AEPD (Spain) - EXP202406716

AEPD - EXP202406716
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 21.1 LSSI
Type:	Complaint
Outcome:	Upheld
Started:	22.04.2024
Decided:	05.12.2024
Published:	12.12.2024
Fine:	20,000 EUR
Parties:	n/a
National Case Number/Name:	EXP202406716
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	ao

The DPA fined a controller €20,000 for failing to respond to the data subject’s multiple requests to discontinue the delivery of advertising emails.

English Summary

Facts

The data subject had used the contact form provided by the controller three times in order to cancel the advertising emails they were getting. The first contact form request was sent on the 30 January 2024 but there had been no response by the controller to any of the requests. The data subject also sent an email to the contact email address available in the controller's privacy policy but again there was no response.

On the 22 April 2024, the data subject lodged a complaint against the controller, with the Spanish DPA (Agencia Española de Protección de Datos - AEPD). The AEPD on the 3 May 2024 forwarded the complaint to the controller and after receiving no response, resent the documents on the 14 May 2024. The AEPD again received no response from the controller.

Holding

On the 13 September 2024, the AEPD initiated disciplinary proceedings for the violation of Article 21.1 of Ley 34/2002 (de servicios de la sociedad de la información y de comercio electroónico - LSSI) which transposes the e-privacy Directive into national Spanish law. Article 21 regulates the sending commercial messages through electronic means and establishes, as a general rule, that consent is necessary for such messages.

With regard to the considerations laid out in Article 40 of the LSSI the AEPD found a fine of €20,000 appropriate.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/10

 Procedure No.: EXP202406716 (PS/00356/2024)

SANCTIONING PROCEDURE RESOLUTION

From the actions carried out by the Spanish Data Protection Agency and based on the
following:
BACKGROUND

FIRST: On 04/22/24, Ms. A.A.A. (the complaining party), filed a complaint
with the Spanish Data Protection Agency.

The complaint is directed against the entity DIGITAL PHOTO IMAGE, S.A. with NIF:
A60984259, (the respondent party), for the alleged violation of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI).

The complaining party states that he or she does not wish to continue receiving emails from
this company. In your emails you say “…you can exercise the rights of access,
rectification, cancellation... after accessing www.nikonistas.com or the contact
form...” but you have written 3 times to the contact form and have not

received a response. You have also written directly to the contact email that appears in the
privacy area, but you have not received any response either. There is no contact telephone number.

Along with the complaint letter, the following documentation is attached:

- Dated 01/30/24, copy of the email sent from the address
no-reply@nikonistas.com to the address ***EMAIL.1, with the subject: “Nikonistas,
Support query sent” and the following message:

or “Thank you very much for contacting us. Regarding your query,

as soon as possible one of our support agents will
send you the response with the appropriate information. Name and surname:
A.A.A. Email: ***EMAIL.1.

Description of the query: I request to be removed from the Nikonistas Club and that
you please stop sending me emails. Thank you!”

- Dated 02/14/24, copy of the email sent from the address
no-reply@nikonistas.com to the email address ***EMAIL.1, with the subject:

“Nikonistas, Support query sent” and the following message:

or “Thank you very much for contacting us. Regarding your query,
as soon as possible one of our support agents will send you a response with the
appropriate information. Name and surname:
A.A.A. Email: ***EMAIL.1.

Description of the query: Good morning. 15 days ago I requested to be removed
from the club and to delete all my data, but I continue to receive your
emails. PLEASE, I do not want to continue receiving your promotional
emails to my email address, they are very numerous. If

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/10

they continue to not respond to my request, I will have to report them for
non-compliance with the European Data Protection Regulation”.

- Dated 21/02/24, copy of the email sent from the address
no-reply@nikonistas.com to the email address ***EMAIL.1, with the subject:

“Nikonistas, Support query sent” and the following message:

or “Thank you very much for contacting us. Regarding your query
as soon as possible one of our support agents will
send you the response with the appropriate information. Name and surname:

A.A.A. Email: ***EMAIL.1

Description of the query: PLEASE, this is the 3rd time I write.
I request that you delete my data from your file and STOP SENDING ME
MESSAGES TO MY EMAIL. If you do not do so, I will file a complaint against you for
non-compliance with the Data Protection Law.”

