AEPD (Spain) - EXP202401934

AEPD - EXP202401934
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 21 LSSI
Type:	Complaint
Outcome:	Upheld
Started:	02.01.2024
Decided:	26.09.2024
Published:	20.11.2024
Fine:	20,000 EUR
Parties:	Supervista Optics Spain
National Case Number/Name:	EXP202401934
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	ao

The DPA fined an optician €20,000 for sending a former customer a marketing email even though she had expressly objected to this form of processing.

English Summary

Facts

On the 2 January 2024, the data subject filed a complaint against the controller, Supervista Optics - an optician, with the Spanish DPA (AEPD). The data subject had received an email from the controller informing her that although it had been two years since she had purchased glasses with the controller, she is entitled to a free eye examination with the controller.

The data subject had previously exercised her right to object to receiving any marketing communications on 24 May 2023. The controller had acknowledged receipt of the request and placed the data subject on a “marketing blacklist”.

The controller argued, that the communication was a service email, which did not discuss content of a commercial nature. It detailed that it was justified in sending this email as the warranty for the purchased glasses had not expired yet. It further argued that Article 21(2)(1) of the Spanish transposition of the e-privacy Directive, Law 34/2002 (Ley 34/2002 - LSSI) allows for the delivery of commercial advertisements as long as there is a contractual relationship between the controller and the data subject.

Holding

The AEPD held, that any form of communication, which directly or indirectly promotes the goods, or services of a company is classified as being of a commercial nature. Although the service offered is free of charge, it is performed as part of the controller’s commercial activity as an opticians.

Article 21(2)(1) LSSI would only hold up if the data subject had not specifically exercised their right to object. The AEPD set a fine of €20,000 for the violation of Article 21(1) of the LSSI.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/12

 File No.: EXP202401934

SANCTIONING PROCEDURE RESOLUTION

From the procedure instructed by the Spanish Data Protection Agency and based
on the following

BACKGROUND

FIRST: A.A.A. (hereinafter, the claimant) filed a

complaint with the Spanish Data Protection Agency (hereinafter AEPD) on 02/01/2024. The
complaint is directed against GAFAS EN RED DE ÓPTICAS S.L. (hereinafter GAFAS
EN RED), with NIF B73833758, but in the allegations of 11/07/2024 to this
sanctioning procedure, its legal representative reports that the name of the
company is SUPERVISTA OPTICS SLU as of 01/01/2024.

The reasons on which the claim is based are the following:

The receipt of commercial electronic communications at the email address
***USUARIO.1@gmail.com, the last one being dated 12/12/2023, after confirmation
on 05/24/23 by GAFAS EN RED of the receipt of opposition/deletion of the

complainant's request to receive commercial communications.

Along with the notification, a copy of the message of 05/24/23 from GAFAS EN RED is provided,
confirming the requested cancellation, as well as a copy of the message of 12/12/2023, in which
GAFAS EN RED offers a new vision review to the complainant.

The email sent by GAFAS EN RED to the complainant says the

following:

“Dear customer, it has been approximately 2 years since you purchased a pair of

glasses from us.

Did you know that, despite the passage of time, as a customer of gafas.es you are entitled
to a free vision check?

Since visual acuity can change significantly over the course of

two years, we would like to remind you today that you are invited to have a free vision
check with us.

Perhaps you have already noticed this for yourself? For example, have you
experienced pronounced glare from traffic lights while driving at night?

If so, this would be a clear sign that your visual acuity has changed!

In addition, with the glasses you purchased from us, you are always entitled to a
free, no-obligation eyeglass fitting and vision check. The eyeglass fitting
includes: - Cleaning, screwing and adjusting the frame for greater comfort. -

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/12

Free professional eye exam to assess the current state of your lenses and whether
your prescription has changed. BOOK A FREE GLASSES FITTING AND EYE
CHECK-UP”

SECOND: In accordance with article 65.4 of Organic Law 3/2018, of December 5, on the
Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), said claim was transferred on 02/02/2024 to GAFAS EN
RED, so that it could proceed with its analysis and inform the AEPD within one month of the actions carried out, to comply with the requirements provided for in the
data protection regulations.

