedings.
In fact, as has already been shown, it is the controller who has the obligation to
guarantee that the processing is lawful.
The defendant could not ignore the fact that the personal data processing operation in
question involved the use of personal data and depended, as a condition of lawfulness,
on the prior express consent of the data subject, in the context of sending
unsolicited communication for direct marketing purposes.
Thus, even the defendant's claim that she has no connection with the email addresses
from which the B6 electronic communications contained in the case file were sent,
for the reasons given above, still does not exonerate her from responsibility for the
administrative offense.
And this is because, in addition to the arguments already set out, at no time does the
defendant allege, let alone provide any evidence to prove, that the participant had
previously given his consent to the sending of unsolicited communications, for direct
marketing or advertising purposes, by an Iado.
On the other hand, at no point in her written defense does the defendant deny that the
advertising content contained in the electronic communications belongs to her - e.g.
the brand used, the sayings, or the advertising campaigns themselves included in
the electronic communications.
Case No. 7847/2013 4
Moreover, the defendant did not react by judicial means to a possible unauthorized use of the
graphic elements protected by the rights they enjoy.
Furthermore, the conclusion that it was the defendant
who decided to carry out marketing actions to
attract new customers, thus defining the purpose
of the processing of personal data - a marketing campaign aimed at potential clients
(creation of leads) - and established the means to carry it out - by contractingfrom to
provide a service for sending emails and using the database that this company
holds -, is evident from the statements made by the defendant's legal representative,
as well as from the 86 electronic communications that show that unsolicited
communications were made, for advertising or direct marketing purposes.
Furthermore, on folio 287 of the case file, the participant made it known that after
submitting the respective report to the CNPD against the defendant in these
proceedings, he never again received any unsolicited electronic communication, for
the purposes of direct rriarketing, or advertising, regarding the provision of goods or
services, via the electronic addresses in question, which shows that the defendant
was and is responsible for processing personal data, and not the entities operating
the websites that used the electronic addresses to send the communications to the
participant.
Next, we should consider the question of the probative force of the documents in
the case file, which embody the electronic communications received by the
participant.
Article 164(1)o of the Code of Criminal Procedure, which applies here ex v/ article
41(1) of the General Regime of Administrative Offenses and Fines, states:
"Evidence by document is admissible, meaning a statement, sign or notation
embodied in writing or any other technical means, under the terms of the criminal
law."
Paragrapho 2 of the aforementioned provision allows for documentary evidence to be
added of its own motion or on request.
Electronic communications objectively constitute statements embodied in writing, falling
within the concept of Article 164(1)O of the Code of Criminal Procedure. Accordingly,
and in concrete terms, such communications fall within the concept of
electronic document, which corresponds to that which is drawn up by means of
electronic data processing (Article 2(a) of Decree-Law no.o 290-D/99, de
AV. U. CAftLOS I, 134 - 1" | j 200-¢51 LI S 6UA | WW\V.CN P ti.I' F | TF[. -3°i1 213 928 400 FAX: +351 213'276 832
Case No. 7847/2013 4v.
2 of August, republished with amendments in the annex to Decree-Law no. 88/2009 of
April 9).
Article 4 of the above-mentioned law s t a t e s : "Copies of electronic documents,
whether on the same or a different type of support, are valid and effective under the
terms of the law and in addition to the probative force attributed to folio copies by
Article 387(2) of the Civil Code and Article 168.o of the Code of Criminal Procedure, if
the requirements laid down therein are met."
In turn, Article 168 of the Code of Criminal Procedure states that a mechanical
reproduction has the same probative value as the original if it has been identified with it
in that or another case.
In this regard, PAULO PINTO DE ALBUQUERQUE1 points out that, "The mechanical
reproduction of documents can be made when the originals cannot be preserved or
attached to the file. The law even allows this reproduction to be made in the file in
which the reproduction is kept or in another file, and does not establish any
requirement as to the nature of the aulor/dade that confirms the identification of the
mechanical reproduction with the ofp/na/s."
Having looked at the case file, it can be seen on pages 195 and 196 that the CNPD
asked the participant to send the electronic communications, which were mechanically
reproduced and have the same probative value as the original.
In addition, the defendant claims, in conclusion, that she challenges the validity,
veracity and authenticity of the documentary evidence contained in the case file.
However, the defendant does not allege any fact that indicates or demonstrates,
concatenated with others, that the validity, veracity or authenticity of the documentary
evidence is in question.
Nor does the defendant allege the material falsity or ideological falsity of the documents
contained in the case file, identified and related to the facts proven in the draft decision.
