AEPD (Spain) - PS/00142/2020

AEPD - Nº: PS/00142/2020
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 7 of the Directive 2000/31/EC of the European Parliament and the Council 21.1 LSSI Spanish Law on Information Society Services and Electronic Commerce Article 85 LPACAP Spanish Law on Common Administrative Procedure of Public Administrations
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	20.06.2015
Fine:	1500 EUR
Parties:	n/a
National Case Number/Name:	Nº: PS/00142/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	aepd.es (in ES)
Initial Contributor:	Pablo Rossi

The AEPD decided to fine the entity BUBO MEDIA S.L in the amount of EUR 1500 for the unsolicited sending of commercial communications by SMS, prohibited by article 21.1 of the LSSI (Spanish Law on Information Society Services and Electronic Commerce, which transposes into Spanish law the Directive 2000/31/EC on electronic commerce). However, the entity made use of two attenuating factors from the LPACAP (Spanish Law on Common Administrative Procedure of Public Administrations). This led to a reduction of up to EUR 600 in the amount of the penalty, setting the total amount of the fine in EUR 900.

English Summary

Facts

On 13/11/19 the AEPD received a written submission from the complainant in which it was stated the following: I periodically receive SMS messages on [my phone] from some service to which I have not subscribed, nor have I consented to any use of my data and it is also impossible to communicate my cancellation. The messages in dispute are attached to the written submission.

In view of these facts, the Subdirectorate General for Data Inspection proceeded to carry out actions for their clarification. The entity AIRE NETWORKS DEL MEDITERRÁNEO and the entity DIGITAL VIRGO ESPAÑA, S.A were contacted so that they could indicate the identification data and the ownership of the telephone lines from which the messages had been sent. DIGITAL VIRGO ESPAÑA, S.A sent written response, establishing that the owner of the line under investigation was BUBO MEDIA, S.L. by virtue of a contract for the provision of telecommunications services.

On 17/04/20, the entity BUBO MEDIA, S.L. sent to AEPD an e-mail indicating that the way that their customers know about their products and services is through a website and that the way that their costumers request their services is through a phone number. They also stated that the contracting of the services is not accompanied by a written contract and that the conditions of the service and the purposes of the use of the data are indicated in the aforementioned website. As regards for the provision of consent and the contractual relationship, they stated that the costumers are also aware of the contract conditions by the website and that the fact that the customer contacts them by making a phone call to show interest in their services constitutes a clear affirmative act. They made also reference to the fact that they consider that the provision of their consultancy services includes appropriate interaction with the user and that they have recently included the option to unsubscribe from commercial communications by means of a link that appears in the first confirmation sent to costumers

. By its side, the AEPD verified the information that appears in the "Privacy Policy" of the web, where it stands out; among other aspects, that the responsible of the processing is BUBO MEDIA and that the costumers can withdraw their consent given at any time using a mechanism devised for that purpose.

Dispute

Can BUBO MEDIA’S actions be regarded as unsolicited sending of commercial communications by SMS, without the offering of a mechanism to oppose the processing of personal for marketing purposes, prohibited by article 21.1 of the LSSI?

In this case, there was no dispute. BUBO MEDIA acknowledged that their actions were not in line with article 21.1 LSSI, recognized their responsibility and paid the fine in advance, thus mitigating the amount to be paid for such infringement.

Holding

Firstly the AEPD decided to initiate a sanctioning procedure against the entity BUBO MEDIA, S.L. for the alleged infringement of Article 21.1 of the LSSI, typified as minor infringement in Article 38(4) (d). The fine associated with this infringement is calculated in EUR 1500. However, two attenuating circumstances of the Spanish Law on Common Administrative Procedure of Public Administrations (Article 85) can be applied, which may respectively reduce the fine by 20%. The first mitigating factor is to acknowledge their responsibility within the time allowed for the submission of claims. The second mitigating factor is, at any time prior to the resolution of the proceedings, to make voluntary payment of the proposed penalty.

On June 9, 2020, BUBO MEDIA, S.L. proceeded to pay the sanction in the amount of EUR 900, applying therefore the two previously mentioned reductions. This implied the recognition of their responsibility and the resignation to any action or appeal in administrative channels against the sanction. After these events, the AEPD decided to terminate the procedure.

