AEPD (Spain) - PS/00235/2019

AEPD - PS/00235/2019 938-0419
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(a) GDPR
Type:	Investigation
Outcome:	Violation
Decided:	February 2020
Published:	n/a
Fine:	EUR 120000
Parties:	VODAFONE ESPAÑA SAU
National Case Number:	PS/00235/2019
European Case Law Identifier	n/a
Appeal:	n/a
Original Language:	Spanish
Original Source:	AEPD (in ES)

Following an investigation, the Spanish Data Protection Authority (AEPD) imposed a fine of 120,000 Eur on VODAFONE ESPAÑA SAU (Vodafone) for a serious violation of Articles 6(1)(a) and 5(1)(a) GDPR.

English Summary

Facts and questions arising

In January 2018, Mr A.A.A. contacted Vodafone to open an account. By mistake, his 14-year old son was subscribed for the services offered by Vodafone. Mr A.A.A. tried to rectify the data soon after the subscription.

In September 2018, Mr A.A.A.'s son received a letter from Vodafone informing that his son had entered into a debt of 93,77 EUR and that, in the event of non-payment, his son would be included in the debtors' records. In the absence of payment, the reference was finally made in the debtors' records in October 2018.

In February 2019, Mr A.A.A. attempted to withdraw his son from the services since the processing of his son's personal data was unlawful and lasted for 13 months.

Holding

According to the AEPD, the processing was unlawful. Neither the complainant nor his son have given consent to the processing of the personal data by Vodafone. The processing has therefore violated Articles 6(1)(a) and 5(1)(a) GDPR.

Moreover, the AEPD stated that apart from the unlawful processing of the complainant’s personal data Vodafone has included unduly the complainant's son's personal data in the ASNEF and DEXCUUG debtors' records. The complainant received the prior payment order giving him 10 days to remedy the alleged non-payment, but Vodafone included the complainant's personal data in the ASNEF file already one day later, and in the FIDEXCUG file 4 days later without waiting for the 10-day period granted.

After conducting the investigation, the AEPD decided that Vodafone has seriously violated Articles 6(1)(a) and 5(1)(a) GDPR and the relevant provisions of the national law. The AEPD decided to impose a fine of 120,000 Eur on the Controller, VODAFONE ESPAÑA SAU.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Spanish original for more details.

Procedure No: PS/00235/2019 938-0419

RESOLUTION OF THE DISCIPLINARY PROCEEDINGS

In penalty proceedings PS/00235/2019, instructed by the Spanish Data Protection Agency, the entity VODAFONE SPAIN SAU.(Vodafone), with
C.	I.F.A80907397, (hereinafter referred to as ‘claimed entity’), having regard to the complaint lodged by
D.	A.A.A., (hereinafter referred to as “the complainant”), and based on the following,
BACKGROUND
FIRST:On 09/03/19, he had entered this agency in writing,  submitted by B.B.B.B., as the complainant’s representative and father, in which he stated, inter alia:
“In September 2018, my son, a minor, receives a letter from Vodafone España SAU, informing you that it has entered into a debt of EUR 93,77 and that in the event of non-payment they will be included in a list of bad debtors. I contacted them to comment on the case, but far from doing so they continued to arrive letters stating that they were either paid or included in a ASNEF file. I lodged a complaint with the ‘Oficina de Atención al Usuarios de Telecomunicaciones’, which gave me the reason (N/REF.: RC1020566/18)’.
In this complaint, the documents were set out in detail in the document initiating the procedure and in the motion for a resolution.
SECOND:In the light of the facts set out in the complaint and the documents provided by the complainant, the Subdirectorate-General for Data Inspection carried out measures to clarify matters, under the powers of investigation conferred on the supervisory authorities by Article 57 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation (GDPR)).Thus, on 02/04/19, an information injunction was sent to the entity in question.
THIRD:On 03/07/19, the entity in question refers to this Agency information already set out in the document initiating the procedure and in its motion for a resolution.
FOURTH:On 19/07/19, an information injunction was sent to ASPNEF-EQUIFAX and to EXPERIAN to inform the Agency of the data contained in ASNEF and BATEXCUG files, with regard to the complainant.
On 24/07/19 and 28/08/19, the Agency receives reports from the companies indicated above in which they state, with regard to the complainant:
File	F. high	F. Low	Days
registered	Entity
Reporting person	Balance
debtor
ASNEF	18/10/18	16/11/18	30 days	VODAFONE	EUR 93,77
BAUXCUG	21/10/18	18/11/18	29 days	VODAFONE	EUR 93,77