Furthermore, there is no reason to doubt the genuineness and veracity of the
documentary evidence in question, which is why the CNPD assessed it and built the
draft decision on the basis of it.
' Cfr. Comentário do Códipo de Processo Penal, 3.' updated edition, p, 451
Case No. 7847/2013 5
Finally, the defendant argues that the basis of legitimacy for the processing of personal
data consisting of the sending of unsolicited communication, for direct marketing or
advertising purposes, lies in the pursuit of the legitimate interest of the data controller.
The defendant is not right about this argument either. If not, let's see.
Legitimate interest can be the basis for processing personal data under the terms of
article 6 of the LPDP. However, in this case, because a specific legal regime applies to
processing corresponding to the sending of electronic communications for direct
marketing purposes, its grounds can only be those provided for in this special regime.
In other words, as the special law restricts the grounds for legitimacy of this processing
of personal data, other grounds provided for in that general law are not applicable.
As a result, Article 22 of Decree-Law No. 7/2004, of January 7, as amended by Decree-
Law No. 62/2009, expressly established the prior consent of the data subject as the
basis of legitimacy for the processing of personal data consisting of the sending of
unsolicited communications for direct marketing purposes.
oSimilarly, Article 13a(1) of Law 41/2004, of August 18, as amended by Law 46/2012, of
August 29, maintained consent as the basis of legitimacy for such processing, alluding
to the prior express consent of the subscriber who is a natural person, even extending,
in comparison with the above-mentioned law, and in an exemplary manner, the various
means by which the communication could be sent. And, with the exception of the case
provided for in Article 13a(3), which does not apply here (since it is claimed by the
participant and not contested by the defendant that he is not and never has been a
customer or subscriber to the defendant's products or commercial content), consent is
the only basis for legitimacy for this type of data processing.
In any case, it should be noted that the Defendant's invocation of a legitimate interest in
sending unsolicited electronic communications to the participant is a demonstration and
implicit acknowledgment that it considers itself responsible for data processing. For the
reasons set out above, the defense's allegations do not call into question the facts
contained in the draft decision, nor the legal framework used, and we therefore intend to
maintain the position taken in that draft.
Case No. 7847/2013 5v.
Therefore, in the light of the elements contained in the case file, we consider the
following to be proven:
III - Facts
1.
(see page 1 of the
case file)
2. The participant
owns the e-mail address (see
pages 275 and 276 of the case file)
3. This is a personal email address (see pages 275 and 276 of the case file).
4. The participant has never been, nor is he, a client of the defendant (see pages 275 and 276 of the
case file).
5. The participant never provided the defendant with his identification and contact
details or email address (see pages 275 and 276 of the case file).
6. The participant never gave his prior consent to the defendant to send him unsolicited
electronic communications for direct marketing purposes (see pages 275 and 276 of
the case file).
7. On October 11, 2011, at 9:25 a.m., the participant , holder ofthe e-
mail address ,received an e-mail from the e-
mail address as follows
subject: "Discover receive a camera". (see pages 166, 165
and 164 of the case file).
8. On October 11, 2011, at 09:35 a.m., email address holder
received an electronic communication from the
email address , subject: "Discover
and receive a camera". (cf. folios 169, 168 and 167 of the
files).
9. On October 27, 2011, at 09:11 a.m., holder of the email address
received an electronic communication from the
email address with the subject line: "Important
message for". (see folio 170 of the case file).
10. On October 27, 2011 , at 9:17 a.m. , the holder of the email
address
received an electronic communication from the
The
defendan
t
is the holder of the
NIPC/NIF je
has
e-mail a d d r e s s
"Important message for you". (cTr. fols. 171 of the case file)
Case No. 7847/2013 6
with as subject:
11. On November 3, 2011, at 05:07 a.m, email address holder
received an electronic communication from the
email address , with the following subject line:
It has a very important message." (see pages 172, 173 and 174 of the case file)
12. On November 14, 2011, at 13:05, email address holder
received an electronic communication from the
email address with the subject line: "Request your
digital camera". (see pages 175 and 176 of the case file)
18. On November 29, 2011, at O8h48, holder of the e-mail address
received an electronic communication from the
e-mail e-mail with as subject:
"Discover your offers here without obligation". (see folios 177 and 178 of the case
file)
14. On November 29, 2011 , at 08:52 a.m. , the holder of the email
address
received an etheric communication from the
eletfónico address . with the subject: "Take advantage now
these 3 welcome gifts". (see folio 179 of the minutes)
15. On December 5, 2011, at 11:20 a.m., , holder of the e-mail address
received an electronic communication from the
e-mail address Subject: "Request
already his digital camera". (see pages 182 to 180 of the case file)
16. On December 5, 2011, at 11:23 a.m, owner of the e-mail address
received an electronic communication from the
email address , with the subject line: "Order your
digital camera™ now." (see folios 185 to 183 of the case file)
17. On December 15, 2011, at 11:10 a.m, email address holder
received an electronic communication from the
email address with the subject line: You
have a very important message". (see folio 186 of the case file)
8. On December 20, 2011, at 18h14, email address holder
received an electronic communication from the
address e-mail
"Important message for the attention of" (see folios 188 and 187 of
the case file)
as subject:

Case No. 7847/2013 6v.