The transfer, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was collected on February 13, 2023, as stated in the
acknowledgement of receipt that is in the file. No response has been received to this transfer letter.

THIRD: On April 2, 2024, in accordance with article 65 of the LOPDGDD,
the claim submitted by the complaining party was admitted for processing.

FOURTH: On May 28, 2024, the Director of the AEPD agreed to initiate sanctioning proceedings against the respondent party, for the alleged violation of Article 21 of the LSSI,

specified in Article 38.4.d) of the LSSI.

FIFTH: The aforementioned start agreement was notified electronically on 05/29/2024
in accordance with the rules established in Law 39/2015, of October 1, on the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), and the acknowledgement of receipt takes place on 06/07/2024.

SIXTH: On 07/04/2024, SUPERVISTA AG, as 100% owner of SUPERVISTA
OPTICS SLU (formerly called GAFAS EN RED), submits a request for an extension
until July 12, 2024 for this file. SUPERVISTA AG is a S.A. with
domicile in Germany, Königs Wusterhausen SIEMENSSTRABE 2, 15711 CP.

In the request for an extension of a new period for the allegations, in addition to being
untimely, there is also no documentary evidence that the signatory of
SUPERVISTAAG holds the representation of SUPERVISTA S.L.U.

SEVENTH: In its written allegations of 07/11/2024 SUPERVISTA OPTICS SLU
(SPAIN), it first indicates that as of 01/01/2024 GAFAS EN RED) there has been a
change of corporate name, becoming SUPERVISTA
OPTICS SLU; and then states in summary that the complainant was a
customer of GAFAS EN RED and after refusing to receive messages on 07/24/2023, it was
included on a marketing blacklist, so it did not receive electronic
commercial communications from that date onwards. However, your data, as a

customer and user, continued to be stored in accordance with legal requirements.

You also allege that on 12/12/2023, GAFAS EN RED sent the complainant a

message for a free review of the purchased glasses, as the warranty period had not yet expired

and that it was a service email and not a commercial one, because article 21.2 of the LSSI
authorizes the sending of commercial communications when there is a prior contractual relationship and the communication
refers to the purchased product.

The Court concludes in its pleadings that there is no infringement, no intent, no
repeat in this case and that the proposed fine of twenty thousand euros (€20,000) is completely disproportionate, even if intent and
repeat are assumed.

It also cites the judgment of the CJEU (EuGH/ECJ C-300/21 of 04.05.2023), according to which
it must be examined whether damage has been caused to the person concerned, which occurs
if the data of the data subject has been disclosed to unauthorized third parties. This
judgment resolves a preliminary question on the interpretation of Article 84 of the

GDPR, on the possibility of automatically obtaining compensation for damages before the courts, based on a breach of the GDPR.
EIGHTH: In the Resolution Proposal of 07/08/2024, the allegations of the

Initiation Agreement presented by GAFAS EN RED on 11/07/2024 are assessed as follows:

GAFAS EN RED alleges that the complainant was a client and that after exercising his
right to object to advertising communications on 24/05/2023, the complainant was included in a marketing blacklist, so he did not receive any

electronic commercial communications from that date. GAFAS EN RED considers that the message sent is for its client, it is not of a commercial nature, as it is a service offered to its client, in accordance with article 21.2 of the
LSSI.

In this regard, it is necessary to reiterate the definition of commercial communication in ANNEX

section f) of the LSSI as: “any form of communication aimed at the promotion,
directly or indirectly, of the image or the goods or services of a company,
organization or person that carries out a commercial, industrial, artisanal or
professional activity.” In accordance with this definition, both the letter and the
e-mail sent by GAFAS EN RED have the character of commercial

communication.

With respect to article 21.2 paragraph 1 of the LSSI alleged by GAFAS EN RED, the
sending of advertising communications would only be applicable as long as the
interested party has not exercised his right to object, provided for in paragraph 2 of
article 21.2 of the LSSI itself.

Since the complainant exercised his right to object to continuing to receive
advertising messages on 05/24/2023 and GAFAS EN RED acknowledged receipt of
this request on the same date, subsequent communications from GAFAS EN RED
have taken place against the expressed will of the complainant.