FIFTH:On 09/09/19, the complainant’s representative was asked to send to the complainant’s representative a copy of the DNI or documentation proving the complainant’s age at the material time.
On 11/09/19, the complainant sends this agency a copy of the DNI on the basis of which it appears that the date of birth is 23/12/2003, so that, at the material time, (date of registration of the telephone line and date of inclusion of his personal data in ASNEF and BDEXCUG files: 17/01/18 18/10/18 and 21/10/18 respectively), the complainant was 14 years old, on 23/12/17.
FIFTH:On 04/11/19, the probationary period was commenced, I agreed as¬ follows: the complaint lodged by the complaint¬ and its documentation, the documents obtained and generated which form part of the file E/3639/2019 and (b) — to be reproduced for purposes of proof, to be reproduced for purposes of proof, to be reproduced for the purposes of proof, are set out below.
SIXTH: On 16/01/20, the respondent was notified of the proposal to terminate the agreement, proposing that¬ the director of the AEPD then penalise the entity VOLADFONE SPAIN SAU, on the grounds that it infringed Articles 6.1 (a) and 5.1 (a) of the GDPR, in breach of Articles (a) and (a) of the GDPR¬, in accordance with Article 71 (1) (a) and (b) respectively of the LOPDGDD. with a fine of 120.000 (one hundred and twenty thousand euros), in accordance with Article 58 (2) of the GDPR.
SEVENTH:Notified of the motion for resolution, the entity in question puts¬ forward statements in relation to the proposal on 30/01/20, in the period granted for that purpose, essentially on the basis of:
The facts are as follows:Mr A.A.,  he maintains that¬ his son received a letter from Vodafone in September 2018 informing him that he had entered into a debt of EUR 93,77 and that, in the event of non-payment, he would be included in the debtors’ ledger. In the absence of payment, they were finally included in the late payment file in October.
In the letter of Motion for a Resolution, the Agency maintains that “the entity Recla Mada¬ has processed the complainant’s personal data without¬ feeling it with feelings, after having tried to withdraw the services provided and that, in addition, that processing was carried out in an unlawful manner and not fair in relation to their inclusion in the credit records.” Reason for attributing to my client the violation of Articles 5.1 and 6.1 of the GDPR.
Registration in the services took place on 27 January 2018, due to an error made by the Commission, in so far as it was on the top of the line, as it included the personal data of his or her child, who is a minor, rather than his own data.
It was Mr A.A.A. himself  who applied for the registration of the mobile line, through the Vodafone store, on the basis of his own personal details of his son to my re¬ presented. It should be borne in mind that Mr A.A. was not a previous client of Vodafone, so my client did not have any personal data from the¬ applicant. This means that, in no case, Vodafone was able to allocate or associate any other data.

