AEPD (Spain) - PS/00332/2020

AEPD - PS/00332/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 7 GDPR 21 LSSI 21(1) LSSI
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	11.12.2020
Fine:	8000 EUR
Parties:	BORJAMOTOR, S.A.
National Case Number/Name:	PS/00332/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	CSO

The Spanish DPA (AEPD) fined Borjamotor, S.A. for infringing Article 7 GDPR and Article 21(1) of the Spanish Law on Information Society Services (LSSI). Borjamotor, S.A., recognizing its responsibility, made an early payment of €4800 (reduced from the original €8000 fine).

English Summary

Facts

In 2016, the complainant exercised his right to object to BORJAMOTOR, S.A. processing his personal data for direct marketing via e-mail. However, the complainant continued to receive e-mails with offers, although less frequently.

The complainant addressed the company on two further occasions to stop receiving emails: in November 2018 and in September 2019. For the last unsubscribe request, the complainant used the contact form on the company's website to insist that he did not want to receive any more advertisements and to inform the company that he was going to lodge a complaint with a supervisory authority. The company responded to the data subject by showing its apologies. The AEPD did not admit the complaint to be processed because they thought that the situation had been rectified. However, in June 2020, the complainant received an SMS from the defendant with advertising content, so the data subject filed a new complaint with the AEPD.

After a request for information, the company said that the complainant had received the SMS because months before he had used the contact form on the BORJAMOTOR, S.A. website to inform them about his complaint. In order to send the complainant's message correctly, it was necessary to accept the privacy policy and, therefore, the sending of electronic commercial communications.

Dispute

Did the defendant have the data subject's consent to send him commercial communications? Is it correct to send commercial communications to a person just because they used a contact form?

Holding

The AEPD maintains that the defendant infringed the LSSI by sending commercial communications without consent. Likewise, the AEPD points out that the contact form did not meet the requirements of the GDPR regarding consent, since, if the data subject wanted to communicate with the company, he must necessarily accept that his personal data would be processed for advertising purposes. Therefore, the consent was neither free nor specific.

The AEPD decided to impose on the defendant €4000 for each of the infringements, that is, €8000 in total. Finally, the company used the system of reductions for voluntary payment provided for in the Spanish administrative law and paid a fine of €4800.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

                                                                             1/14








     Procedure No.: PS / 00332/2020

RESOLUTION R / 00618/2020 OF TERMINATION OF THE PROCEDURE BY PAYMENT

                                   VOLUNTARY

In the sanctioning procedure PS / 00332/2020, instructed by the Spanish Agency for
Data Protection to BORJAMOTOR, S.A., considering the complaint filed by A.A.A.,
and based on the following,


                                 BACKGROUND

FIRST: On November 10, 2020, the Director of the Spanish Agency
of Data Protection agreed to initiate a sanctioning procedure against BORJAMOTOR,
S.A. (hereinafter, the claimed), through the Agreement that is transcribed:


<<
Procedure Nº: PS / 00332/2020
935-240719
            AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE

Of the actions carried out by the Spanish Data Protection Agency before

the entity, BORJAMOTOR, S.A. with CIF .: A53429403 (hereinafter, “the entity
claimed ”), by virtue of a complaint filed by D.A.A.A., (hereinafter,“ the
claimant ”), and based on the following:

                                      ACTS


FIRST: On 06/10/20, you have an entry in this Agency, a complaint filed
by the claimant in which it indicated, among others, the following:

“On 09/12/19 I filed a complaint for email spam (# 043160/2019).

With exit no. 090520/2019 I am informed of the agreement of non-admission of processing of
the claim (file No. E / 09997/2019). Yesterday I received an SMS from Borjamotor in the
mobile phone *** PHONE. 1, whose screenshot is attached. It seems that
forwarding of commercial content, this time via SMS, is in contradiction with
the internal measures that the Borjamotor company reported that it had adopted in the
written reply to the request by the AEPD, within the actions

of the aforementioned file, which is why I have not contacted the
company.".