19. On December 20, 2011, at 6:07 p.m., holder of the email address
received an electronic communication from the
email address, with the subject line:
"Important message for the attention of" (see folio 189 of the case file).
20. On December 28, 2011, at 10:15 a.m., holder of the email address
received an electronic communication from the
email address withthe subject line: "Get
your digital camera now". (see pages 192 to 190 of the case file)
21. On December 29, 2011, at 12:20 p.m., holder of the email address
received an electronic communication from the
email address with the subject line:
It has a very important message". (see folio 193 of the case file)
22. On January 5, 2012, at 4:53 p.m., holder of the email address
received an electronic communication from the
e-mail e-mail with as subject:
"Have your rights been violated? We'll help!". (see folio 138 of the case file)
23. On January 5, 2012, at 4:56 p.m., email address holder
received an electronic communication from the
emailaddress withthe subject line: "Have your
rights been violated? We'll help!". (see folios 141, 140 and 139 of the case file)
24. On January 23, 2012, at 10:07 a.m, email address holder
received an electronic communication from the
e-mail e-mail
of the case file)
subject:
thousands of euros a year". (see folio
142
25. On January 23, 2012, at 10:12 a.m., holder of the email address
received an electronic communication from the
email address , the subject being:
thousands of euros a year". (see folio 43 of the case file)
26. On January 30, 2012, at 8:15 a.m., holder of the email address
received an electronic communication from the
emailaddress with the subject line: "Limited
offer: a multimedia set and wireless headphones". (see pages 146 to 144 of the case
file)
Case no. 7847/2013 7
27. On January 30, 2012, at 8:20 a.m., holder of the email address
received an electronic communication from the
email address with the subject line: "Limited
offer: a multimedia set and wireless headphones". (see pages 149 to 147 of the
case file)
28. On February 2, 2012 , at 10:30 a.m. , holder of the email
address
received an electronic communication from the
email address with the subject line:
1 Multimedia Set and Wireless Headphones". (see pages 151 and 150 of the
case file)
29. On March 1, 2012, at 11:28 a.m., email address holder
received an electronic communication from the
email address\endO subject: for you, 1 set of multimedia and wireless
headphones". (see folios 153 and
152 of the case file)
30. On March 7, 2012, at 11:00 p.m., holder of the email address
received an electronic communication from the
email address with the subject line: "Offer
limited: a multimedia set and wireless headphones". (see pages 156 to 154 of the
case file)
31. On March 8, 2012, at 06:04 a.m, email address holder
received an electronic communication from the
e-mail address as subject: "Offer
limited: a multimedia set and some doseless headphones". (see folios 159 to
157 of the ãUtOS)
32. On March 26, 2012, at 1:54 p.m., holder of the email address
received an electronic communication from the
email address , with the following subject line:
It has a very important message". (see folio 160 of the case file)
33. On April 6, 2012, at 09:26 a.m., holder of the email address
received an electronic communication from the
multimedia autOs) with the subject line: 'Get everything
with no strings attached '". (see folio 107
of the
A\' D. C.ARI.O$ I. 1 34 - lº | l 200-fiS 1 1.[ S itOA | W\V\V.C.U P D. EN i TE L: -351 2 l3 928 400 { FAX: -3S1 21 3 97G 832Case No. 7847/2013 7v.
34. On April 9, 2012, at 9:33 a.m., holderdo electronic address
received an electronic communication from the
address
multimedia set plus autos)
35, On April 17, 2012, at 13:06,
received
with the subject line: "Receive one
without obligation". (see folio 108 of
the
holder of the electronic
address an electronic communication from the
address with the subject line: " Did
you know we have 2 presents for you?" (see folio 109 of the case file).
