AEPD (Spain) - PS/00209/2019

AEPD - PS/00209/2019
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:
Type:	Complaint
Outcome:	Upheld
Decided:	n/a
Published:	n/a
Fine:	EUR 20,000
Parties:	VODAFONE ONO SAU
National Case Number:	PS/00209/2019
European Case Law Identifier	n/a
Appeal:	n/a
Original Language:	Spanish
Original Source:	AEPD (in ES)

.........

English Summary

Facts

.........

Dispute

........

Holding

........

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Spanish original for more details.

Procedure No:PS/00209/2019
938-0419
RESOLUTION OF THE DISCIPLINARY PROCEEDINGS
In sanction proceedings PS/00209/2019, instructed by the Spanish Data Protection Agency, the entity VODANOONE SAU, with C.I.F. A62186556, (hereinafter referred to as the “respondent”), having regard to the complaint lodged by  A.A.A., (Mr Lante¬, “the complainant”), and on the basis of the following:
BACKGROUND
FIRST:Since December 2017, the complainant has submitted a number of letters to the complainant in which he denounces the entity VODAFONE, on the basis of the receipt of commercial calls, without his consent and having informed the company on several occasions that he refused to receive them.The telephone number is included in the RoRobon List since 2013 and is not a customer of the company.You also complain about the receipt of commercial emails in a number of accounts of your title, also stating that you have repeatedly objected to receiving this type of email.
With the letters of complaint, it is accompanied by the certificate of registration in the Robinson List since 2013 and several letters and letters sent to the company, the content and relationship of which is detailed in the document initiating the procedure and in the letter of motion for a resolution.
SECOND:In the light of the facts set out in the complaint and the documents provided by the complainant, the Subdirectorate-General for Data Inspection carried out measures to clarify matters, under the powers of investigation conferred on the supervisory authorities in Article 57 (1) of the GDPR.Thus, on 31/10/18, an information injunction was sent to the entity in question.
THIRD:By letter dated 18/01/19, in the context of Cases E/08257/2018, E/0482/2019 and E/2463/2019, the entity complained against provided the Agency with detailed information in the document initiating the procedure and in the motion for a resolution.
FOURTH:In the light of the facts reported, the documentation provided by the parties and in accordance with the evidence available, the Data Inspectorate of this Spanish Data Protection Agency took the view that the conduct of the entity complained against did not fulfil the conditions laid down by the legislation in force, with the result that a penalty procedure should be opened.Thus, on 09/09/19, the Director of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against the entity sought, pursuant to the powers set out for infringement of Article 48 (1) (b) of the LGT, arguing that:‘In the present case, it has been verified that the person concerned, being listed in the Robinson List as from year 2013 and having even exercised his right to object to the entity VOLADFONE, to object to his personal data being processed for commercial use, has continued to send advertisements to 
Ooped
Data subject via e-mail and commercial calls in the following years
FIFTH:Notified of the initiating agreement, the entity in question, by letter of 23/09/19, put forward arguments, the content of which is set out in detail in the written motion for a resolution.
SIXTH:On 21/10/19, the probationary period was commenced and the complaint lodged by the complainant and its documentation, the documents obtained and generated which form part of the file and reproduced for purposes of proof, the allegations made in the original agreement of PS/00209/2019, submitted by the party against which the complaint was lodged, were reproduced for the purposes of proof.
SEVEN:On 10/12/19, the entity is notified of the proposal to propose a¬ solution in which it is proposed that the Director of the Spanish Data Processing Agency should sanction VODAFONE España SAU, as a result¬ of an infringement of Article 48 (1) (b) of the LGT, which is classified as minor in Article 78 (11) of the LGT, with a fine of EUR 20,000 (twenty thousand euros),
EIGHT:Notified of the motion for resolution, the entity in question puts¬ forward arguments on the proposal for the period granted for that purpose, essentially on the basis of:
‘The complainant claims to be receiving commercial calls at Vodafone’s * * * telecommunication telephone number by Vodafone, but does not indicate the numbers calling¬ the number * * * TELEFONO.2.We have again checked that this calling-number is not owned by Vodafone, nor does it appear in the database from which they make calls to the employees of my client.
In accordance with the Memorandum of Understanding set out in the Memorandum of Understanding set out in the Agreement to initiate this Procedure, Vodafone is reaffirming that all the telephone numbers of this customer, namely its mobile line * * * TELEFONO.3, and its fixed lines * * * Tylfon.O.4 and * * * TELEFFUNO.1, are included in the Official Digital List as well as in our internal Robinson List.Thus Vodafone could not have included them in¬ the collection campaigns directly managed by it.
In particular, we verified that the exact dates since they were included are the following:
—  * * * TELEFFONO3:It is included in the Official Digital List from the time of¬ the submission of 11 December 2013.It is also included in our internal Robinson List as from 5 February 2019. 
Ooped
 —  * * * TELEFFONO4:It is included in the Official Digital List from the time of¬ the submission of 11 December 2013.It is also included in our internal Robinson List as from 31 January 2019.
— * * * TELEFFONO1:It is included in the Official Digital List from the time of¬ the submission of 11 December 2013.It is also included in our internal Robinson List as from 15 May 2018.
We also verified once again that, for the services for which the complainant is a customer, as already explained in previous reporting requirements, the tant¬ has a conspicuity check that is marked so that it can also not be included in marketing years for portfolio customers.
Similarly, my client is generally taking a number of¬ steps to avoid that third parties using its own databases to handle Vodafone’s name continue to call per sonas such¬ as the complainant that they do not wish to receive commercial calls.
In particular, these measures already known to the Agency are as follows:
1.	A first communication was sent to all our staff on 19 November 2018 to remind them of their obligations in terms of data protection.This is attached as Doc 1.
2.	A simpler automatic system has been set up to¬ enable customers to oppose commercial communications.This request can be made via the darabbaa.s web page. please find attached as Doc. 2 a screen of this website.
3.	A database has been set up with telephone numbers that you use¬ as your colleagues when you call recruitment, in the month¬ of 2018.This database is regularly updated in order to have all the numbers used by all the partners in the different areas of the company (online, teleshopping, retail and door to door).In order to increase the number of registers in the database and to be able to identify potential contributors who do¬ not comply with their obligations as operators responsible for the databases using it and the procedures laid down at Vodafone, the contract is gradually being included in all the contracts with partners, the obli¬ contracted to provide us with the list of telephone numbers from 