SECOND: In view of the facts set forth in the claim and the documents
provided by the claimant, the SG of Data Inspection proceeded to carry out

actions for its clarification, in accordance with article 65.4 of the Law
Organic 3/2018, of December 5, Protection of Personal Data and guarantee of
digital rights (LOPDGDD). Thus, dated 06/19/20 and reference number
E / 05058/2020, a written request for information was addressed to the entity
claimed.


THIRD: On 07/27/20, this Agency receives a written reply to the
requirement, by the claimed entity, in which it is reported, among others,
of:
C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 2/14









“After the first claim, Borjamotor decided to delete the customer's data in its
DMS, since its only operation was the purchase of a vehicle in 2012, and so

we made known in our brief of allegations requested in the file
9997/2020. Document 1: Your data does not appear in the DMS searching by name,
mobile or email Document 2: Block to receive email in our
mailmarketing tool (Sender Grobal provider)

No right has been formally exercised by the claimant, properly

said, regulated in articles 15 to 22 of the RGPD so it has not been sent
response to the complainant in this regard.

The incidence in the shipment is due to your last communication via contact form.
After unsubscribing from the mailmk tool (09-11-2019), on the same date, and

a few minutes after unsubscribing, he filled out a business contact form
(WEB) to communicate your claim accepting again our policy of
privacy and granting your consent, among other purposes, to shipments
commercial.
These data are automatically collected in the database for shipments
commercial (tool managed by our digital service provider

Sender Global, this tool only blocks the data from which the withdrawal is requested, in
in this case the email, leaving active the mobile phone data provided by the
claimant). It is at this point where the question lies, despite maintaining
blocked sending mail, activated his mobile number as contact. Borjamotor no
You usually use the SMS tool for commercial shipments, but in this case,

used to send an event, and it was the one received by the claimant (ONE SMS
submitted by BORJAMOTOR on 06/9/2020 at 1:39 PM). OPEL did not send any SMS to
client.

The mobile data has been blocked so as not to receive SMS, with this the claimant does not

will be contacted by any channel. Additionally SENDERGLOBAL on request
of BORJAMOTOR, has carried out a system of total withdrawal and not differentiated by the
different communication channels that a user can receive through
SenderGlobal. This procedure acts when a user makes the unsubscribe request
for any of the communications only sent from the platform
SenderGlobal and through the correct link will proceed to unsubscribe without being able to receive

again notifications

Attached documents: Document 1: Your data has been deleted in our DMS (base
management data) on 11/11/2019. We provide a screenshot of the file
customer. Document 2: Blocking to receive email in our tool

mailmarketing (Sender Grobal provider). This block was applied on the previous date
to the first claim. Document 3: Sender Global SMS / email blocking (in the
second page of the PDF it is observed that the contact has been totally blocked,
without the possibility of receiving more shipments, once this file is resolved
we will proceed to delete the data in our Sender Global tool ”.


FOURTH: In file E / 0997/2019, whose resolution was notified to the claimant
on 12/16/19, the following was indicated, among others:


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 3/14








“(…) In the present case, the claim presented has been received by this Agency
by A.A.A., dated September 12, 2019 and entry registration number
043160/2019, against BORJAMOTOR, S.A., for an alleged violation of Article

17 of the RGPD. In particular due to the following circumstances:

It is stated by the claimant that he has received commercial emails despite having
The cancellation requested in advance via email on 11/12/18. 9/11/19 receives a new
mail, filing a complaint through the form on its website,
answering the same, but nevertheless on September 12 he received a new

mail.

In accordance with the regulations set forth, prior to admission for processing
of this claim, it was transferred to BORJAMOTOR, S.A. for what
proceed to its analysis and respond to this Agency within a month.

Likewise, the respondent was asked: accreditation of the response provided to the
claimant, in the event of exercising the rights regulated in articles 15
to 22 of the RGPD; report on the causes that motivated the incident produced; and
details of the measures adopted to avoid similar situations.

In response to said request, this Agency has received a letter from

BORJAMOTOR, S.A. that for what is of interest here states the following:
proceeded to the total deletion of the claimant's data. It is stated that the
mail sent on 09/12/19 was not a commercial mail but a writing
apologetic. Internal measures have been adopted to channel all requests for
rights that are received even if they reach the entity through channels other than the

email address enabled. Once the reasons given by
BORJAMOTOR, S.A., which are in the file, this Agency considers that the
responsible has attended the claim presented.