36. On May 2, 2012, at 09h46, email address holder
received an electronic communication from
address . with the subject line: "For you, free of
charge, a set ofmultimedia plus " (see pages 111 and 110 of thecase file)
37. On May 8, 2012, at 11:32 a.m, holderdo address e-mail
received an electronic communication from
email address on the subject: "
Did you know thathas 2 gifts and foryou. No strings attached."
(see folios 113 and 112 of the case file)
38. On May 28, 2012, at 10:23 a.m, holderdo address e-mail
received an electronic communication from the
e-mail e-mail
"Receive a multimedia set plus 114 of
the files)
having subject:
no strings attached!". (see pages 116 to
39. On May 28, 2012, at 10:28 a.m., the holderdo email address
received an electronic communication from
email address with the subject line: "Receive a set of
multimediaplus withoutobligation". (see pages 119 to 117
of the case file)
40. On May 31, 2012 , at 10:51 a.m. , holderdO email address
received an electronic communication from
email address with the subject line: "I have
a very important message". (see folio 120 of the case file)
41. On June 19, 2012, at 06:04 a.m, owner of the address
received an electronic communication from
your offers?"
(see pages 122 and 121 of the case file).
Case No. 7847/2013 8
with the subject: "Have you received the
42. On June 19, 2012, at 06:03 a.m., email address holder
from the
with the subject: "Already
received your offers?" (see folios 124 and 123 of the case file).
43. On June 19, 2012 , at 11:40 a.m. , holder of the email
address
received an electronic communication from the
emailaddress withthe subject line: 'we still
have 2 gifts and reservedfor you. No strings attached." (see
pages 130 and 129 of the case file)
44. On July 6, 2012, at 11:10 a.m., email address holder
received an electronic communication from the
email address
knew that we have 2 gifts and
pages 132 and 131 of the case
file)
on the subject: "
for you. No obligation to buy." (cfr.
45. On July 9, 2012, at 08:28 a.m., holder of the email address
received an electronic communication from the
email address withthe subject line:
"Exceptional offer: a multimedia set + wireless headphones" (see folios 135 to 133 of
the case file)
46. On July 9, 2012, at 08:32 a.m., holder of the email address
received an electronic communication from the
electronicaddress with the subject: "Exceptional
offer: amultimedia set + wireless headphones". (see pages 71 to 69 of the case file)
47. On July 24, 2012 , at 11:43 a.m. , the holder of the email
address
received an electronic communication from the
email address with the subject line: "Attention
You have a notice to receive your Offers." (see folio 72 of the case file)
48. On July 30, 2012, at 12:52 p.m., holder of the email address
received an electronic communication from the
email address with the subject line: "Offer
received a communication
email address
Av. D. UAR1.OS 1. 1 34 - I ° | l 200-65 l LS BOA | \ V W W .CF ED. PT { TE L: -351 213 928 400 } FAX: 3S1 213 97f' 832
Case No. 7847/2013 8v.
limited: a multimedia set and wireless headphones". (see pages 75 to 73 of the case
file)
49. On July 30, 2012. at 12:56 p.m, email address holder
received an electronic communication from
email address , with the subject line: "Limited offer: a
multimedia set and wireless headphones". (see pages 78 to 76 of the case file)
50. On August 6, 2012 , at 11:50 a.m. , the holder of the email
address
received an electronic communication from
email address with the subject line: "Limited
offer: a multimedia set and wireless headphones". (see pages 81 to 79 of the case
file)
51. On August 6, 2012, at 11:53 a.m, email address holder
received an electronic communication from
electronicaddress with the subject line: "Limited
offer: a multimedia set and wireless headphones". (see pages 84 to 82 of the case
file)
52. On August 28, 2012 , at 10:58 a.m. , the holder of the email
address
received an electronic communication from
emailaddress with the subject line:
did you know that we have 2 Gifts and 3 magazines for you. No obligation to
buy." (see pages 86 and 85 of the case file)
53. On September 10, 2012, at 08:37 a.m, email address holder
received an electronic communication from
emailaddress with the subject line:
"We havean exceptional offer for you". (see pages 88 and 87 of the case file)
54. On September 10, 2012, at 09:06, email address holder
received an electronic communication from
address withthe subject line: "We have an
exceptional offer for you". (see pages 90 and 89 of the case file)
ss On September 25, 2012 , at 10:58 a.m. , holder of the email address
received an electronic communication from the
email address , with the subject line: "Attention
you have a notice to receive your offers", (see folio 91 of the case file)
AV. D. CAltLOS 1, 134 - lº { 1200-t'51 Fl S bOA i WWW.CN PD. PTTO L. +35l 213 926 400 | FAX: +35 l ?' l ? 976 832
Process n.0 7B47/2013 9
56. On October 16, 2012, at 10:34 a.m., holder of the email address
received an electronic communication from the
email address withthe subject line: "Attention
you have a notice to receive your offers". (see folio 92 of the case file)
57. On November 13, 2012, at 09:51 a.m., holder of the email address
received an electronic communication from the
email address withthe subject line: "Attention
you have been selected to receive 2 gifts. Please confirm delivery" (see folio
93 of the
files)
58. On November 15, 20 2, at 09n18, . holder of the e-mail address
from the subject: "No
lose this health card with exceptional conditions". (see folios 99 to 97 of the case
file) 5s. On November 15, 2012, at 9:21 a.m., the holder of the email address
received an electronic communication from the
emailaddress with the subject line: "Don't miss
out on this health card with exceptional conditions". (see pages 96 to 94 of the case
file)
60. On November 26, 2012 , at 08:33 a.m. , the holder of the email
address
received an electronic communication from the
address Discover free
of charge (page 100 of
the case file)
subject subject:
and receive a set of Multimedia". (cf.