Ooped
this calls for calls to be made by both the partner and any¬ undertakings which may be subcontracted to carry out these recruitment activities.
4.	They have been notified to cooperating companies by reminding them of their data protection obligations in respect of collecting calls on behalf of Vodafone, in particular, the directory obligation is stolen, official.In addition, Vodafone has met with the owners and managers of some of these companies for this purpose.
5.	The implementation of other measures is being assessed as the routing of the calls made by these collaborators through Vodafone, which is to¬ be implemented fully by the end of December.In this way, these partners will only be able to make calls through specific and identified numbers, which will also prevent calls to be made to the numbers included in the list of ADHD as well as in the internal Robinson List.
In view of the above, my client understands that it has put all the means¬ available to it and acting in accordance with the rules, as long as all the existing measures have been taken and all the viable filters are applied to prevent practices such as those that the complainant is denouncing, deploying the utmost diligence.
As the Agency is aware, the commercial campaigns directly managed by Vo dafone¬ are based on a robust process that is continuously reviewed and¬, today, Vodafone is assessing the campaigns carried out by third parties to ensure that they do not infringe data protection law or the rights of the persons called on in such campaigns.
In this connection, it should also be borne in mind that those commercial campaigns¬ are not directly carried out by Vodafone but by their collaborators.It is therefore to be understood¬ that the numbers from which calls are received are to be known in order to¬ confirm who does actually do so.The complainant has only provided a number which is not part of the database used by the cooperating companies of Vodaphfo¬ ne to make marketing campaigns as verified.
As far as these facts are concerned, my client wishes to reiterate once again the absence of¬ an infringement in the acts carried out in the file in question.In that regard, it is important to point out the repeal of Article 130 of Law No 30/1992, which provided that ‘only natural and legal persons who are responsible for them may be penalised for acts constituting an infringement’.
We are faced with a lack of room for fault-based liability, a principle which governs or has to apply in the administrative penalty field, since, in so far as it is said — 
Ooped
Cion of the State’s ius puniendi is unacceptable in our legal system for a system of liability without fault.
Having regard to the special nature of the law on penalties, which makes it impossible to impose penalties without taking account of the will of the person concerned, or the factors which may have led to a breach of a legal obligation, that party maintains that the imposition of penalties is not unlawful.
However, as may be seen, the conduct described in the course of the¬ proceedings does not involve any intent whatsoever, either to intent, or to fault.Consequently, since there is¬ no remedy, that party confirms that it is wholly inappropriate to impose a penalty on my client as one of the essential requirements of the administrative penalty law.
The complainant is considered to have acted without a minimum legal standard of probative value, leading to the demonstration of the guilt of Voida — FONE, he shows that the only number provided from the person who received the flame does not¬ belong to any of the collaborator of my client.In addition to the fact that the complainant’s ownership numbers were included in the list of Digital Rights and the internal Robinson List of Vodafone and, therefore, Vodafone’s collaborators should be able¬ to use the filtering of those numbers in the course of the commercial campaigns.
In this regard, it is important to draw attention to the fact that some of the¬ images of this type of campaigns use tretas of the most disparate nature and, on the basis¬ of the facts, it is done by an undertaking which is not for those who work with the idea of causing improper intent, in another call, to capture the user’s interest.
In the alternative, and in the event that, in spite of the explanations given above, the Agency considers that my company merits a penalty for committing an infringement of Article 48.1 (b) of the General Tax Law, the amount of that penalty should be moderated, with the minimum amount being imposed, taking into account the¬ relevant circumstances set out in Article 83.2 of the GDPR:(a) processing of the complainant’s data has been carried out locally;(b) There is no intention on the part of Vodafone that, on the contrary, it causes my client clear damage (complaints, bad image, possible fine for the¬ Agene, etc. and c) it is taking all due care that can be required for the purpose of ensuring¬ that these staff perform properly¬ in carrying out trade campaigns on behalf of Vodafone. 
Ooped
The requested entity is requested to:1There was no need to adjudicate on the matter, with the result that action 2 was closed.In the alternative, impose on my¬ own initiative the penalties for minor infringements to the minimum grade.
In the light of the above, the following facts are considered by the Spanish Data Protection Agency in the present proceeding.
FACTS
1.	— Constant inscribed on the Robinson List the following phone numbers and email addresses in the name of the complainant since 11/12/13:Telephone lines:* * * TELEFONO.1, * * * TELEFFONO4 and * * * TELEFFONO3;— E-mail addresses:* * * EMAIL.1,  * * * EMAIL.2,  * * * EMAIL.3.
2.	— On 21/12/17, the complainant sends, by email  * * * EMAIL.4, the documentation required by Vodafone to exercise his access and revocation rights.This documentation is sent to the addresses.
Data protectiondedata. is:And data protectionwith@ono.
3.	The complainant has provided a copy of a letter addressed to VODAFONE SPAIN SAU — handed over to the consignee on 12/02/18-, to receive commercial calls from the company on its telephone number  * * * TELEFIFO1, from the telephone number  * * * TELEFFONO2, and by reiterating the right of access to and cancellation of the company.
4.	In the email sent by the complainant on 16/03/18, from management
* * * EMAIL.4 and for use	 for data @ vodaine.	 and
Protecciondedatos@ono.es, you complain that you receive commercial calls from Vodafone, and you repeat the requests made to the company that you should not call you again.
5.	The company recognises (by letter sent to this agency on 10/05/19) that:
“08/04/17 marked negative options:“not to receive communications from Vodafone or Vodafone”;‘Do not transfer their data to other companies in the Vodafone group’;“do not use traffic and billing data for commercial purposes” and “do not use navigation data for commercial purposes”.
6.	The complainant provided a copy of an email dated 11/11/18, to  propuestas.onovodafone@gmail.com:The e-mail address,  * * * EIMA.1, the content of which refers to the promotion of products and services of the mark VOLTAONE ONO.
7.	— The respondent submits a copy of an e-mail dated 29/04/19, originating from dpo-spain@vodafone.com and  posted to the complainant’s address, where they apologise for the event, stating that they have taken the necessary measures to avoid including them in the next business actions, and requesting that, if they are subsequently repeated, the calling line is identified against the distributor.