- Dated 02/29/24 copy of the email sent from the address
no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject:
“Precision technology that takes your game to the next level with Nikon COOLSHOT
rangefinders” and containing the following advertising message:

or “A.A.A.: Nikon laser rangefinders stand out for their cutting-edge
laser ranging technology, which guarantees millimeter precision in
distance measurement.”

- Dated 05/03/24, copy of the email sent from the address

***EMAIL.1 to the address club@nikonistas.com, with the subject: A/A DIGITAL
PHOTO IMAGE / About personal data / Privacy and containing the
following message:

or “Good afternoon: I have been receiving your emails for a long time because I

once had a Nikon camera, but I no longer want to receive them and I want you to
delete my data from your archive. According to the bottom of your newsletter:
"You can exercise the rights of access, rectification, cancellation,
opposition, deletion, limitation and portability by modifying the personal
data in 'edit my profile', after accessing
www.nikonistas.com or the contact form.” Well, this is not

true. I have not been able to exercise my rights to cancel my data.
I have already sent 3 messages to the contact form and, not only have I not
received a response, but I continue to receive your newsletters very often to my email. Searching on your website, I found
this other address and that is why I am writing to you by this means. Please stop
sending me emails and delete my data.”

- Dated 03/14/24 copy of the email sent from the address
no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Renew
your Nikon Z 9 thanks to the latest updates” and containing the following
advertising message:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/10

or “A.A.A., the new update will allow for additional improvements
in the operation of the Nikon Z 9, such as greater visibility and an
increase in the number of functions that can be assigned to
custom controls...”

- Dated 03/25/24 copy of the email sent from the address
no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject:

“Exploring the best binoculars for your outdoor adventures” and containing the
following advertising message:

or “Nikon Sport Optics stands out as one of the leading manufacturers of
binoculars, specializing in the creation of all-terrain binoculars. AA.A., whether you are a casual outdoor enthusiast or a
dedicated hobbyist, having the best Nikon binoculars is essential for your specific
activity. Today we propose

four of the best Nikon binoculars, …”

- Dated 03/27/24 copy of the email sent from the address
no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Nikon AF system
with eye detection and tracking for animals” and containing
the following advertising message:

or A.A.A., photographing our pets can be fun and easy if
they are docile and remain still. However, for more energetic pets or
animals it can be an odyssey. Nikon Z cameras...

- Dated 04/05/24 copy of the email sent from the address
no-reply@nikonistas.com to the address ***EMAIL.1 with the Subject: “Nikon Z 6II Experts Talks | We talk to B.B.B., a travel, event,
gastronomy, etc. photographer.” and containing the following message:

o In this online chat B.B.B. will mainly tell us about his experience

with the Nikon Z 6II and other Nikon Z cameras he has worked with,
such as the Z fc and the Z f, among others. We will talk about travel photography,
events, gastronomy, etc. as well as his work and projects.
He will also tell us about the lenses he works with, their advantages,
their quality.

- In each advertising email received there is the following message:

o You can exercise the rights of access, rectification, cancellation,
opposition, deletion, limitation and portability by modifying the personal
data in 'edit my profile', after accessing

www.nikonistas.com or the contact form.

o Do not reply to this email, this sender does not accept incoming mail,
so you will not receive a reply.

SECOND: On 03/05/24, in accordance with the provisions of article 65.4
of Organic Law 3/2018, of December 5, on the Protection of Personal Data and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/10

Guarantee of Digital Rights, (LOPDGDD), this Agency forwarded
the claim to the respondent party so that it could proceed to analyze it
and report, within one month, on what was set out in the claim letter.

The transfer was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations
(LPACAP), by electronic notification, with the following result: "expired due to
expiration, as the deadline established for the appearance was exceeded, on
14/05/24 00:00", as stated in the certificate in the file.