Individual persons who were completed by Mr A.A.A. at the time of managing the registration of the services through the Tienda Online.
Similarly, if it had not been for the recruitment of part of the registration, my¬ client would not have been able to obtain the data from the child.
As was established by the letter of Grounds of the Acuerdo de Inicio, re mise en route¬ by that party on 16 October 2019, when it was wrong, Mr A.A. A. contacted Vodafone, on 12 February 2018 (just two weeks after the registration), and informed my client about his mistake on the top of the line in providing his son’s details. In view of the above, my¬ account was given the possibility to change the type of contract on the line, on postpre-paid payment, by expressly consenting to this change to the complainant.
That acceptance was thus taken into account in the internal systems of my repre¬ sitting, processing the opening of a change of line of postprepaid payment on the same day and processing the delivery of a SIM card at home.
That being so, it is thus established that Mr A.A.’ s consent, that is to  say, his recruitment, was accepted and desired by him. It is also understandable that, if the complainant had not wished to change the post-payment line, he would have returned the SIM card received, or would have manifested its refusal to my client in some or other way.
Up to this point, without having received any form of communication from Mr A.A.A. to this point,  and without my client having received any communication from his party for a full year, Vodafone has received a decision issued by SETSI following a complaint made by  Mr A.A.A.
That notification was received on 08/02/19, as we have already mentioned, one year later, with my client being required to remove the line mo¬ vil, and payment was made for the amounts invoiced to the complainant, as had been done by Vodafone immediately when managing the withdrawal, crediting and confirming that the child was not included in solvency files on 15/02/19.
It is from any observable point that Vodafone acted at all times in accordance with what was requested by the complainant, and that, at all events, it had the agreement of  Mr A.A.A., not one, but at three points in time:
i)	you recognise that you have made an error online;
ii)	when it accepts to change the contract on the post payment line and
iii)	when it receives and is provided with the SIM at home, without indicating the SIM at¬ the time it takes place.
This party wishes to point out that the actions which it has taken at all times are deemed to be diligent, without having carried out any processing of the data that could be considered to be incorrect or bad faith, but it has been appropriate to what the complainant had requested from my client at any given time.

In short, it is clear from the description of the facts and the documents submitted throughout the procedure that it can be observed and that part reiterates that there has been no deception or intent on the part of¬ Vodafone.
It is appropriate for the Agency to declare that there is no need to adjudicate on this file and to close the proceedings, since the facts have been produced without any intention on the part  of my client. 
In the alternative, and in the event that, in spite of the explanations given above¬, the Agency considers that my company merits a penalty for committing infringements of Articles 5.1 and 6.1 of the GDPR, the amount of that penalty should be moderated, with the minimum amount being imposed, taking into account the following circumstances set out in Article 83.2 of the GDPR: The treatment has been carried out at local level and that there is no intention on the part of Vodafone to do so on¬ the basis of the claims which, on the contrary, cause my client clear damage.
In the light of the above, I hereby request that: There is no need to adjudicate on¬ the finding and closing of the proceedings, (ii) in the alternative, a reduction of the penalty¬ initially prescribed, taking the mitigating factors in question into account.
Of the actions taken in the present proceeding, the information and documentation submitted by the parties, the following have been provided:
FACTS
a)	With regard to the complainant’s minority of age:
The complainant’s date of birth is 23/12/03 and therefore, on the date of the events, (date of registration of the telephone line and date of inclusion of his personal data in ASNEF and BDEXCUG files: 17/01/18; 18/10/18 and 21/10/18 respectively), the complainant was 14 years old, on 23/12/17, and therefore did not need the empowerment of the parents or guardians for the processing of the child’s personal data.
b)	In the case of unauthorised processing of the complainant’s personal data, in order to purchase a mobile line, the documentation provided and the internal notes of the company, the following points should be noted:
1. On 27/01/18 there was a high level of registration in the services of Vodafone, through the online shop, in the name of the complainant. This is done by the father.
2. On 12/02/18, the father called on the company to indicate the high level of error and the intention to deregister the services. In light of the above, Vodafone gives it the possibility to change the type of contract on the line, for postpre-paid payment, consenting to the complainant.
3. On 17/10/18, the complainant receives a letter from ISFG Commercial Reports SL, asking for a debt with Vodafone, informing him, inter alia, that:“if you do not pay the debt within 10 days, VODAFONE could incorporate your data in a credit and asset credit rating file.”This deadline would therefore end on 27/10/18.