 LEGAL BASIS
I
In accordance with Article 84 (3) of General Telecommunications Law 9/2014 of 9 May (General Telecommunications Act), it is¬ the responsibility of the Director of the Spanish¬ Data Protection Agency.
II
The joint assessment of the documentary evidence in the procedure is brought to the attention of the AEPD (AEPD) with a view of¬ the action complained of, as stated above.
However, in the present case, the following points should be clarified:
The complainant was included in the Robinson List since 2013 and stated this in both emails and letters sent to the respondent, stating that he was receiving advertising calls.
The list of all communications is to be found in the written submissions, both for¬ the file and for a motion for a resolution.However, for example, there is an email dated 21/12/17, from  * * * EMAIL.4, and to  protecciondedatos@vodafone.es;And  protecciondedatos@ono.es where the complainant attaches the document concerning the exercise of the right to access and re¬ destined for his or her data and another document dated 27/12/17, with the same origin and destination, where the complainant repeats the petitions and has shown that he still receives from the company a¬ commercial player.
With regard to the company’s claims when it indicates that the telephone number from which the commercial calls were made  (* * * TELEFIFO2), it does not belong to the company or to any of its partners, it should be noted that there is also an email sent by the complainant, on 16/03/18 to the complaint, where it is reported that he receives commercial calls from Vodafone, from the telephone number  * * * TELEFFONO.5, but there is no clarification as to the ownership of this number in¬ Vodafone’s statements.The company was brought to the attention of the company, both in¬ the e-mail sent by the complainant on 16/03/18 and by the complainant in the letter which was sent to them on 31/10/19.
Apart from this, the company has recognised that it was not until 08/04/17, when it ticked the complainant’s register with the options for:“not to receive communications from Vodafone or Vodafone”;“do not use traffic and billing data for commercial purposes” and “do not use navigation data for commercial purposes” and provides a copy of the e-mail dated 29/04/19, to  dpo-spain@vodafone.com
C/Jorge Juan, 6	 www.agpd.es
28001 — Madrid	 sedetagd.gob.es 