Although the notification was validly carried out by electronic means, in accordance with the
provisions of article 41.5 of the LPACAP, said claim was sent again to the
respondent party on 14/05/24, with access to the content of the
notification taking place on 14/05/24 by C.C.C., as stated in the file.

There is no record of any response to the request for information being received
by this Agency.

THIRD: On 03/05/24, this Agency accessed and completed the
information that appeared in the “Privacy Policy” of the website
www.nikonistas.com (https://www.nikonistas.com/digital/politica-privacidad.php),

where, among other issues, it is noted:

“DIGITAL PHOTO IMAGE, S.A. –

PRIVACY NOTICE (…)

YOUR RIGHTS: You can contact us to
exercise any of the rights granted to you under
applicable data protection laws, (…) and (6) the right to
object to the processing, and, where we have asked for your consent,
withdraw this consent (…).

or 6) The right to object: You also have the right to object to
the processing of your personal data, which means that you can
ask us not to process your personal data. At any time and free of charge, you may object to the processing of your data for direct marketing purposes, in cases where they are processed for such purposes, including the creation of profiles for the purpose of direct sales. If you exercise this right, we will not process your personal data for such purposes.

o CONTACT INFORMATION FOR YOUR PRIVACY QUERIES: DIGITAL PHOTO IMAGE, S.A. Ciencias 81, Nave 8
Polígono industrial Pedrosa, (08908) L’Hospitalet de Llobregat
(Barcelona) club@nikonistas.com.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/10

o This site is managed by Digital Photo Image, S.A. (Finicon Group)
with NIF: ESA-60984259 and Mercantile Registry of Barcelona, Volume
28,661, Folio 9, Sheet B141,711.

FOURTH: On 07/22/24, the Director of the Spanish Data Protection Agency
issued an agreement to admit the processing of the claim submitted, in accordance with article 65 of the LOPDGDD.

FIFTH: On 09/13/24, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent party in accordance with the provisions of articles 63 and 64 of the LPACAP, for the alleged violation of article 21.1 of the LSSI, classified as minor in art. 38.4.d) in the aforementioned regulation.

In the opening agreement it was determined that the sanction that could correspond,
considering the evidence existing at that time and without prejudice to what would result
from the instruction, would amount to a total of 20,000 (twenty thousand euros).

The notification of the initiation of the file was carried out in accordance with the rules

established in the LPACAP, by electronic notification, with the following
result, producing access to the content of the notification on 09/13/24, as
shown in the file.

SIXTH: Notified the aforementioned initiation agreement in accordance with the rules established

in the LPACAP and the period granted for the formulation of allegations having elapsed, it has
been confirmed that no objection to the initiation of the file has been received,
in this Agency.

Article 64.2.f) of the LPACAP - a provision of which the respondent party was informed
in the agreement to open the procedure - establishes that if no allegations are made in the period provided for regarding the content of the agreement to initiate the procedure, when
it contains a precise statement about the imputed liability,
it may be considered a resolution proposal. In the present case, the agreement to
initiate the sanctioning procedure determined the facts in which the imputation was specified, the infringement of the LSSI attributed to the respondent and the sanction that could

be imposed. Therefore, taking into account that the respondent party has not
made allegations to the agreement to initiate the procedure and in accordance with the provisions of
article 64.2.f) of the LPACAP, the aforementioned agreement to initiate the procedure is
considered in the present case a resolution proposal.

In view of all the actions taken, the Spanish Data Protection Agency
considers the following proven facts in this procedure:

PROVEN FACTS

First: From the documentation provided by the claimant it appears that the

entity Digital Photo Image S.A. is responsible for the processing of personal data in relation to electronic communications sent by the
“Nikonistas” platform through the email no-reply@nikonistas.com.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/10

Second: From the documentation provided by the complainant, it is clear that, on
30/01/24, the complainant requested, through the contact form on the Nikonistas
website (www.nikonistas.com), to be removed from the club and to stop the sending of

advertising emails, as can be seen from the communication received
by the complainant from the address no-reply@nikonistas.com with the automatic
acknowledgement message.