4. On 17/10/18, the complainant’s father lodged a complaint with the State Secretariat for the Advancement Digital (SEAPAD), complaining that:‘VODAFONE has registered services in the name of his or her child without his consent and has transferred them to a collection management company which requires payment of EUR 93,77’.
5. On 19/10/18, the complainant receives a notification from ASNEF, informing him that:‘ We would inform you that, on 18/10/18, the entity VOLDAFONE has applied for registration in the ASNEF file of personal data relating to the non-payment of the contract with that entity for an amount of EUR 93,77.’
6. On 23/10/18, the complainant receives a notification from EXPERIAN, informing them that:‘This file contains a transaction in which there has been a default on payment and in which you intervene, the Entity: Vodafone Amount: EUR 93,77”
7. On 08/02/19, the EDPS issued a resolution in which it states, inter alia, that Vodafone has not at any time established that the complainant had given his consent to the processing of his personal data last¬ for the 13 months that the mobile line was active. Alternatively, it is¬ stated that:‘The complaint regarding the activation of the services by VODAFONE ESPAÑA, S.A.U. in the name of the complainant should be accepted as regards the high level of unsolicited demand, recognising the claimant’s right to obtain his immediate withdrawal from the service not applied for, and not to pay any invoices which may have been issued by VODADFONE ESPAÑA, S.A.U., and the refund should be paid if it has already been paid by the subscriber.
8. On 08/02/19, the complainant’s father makes a call to Vodafone to report the facts and to remove the line. However, the company claimed that there was also an application for ‘high fibre’, coupled with the telephone number, actively continued the line and then invoices it until 15/02/19 (7 days), when the line should be withdrawn and the turnover adjusted.
c)	— As regards the inclusion of the complainant’s personal data in the financial solvency files, ASNEF and BDEXCUG, it is noted that:
-	The complainant received a letter dated 17/10/18 from ISFG Commercial Reports SL, requesting it to claim a debt in favour of Vodafone, giving him 10 days to regularise his situation. If that were not the case, he stated that his personal data would be incorporated into the assets and assets.
-	Despite giving it a period of 10 days to regularise its alleged debt situation with Vodafone, as from 17/10/18, Vodafone included its personal data in ASNEF the following day, 18/10/18, and in BAIXCUG, on 21/10/18, 4 days later, without meeting the deadline granted to the complainant for the payment of the alleged debt.

— The personal data of the complainant were included in the ASNEF file for 30 days (from 18/10/18 to 16/11/18) and in the BFTDECUG file, for 29 days (from 21/10/18 to 18/11/18).
LEGAL BASIS
I
The Director of the Spanish Data Protection Agency is responsible for resolving this procedure, in accordance with Article 58.2 of the GDPR in Article 47 of the Organic Law on Data Protection.
II
The joint assessment of the documentary evidence in the procedure is brought to the attention of the AEPD (AEPD) with a view of¬ the action complained of, as stated above.
However, in this case, and in reply to the arguments put forward by the entity in question, the following points should be noted:
The entity acknowledges that, through the online shop, a mobile line was registered in the name of the complainant and that he remained high since 17/01/18 on 15/02/19. However, even the EPSS, in its decision dated 08/02/19, stated that, no time, Vodafone had not been able to establish that the complainant or his representative (in the father, in this case) had consented to the processing of personal data during the 13 months that the mobile line was active.
However, it is clear that if there is a high level of services in Vodafone on 27/01/18, the father’s name is the name of the complainant. But on 12/02/18 (15 days later), the father calls the company to indicate the error in the high and the intention to deregister the services. In light of the above, Vodafone gives it the possibility to change the type of¬ treatment of the line, for postpre-payment, and according to the entity, the parent consents.
On 17/10/18, the complainant receives a letter from ISFG Commercial Reports SL, asking for a debt with Vodafone, informing him, inter alia, that: “if you do not pay the debt within 10 days, VODAFONE could incorporate your data into a credit and asset credit rating file”, before which the father submits a complaint to the State Secretariat for the Avance Digital which resolves, on 08/02/19 upholding the complaint. Within the same day, the complainant’s father contacts the entity to report the facts and to withdraw the line but it is not until 7 days (15/02/19), when Vodafone proceeded to execute the father’s application.
Apart from the unauthorised processing of the complainant’s personal data referred to in the previous points, there is also an undue inclusion of his data in ASNEF and DEXCUUG heritage records, as the complainant received the prior payment order dated 17/10/18, giving him 10 days to remedy the alleged non-payment, but only one day later, Vodafone includes the complainant’s personal data in the ASNEF file and 4 days later in the FIDEXCUG file, without waiting for the 10 days granted.