For this reason, in accordance with the provisions of art. 65.4 of the LOPDGDD, the

Director of the AEPD agrees not to admit for processing the claim presented by
A.A.A. against BORJAMOTOR, S.A. (…) ”.

FIFTH: In view of the facts denounced, in accordance with the evidence of
that is available, the Data Inspection of this Spanish Agency for the Protection of
Data considers the above, does not comply with current regulations, therefore

that the opening of this sanctioning procedure proceeds.

                           FOUNDATIONS OF LAW
                                           I
                                     Competition:


A) .- On the consent to receive communications from the claimed entity:

By virtue of the powers that article 58.2 of Regulation (EU) 2016/679, of the
European Parliament and of the Council, of 04/27/16, regarding the Protection of

Individuals with regard to the Processing of Personal and Free Data
Circulation of these Data (RGPD) recognizes each Control Authority and, according to
established in arts. 47, 64.2 and 68.1 of Organic Law 3/2018, of December 5,
Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD),

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 4/14








the Director of the Spanish Data Protection Agency is competent to initiate
this procedure.

Sections 1) and 2) of article 58 of the RGPD, list, respectively, the
investigative and corrective powers that the supervisory authority may have at the disposal of the

effect, mentioning in point 1.d), that of: “notify the person in charge or commission of the
treatment of alleged infringements of this Regulation ”and in 2.i), that of:
“Impose an administrative fine in accordance with article 83, in addition to or instead of the
measures mentioned in this section, according to the circumstances of each
case.".


B) .- On the sending of commercial communications of the claimed entity:

In accordance with the provisions of art. 43.1, second paragraph, of the Law
34/2002, of July 11, on Services of the Information Society and Commerce
Electronic (LSSI), is competent to initiate and resolve this Procedure

Sanctioner, the Director of the Spanish Agency for Data Protection.

                                           II
1º.- In the present case, the facts must be addressed as a preliminary matter.
occurred under file E / 0997/2019. Thus, dated 09/12/19, the claimant
presented before this Agency, complaint against the claimed entity in which it indicated

that since 2016 decided not to receive any more advertising emails from the dealer and
This is how it was sent to you through the direct access on your website
www.opelborjamotor.es/es/contacto. However, I kept getting emails with
offers, although less frequently. In November 2018 he again requested the withdrawal
by email and the last attempt was on 09/11/19 using the access again
direct from the website of the claimed entity, www.opelborjamotor.es/es/contacto


The complaint letter was then accompanied by the following documentation:

a) .- Copy of an email, dated 09/11/19, sent from the address
Opel Borjamotor <info@opelborjamotor.es> to the email address of the
claimant, with commercial information of the dealer.


b) .- Screenshot of the dealer's contact website,
www.opelborjamotor.es/es/contacto, with the claimant's data in the section
"Sender" and with the following message in the "reason" field:

       “On several occasions I have carried out the cancellation procedure to not receive

       communications from that company. They seem to ignore the wishes of
       clients, at least in my case. How do I keep the last request to unsubscribe?
       date 11/12/18 I am going to send it, along with the capture of the mail that I have
       sent today, so that you are aware of it, the Spanish Agency for
       Data Protection".


c) .- There is on this contact page, www.opelborjamotor.es/es/contacto, a banner
with the following information, without the option to reject:



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 5/14










     - "By clicking the" Send "button, the user accepts that their personal data

          They will be treated and used by the parties listed in the << Declaration of
          Privacy >>, for the purposes mentioned. Therefore, you hereby
          You agree to be contacted in order to receive more

          Information about Opel products and services from a Dealer
          Opel. "


     - I accept the data processing described in the << Declaration of

          Consent >>.


d) .- If the "Declaration of Consent" is accessed, through the link
corresponding, a page is displayed with the following information:


          "I accept that my personal data provided in relation to the information

          that I submit as part of this application, are processed for purposes of
          personalized marketing and market studies by Borjamotor S.A, Carretera

          de Ocaña, 56 03006 Alicante, protecciondedatos@grupoborja.es, 965 113 465
          by Opel España S.L.U. with C.I.F. nº B-50629187 and with registered office in Polígono

          Industrial Entrerríos, s / n, 50639 Figueruelas, Zaragoza, and Opel Automobile
          GmbH, with registered office in Bahnhofsplatz, D-65423 Rüsselsheim, Germany ”.