and to the complainant’s address, where they apologise for the event, stating that they have already taken the appropriate measures to avoid including the complainant in the form¬ of commercial activities.
However, the 11/11/18, Vodafone sends from:Proposals.onovoid proposals— fone@gmail.com;To the complainant’s address,  * * * EIMA.1, an e-mail with a commercial content which refers to the promotion of products and services of the brand VOLTAONE ONO.
Finally, it continues to state, on the part of the entity in question, that it does not have an unlawful¬ act of life in its acts, but it must be borne in mind that this is not at the origin of the case by¬ reference to the intention or otherwise of the commercial calls.This is sanctioned by the entity’s lack of diligence in solving a problem with a customer, since it knew about the fact that the complainant was on a Robinson list and that he continued to receive telephone calls and e-mails with the company’s promotions, he did not take any action in this respect, thereby allowing the complainant to continue to receive advertising, with the entity failing to send advertising to the complainant by means of e-mails and¬ commercial flame until he did not include it in its ‘Robinson List’.
On the request of the entity in question to be punished, if the pre closure¬ file is not closed, to impose a sanction  ‘for minor infringement to its minimum grade’, to indicate that, both in the opening of the file and in the motion for a resolution, the sanction imposed as minor in Article 78.11 of the LGT, punishable by a fine of up to EUR 50,000, is deemed to be in line with the minimum level requested, as 40 % of the maximum possible sanction.
— III —
The facts set out above involve a breach of Article 48 (1) (b) of the Ley LGT, as set out in Title III of Law LGT, which states that:‘With regard to the protection of personal data and privacy with regard to directories of subscribers, end-users of electronic communications services shall have the following rights:(...) (b) to object to receiving unwanted calls for the purposes of commercial communication which take place through systems other than those set out in the previous paragraph and to be informed of this right ",
This Infringement is found to be ‘minor’ in Article 78 (11) of that Standard, which it considers as such:‘Breach of public service obligations, public obligations and infringement of the rights of consumers and end-users as laid down in Title III of the Law and its implementing legislation may be fined up to EUR 50.000 in accordance with Article 79 (d) of the LGT. 