61. On November 26, 2012 , at 8:49 a.m. , the holder of the email
address
received an electronic communication from the
emailaddress with the subject: "Discover for
free and receive a set of Multimedia". (see folio 101
of the case file)
62. On December 6, 2012 , at 11:04 a.m. , the holder of the e-mail
address
received an electronic communication from the
email address , with the subject line:'Attention,
you have 2 gifts for Confirm delivery". (see folio 102 of the case
file)
63. On December 10, 2012 , at 08:25 a.m. , the holder of the email
received a communication
email address
address
received an electronic communication from the
e-mail e-mail with as subject:
AV. D. CAltLOS 1, 134 - lº { 1200-t'51 Fl S bOA i WWW.CN PD. PTTO L. +35l 213 926 400 | FAX: +35 l ?' l ? 976 832
"Find out for free pages
103 of the case file)
Case No. 7847/2013
receive a set of multimedia." (cf.
9v. t"
64. On December 10, 2012, at 08:42 a.m, email address holder
received an electronic communication from the
address with the subject line: "Discover
forfree and receive a set of media." (cfr. f\s. 104 of the case
file)
65. On December 31, 2012, at 08:22 a.m, email address holder
received an electronic communication from
address Discover
free of charge on page
105 of the case file)
having subject:
and receive a set of multimedia". (cf.
66. On December 31, 2012, at 08:30 a.m, holder of the e-mail address
received an electronic communication from
emailaddress with the subject line: "Discover
forfree and receive a set of multimedia". (see folio 106 of the
case file)
67. On January 5, 2013, at 09:55 a.m., email address holder
received an electronic communication from
email address with the subject line: "Don't miss
out on this health card with exceptional conditions". (see pages 31 to 29 of the case
file)
68. On January S, 2013, at 10:03 a.m, email address holder
received an electronic communication from
email address with the subject line: "Don't miss out on
this health card with exceptional conditions". (see pages 34 to 32 of the case file)
69. On January 10, 2013, at 10:56 a.m, email address holder
received an electronic communication from
e-mail address with the subject line: "Attention:
2 offers stop Confirm delivery". (see folio 35 of the case file)
70. On January 17, 2013, at 12:18 p.m., holder of the email address
received an electronic communication from the
email address with the subject line: "Attention: your
gifts are awaiting confirmation". (see page 36 of the case file)
email address
received an electronic communication from the
, subject: "To:
Free, MPS Multimedia player and
Process n.0 7847/2013 10
71. On January 21, 2013, at 8:20 a.m., the holder of the electronic address
received an electronic communication from the
email address with the subject line: "We have a
exceptional proposal for you". (see pages 38 and 37 of the case file)
72. On January 21, 2013 , at 08:32 a.m. , holder of the email
address
received an electronic communication from the
e-mail address as subject:
"We have an exGectional proposal for you". (see folios 0 and 39 of the case file)
73. On February 13, 2013, at 05:04 a.m, email address holder
received an electronic communication from the
email address Subject: "Offer
Iİmitada: a multimedia MP5 player p lus (see pages 43 to 41 of the case file)
74. On February 13, 2013, at 11:43 a.m., holder of the email address
folios 46 to 44 of the case file)
75. On March 4, 2013, at 8:36 a.m., holder of the email address
received an electronic communication from the
email address with
the subject line:
"Ofena limitada:a multimedia MP5 player plus ". (see pages49 to 47 of the
case file)
76. On March 4, 2013, at 9:05 a.m., email address holder
received an electronic communication from the
email address , with the subject line: "Ofena
limited: a multimedia MP5 player plus !". (see pages 52 to 50 of the case file)
77. On March 7, 2013, at 11:14 a.m., email address holder
received an electronic communication from the
email address with the subject line: "For: Free,
MPS Multimedia player and all without obligation!". (see pages
55 to 53 of the case file)
78. On March 18, 2013, at 8:46 a.m., holder of the email address
received an electronic communication from
e-mail e-mail limited: a multimedia MP5 player plus
\v. D. CARGOS [. 134 - I° | I 200-ó5 I FI 5 USA | M'WW.CA PM. ENTEL: -35l 213 928 400 { FAx: -3S1 213 97b 832subject: "Ofena".