Article 21 of the LSSI thus expressly prohibits the sending of
advertising or promotional communications by email that have not previously been
requested or expressly authorized by the recipients thereof and also those made against the right of opposition of the interested party,
duly expressed.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/12

GAFAS EN RED also claims that there is no infringement, no intent, no
repeat in this case and the proposed fine of twenty thousand euros (20,000 €)
is completely disproportionate, even if intent and

repeat are assumed.

As regards the non-existence of the alleged infringement, article 38.4 section d) of the
LSSI classifies as a minor infringement the sending of commercial communications by
e-mail or other equivalent means of electronic communication, when such
sending does not comply with the requirements established in article 21 of the LSSI, as is

the case. Sending advertising communications in the knowledge of the contrary will expressed by the interested party is a minor infringement according to the LSSI, since GAFAS EN RED was aware of the opposition of the complaining party, to whom it sent a confirmation email.

As regards the allegation of the lack of proportionality of the sanction, it should be noted that the proposed €20,000 for the sanction is at the mid-range of fines of up to a maximum of €30,000, as stipulated for minor infringements by article 39.1 c) of the LSSI.

As regards the allegation of the absence of recidivism, Law 40/2015 on the Legal Regime of the Public Sector (hereinafter LRJSP), in its article 29.3 section d)
(proportionality of sanctions for the sanctioning power) regulates this aspect
as follows:

“The degree of the sanction will especially consider the following criteria:

(…)
d) Recidivism, due to the commission within a period of one year of more than one infringement of the
same nature when this has been declared by a final resolution in an administrative
process.”

There is already a final resolution of the sanctioning procedure of the AEPD itself
(PS/00076/2024), for the commission within a year of an infringement of the
same nature by GAFAS EN RED; the sanction proposal of
PS/00076/2024 was initially €10,000 and the sanction finally paid was reduced
by €6,000, but only as a result of the reductions of 20% for recognition of
responsibility and 20% for waiving the administrative route (total reduction of 40%

of the sanction as a sum of both concepts).

Therefore, it is appropriate to aggravate the sanction proposal, thus complying with the
principle of proportionality, as the breach is aggravated, in accordance with
article 29.3 section d) of the LRJSP.

As regards the allegation of lack of intention as an aggravating factor, it should be noted
that GAFAS EN RED ignores the legitimately expressed desire of the
complainant to whom it even sent an e-mail confirming his right to object, thereby demonstrating a qualified desire to contradict his desire
not to receive advertising mailings, by sending him an e-mail and also a postal mail,
both with similar promotional content.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/12

In the grading of the sanction, the application of the aggravating factors of intention and
recidivism are correct in terms of the application of the principle of proportionality
in the sanction, taking as a starting point the previously proposed sanction

(PS/00076/2024), together with the two aggravating factors described and duly accredited.

GAFAS EN RED invokes in its defence the judgment of the Court of Justice of the
European Communities (EuGH/TJCE C-300/21 of 04.05.2023), which would require the
existence of damage to the affected person as a prerequisite for the sanction and
which would only take place if the data subject's data has been disclosed to unauthorized

third parties.

This judgment resolves a preliminary question on the interpretation of article 84
of the GDPR, namely the possibility of automatically obtaining compensation for
damages before the courts, based on a violation of the GDPR. This

contentious issue and its solution in the indicated judgment, has nothing to do with the
present procedure, which is based on an administrative infringement of the
LSSI, and not on the requirements necessary for a possible
compensation for damages before the civil courts for non-compliance with the
RGPD, so the resulting jurisprudence and doctrine would not be applicable to
the case in question.

NINTH: In the resolution proposal, the initial sanction of the
Initiation Agreement is confirmed and it is proposed that SUPERVISTA OPTICS SLU (until
31/12/2023 under the name of GAFAS EN RED DE ÓPTICAS, S.L.) be sanctioned with a fine of
twenty thousand euros (€20,000) for the infringement of Article 21 of the LSSI, classified in

Article 38.4.d) of the LSSI.