In accordance with the above, and without prejudice to the outcome of the proceedings, for the purposes of determining the amount of the penalty to be imposed in the present case, it is considered appropriate to graduate the penalty to be imposed in accordance with the following criteria laid down in Article 80 (1) and (2) of the LGT:
-	Cessation of the unlawful activity, prior to or during the procedure of the former¬ penalty order (paragraph g).
-	The taking into account of the economic situation of the offender (point 2).
Following evidence obtained at the stage of previous investigations, it is considered appropriate to graduate the penalty to EUR 20,000 (twenty thousand euros).
Therefore, in the light of the above, by the Director of the Spanish Data Protection Agency,
HEREBY ORDERS:
FIRST:Imposing an amount of EUR 20,000 (twenty thousand euros) to the entity VODAIONE ONO SAU, with C.I.F. A62186556, for infringement of Article 48 (1) (b) of Law LGT, which is classified as ‘minor’ in Article 78 (11) of the Law.
SECOND:Notify the complainant of this decision and report back to the complainant on the outcome of the complaint.
THIRD:Please note that the sanction imposed must be effective once this decision is enforceable, in accordance with the provisions of Article 98.1 (b¬) of Law No 39/2015 of 1 October 2015 on the administrative and administrative procedure for public¬ administrations (LPACAP), within the period for voluntary payment referred to in Article 68 of the General Tax Collection Regulation, approved by Royal De¬ Creto 939/2005 of 29 July 1992, in conjunction with Article 62 of Law No 58/2003 of 17 December 1992, by entering into the restricted account No  ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency with the Banco CAIXABANK, S.A. or else, it will be collected in a limited period of time.¬
Once they have been notified and enforceable, if the date of enforceability is between 1 and 15 of each month inclusive, the period for payment¬ will be until the 20th day of the following month or immediately, and if the date of enforceability is¬ between 16 and the last day of each month, both inclusive, the time limit for payment is until 5 of the second next or immediate working month. 

Pursuant to Article 82 of Law 62/2003 of 30 December on¬ tax, administrative and social measures, this Resolution shall be made public once it has been notified to the persons concerned.The publication will¬ be made in accordance with Instruction 1/2004 of 22 December on the Spanish Data Protection Agency on the publication of its resolutions.
Pursuant to Articles 112 and 123 of the LPACAP, the interested parties may lodge an appeal against this decision before the Director of the Spanish Data Protection Agency within one month of making this decision¬, or, directly, an administrative appeal before the Chamber for Contentious Administrative Proceedings¬ of the National High Court, pursuant to¬ Article 25 and paragraph 5 of the fourth additional provision of Law No 29/1998 of 13/07, governing the Jurisdiction of the Administrative Courts, within the period of¬ two months from the day following notification of this act, as provided for in Article 46 (1) of the aforementioned Law.
Finally, it should be noted that, in accordance with Article 90.3 (a) of the LPACAP, the final decision may be suspended as a precautionary measure if it is¬ clear that they intend to bring administrative proceedings.If this is the case, the person concerned must formally notify this fact in writing, addressed to the Spanish Data Protection Agency, by means of the Agency’s¬ Electronic Medicinal Product website [https://sedeagpd.gob.es/sede-electronicaweb/], or through one of the other registers provided for in Article 16.4 of Law 39/2015 of 1 October 2013.He shall also transfer to the Agency the documents attesting to the actual lodging of the appeal.If the Agency is not aware of the lodging of the contentious appeal proceedings within two months of the day following the notification of this decision, it would terminate the provisional suspension.
Martes España Martí
Director of the Spanish Data Protection Agency