(see pages 58 to 56 of the case
file)
Case No. 7847/2013
79. On March 18, 2013, at 10:22 a.m., holder of the email address
received an electronic communication from the
email address , with the subject line:
"Limited offer:a multimedia MP5 player plus ". (see pages 61to 59 of the case
file)
80. On April 1, 2013 , at 11:33 a.m. , the holder of the email
address
received in an electronic communication from the
10V.
address Discover free
of charge (see pages 63
and 62 of the case file)
with as subject:
and receive an MP5 Multimedia
player".
8 . On April 1, 2013, at 11:38 a.m., the holder of the email address
received an electronic communication from the
email address free
of charge
files)
with the subject: "Discover and
receive an MPS reader". (see folios 65 and 64
of the
82. On April 15, 2013, at 13:13, email address holder
received an electronic communication from the
e-mail e-mail having
"Receive free .(see pages 68, 67 and
66 of the case file)
83. On April 15, 2013, at 1:23 p.m., holder of the email address
received an electronic communication from the
emailaddress with the subject line: "Receive
FREE . (see pages 4 to 2 of the case
file)
84. On April 29, 2013, at 08:56 a.m., holder of the email address
received an electronic communication from the
e-mail e-mail
"LIMITED OFFER: a multimedia MPS reader plus files)
with as subject:
(see folios 6 and 5
85. On April 29, 2013, at 09:34 a.m., holder of the email address
received an electronic communication from the
emailaddress withthe subject line: "LIMITED
OFFER:a multimedia MP5 player plus '.(seepages 9 to 7 of the
case file)
86. On May 9, 2013, at 11:00 a.m., holder of the email address
received an electronic communication from the
Case No. 7847/2013 11
email address with the subject line: "Attention:
Please confirm receipt of your MP5 player". (see pages 12 to 10 of the case file)
87. On May 17, 2013, at 08:16 a.m., holder of the email address
received an electronic communication from the
address email
address "Receive the
file for FREE)
with as subject:
folios 15 to 13 of the
88. On May 27, 2013, at 08:44 a.m, email address holder
received an electronic communication from the
e-mail e-mail
Find out for free
(see pages 17 and 16 of
the case file)
with as subject:
and receive an MP5 Multimedia
player".
89. On May 27, 2013, at 08:52 a.m., holder of the email address
received an electronic communication from the
email address free
of charge to
and 18 of the case
file)
with the subject: "Discover and
receive a multimedia MP5 player!". (see folio 19
90. On June 3, 2013, at 8:27 a.m., holder of the e-mail address
received an electronic communication from the
email address, with the subject
line: "Don't miss out on this health card with exceptional conditions". (see pages 25
to 23 of the case file)
91. On June 3, 2013, at 08:35 a.m., holder of the email address
received an electronic communication from the
email address with the subject line: "Don't miss out
on this health card with exceptional conditions". (see pages 22 to 20 of the case
file)
92, On June 5, 2013, at 4:12 a.m., holder of the e-mail address
received an electronic communication from the
e-mail address with the subject line: "Attention:
has an MP5 player waiting for you." (see pages 28 to 26 of the case file)
93. The participant never asked the defendant to send the electronic
communications listed and described above (see pages 275 and 276 of the case
file).
94. All the aforementioned electronic communications refer to products or services
provided by the defendant.
AV. D. CAFLLOS l. t 34 - ° | 1200-53 I LIS BOA | Wk'\V.Ú N I'D.I'T | TEL: +331 2T 3 028 *t00 | Fax: ' 351 213 976 832
Case No. 7847/2013 11v.
95. The defendant processed personal data in the course of carrying out a specific
activity, which necessarily has an impact on the privacy of natural persons and she
had an obligation to find out the legal framework in which it could in fact be carried
out.