On 08/07/2024, the AEPD notified SUPERVISTA OPTICS SLU, with an acknowledgement of receipt
of 08/08/2024, of the proposed resolution, granting them a period of 10 days to
make new allegations, without any allegation having been submitted to date.

From the actions carried out in the present procedure and the documentation
in the file, the following have been proven:

PROVEN FACTS

FIRST: The complainant has been a client of GAFAS EN RED (from
01/01/2024 it is called SUPERVISTA OPTICS SLU).

SECOND: On 05/24/23 the complainant exercised before GAFAS EN RED its right
to object to the receipt of advertising communications. GAFAS EN RED

notified on the same date the cancellation of the complainant's data.

THIRD: On 12/12/2023, the complainant received a commercial communication at his/her email address from GAFAS EN RED ***USUARIO@gmail.com, again, for an eye exam and the prescription of new glasses.

LEGAL BASIS

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/12

I
Jurisdiction

In accordance with the provisions of article 43.1 of Law 34/2002, of July 11, on
information society services and electronic commerce (hereinafter
LSSI) and as established in articles 47, 48.1, 64.2 and 68.1 of Organic Law
3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), the Director of the Spanish Data Protection Agency is competent to initiate and resolve

this procedure. Likewise, article 63.2 of the LOPDGDD determines that: "The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
of Regulation (EU) 2016/679, in this organic law, by the
regulatory provisions issued in its development and, insofar as they do not contradict them,
on a subsidiary basis, by the general rules on administrative procedures."

Finally, the fourth additional provision "Procedure in relation to the
powers attributed to the Spanish Data Protection Agency by other
laws" establishes that: "The provisions of Title VIII and its implementing

rules will be applicable to the procedures that the Spanish Data Protection Agency
must process in the exercise of the powers attributed to it by
other laws."
II
Preliminary issues

Prohibition of unsolicited or expressly authorized commercial communications, by email or equivalent electronic means of communication

In general, the LSSI prohibits unsolicited or expressly authorized commercial communications, based on a concept of commercial communication that
is classified as an information society service and is defined in its Annex
as follows:

“f) Commercial communication”: any form of communication aimed at promoting,
directly or indirectly, the image or the goods or services of a company,
organization or person who carries out a commercial, industrial, artisanal or
professional activity.

For the purposes of this Law, data that allow direct access to the activity of a person, company or
organization, such as the domain name or email address, or
communications relating to the goods, services or image offered
when they are prepared by a third party and without financial compensation, will not be considered commercial communication.

The concept of commercial communication, according to the definition contained in
Annex f), first paragraph of the LSSI, includes all forms of communication
intended to directly or indirectly promote goods, services or the image of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/12

a company, organization or person with a commercial, industrial, artisanal or
professional activity.

On the other hand, the LSSI in its Annex a) defines “Information Society Service” as “any service normally provided for a fee, at a distance,
electronically and at the individual request of the recipient.

The concept of information society service also includes
services not remunerated by their recipients, insofar as they constitute an

economic activity for the service provider.”

The definition of service provider is contained in section c) of the Annex of the
cited standard, which considers as such the “natural or legal person who provides an
information society service”.

The aforementioned section adds that the sending of commercial communications is an
information society service, provided that it represents an economic activity.

According to section d) of the cited Annex, the recipient is the “natural or legal person who
uses, whether or not for professional reasons, an information society
service”.

From the above it follows that, when the commercial communication does not meet the
requirements required by the concept of Information Society Services,
it loses the character of commercial communication.

In this regard, the second paragraph of Annex f) of the LSSI indicates two cases, which
will not be considered commercial communication for the purposes of this Law:

a) data that allow direct access to the activity of a person,

company or organization, such as the domain name or email address, and,

b) communications relating to the goods, services or image offered when they are prepared by a third party and without
financial compensation.

Article 21 of the LSSI regulates the conditions of advertising communications

as follows (the relevant part is underlined):

Article 21

“1. The sending of advertising or promotional communications by

e-mail or other equivalent means of electronic communication that
have not been previously requested or expressly authorized by the recipients of the same is prohibited.

2. The provisions of the previous section will not apply when there is a
previous contractual relationship, provided that the provider has lawfully obtained

the contact details of the recipient and used them to send commercial communications
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/12

regarding products or services of its own company that are
similar to those that were initially the subject of the contract with the client.