Third: From the documentation provided by the complainant, it is clear that on 14/02/24 and 21/02/24, the complainant reiterated her request to unsubscribe and delete her personal

data, stating that she had not received any response to her previous request, and that she continued to receive promotional emails, as can be seen from the copy of the communication received from the address no-
reply@nikonistas.com with the same automatic acknowledgement message.

Fourth: From the documentation provided by the complainant, it is clear that she
continued to receive electronic communications with advertising content from the
respondent entity. The following emails are attached as evidence,
sent from the address no-reply@nikonistas.com to the complainant's email address on 29/02/24; 14/03/24; 25/03/24; 27/03/24 and 05/04/24.

Fifth: From the documentation provided by the complaining party, it is clear that the complaining party
also attempted to exercise its rights to data cancellation by sending a direct email to the address club@nikonistas.com on 05/03/24, in which it
reiterated its request to unsubscribe and have its personal data deleted. A copy of the email sent is provided.

Sixth: All advertising emails sent by Digital Photo Image
S.A. from the address no-reply@nikonistas.com include the following standard
message at the bottom of them: “You can exercise the rights of access, rectification,
cancellation, opposition, deletion, limitation and portability by modifying the personal

data in ‘edit my profile’, after accessing www.nikonistas.com or the
contact form. Please do not reply to this email, this sender does not accept incoming mail, so you will not receive a reply.”

LEGAL BASIS

I
Jurisdiction.

In accordance with the provisions of article 43.1 of the LSSI and the provisions of
articles 47, 48.1, 64.2 and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve

this procedure.

Likewise, article 63.2 of the LOPDGDD determines that: “The procedures
processed by the Spanish Data Protection Agency will be governed by the provisions
of Regulation (EU) 2016/679, by this organic law, by the regulatory

provisions issued in its development and, as long as they do not contradict them, on a
subsidiary basis, by the general rules on administrative procedures.”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/10

The fourth additional provision “Procedure in relation to the powers conferred on the Spanish Data Protection Agency by other laws” establishes
that: “The provisions of Title VIII and its implementing regulations shall apply to

the procedures that the Spanish Data Protection Agency must process in the exercise of the powers conferred on it by other laws."

II
Summary of the facts:

In the present case, the claimant alleges in her claim that, despite
having requested on several occasions that the sending of commercial emails be stopped, she received no response to her requests and continued to receive promotional
communications from the company. She states that she used the means of contact
provided in the company's emails, as well as the contact form on its website, without obtaining any response.

Along with its claim, the complainant attached several emails that it
sent to the respondent and that documented its desire not to receive further commercial
communications from the respondent entity. These emails, sent between January
and April 2024, reflect repeated requests to unsubscribe and cancel its data,
without the respondent complying with these requests despite having replied to the
complainant with the "acknowledgement of receipt" of having received them.

III
Classification of the infringement committed by sending commercial communications
without them having been requested or expressly authorized.

The LSSI prohibits unsolicited or expressly authorized commercial communications, based on a concept of commercial communication that is classified as an information society service and is defined in its Annex as: “f)

any form of communication aimed at the direct or indirect promotion of the image or
the goods or services of a company, organization or person that carries out a commercial, industrial, artisanal or professional activity

The fact that the respondent sends advertising emails to the complainant
that have not previously been requested or expressly authorized may

constitute a violation of the provisions of art. 21 of the LSSI, as it establishes:

“1. The sending of advertising or promotional communications
by email or other equivalent means of electronic communication
that have not previously been requested or expressly authorized by

the recipients of these is prohibited.

2. The provisions of the previous section shall not apply when there is a
prior contractual relationship, provided that the provider has lawfully obtained the
recipient's contact details and used them to send commercial
communications regarding products or services of its own company that are
similar to those that were initially contracted with the client. In any case, the provider must offer the
recipient the possibility of opposing the processing of their data for
promotional purposes through a simple and free procedure, both at the
time of data collection and in each of the commercial communications sent to
them.