96. Thus, the defendant had a duty to know that the basis of legitimacy for carrying out
unsolicited communications operations for the purposes of direct marketing of data
subjects who were not its customers lies in the consent of those data subjects,
which must be obtained prior to the processing of the personal data concerned.
97. As such, the defendant acted freely, voluntarily and consciously, with the intention of
carrying out unsolicited communications for promotional and direct marketing
purposes, without taking into account the existence of the participant's prior and
express consent, representing as possible that she would harm the participant's
privacy, not using the care she was obliged to and capable of, knowing full well that
she was acting against the law.
IV - Reasons for the conviction on factual decisions
- The electronic communications attached to the case file;
- The statements made by the participant;
- The statements made by the defendant's legal representative; e,
- Written defense presented by the defendant.
Therefore, in view of the facts established, there is sufficient evidence that the defendant
committed, in consummate form, the following acts
with conscious negligence, of forty-six administrative offenses foreseen and
punishable under the combined provisions of article 22.o , with paragraph b) of n,o
1 and paragraph 4, both of article 37 of Decree-Law no. 7/2004, of January 7, as
amended by Decree-Law no. 62/2009, of March 10, a fine of €6,500.00 to €50,000.00,
increased by one third of the maximum and minimum limits, due to the fact that the
infringements in question were committed by a legal person, under the terms of
paragraph 5 of the aforementioned provision.
From the above, it appears that the defendant committed several administrative
offenses, having harmed the legal good protected by the above-mentioned
administrative offenses on forty-six occasions, and that there was therefore a real
competition of
Case No. 7847/2013 12
administrative offenses, and it is therefore necessary to apply Article 19(1) of the
General Regime of Administrative Offenses and Fines, applicable ex x/ Article 35 of the
LPDP, justifying the legal cumulation of fines, based on the limits set out in paragraphso
2 and 3 of that precept.
Therefore, and prior to making the legal cumulation, it is important to determine the
criteria for determining the specific amount of each fine, in accordance with Article
18(1) of the General Regime of Administrative Offenses and Fines.
- the seriousness of the offense - measured by the factual circumstances described
above regarding the manner and form in which the offense was carried out;
- the degree of guilt of the defendant - understood as an element of subjective imputation
to the agent, and, / in this case, as the result of negligent action insofar as the
defendant acted with the purpose of carrying out unsolicited communications for
promotional and direct marketing purposes, without taking care of the existence of the
participant's prior consent, representing as possible that it would harm the participant's
privacy, not using the care to which she is obliged and of which she was capable,
knowing full well that she was acting against the law;
- the defendant's economic situation - in relation to which, in this case, nothing is
he said;
- economic benefit derived by the defendant - in relation to which it is not p o s s i b l e to
evaluate or quantify in monetary terms; e,
- the minimum and maximum amounts laid down by law for fines.
Accordingly, and with regard to the administrative offenses provided for and punishable,
pursuant to the combined provisions of Article 22, with paragraph 1(b) and paragraph 4,
both of Article 37 of Decree-Law no.o 7/2004, of January 7, as amended by Decree-Law
no. 62/2009, of March 10, with a fine of € 2,500,00 to € 50,000,00.500.00 to €
50,000.00, increased by one third of the maximum and minimum limits, under the terms
of paragrapho 5 of the latter provision, which amounts to a minimum of € 3,333.00 to €
66,666.00, thus constituting the administrative offense framework abstractly applicable.
In fact, taking into account the criteria described above, the CNPD sets the amount of
the fine for each infringement at: €4,000.00.
The framework of the reasoning was left out of the deliberation protocol.
Case No. 7847/2013 12v.
The minimum limit of the tender is therefore €4,000.00, and the maximum limit is
€133,332.00, as is clear from the application of Article 19(1) and (2) of the General
Regime of Administrative Offences and Fines, ex m/n,o 3 of Article
41 of Decree-Law no. 7/2004, of January 7, as amended by Decree-Law no. 62/2009,
of March 0.
Having assessed the facts in the light of the criteria set out above and duly weighed up,
it is considered appropriate to impose a single fine, in legal terms, of € 7.000.00 (seven
thousand euros) for the commission of forty-six administrative offenses provided for
and punishable under the combined provisions of Article 22, with ) of paragraph 1 and
paragraph 4, both of Article 37 of Decree-Law no. 7/2004, of January 7, as amended by
Decree-Law no.62/2009, of March 10 -,
which we hereby reproduce in full for all due and legal purposes.