          My data will be processed for the purposes listed below and
          shared with the following recipients:


            Data Purpose Recipients
 Identification data and Customer Service: for example, The Opel Dealer, Opel Automobile GmbH,
 contact (name and invitations to events, information about Opel España S.L.U., and subsidiaries of the Opel group

 surname, address of belt (technical) updates of my vehicle share my personal data with
 electronic, current / vehicle number of my interest, respective information responsible for its treatment for
 phone), and information about any vehicle services, marketing / market research purposes,
 related sent by notification of maintenance date / related IT services, administration and
 you (as part of / in inspection / service / repair. support.
 regarding your requests) Customer information: Contact for Opel Dealer, Opel Automobile GmbH and
                              communicate, for example, Opel España S.L.U., and subsidiaries of the Opel group

                              availability of new vehicles or also share my personal data with the
                              occasion, financing offers and leas corresponding IT service provider (GM
                              dealer services, offerings from Holdings LLC, Michigan, USA) based outside
                              reviews and workshop, completion of my European Economic Area (EEA) and, for
                              financing or leasing contract or both, in a country without the adequate level of
                              improvement measures for my vehicle. data protection. There is no decision
                              Advertising: Individual advertising or according to the European Commission, but yes
                              personalized offers, products and appropriate security mechanisms, in this

                              services. case the Standard Contractual Clauses of the
                              EU Satisfaction Surveys (SCC). If I want a copy, I can
                              customer: Contact after purchase or send an email to:
                              service, to know my satisfaction coprivacyrights@opel.com
                              my vehicle or the service received.
 Name, surname, address To carry out the financing / Opel Financial Services España, S.A., with

 –And if required - year and we provide, leasing services and other addresses in Figueruelas, Zaragoza, Polígono
 month of birth, Offer requests. Entrerríos s / n, postal code 50639, Spain).
 Identification and details of There is no adequacy decision of the
 contact (name *, email *, European Commission, but there is
 address *, telephone *, code adequate protections, since the collection and
 postal), data processing is carried out under levels of
                                                                       security that will prevent their loss or
                                                                       manipulation by third parties. With the purpose of

                                                                       offer adequate data protection
                                                                       transferred personnel, the Opel Dealer

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 6/14









                                                          has entered into a contract for the processing of
                                                          data with the service provider entity
                                                          approved by the authorities of the Union
                                                          European. Likewise, it is understood that
                                                          some of the personal data reflected in
                                                          this form may be transferred to others
                                                          countries outside the European Union, for the purposes of
                                                          storage and preservation services
                                                          information.


        I accept that the Opel Dealer, Opel España S.L.U. and Opel Automobile
        GmbH use my data defined above to enable the exact
        identification, to offer me better services and experiences and to avoid

        possible inconsistencies in relation to the purposes above
        defined. Both companies use business rules in business processes.
        merge and merge to detect potential matches between two or more
        records from different sources and systems (for example, through

        of online requests sent to Opel, participation in marketing events of
        Opel, using myOpel) to create a single customer record.

        My personal data will be stored, for the purposes above

        described, within three years since my last contact with Opel
        (…) ”.


e) .- The claimant submitted a copy of the email, dated 09/12/19, sent
from the internet sales address <internet@borjamotor.com>, with the following
message:


        "Good morning: Juan Faus. First of all, apologize if you have been able to
        get some communication that has not been to your liking. Will not return to
        occur(…)".


2.- On 12/16/19, once the reasons stated by the entity have been analyzed
claimed in the reference file and in accordance with the provisions of the
art. 65.4 of the LOPDGDD, the Director of the AEPD agreed not to admit the
claim presented when considering that the situation denounced was remedied

by the claimed entity.

3º.- However, on 06/10/20, a new
complaint filed by the claimant in which he indicated that he had again received

a commercial communication from the claimed entity, on this occasion, via SMS.