Comment

Despite the fact that the Directive 2000/31/EC on electronic commerce has been introduced into the legal systems of the Member States in a harmonized manner, each Member State has its own administrative sanctioning procedures. This underlines the importance of knowing the administrative sanctioning procedures of each Member State, where small particularities can mean big differences from one State to another.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

219
Product No.: PS/00142/2020
RESOLUTION R/00255/2020 ON THE TERMINATION OF THE PROCEDURE BY PAYMENT VOLUNTEER
In sanction procedure PS/00142/2020, conducted by the Agency Española de Protección de Datos a BUBO MEDIA, S.L., having regard to the complaint submitted by A.A.A., and based on the following,
BACKGROUND
FIRST: On June 5, 2020, the Director of the Spanish Data Protection agreed to initiate disciplinary proceedings against BUBO MEDIA, S.L. (hereinafter, the claimed), by means of the Agreement that is transcribed:
Product No.: PS/00142/2020
166-240719 AGREEMENT TO INITIATE DISCIPLINARY PROCEEDINGS Of the actions carried out by the Spanish Data Protection Agency beforethe entity BUBO MEDIA, S.L., with CIF.: B22396956, (hereinafter, "the entity complaint), pursuant to the complaint lodged by Mr A.A.A., (hereinafter claimant') and on the basis of the following:
FACTS
FIRST: On 13/11/19, it was entered into this Agency in writing by the claimant, in which he stated, among other things, the following:
"I have been receiving periodically on my mobile phone number ***PHONE.1, SMS messages from a service to which I have not subscribed, nor have I consented to the use some of my data, and also it is impossible to access to communicate my low. I put the last received (screenshots attached): 
- Date: 01/11/19 12:35 Sender B.B.B. (no sender number displayed!)
Content: I know the unfair situation you are in and believe me you don't deserve it. I can help you to regain your happiness. Call me now! ***Phone.2 or ***PHONE.3 o,o2e/s*
- Date: 31/10/19 12:35 Sender C.C.C. (no sender's number!)
Content: I know you are getting to know him and would like to have a relationship. This playing with you or does he have feelings for you? Call me now! ***PHONE.2 or ***PHONE.3 or,o2e/s
- Date: 28/10/19 11:18 Sender B.B.B. (no sender's number!)
Content: I know the unfair situation you are living in and believe me you don't deserve it. I can help you to regain your happiness. Call me now! ***PHONE.2 or
***PHONE.3 o,o2e/s*
- Date: 24/10/19 13:55 Sender C.C.C. (no sender's number!) Content: I know you are getting to know him and would like to have a relationship. This playing with you or does he have feelings for you? Call me now! ***PHONE.2 or ***PHONE.3* or,o2e/s
- Date: 21/10/19 15:55 Sender D.D.D. (no sender's number!) Content: I know that you are suffering to think that you have lost his love. What you have afraid it won't come back to you. I have good news. Call me now! ***Phone.2 or phone.3
I tried to call the landline number in the SMS several times -***PHONE.3- and disconnects me without answering the call. At ***PHONE.2 I haven't called, because I know that it is a special tariff number, which would be a alleged fraud."
SECOND: In view of the facts set out in the complaint and the documents provided by the claimant, the Subdirectorate General for Data Inspection proceeded to take action for its clarification, under the powers of investigation granted to the control authorities in Article 57(1) of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter referred to as GPRD). Thus, dated 12/03/20, is addressed to the entity AIRE NETWORKS DEL MEDITERRANEAN, to indicate to this Agency the identification data and the ownership of the telephone line ***TELÉFONO.2, on the days: 21, 24, 28 and 31 of October 2019 and 1 November 2019 On the same date, a request was addressed to DIGITAL VIRGO ESPAÑA, S.A. so that it could indicate the identification data and the ownership of the telephone line ***TELEPHONE.2, on 21, 24, 28 and 31 October and 1 November 2019
THIRD: On 25/03/20, the entity DIGITAL VIRGO ESPAÑA, S.A., refers to this Agency's written reply, attaching to it a copy of the "standard contract of provision of voice premium rate services by means of telephone access 803/806/807 and 905", signed on 01/03/15 between the JET entity MULTIMEDIA ESPAÑA, SA. and the entity BUBO MEDIA, S.L. by which the entity Digital Virgo Spain, as a telecommunications services provider, has awarded the telephone number ***TELÉFONO.2 to the entity BUBO MEDIA, S.L, indicating furthermore in the statement that: "They are not aware of any change in ownership of the premium rate number on the dates indicated in the request".