It also appears, in view of the facts and findings, that it is sufficiently
it is alleged that the defendant has committed with
conscious negligence, forty administrative offenses foreseen and punishable in the
under the combined provisions of Article 13a(o ) and Article 14(f)(o )(1) and (5) of Law
41/2004 of August 18, as amended, with a fine of between €5,000.00 and
€5,000,000.00.
In addition, under the terms of article 17, no.o 4 of the RGCO, applicable ex v/ article 35
of the LPDP, acts committed negligently are punishable by a fine, with the minimum
and maximum limits abstractly applicable being reduced by half - € 2,500.00 to
2,500,000.00.
The aforementioned criteria must also be used to determine the specific fine(s) to be
imposed:
- the seriousness of the offense - measured by the factual circumstances described
above regarding the manner and form in which the offense was carried out:
- the degree of guilt of the defendant - understood as an element of subjective imputation
to the agent, and, at home, as the result of negligent action insofar as the defendant
acted with the intention of carrying out unsolicited communications for the purpose of
Case No. 7847/2013
promotional and direct marketing, without taking into account the existence of the
participant's prior consent, representing as possible that it would harm the participant's
privacy, not using the care to which it is obliged and of which it was capable, knowing
full well that it was acting against the law;
- the defendant's economic situation - in relation to which, in this case, there is nothing to be found
he said;
- economic benefit derived by the defendant - in relation to which it is not p o s s i b l e to
evaluate or quantify in monetary terms; e,
- the minimum and maximum amounts laid down by law for fines.
Valuing the facts in the light of the criteria set out above and duly weighted, the amount
of the fine for each offense is set at: G 2.500,00.
However, unlike the infringements provided for and punished by Decree-Law no.
7/2004, of January 7, as amended by Decree-Law no.O 62/2009, of March 10 - which
stipulates that the applicable subsidiary legislation is the General Regime of
Administrative Offenses and Fines, which establishes the rule of legal cumulation -, with
regard to infringements of Law 41/2004, of August 18, in its current version, the rule
contained in Article 16 sets out, as subsidiary legislation, the LPDP, in particular the
rules of Articles 33.O to 39. In turn, Article 39(2)0 of the LPDP stipulates that the
penalties applicable to administrative offenses in competition - which is the case here
- are always materially cumulative. This system determines that the single fine to be
imposed is the arithmetic sum of the fines imposed on each of the offenses, and there
is no room for reduction.
In obedience to this dictate, by virtue of the principle of legality laid down in article 43.o
of the General Regime of Administrative Offenses and Fines, ex x/article 35 of the
LPDP, the CNPD is bound to apply the system of cumulation defined by the Law, in this
case the LPDP, by virtue of the specific regulation of the system of concurrence of
infractions and sanctions contained therein.
Therefore, and considering, as has already been stated, that there is competition in
the application of a single fine of €7,000.00 (seven thousand euros) - f o r t h e
commission of forty-six administrative offenses provided for and punishable under the
combined provisions of the
Lisbon, May 6th, 2019
José Grazína hado (report
Case No. 7847/2013 13v.
Article 22, paragraph 1(b) and paragraph 4, both of Article 37 of Decree-Law No.
7/2004, of January 7, as amended by Decree-Law No. 62/2009, of March 10 - together
with the forty fines of e2.500.00 (two thousand five hundred euros) each for committing
the forty administrative offenses provided for and punishable under the combined
provisions of Article 13(1)o -A and Article 14(f)o 1 and 14(5)o of Lawo 41/2004, of August
18, in its current wording, the CNPD sets a fine of €107,000.00 (one hundred and
seven thousand euros).
V - Conclusion
In view of the above, the CNPD decides:
1. To impose on the defendant a fine of G
107,000.00 (one hundred and seven thousand euros);
2. Under the terms of Article 58(2) and (3) of the General Regime of Administrative
Offenses and Fines, inform the defendant that:
a) The sentence becomes final and enforceable if it is not challenged in court
in accordance with Article 59;
b) In the event of a legal challenge, the Court may decide by hearing or, if the
defendant and the Public Prosecutor's Office do not object, by simple order.
The defendant must pay the fine within 0 days of its becoming final, sending the CNPD
the respective payment slip. If it is impossible to pay the fine in time, the defendant
must notify the CNPD in writing.
Case No. 7847/2013 14
NATIONAL DATA
PROTECTION
COMMISSION
Luís Barroso
Maria Cândida Guedes de Oliveira
Pedro Mourão
Maria Teresa Naia
Filipa Calvão (President)