In any case, the provider must offer the recipient the possibility of opposing the
processing of their data for promotional purposes through a simple and free procedure, both at the time of data collection and in each of the
commercial communications sent to them.

When the communications have been sent by email, this

means must necessarily consist of the inclusion of an email address or other valid electronic address where this right can be exercised,
and the sending of communications that do not include this address is prohibited.”

Article 21.1 of the LSSI expressly prohibits the sending of advertising or promotional communications by email, which have not been previously requested or expressly authorized by the recipients of the same, with the sole exception provided for in article 21.2 of the LSSI, which authorizes the sending of commercial communications when there is a prior contractual relationship, and exclusively for commercial communications referring to products or services of

your own company that are similar to those initially contracted by the client.

"Spam" refers to any type of unsolicited communication, sent electronically and whose purpose is to offer, market or try to arouse interest in a product, service or company.

The sending of commercial messages, without prior consent or having exercised the right of opposition, is prohibited by Spanish legislation, and even more so when it is carried out in a massive and indiscriminate manner. The low cost of sending emails via the Internet or by mobile phone (SMS and MMS), their possible

anonymity, the speed and volume of transmissions have favored this practice to be carried out in an abusive and indiscriminate manner.

III
Obligation breached

Article 21 of the LSSI

The known facts could constitute an infringement, attributable to the respondent party, for violation of article 21 of the LSSI.

In accordance with the available evidence, GAFAS EN RED sent a commercial email on 12/12/2023 to the complaining party's email address
***USUARIO.1@gmail.com, despite GAFAS EN RED having confirmed by
message dated 24/05/23 the removal from its databases for the purposes of commercial
communications, in response to the complaining party's request.

GAFAS EN RED is a service provider, as it is a
legal person that provides an information society service (Annex
c) of the LSSI) that carries out commercial communication for the direct

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/12

or indirect promotion of the image or of its goods or services of its company, (definition Annex
f) of the LSSI). The service offered is a free eye exam, a non-remunerated
service, but which GAFAS EN RED carries out within the framework of its commercial activity,

in its capacity as a provider of optical services (sale of glasses, etc.) for
the promotion of its goods and services.

GAFAS EN RED would have sent an email with advertising communication,
knowing the recipient's opposition since May 2023, despite the fact that GAFAS EN RED communicated on that date the deletion of personal data to the

complainant.

By sending the commercial communication without the consent of the complainant, who has exercised his right of opposition prior to sending it,
GAFAS EN RED would have infringed article 21 of the LSSI, which requires for these

cases the consent of the recipient and prohibits the sending of commercial communications
after the right of opposition has been exercised.

IV
Classification of the infringement

Thus, the sending of unsolicited commercial communications, outside the
exceptional assumption of article 21.2 of the LSSI, may constitute a minor or serious infringement of the LSSI.

Title VII of the LSSI, under the heading “Infringements and sanctions”, contains the

penalty regime applicable in the event of any of the infringements contained in the table of infringements contained therein. Specifically,
Article 37 specifies that “information society service providers are subject to the
penalty regime established in this Title when this Law is applicable to them.”

In accordance with the provisions of Article 38, in its sections 3 and 4 of the LSSI,
the following are considered serious and minor infringements (the part applicable to the case is underlined):

“4. The following are considered minor infringements:

d) The sending of commercial communications by email or other equivalent means of
electronic communication when said sending does not comply with the
requirements established in Article 21 and does not constitute a serious infringement.”

In view of the proven facts, non-compliance with Article 21 of the LSSI
constitutes, in the terms indicated by the aforementioned Article 38.4.d), a minor infringement
in this case, as it involves an individual sending of an advertising or

promotional communication by email, without the consent of the interested party.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/12

V
Proposed sanction

This infringement of Article 21, being classified as minor, may be sanctioned with
a fine of up to €30,000, in accordance with Article 39.1 c) of the LSSI, which stipulates the
following (the part applicable to the case is underlined):

“1. For the commission of the offences listed in the previous article, the following sanctions will be imposed:

a) For the commission of very serious offences, a fine of 150,001 to 600,000 euros.
The repetition within a period of three years of two or more very serious offences,
sanctioned with final character, may give rise, depending on its circumstances, to the
sanction of prohibition of acting in Spain, for a maximum period of two years.

b) For the commission of serious offences, a fine of 30,001 to 150,000 euros.
c) For the commission of minor offences, a fine of up to 30,000 euros.”