4.- According to the allegations presented by the entity claimed before this new
complaint, it was indicated that:


        "The incidence in the shipment is due to your last communication via the
        Contact. After unsubscribing from the mailmk tool (09-11-2019), in the

        same date, and a few minutes after unsubscribing, he filled out a form
        commercial contact (WEB) to communicate your claim accepting
        new our privacy policy and giving your consent again,
        among other purposes, to commercial shipments ”.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 7/14








5º.- However, according to the documentation presented by the claimant, in relation
With the file E / 09997/2019, the claimed entity sent an email a
day later, on 09/12/19 with the message: “First of all, I apologize if you have

been able to get some communication that has not been to your liking. It will not happen again.
Greetings and again, sorry for the inconvenience ”.
                                            III

In the present case, the claimant asked the claimed entity, on 09/11/19, to
through his contact page, www.opelborjamotor.es/es/contacto, that he did not want

receive more commercial communications from the dealer. A day later, the entity
The complained party responds that it will not “happen again” and apologizes for the damages.
caused. However, nine months later, on 06/10/20, the claimant returned to
receive a new commercial communication from the claimed person via SMS.


The facts presented, without prejudice to what results from the instruction, consisting of
the sending of non-consensual commercial communications, could constitute
infringement, by the defendant as established in article 21 of the
LSSI, where it is established that:

"1. The sending of advertising or promotional communications by

email or other equivalent electronic means of communication that
had not previously been requested or expressly authorized by the
recipients of the same.

2. The provisions of the preceding section shall not apply when there is a

previous contractual relationship, provided that the provider had obtained lawfully
the recipient's contact details and will use them to send communications
commercial related to products or services of your own company that are
similar to those that were initially contracted with the client.


In any case, the provider must offer the recipient the possibility of opposing the
processing of your data for promotional purposes using a simple procedure
and free of charge, both at the time of data collection and at each of the
commercial communications that you direct.

When the communications have been sent by email, said

means must necessarily consist of the inclusion of an email address
email or other valid email address where this right can be exercised,
being forbidden the sending of communications that do not include said address. "

The aforementioned offense is classified as minor in art. 38.4.d) of said

standard, which qualifies as such, “Sending commercial communications by mail
electronic or other equivalent electronic means of communication when in said
shipments do not meet the requirements established in article 21 and do not constitute
Serious offense".


In accordance with the provisions of article 39.1.c) of the LSSI, minor infractions may
be sanctioned with a fine of up to € 30,000, establishing the criteria for its
graduation in article 40 of the same rule.


C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 8/14








After the evidence obtained in the preliminary investigation phase, and without prejudice to
what results from the instruction, it is considered that the sanction should be
impose in accordance with the following aggravating criteria, established in art. 40 of
the LSSI:


The existence of intentionality, an expression that must be interpreted as equivalent to
degree of guilt according to the Judgment of the National Court of
11/12/07 relapse to Appeal no. 351/2006, corresponding to the entity
denounced the determination of a system for obtaining informed consent
that conforms to the mandate of the LSSI.


Period of time during which the offense has been committed, as it is the first
claim of September 2019, (section b).

Based on these criteria, it is deemed appropriate to impose on the claimed entity
a penalty of 4,000 euros (two thousand euros), for the violation of article 21 of the LSSI,

Regarding the sending of commercial communications to the claimant without consent
express of the same
                                           IV

On the other hand, by this Agency it has been found that, when the user of
the website www.opelborjamotor.es, makes use of the existing form on the page

www.opelborjamotor.es/es/contacto, if you wish to contact the
dealer, you must accept both the "privacy statement", where the user
obligatorily accepts that, "they get in touch in order to receive more
information on Opel products and services from an Opel Dealer. ”,
as the "declaration of consent", where the user must accept
obligatorily, among others that, "the personal data provided in relation to

the information, are processed for personalized marketing purposes and
Market studies (…)".

Article 6.1. of the RGPD, establishes that the processing of personal data only
It will be lawful if at least one of the conditions indicated therein is met,
Among which is, in section b), if the treatment is “necessary for the

execution of a contract in which the interested party is a party or for the application to
request of this of pre-contractual measures ”, in which case, the sending of
communications that are closely related to the end of the signed contract, would be
endorsed by this precept, as it would be in the present case, maintain communication
between both parties, for the resolution of the questions raised by the user.