FOURTH: On 26/03/20, the entity AIRE NETWORKS DEL MEDITERRÁNEO, S.L.U., refers to this Agency in writing, indicating that: "the identification data, concerning line ***PHONE.3 are as follows: MONEMA COMMUNICATIONS S.L. B26439653, with registered office at C/ Gran Vía Rey Juan Carlos 17, 5º D. 26002 - LOGROÑO, no changes in ownership are recorded to date.
FIFTH: On 17/04/20, the entity BUBO MEDIA, S.L. sent to this Agency e-mail from ***EMAIL.1 indicating, inter alia, the next:
1. That your customers know your products and services through a website and contact them and therefore request their services through a phone. That said telephone number is published on the web ***URL.1 
2. That the contracting of the services is not accompanied by a written contract. That its products are offered through the indicated website. That on this website the customer is informed of the conditions of the service, the purposes of the use of the data. 3. That the provision of consent and the contractual relationship is based on; a. The client is aware of the offer and the contract conditions on its website b. That the customer contacts them by making a phone call to show their interest in the service.
You contribute writing from MONEMA COMMUNICATIONS S.L. stating that you provide the virtual switchboard service to the company BUBO MEDIA S.L. and that in this switchboardthe following calls were received:
- from number ***TELÉFONO.1 to number ***TELÉFONO.4 (of which he is BUBO MEDIA, S.L.) at 13:51:09 on 21/10/2019. - from number ***TELÉFONO.1 to number ***TELÉFONO.4 (of which it is BUBO MEDIA, S.L.) at 13:51:20 on 21/10/2019. 
from number ***TELÉFONO.1 to number ***TELÉFONO.4 (of which he is the holder BUBO MEDIA, S.L.) at 13:52:35 on 21/10/2019.
- from number ***TELÉFONO.1 to number +***TELÉFONO.4 (of which it isVBUBO MEDIA, S.L.) at 13:52:49 on 21/10/2019.
- from number ***TELÉFONO.1 to number ***TELÉFONO.3 (of which it is the holder BUBO MEDIA, S.L.) at 13:29:55 on 28/10/2019.
- from number ***TELÉFONO.1 to number ***TELÉFONO.3 (of which it is the holder BUBO MEDIA, S.L.) at 13:31:08 on 28/10/2019.
4. That therefore there is a clear affirmative act.
5. That it can be verified that the SMS messages were sent after the customer made the calls from his mobile phone to his telephone services.
6. That messages to customers are sent only in the event that you have contacted with them.
7. That in the section on the purposes of the use of personal data on the website reference is made to the possibility of sending messages to the mobile phones that contact your company.
8. That they understand that the provision of their advisory services includes the due interaction with the user.
9. That the sending of messages is automatically disconnected in a very short time of time if the system detects that the user does not contact them again.
10. That in any case the cancellation of the message sending can be done if the client apply.
11. That, in order to ensure that the conditions of service are still transparent, the includes an informative recording that is broadcast on a mandatory basis at the beginning of all the calls.
12. That they have recently included the option to unsubscribe from communications commercial through a link that appears in the first of the messages information that is sent to customers.
SIXTH: On 05/05/20, the following is checked on the web ***URL.1 information:
1.- The telephone numbers ***TELÉFONO.3 and ***TELÉFONO.2 are advertised 2.- Of the information that appears in the "Privacy Policy" of the web, it stands out: - That the responsible for the treatment is BUBO MEDIA, S.L., its postal address and the email address of the Data Protection Officer. - In the section "Purposes of the Processing" it is stated that: "Contact and/or send notifications via telephone and SMS to inform about our products, services, special offers, updates, opportunities, communications commercial and advertising etc. You can revoke your consent to receive these notifications using the mechanism implemented for this purpose. In the event that these communications are received by phone (call, SMS, WhatsApp, ...), you can unsubscribe by calling from the phone number where you receive communications to the phone number
***PHONE.5"
- The section on "Rights of the persons concerned" states: "... You can also exercise the right to data portability, as well as withdraw the consents given at any time, without affecting to the lawfulness of processing based on consent prior to its withdrawal. Users may check their personal data and/or exercise your associated rights by sending an accompanied email of your ID card to ***EMAIL.2 or, by post, to BUBO MEDIA SL Apartado de Correos, 77 de Sariñena (Huesca - 22200) indicating the rate of duty wants to practice..."