Likewise, in accordance with the evidence available, it is considered that
it is appropriate to graduate the sanction to be imposed in accordance with the following criteria
established in article 40 of the LSSI:

“The amount of the fines imposed will be graduated according to the following
criteria (the criteria applied are underlined):

a) The existence of intentionality.
b) Period of time during which the infringement has been committed.
c) Recidivism by committing infringements of the same nature, when
this has been declared by a final resolution.
d) The nature and amount of the damages caused.
e) The benefits obtained by the infringement.

f) Volume of turnover affected by the infringement committed.
g) Adherence to a code of conduct or a system of advertising self-regulation applicable to the infringement committed, which complies with the provisions of
article 18 or the eighth final provision and which has been reported
favorably by the competent body or bodies.”

-The existence of intentionality (section a), since the complaining party had
requested that no more commercial communications be sent to it and the entity
responded to had acknowledged receipt of said request, confirming that it had been
acknowledged, and despite this, it has subsequently sent advertising messages again.

-As there is a final resolution of the sanctioning procedure of the AEPD
(PS/00076/2024), for the commission by GAFAS EN RED of an infringement of the
same nature in the same year, the aggravating circumstance of recidivism also applies
(section c).

For all the reasons set out above, it is considered appropriate to maintain the proposed
sanction of the initiation agreement, of an administrative fine of twenty thousand euros
(€20,000).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/12

Therefore, in accordance with applicable legislation and having assessed the criteria for
graduating sanctions whose existence has been proven,

the Director of the Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE on SUPERVISTA OPTICS SLU (until 31/12/2023 under the
name of GAFAS EN RED DE ÓPTICAS, S.L.), with NIF B73833758, for a
violation of Article 21 of the LSSI, classified in Article 38.4.d) of the LSSI, a
fine of twenty thousand euros (20,000 euros).

SECOND: NOTIFY this resolution to SUPERVISTA OPTICS SLU.

THIRD: This resolution will be enforceable once the deadline for filing the optional appeal for reconsideration ends (one month from the day following the notification of this resolution) without the interested party having made use of this faculty.
The sanctioned party is warned that he must make effective the sanction imposed once this resolution is enforceable, in accordance with the provisions of art. 98.1.b)
of Law 39/2015, of October 1, of the Common Administrative Procedure of the
Public Administrations (hereinafter LPACAP), within the voluntary payment period
established in art. 68 of the General Collection Regulations, approved by Royal

Decree 939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by depositing it, indicating the NIF of the sanctioned party and the procedure number that appears in the heading of this document, in the restricted account nº IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code:
CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency in

the banking entity CAIXABANK, S.A. Otherwise, it will be collected during the enforcement period.

Once the notification has been received and is enforceable, if the date of enforceability is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter.

In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure in accordance with art. 48.6 of the LOPDGDD, and in accordance with the provisions of article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the Director of the Spanish Data Protection Agency within one month from the day following the notification of this resolution or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following the notification of this act, as provided for in article 46.1 of the aforementioned Law.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/12

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of the LPACAP, the final decision in administrative proceedings may be provisionally suspended if the interested party
expresses his intention to lodge an administrative appeal.
If this is the case, the interested party must formally communicate this fact by means of a

written letter addressed to the Spanish Data Protection Agency, presenting it through the
Electronic Registry of the Agency [https://sedeagpd.gob.es/sede-electronica-
web/], or through one of the other registries provided for in art. 16.4 of the
cited Law 39/2015, of October 1. He must also transfer to the Agency the

documentation that proves the effective filing of the administrative appeal. If the Agency is not aware of the filing of the administrative appeal within two months from the day following the notification of this resolution, it will terminate the precautionary suspension.

Mar España Martí

Director of the Spanish Data Protection Agency

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es