However, for any other type of communication with the user, as in this
case, to, “(…) receive more information about Opel products and services from
an Opel Dealer. ", or so that," the personal data provided in relation to
to the information, are processed for personalized marketing purposes and
market studies (…) ”, the provisions of section a) of article

6.1 of the RGPD, where it is stated that: “the treatment will only be lawful if the interested party gave
your consent to the processing of your personal data for one or more purposes
specific ”.

Article 7 of the RGPD, establishes for its part, in relation to consent, that:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 9/14









"1. When the treatment is based on the consent of the interested party, the person in charge
must be able to demonstrate that he consented to the processing of his data

personal.

2. If the consent of the interested party is given in the context of a written statement
that also refers to other matters, the request for consent will be submitted
such that it is clearly distinguished from other subjects, intelligibly and clearly
easy access and using clear and simple language. No part will be binding

of the declaration that constitutes an infringement of these Regulations.

3. The interested party will have the right to withdraw their consent at any time. The
Withdrawal of consent will not affect the legality of the treatment based on the
consent prior to its withdrawal. Before giving consent, the interested party

will be informed of it. It will be as easy to withdraw consent as it is to give it.

4. When evaluating whether consent has been freely given, it will be taken into account in the
as much as possible the fact whether, among other things, the performance of a contract,
including the provision of a service, is subject to consent to the treatment of
personal data that are not necessary for the execution of said contract ”.


In relation to these two cited articles, it should also be taken into account the
considering (32) of the RGPD, as it indicates that:

“Consent must be given through a clear affirmative act that reflects a

free, specific, informed, and unequivocal manifestation of the interested party
accept the processing of personal data that concerns him ... Therefore, the
Consent must be given for all processing activities carried out with the
same or the same ends. When the treatment has several purposes, the
consent for each of them, freely and without obligation.


For its part, article 6.2 of the LOPDGDD establishes, on the treatment based on the
consent, that: "When it is intended to base the processing of data on the
consent of the affected party for a plurality of purposes, it will be necessary that
It is specifically and unequivocally stated that said consent is granted to
All of them".


Well, in accordance with everything indicated, data processing requires the
existence of a legal basis that legitimizes it, as in this case, the execution of a
contract in which the interested party is a party (the realization of a request, a query or
a comment) through its website, in which case, the answer to the question

raised would be supported by this precept. Not so, when the shipment is
communications that do not have the same purpose as that included in the request
made, in which case the consent of the interested party is required
freely for each of the other purposes, such as, for example, the
sending advertising communications. Situation that is not fulfilled in the present

case, because to send the request or query to the entity, it must be accepted without option
to refusal that the user receives commercial communications from the claimed entity.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 10/14








Thus, the known facts could constitute an infraction,
attributable to the defendant, for violation of article 7 of the aforementioned RGPD, to
carry out the collection of consent through a mandatory action to receive

any type of communication, even if it is different from the purpose for which they have been
obtained personal data.

For its part, article 72.1.c) of the LOPDGDD, considers very serious, for the purposes of
prescription, "Failure to comply with the requirements of article 7 of the RGPD".


This offense can be sanctioned with a fine of € 20,000,000 maximum or,
in the case of a company, an amount equivalent to a maximum of 4% of the
total annual global business volume of the previous financial year, opting for the
of greater amount, in accordance with article 83.5.b) of the RGPD.


In accordance with the indicated precepts, and without prejudice to what results from the
instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In the present case, it is considered that the sanction to be imposed should be adjusted according to
with the following criteria established in article 83.2 of the RGPD:

    - The intentionality or negligence in the infraction. In the present case we are

        in the event of unintentional negligent action, (section b).

    - The categories of personal data affected by the infringement
        (section g).


    - The way in which the supervisory authority learned of the infringement. The
        The way in which this AEPD has learned has been by filing
        two complaints by the claimant, (section h).