When the communications have been sent by email, this means must necessarily consist of the
inclusion of an email address or other valid electronic address where this
right can be exercised, and the sending of communications that do not include this
address is prohibited.”

IV
Sanction

The aforementioned infringement is classified as “minor” in art. 38.4.d) of said
regulation, which qualifies as such, “The sending of commercial communications by

e-mail or other equivalent means of electronic communication when said

sending does not comply with the requirements established in article 21 and does not
constitute a serious infringement”.

According to the provisions of article 39.1.c) of the LSSI, minor infringements may be
sanctioned with a fine of up to €30,000.

Furthermore, article 40 of the LSSI establishes the criteria for the
graduation of the amount of the sanctions: “The amount of the fines imposed will be graduated
according to the following criteria: a) The existence of intentionality. b) Period of time during which the infringement has been committed. c) Recidivism in the commission of

infringements of the same nature, when so declared by a
final resolution. d) The nature and amount of the damages caused. e) The
benefits obtained from the infringement. f) The turnover volume affected by the
infringement committed. g) Adherence to a code of conduct or a
self-regulation advertising system applicable to the infringement committed, which complies

with the provisions of article 18 or the eighth final provision and which has been
favorably reported by the competent body or bodies.

Based on the evidence obtained, it is considered that it is appropriate to graduate the sanction to be imposed
in accordance with the following circumstances, established in art. 40 of the LSSI:

- The existence of intentionality (section a) since the respondent receives up to
three requests to be removed from the system by the complainant without
accessing the request since it is noted that the complainant continues to send commercial
communications after receiving the requests.

In accordance with these criteria, it is considered appropriate to impose a fine of 20,000 euros (twenty thousand euros), for the infringement of article 21.1 of the LSSI.

In accordance with the applicable legislation and having assessed the criteria for grading the sanctions whose existence has been proven, the Director of the Spanish Data Protection Agency

RESOLVES:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/10

FIRST: TO IMPOSE on the entity DIGITAL PHOTO IMAGE, S.A. with NIF:
A60984259, for the infringement of article 21.1 of the LSSI, classified as minor in art.
38.4.d) of the aforementioned regulation, a fine of 20,000 euros (twenty thousand euros).

SECOND: NOTIFY this resolution to DIGITAL PHOTO IMAGE, S.A.

THIRD: Warn the sanctioned party that the sanction imposed must be made effective
once this resolution is enforceable, in accordance with the provisions of
article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure

of Public Administrations, within the voluntary payment period indicated in
article 68 of the General Collection Regulations, approved by Royal Decree
939/2005, of July 29, in relation to art. 62 of Law 58/2003, of 17 December, by depositing it in the restricted account No. ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency at the banking entity

CAIXABANK, S.A. or, otherwise, it will be collected during the enforcement period.

Once the notification has been received and enforced, if the enforcement date is between the 1st and 15th of each month, both inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day thereafter, and if it is between the 16th and the last day of each month, both inclusive, the payment deadline will be until the 5th of the second following month or the next business day thereafter.

In accordance with the provisions of Article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.

Against this resolution, which ends the administrative procedure (article 48.6 of the LOPDGDD), and in accordance with the provisions of articles 112 and 123 of Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations, interested parties may optionally file an appeal for reconsideration with the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Chamber of the National Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned legal text.

Finally, it is noted that in accordance with the provisions of art. 90.3 a) of Law 39/2015,
of October 1, on the Common Administrative Procedure of Public Administrations,

the final resolution may be provisionally suspended by administrative means if
the interested party expresses his intention to file a contentious-administrative appeal.
If this is the case, the interested party must formally communicate this fact by means of
a written document addressed to the Spanish Data Protection Agency, presenting it through
the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronicaweb/],

or through one of the other registries provided for in art. 16.4 of the aforementioned Law
39/2015, of October 1.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/10

You must also forward to the Agency the documentation that proves the effective filing of the

administrative appeal. If the Agency is not aware
of the filing of the administrative appeal within two months
from the day following notification of this resolution, it will consider the

precautionary suspension to be terminated.

Mar España Martí

Director of the Spanish Data Protection Agency.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es