As regards the company’s request to apply as mitigating points the points set out in Article 83.2 of the GDPR: (a) The treatment has been carried out ted.¬ b) There is no intention on the part of Vodafone for the facts to claim¬ two that, on the contrary, cause my client clear damage to indicate that the treatment locally refers to the treatment limited to a particular state of the EU, in this case Spain, so it is not to be considered as a mitigating factor, and as far as it is concerned that there is no intention on the part of Vodafone to indicate that negligent behaviour of the company has been demonstrated.
As stated above, the Director of the Spanish Data Protection Agency
HEREBY ORDERS:
FIRST:Impose on the entity VODAFONE SPAIN SAU.(Vodafone), in the case of C.I.F. A80907397, a penalty of EUR 120,000 (one hundred and twenty thousand euros), under¬ Article 6.1 (a) and Article 5.1 (a) of the GDPR, under consideration as ‘very serious’, in¬ Article 71 (1) (a) and (b), respectively, of the LOPG.
SECOND:Notify the complainant of this decision to the entity VODAFONE ESPAÑA SAU. and, and to inform the complainant about the outcome of the complaint.
THIRD:Please note that the sanction imposed must be effective once this decision is enforceable, in accordance with the provisions of Article 98.1 (b¬) of Law No 39/2015 of 1 October 2015 on the administrative and administrative procedure for public¬ administrations (LPACAP), within the period for voluntary payment referred to in Article 68 of the General Tax Collection Regulation, approved by Royal De¬ Creto 939/2005 of 29 July 1992, in conjunction with Article 62 of Law No 58/2003 of 17 December 1992, by entering into the restricted account No  ES00 0000 0000 0000 0000 0000, opened in the name of the Spanish Data Protection Agency with the Banco CAIXABANK, S.A. or else, it will be collected in a limited period of time.¬
Once they have been notified and enforceable, if the date of enforceability is between 1 and 15 of each month inclusive, the period for payment¬ will be until the 20th day of the following month or immediately, and if the date of enforceability is¬ between 16 and the last day of each month, both inclusive, the time limit for payment is until 5 of the second next or immediate working month.
Pursuant to Article 82 of Law 62/2003 of 30 December on¬ tax, administrative and social measures, this Resolution shall be made public once it has been notified to the persons concerned. The publication will¬ be made in accordance with Instruction 1/2004 of 22 December on the Spanish Data Protection Agency on the publication of its resolutions.
Against this resolution, which brings the administrative procedure to an end, and in accordance with the provisions of Articles 112 and 123 of the LPACAP, the persons concerned may¬, on their own initiative, appeal to the Director of the Spanish Data Protection Agency within one month of the day following the date of publication of the opinion. 
oepd
as a result of this decision, or, directly, an administrative appeal before the Chamber for Contentious Administrative Proceedings of the National High Court, pursuant to¬ Article 25 and paragraph 5 of the fourth additional provision of Law No 29/1998 of 13/07, governing the Jurisdiction of the Court of Justice, within the period¬ of two months from the day following notification of that measure, as provided for in Article 46 (1) of that Law.
Finally, it should be noted that, in accordance with Article 90.3 (a) of the LPACAP, the final decision may be suspended as a precautionary measure if it is¬ clear that they intend to bring administrative proceedings. If this is the case, the person concerned must formally notify this fact in writing, addressed to the Spanish Data Protection Agency, by means of the Agency’s¬ Electronic Medicinal Product website [https: //sedeagpd.gob.es/sede-electronicaweb/], or through one of the other registers provided for in Article 16.4 of Law 39/2015 of 1 October 2013. He shall also transfer to the Agency the documents attesting to the actual lodging of the appeal. If the Agency is not aware of the lodging of the contentious appeal proceedings within two months of the day following the notification of this decision, it would terminate the provisional suspension.

Martes España Martí
Director of the Spanish Data Protection Agency