In accordance with the indicated precepts, and without prejudice to what results from the

instruction of the procedure, in order to fix the amount of the sanction to be imposed in
In the present case, it is considered that the sanction to be imposed should be adjusted according to
with the following criteria established in article 76.2 of the LOPDGDD:

    - The linking of the offender's activity with the performance of treatment of
        personal data, (section b).


The balance of the circumstances contemplated in article 83.2 of the RGPD, with
Regarding the offense committed by violating the provisions of Article 13, it allows
set a penalty of 4,000 euros, (four thousand euros).


Therefore, the total sanction to impose, for infractions in the cookie policy in
the four web pages owned, would be 8,000 euros (eight thousand euros).

In accordance with the foregoing, by the Director of the Spanish Agency for
Data Protection,

                                      HE REMEMBERS:

START: SANCTIONING PROCEDURE to the entity BORJAMOTOR, S.A. with
CIF .: A53429403 for violation of:

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 11/14









    - Article 21 of the LSSI, punishable in accordance with the provisions of art. 39) and 40)
        of the aforementioned Law, regarding the sending of commercial communications without the

        express consent for it.

    - Article 7 of the RGPD, by not obtaining, individually, consent
        of the client, for the treatment of their personal data, when its purpose is
        different from the one pursued in the execution of the request made.


APPOINT: as Instructor to D. R.R.R., and Secretary, where appropriate, to Ms. S.S.S.,
indicating that any of them may be challenged, if applicable, in accordance with the
established in articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime
of the Public Sector (LRJSP).


INCORPORATE: to the sanctioning file, for evidentiary purposes, the claim
filed by the claimant and his documentation, the documents obtained and
generated by the Subdirectorate General for Data Inspection during the
investigations, all of them part of the present administrative file.

WHAT: for the purposes provided for in art. 64.2 b) of Law 39/2015, of October 1, on

Common Administrative Procedure of Public Administrations, the sanction that
could correspond would be: 8,000 euros (eight thousand euros), for the infractions:

    - 4,000 euros, (four thousand euros), for the violation of article 21 of the LSSI,
        regarding the sending of commercial communications without consent

        expressly for this, without prejudice to what results from the instruction of this
        proceedings.

    - 4,000 euros, (four thousand euros), for the violation of article 7 of the RGPD,
        Regarding the collection of the consent of the clients for the treatment of

        your personal data when said treatment is for purposes other than the
        execution of the request made, without prejudice to what results from the instruction
        of this file.

WHAT: in accordance with article 58.2 of the RGPD, the corrective measure that could
be imposed on the entity BORJAMOTOR, S.A. would consist of ORDERING HIM to take

the necessary measures on:

    - Take the necessary measures to obtain the client's consent to
        the processing of your personal data when the purpose is different from the management
        of the consultation indicated in the "reason" of the contact.


NOTIFY: this agreement to initiate a sanctioning file to the entity
BORJAMOTOR, S.A, granting a hearing period of ten business days so that
formulate the allegations and present the evidence it deems appropriate.


If within the stipulated period it does not make allegations to this initiation agreement, the same
It may be considered a resolution proposal, as established in article
64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
the Public Administrations (hereinafter, LPACAP).

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 12/14









If within the stipulated period it does not make allegations to this initiation agreement, the same
It may be considered a resolution proposal, as established in article

64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of
the Public Administrations (hereinafter, LPACAP).

In accordance with the provisions of article 85 of the LPACAP, in the event that the
penalty to be imposed would be a fine, you may recognize your responsibility within the
term granted for the formulation of allegations to the present initiation agreement; the

which will entail a reduction of 20% of the sanction to be imposed in
the present procedure, equivalent in this case to 1,600 euros. With the app
of this reduction, the penalty would be established at 6,400 euros, resolving the
procedure with the imposition of this sanction.


In the same way, you may, at any time prior to the resolution of this
procedure, carry out the voluntary payment of the proposed sanction, which
will mean a reduction of 20% of the amount of this, equivalent in this case to
1,600 euros. With the application of this reduction, the sanction would be established in
6,400 euros and its payment will imply the termination of the procedure.