- In the "Terms and Conditions" section 1 "Acceptance of Terms and Conditions" It reads: "The following terms and conditions are mandatory, acceptance and compliance by all Users accessing the services provided by BUBO MEDIA, SL with CIF B22396956, Apartado de Correos, 77 of 22200 HUESCA (hereinafter the "Company"), by telephone or electronic means.
- Access to our services implies the express acceptance by the User of all terms and conditions set forth herein. if you do not agree with any of the following conditions, you must not use the services offered".
LEGAL FOUNDATIONS
I In accordance with the provisions of Article 43.1, second paragraph, of the 34/2002 of 11 July, Information Society Services and Trade  (LSSI), is competent to initiate and resolve this Procedure Sanctioner, the Director of the Spanish Data Protection Agency. II In the present case, according to the statements made by the entity in question, customers know your products and services through your website, ***URL.1 and contact the company through the telephone numbers that appear published in it: ***Telephon.3 and Telephon.2. It is also stated that "you are informed of the conditions of service, the purposes of the use of the data and consent." Information available on the "privacy policy." In the case of the complaint submitted by the complainant, the entity indicates that, in the The switchboard that manages the calls received 6 calls from the Claimant's telephone number: 4 calls on 21/10/19 and 2 calls on 28/10/19 and which were made before the entity sent you the SMS", but it does not specify either the reason, or the duration or whether they were attended to or not. Nor does it present any kind of recording of the conversation that was supposed to take place.
The claimed entity further states that "in any case, the removal of the sending messages if the customer requests it and they have recently included the to unsubscribe from commercial communications via a link that appears in the first of the information messages sent to customers", but this option does not appear in the messages sent to the claimant. Nor is it indicated in the SMS sent the phone number of the sender, so there is no possibility to be discharged.
III
The facts set out, without prejudice to the outcome of the investigation, consisting of the forwarding of non-consensual commercial communications to the claimant's telephone via SMS and where it offered no mechanism for opposing the treatment of your data for promotional purposes, could constitute an infringement, by the entity claimed under the provisions of Article 21 of the ISESA, which provides as follows:
"1. The sending of advertising or promotional communications by e-mail or other equivalent electronic communication that have not been previously requested or expressly authorized by the recipients of the same.
2. The provisions of the previous paragraph shall not apply where there is a prior contractual relationship, provided that the provider has lawfully obtained the contact details of the recipient and use them to send communications products or services of your own company that are similar to those initially contracted with the client.
In any event, the provider must give the recipient the opportunity to object to the processing of your data for promotional purposes through a simple procedure and free of charge, both at the time of data collection and in each commercial communications to you.
When the communications have been sent by e-mail, said The means must necessarily consist of the inclusion of a postal address or other valid email address where this right can be exercised, it is prohibited to send communications that do not include such an address."
The aforementioned offence is classified as minor in Article 38.4.d) of the said standard, which qualifies as such, "The sending of commercial communications by post electronic or other equivalent electronic communication when in such consignments do not comply with the requirements set out in Article 21 and do not constitute serious infringement".
In accordance with Article 39.1.c) of the ISESA, minor infringements may punishable by a fine of up to 30,000 euros, establishing the criteria for its graduation in article 40 of the same rule.
Following the evidence obtained, and without prejudice to the results of the investigation, the considers that in this case it acts as an aggravating factor: - The existence of intentionality (paragraph a), since the commercial communication in question was sent without the diligence required of the claimed to ensure the existence of prior and express authorization of the addressee for this purpose and without offering him a mechanism for cancellation, especially when, to the claimed, as an entity used to carrying out its activity to the The sending of this type of shipment requires special care in order to The requirements of Article 21 of that standard shall be complied with.
At the same time, the criteria are assessed as mitigating factors:
- The nature and amount of the damage caused (paragraph d), in the absence of proof that the claimant has suffered damage as a result of the receipt of the aforementioned advertising mailings.- The benefits obtained from the infringement (paragraph e), in the absence of proof that the defendant has obtained benefits from the commission of the infringement.

On the basis of these criteria, it is considered appropriate to impose a penalty on the respondent of 1,500 euros (one thousand five hundred euros). Therefore, in view of the above, For the Director of the Agency Spanish Data Protection,
AGREED:
START: SANCTIONING PROCEDURE to the entity BUBO MEDIA, S.L., with VAT number: B22396956, in accordance with Articles 63 and 64 of Law 39/2015, of October 1, the Common Administrative Procedure of the European The Court of Appeals of the Public Prosecutor's Office (LPACAP), for the alleged violation of Article 21.1 of the ISESA, typified as mild in Article 38(4)(d) of that rule. NAME: instructor to D. E.E.E. and, as secretary, to Dª F.F.F., indicating that any of them may be challenged, where appropriate, in accordance with the provisions of Articles 23 and 24 of Law 40/2015 of 1 October on the Legal System for the Sector Public (LRJSP).
INCORPORATE: to the sanctioning file, for evidential purposes, the claim filed by the claimant and his documentation, the documents obtained and generated by the Subdirectorate General for Data Inspection during the investigations.
WHAT: for the purposes of Article 64.2 b) of Law 39/2015, of 1 October, on Common Administrative Procedure of Public Administrations, the sanction that 1,500 (one thousand and five hundred euros), without prejudice to the prejudice to the outcome of the investigation.
NOTICE: the present agreement to the entity BUBO MEDIA, S.L., granting it a ten working day hearing period to make representations and to present the evidence you deem appropriate. If, within the stipulated period, he does not make any allegations to this agreement to begin with, the same may be considered as a motion for resolution, as set out in Article 64.2(f) of Law 39/2015 of 1 October on the Common Administrative Procedure of the Public Administration (hereinafter LPACAP). In accordance with Article 85 of the LPACAP, if the penalty to be imposed other than a fine, may acknowledge its responsibility within the period granted for the formulation of arguments to the present agreement of beginning; th which will be accompanied by a 20% reduction in the penalty to be imposed in the present procedure, equivalent in this case to EUR 300. With the application of 1,200, with the penalty being resolved on procedure with the imposition of this penalty. Similarly, at any time prior to the resolution of this procedure, carry out the voluntary payment of the proposed penalty, which will result in a reduction of 20% of the amount of the payment, equivalent in this case at 300 euros. With the application of this reduction, the penalty would be set at 1,200 and its payment will imply the termination of the procedure.
The reduction for the voluntary payment of the penalty is cumulative with that for apply for recognition of liability, provided that this recognition of the responsibility becomes apparent within the time allowed for formulating allegations to the opening of the procedure. The voluntary payment of the amount referred to in the preceding paragraph may be made at any time prior to the resolution. At in this case, if both reductions were to be applied, the amount of the penalty would be set at EUR 900 (nine hundred euros).
In any case, the effectiveness of either of the two above-mentioned reductions shall be conditional upon the withdrawal or waiver of any action or remedy in the administrative sanction against the sanction. If the decision is made to proceed with the voluntary payment of any of the amounts indicated previously, you will have to make it effective by paying it into the account nº ES00 0000 0000 0000 0000 open on behalf of the Spanish Agency for the Protection of Data in the CAIXABANK, S.A. Bank, indicating in the concept the number of reference of the procedure in the heading of this document and the cause of reduction of the amount claimed. Likewise, you must send the proof of payment to the Subdirectorate General of Inspection to continue the procedure in accordance with the quantity admitted.
The procedure will last a maximum of nine months from the date of the agreement to initiate or, where appropriate, the draft agreement to initiate. Once this period has elapsed, the agreement will expire and, consequently, the actions; in accordance with the provisions of Article 64 of the LOPDGDD. Finally, it is noted that in accordance with Article 112.1 of the LPACAP, No administrative appeal is possible against this act.