The reduction for the voluntary payment of the penalty is cumulative to the corresponding
apply for the recognition of responsibility, provided that this recognition
of responsibility is made manifest within the period granted to formulate
allegations at the opening of the procedure. The voluntary payment of the referred amount
in the previous paragraph it may be done at any time prior to the resolution. In

In this case, if both reductions should be applied, the amount of the penalty would be
established at 4,800 euros (four thousand eight hundred euros).

In any case, the effectiveness of either of the two mentioned reductions will be
conditioned to the withdrawal or resignation of any action or remedy in

administrative against the sanction.

If you choose to proceed to the voluntary payment of any of the amounts indicated
previously, you must make it effective by entering account number ES00
0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for the Protection of
Data in Banco CAIXABANK, S.A., indicating in the concept the number of

reference of the procedure in the heading of this document and the
cause of reduction of the amount to which it is accepted.

Likewise, you must send proof of admission to the Subdirectorate General of
Inspection to continue the procedure according to the quantity

entered.

The procedure will have a maximum duration of nine months from the date of
date of the initiation agreement or, where appropriate, the draft initiation agreement.
After this period, its expiration will occur and, consequently, the file of

performances; in accordance with the provisions of article 64 of the LOPDGDD.

Finally, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP,
There is no administrative appeal against this act.

C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 13/14









Mar Spain Martí
Director of the Spanish Agency for Data Protection.




>>

SECOND: On December 4, 2020, the defendant has proceeded to pay

the sanction in the amount of 4,800 euros making use of the two planned reductions
in the Initiation Agreement transcribed above, which implies the recognition of the
responsibility.

THIRD: The payment made, within the period granted to formulate allegations to

the opening of the procedure, entails the waiver of any action or appeal in the process
administrative against the sanction and the recognition of responsibility in relation to
the facts to which the Initiation Agreement refers.

                            FOUNDATIONS OF LAW


                                             I

By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of
control, and as established in art. 47 of Organic Law 3/2018, of 5
December, Protection of Personal Data and guarantee of digital rights (in

hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection
is competent to sanction the infractions that are committed against said
Regulation; infractions of article 48 of Law 9/2014, of May 9, General
of Telecommunications (hereinafter LGT), in accordance with the provisions of the
article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and

38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the
information and electronic commerce (hereinafter LSSI), as provided in article
43.1 of said Law.

                                             II


Article 85 of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations (hereinafter, LPACAP), under the rubric
"Termination of sanctioning procedures" provides the following:
"1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility,
the procedure may be resolved with the imposition of the appropriate sanction.


2. When the sanction is solely of a pecuniary nature or it is possible to impose a
pecuniary sanction and other non-pecuniary sanction, but the
inadmissibility of the second, the voluntary payment by the presumed responsible, in
any time prior to the resolution, will imply the termination of the procedure,

except in relation to the replacement of the altered situation or the determination of the
compensation for damages caused by the commission of the offense.



C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es 14/14








3. In both cases, when the sanction is solely of a pecuniary nature, the
competent body to resolve the procedure will apply reductions of, at least,

20% of the amount of the proposed penalty, these being cumulative among themselves.
The aforementioned reductions must be determined in the notice of initiation
of the procedure and its effectiveness will be conditioned to the withdrawal or resignation of
any action or appeal in administrative proceedings against the sanction.


The percentage of reduction foreseen in this section may be increased
regulations.

In accordance with the above, the Director of the Spanish Agency for the Protection of

Data RESOLVES:

FIRST: DECLARE the termination of procedure PS / 00332/2020, of
in accordance with the provisions of article 85 of the LPACAP.


SECOND: NOTIFY this resolution to BORJAMOTOR, S.A.

In accordance with the provisions of article 50 of the LOPDGDD, this
Resolution will be made public once it has been notified to the interested parties.


Against this resolution, which puts an end to the administrative procedure as prescribed by
the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure
Common of Public Administrations, interested parties may file an appeal
administrative litigation before the Contentious-Administrative Chamber of the

National High Court, in accordance with the provisions of article 25 and section 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within a period of two months from the
day following notification of this act, as provided in article 46.1 of the

referred Law.


                                                                                  936-031219
Mar Spain Martí
Director of the Spanish Agency for Data Protection




















C / Jorge Juan, 6 www.aepd.es
28001 - Madrid sedeagpd.gob.es